feat: secure React dashboard cutover

tests/web-auth.test.ts

@@ -0,0 +1,101 @@
+import express from 'express';
+import type { AddressInfo } from 'node:net';
+import { afterEach, describe, expect, it } from 'vitest';
+import { createDashboardAuth, createDashboardSessionRouter } from '../src/web/auth.js';
+import { WebServer } from '../src/web/server.js';
+import { ConfigSchema } from '../src/config/index.js';
+
+const servers: Array<ReturnType<express.Express['listen']>> = [];
+
+async function request(
+  app: express.Express,
+  path: string,
+  init: RequestInit = {},
+): Promise<Response> {
+  const server = app.listen(0);
+  servers.push(server);
+  await new Promise<void>((resolve) => server.once('listening', resolve));
+  const { port } = server.address() as AddressInfo;
+  return fetch(`http://127.0.0.1:${port}${path}`, init);
+}
+
+afterEach(async () => {
+  await Promise.all(servers.splice(0).map((server) => new Promise<void>((resolve) => server.close(() => resolve()))));
+});
+
+describe('dashboard authentication', () => {
+  it('rejects protected dashboard and API requests without a token', async () => {
+    const app = express();
+    app.use(createDashboardAuth('dashboard-secret'));
+    app.get('/api/stats', (_req, res) => res.json({ ok: true }));
+
+    const response = await request(app, '/api/stats');
+
+    expect(response.status).toBe(401);
+    expect(await response.json()).toEqual({ error: 'Dashboard authentication required' });
+  });
+
+  it('accepts a bearer token without exposing it in the URL', async () => {
+    const app = express();
+    app.use(createDashboardAuth('dashboard-secret'));
+    app.get('/api/stats', (_req, res) => res.json({ ok: true }));
+
+    const response = await request(app, '/api/stats', {
+      headers: { Authorization: 'Bearer dashboard-secret' },
+    });
+
+    expect(response.status).toBe(200);
+    expect(await response.json()).toEqual({ ok: true });
+  });
+
+  it('issues an HttpOnly session only for a schema-valid token payload', async () => {
+    const app = express();
+    app.use(express.json());
+    app.use(createDashboardSessionRouter('dashboard-secret'));
+
+    const invalid = await request(app, '/auth/session', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ token: 123 }),
+    });
+    const valid = await request(app, '/auth/session', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ token: 'dashboard-secret' }),
+    });
+
+    expect(invalid.status).toBe(400);
+    expect(valid.status).toBe(204);
+    expect(valid.headers.get('set-cookie')).toMatch(/HttpOnly/);
+    expect(valid.headers.get('set-cookie')).toMatch(/SameSite=Strict/);
+  });
+
+  it('does not mount debug endpoints unless explicitly enabled', async () => {
+    const config = ConfigSchema.parse({
+      reddit: { subreddits: ['test'] },
+      openrouter: { apiKey: 'key', imageAnalysisPrompt: 'test', messageGenerationPrompt: 'test' },
+      web: { enabled: true, port: 0, authToken: 'dashboard-secret-token' },
+    });
+    const activityRepo = { getRecent: () => [], insert: () => undefined, prune: () => undefined, countSentSkipped: () => 0 };
+    const server = new WebServer(
+      0,
+      config,
+      {} as never,
+      {} as never,
+      {} as never,
+      activityRepo as never,
+      { info: () => undefined } as never,
+    );
+    server.start();
+    const port = server.getListeningPort();
+    expect(port).not.toBeNull();
+
+    const response = await fetch(`http://127.0.0.1:${port}/api/debug/cookies`, {
+      headers: { Authorization: 'Bearer dashboard-secret-token' },
+    });
+
+    expect(response.status).toBe(404);
+    expect(await response.json()).toEqual({ error: 'API endpoint not found' });
+    server.stop();
+  });
+});