102 lines
3.6 KiB
TypeScript
102 lines
3.6 KiB
TypeScript
import express from 'express';
|
|
import type { AddressInfo } from 'node:net';
|
|
import { afterEach, describe, expect, it } from 'vitest';
|
|
import { createDashboardAuth, createDashboardSessionRouter } from '../src/web/auth.js';
|
|
import { WebServer } from '../src/web/server.js';
|
|
import { ConfigSchema } from '../src/config/index.js';
|
|
|
|
const servers: Array<ReturnType<express.Express['listen']>> = [];
|
|
|
|
async function request(
|
|
app: express.Express,
|
|
path: string,
|
|
init: RequestInit = {},
|
|
): Promise<Response> {
|
|
const server = app.listen(0);
|
|
servers.push(server);
|
|
await new Promise<void>((resolve) => server.once('listening', resolve));
|
|
const { port } = server.address() as AddressInfo;
|
|
return fetch(`http://127.0.0.1:${port}${path}`, init);
|
|
}
|
|
|
|
afterEach(async () => {
|
|
await Promise.all(servers.splice(0).map((server) => new Promise<void>((resolve) => server.close(() => resolve()))));
|
|
});
|
|
|
|
describe('dashboard authentication', () => {
|
|
it('rejects protected dashboard and API requests without a token', async () => {
|
|
const app = express();
|
|
app.use(createDashboardAuth('dashboard-secret'));
|
|
app.get('/api/stats', (_req, res) => res.json({ ok: true }));
|
|
|
|
const response = await request(app, '/api/stats');
|
|
|
|
expect(response.status).toBe(401);
|
|
expect(await response.json()).toEqual({ error: 'Dashboard authentication required' });
|
|
});
|
|
|
|
it('accepts a bearer token without exposing it in the URL', async () => {
|
|
const app = express();
|
|
app.use(createDashboardAuth('dashboard-secret'));
|
|
app.get('/api/stats', (_req, res) => res.json({ ok: true }));
|
|
|
|
const response = await request(app, '/api/stats', {
|
|
headers: { Authorization: 'Bearer dashboard-secret' },
|
|
});
|
|
|
|
expect(response.status).toBe(200);
|
|
expect(await response.json()).toEqual({ ok: true });
|
|
});
|
|
|
|
it('issues an HttpOnly session only for a schema-valid token payload', async () => {
|
|
const app = express();
|
|
app.use(express.json());
|
|
app.use(createDashboardSessionRouter('dashboard-secret'));
|
|
|
|
const invalid = await request(app, '/auth/session', {
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'application/json' },
|
|
body: JSON.stringify({ token: 123 }),
|
|
});
|
|
const valid = await request(app, '/auth/session', {
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'application/json' },
|
|
body: JSON.stringify({ token: 'dashboard-secret' }),
|
|
});
|
|
|
|
expect(invalid.status).toBe(400);
|
|
expect(valid.status).toBe(204);
|
|
expect(valid.headers.get('set-cookie')).toMatch(/HttpOnly/);
|
|
expect(valid.headers.get('set-cookie')).toMatch(/SameSite=Strict/);
|
|
});
|
|
|
|
it('does not mount debug endpoints unless explicitly enabled', async () => {
|
|
const config = ConfigSchema.parse({
|
|
reddit: { subreddits: ['test'] },
|
|
openrouter: { apiKey: 'key', imageAnalysisPrompt: 'test', messageGenerationPrompt: 'test' },
|
|
web: { enabled: true, port: 0, authToken: 'dashboard-secret-token' },
|
|
});
|
|
const activityRepo = { getRecent: () => [], insert: () => undefined, prune: () => undefined, countSentSkipped: () => 0 };
|
|
const server = new WebServer(
|
|
0,
|
|
config,
|
|
{} as never,
|
|
{} as never,
|
|
{} as never,
|
|
activityRepo as never,
|
|
{ info: () => undefined } as never,
|
|
);
|
|
server.start();
|
|
const port = server.getListeningPort();
|
|
expect(port).not.toBeNull();
|
|
|
|
const response = await fetch(`http://127.0.0.1:${port}/api/debug/cookies`, {
|
|
headers: { Authorization: 'Bearer dashboard-secret-token' },
|
|
});
|
|
|
|
expect(response.status).toBe(404);
|
|
expect(await response.json()).toEqual({ error: 'API endpoint not found' });
|
|
server.stop();
|
|
});
|
|
});
|