File size: 5,383 Bytes
4e23b01 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 | import { mkdtemp, rm } from 'node:fs/promises';
import { tmpdir } from 'node:os';
import { join } from 'node:path';
import { Writable } from 'node:stream';
import { pino, type Logger } from 'pino';
import { afterEach, beforeEach, describe, expect, it } from 'vitest';
import { type RunningServer, startServer } from '../src/start';
import { TEST_HOST_IDENTITY } from './helpers/hostIdentity';
const createdDirs: string[] = [];
const running: RunningServer[] = [];
let prevPassword: string | undefined;
async function tmpHome(): Promise<string> {
const dir = await mkdtemp(join(tmpdir(), 'kimi-v2-host-exposure-'));
createdDirs.push(dir);
return dir;
}
function capturingLogger(): { logger: Logger; lines: string[] } {
const lines: string[] = [];
const dest = new Writable({
write(chunk, _enc, cb) {
lines.push(String(chunk));
cb();
},
});
return { logger: pino({ level: 'info' }, dest), lines };
}
beforeEach(() => {
prevPassword = process.env['KIMI_CODE_PASSWORD'];
});
afterEach(async () => {
for (const r of running.splice(0)) {
try {
await r.close();
} catch {
}
}
for (const dir of createdDirs.splice(0)) {
await rm(dir, { recursive: true, force: true });
}
if (prevPassword === undefined) {
delete process.env['KIMI_CODE_PASSWORD'];
} else {
process.env['KIMI_CODE_PASSWORD'] = prevPassword;
}
});
describe('public-bind gate', () => {
it('refuses to bind 0.0.0.0 without --insecure-no-tls', async () => {
const home = await tmpHome();
await expect(
startServer({ hostIdentity: TEST_HOST_IDENTITY, host: '0.0.0.0', port: 0, homeDir: home, logLevel: 'silent' }),
).rejects.toThrow(/without TLS/);
});
it('boots 0.0.0.0 token-only and logs the token-only warning', async () => {
delete process.env['KIMI_CODE_PASSWORD'];
const home = await tmpHome();
const { logger, lines } = capturingLogger();
const server = await startServer({
hostIdentity: TEST_HOST_IDENTITY,
host: '0.0.0.0',
port: 0,
homeDir: home,
logLevel: 'silent',
insecureNoTls: true,
logger,
});
running.push(server);
const token = server.authTokenService.getToken();
const res = await fetch(`http://127.0.0.1:${server.port}/api/v1/healthz`, {
headers: { authorization: `Bearer ${token}` },
});
expect(res.status).toBe(200);
expect(lines.join('')).toContain('token-only auth');
});
});
describe('real password path (verifyPassword)', () => {
async function bootPublic(): Promise<RunningServer> {
process.env['KIMI_CODE_PASSWORD'] = 'test-pw';
const home = await tmpHome();
const server = await startServer({
hostIdentity: TEST_HOST_IDENTITY,
host: '0.0.0.0',
port: 0,
homeDir: home,
logLevel: 'silent',
insecureNoTls: true,
});
running.push(server);
return server;
}
it('accepts the password as a bearer token and sets security headers', async () => {
const server = await bootPublic();
const res = await fetch(`http://127.0.0.1:${server.port}/api/v1/sessions`, {
headers: { authorization: 'Bearer test-pw' },
});
expect(res.status).toBe(200);
expect(res.headers.get('x-content-type-options')).toBe('nosniff');
expect(res.headers.get('content-security-policy')).toBe(
"default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; form-action 'self'; base-uri 'none'; frame-ancestors 'self'",
);
});
it('accepts the persistent token on a public bind', async () => {
const server = await bootPublic();
const token = server.authTokenService.getToken();
const res = await fetch(`http://127.0.0.1:${server.port}/api/v1/sessions`, {
headers: { authorization: `Bearer ${token}` },
});
expect(res.status).toBe(200);
});
it('rejects wrong and missing credentials with 401', async () => {
const server = await bootPublic();
const wrong = await fetch(`http://127.0.0.1:${server.port}/api/v1/sessions`, {
headers: { authorization: 'Bearer wrong-password' },
});
expect(wrong.status).toBe(401);
const missing = await fetch(`http://127.0.0.1:${server.port}/api/v1/sessions`);
expect(missing.status).toBe(401);
});
});
describe('auth-failure rate limit on a real bind', () => {
it('returns 429 on the 11th bad token', async () => {
const home = await tmpHome();
const server = await startServer({
hostIdentity: TEST_HOST_IDENTITY,
host: '0.0.0.0',
port: 0,
homeDir: home,
logLevel: 'silent',
insecureNoTls: true,
authTokenService: {
_serviceBrand: undefined,
getToken: () => 'persistent-token',
isValid: async (candidate) => candidate === 'persistent-token',
},
});
running.push(server);
const url = `http://127.0.0.1:${server.port}/api/v1/sessions`;
let lastStatus = 0;
for (let i = 0; i < 11; i += 1) {
const res = await fetch(url, { headers: { authorization: 'Bearer wrong' } });
lastStatus = res.status;
if (i < 10) {
expect(res.status).toBe(401);
}
}
expect(lastStatus).toBe(429);
const body = (await (await fetch(url, { headers: { authorization: 'Bearer wrong' } })).json()) as {
code: number;
};
expect(body.code).toBe(42901);
});
});
|