File size: 5,507 Bytes
1f21206 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 | import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
import * as fs from 'node:fs/promises'
import * as os from 'node:os'
import * as path from 'node:path'
import { handleApiRequest } from '../router.js'
let tmpDir: string
let originalConfigDir: string | undefined
async function api(
method: string,
pathname: string,
options: {
body?: Record<string, unknown>
bearerToken?: string
} = {},
): Promise<Response> {
const url = new URL(pathname, 'http://localhost:3456')
const headers: Record<string, string> = {}
if (options.body !== undefined) {
headers['Content-Type'] = 'application/json'
}
if (options.bearerToken) {
headers.Authorization = `Bearer ${options.bearerToken}`
}
return handleApiRequest(
new Request(url.toString(), {
method,
headers,
body: options.body === undefined ? undefined : JSON.stringify(options.body),
}),
url,
)
}
beforeEach(async () => {
tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), 'h5-access-api-test-'))
originalConfigDir = process.env.CLAUDE_CONFIG_DIR
process.env.CLAUDE_CONFIG_DIR = tmpDir
})
afterEach(async () => {
if (originalConfigDir === undefined) delete process.env.CLAUDE_CONFIG_DIR
else process.env.CLAUDE_CONFIG_DIR = originalConfigDir
await fs.rm(tmpDir, { recursive: true, force: true })
})
describe('/api/h5-access', () => {
test('GET returns sanitized disabled status by default', async () => {
const response = await api('GET', '/api/h5-access')
expect(response.status).toBe(200)
await expect(response.json()).resolves.toEqual({
settings: {
enabled: false,
tokenPreview: null,
allowedOrigins: [],
publicBaseUrl: null,
},
})
})
test('enable returns raw token once and status stays sanitized', async () => {
const enableResponse = await api('POST', '/api/h5-access/enable')
expect(enableResponse.status).toBe(200)
const enablePayload = await enableResponse.json() as {
settings: {
enabled: boolean
tokenPreview: string
}
token: string
}
expect(enablePayload.settings.enabled).toBe(true)
expect(enablePayload.token).toMatch(/^h5_/)
const statusResponse = await api('GET', '/api/h5-access')
expect(statusResponse.status).toBe(200)
const statusPayload = await statusResponse.json() as {
settings: {
enabled: boolean
tokenPreview: string | null
}
token?: string
}
expect(statusPayload.settings.enabled).toBe(true)
expect(statusPayload.settings.tokenPreview).toBe(enablePayload.settings.tokenPreview)
expect(statusPayload.token).toBeUndefined()
})
test('verify accepts a good bearer token and rejects missing or bad tokens', async () => {
const enableResponse = await api('POST', '/api/h5-access/enable')
const enablePayload = await enableResponse.json() as { token: string }
expect(
await api('POST', '/api/h5-access/verify', { bearerToken: enablePayload.token }),
).toMatchObject({ status: 200 })
expect(await api('POST', '/api/h5-access/verify')).toMatchObject({ status: 401 })
expect(
await api('POST', '/api/h5-access/verify', { bearerToken: 'bad-token' }),
).toMatchObject({ status: 401 })
})
test('regenerate returns a new token and invalidates the previous one', async () => {
const enableResponse = await api('POST', '/api/h5-access/enable')
const enablePayload = await enableResponse.json() as { token: string }
const regenerateResponse = await api('POST', '/api/h5-access/regenerate')
expect(regenerateResponse.status).toBe(200)
const regeneratePayload = await regenerateResponse.json() as {
settings: {
enabled: boolean
}
token: string
}
expect(regeneratePayload.settings.enabled).toBe(true)
expect(regeneratePayload.token).toMatch(/^h5_/)
expect(regeneratePayload.token).not.toBe(enablePayload.token)
expect(
await api('POST', '/api/h5-access/verify', { bearerToken: enablePayload.token }),
).toMatchObject({ status: 401 })
expect(
await api('POST', '/api/h5-access/verify', { bearerToken: regeneratePayload.token }),
).toMatchObject({ status: 200 })
})
test('disable clears access and causes the old token to fail verification', async () => {
const enableResponse = await api('POST', '/api/h5-access/enable')
const enablePayload = await enableResponse.json() as { token: string }
const disableResponse = await api('POST', '/api/h5-access/disable')
expect(disableResponse.status).toBe(200)
await expect(disableResponse.json()).resolves.toEqual({
settings: {
enabled: false,
tokenPreview: null,
allowedOrigins: [],
publicBaseUrl: null,
},
})
expect(
await api('POST', '/api/h5-access/verify', { bearerToken: enablePayload.token }),
).toMatchObject({ status: 401 })
})
test('PUT updates sanitized settings', async () => {
const response = await api('PUT', '/api/h5-access', {
body: {
allowedOrigins: ['https://example.com/path'],
publicBaseUrl: 'https://public.example.com/app/',
},
})
expect(response.status).toBe(200)
await expect(response.json()).resolves.toEqual({
settings: {
enabled: false,
tokenPreview: null,
allowedOrigins: ['https://example.com'],
publicBaseUrl: 'https://public.example.com/app',
},
})
})
})
|