Spaces:
Running
Running
File size: 5,394 Bytes
6ace587 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 | import { argon2Verify } from "hash-wasm";
import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
const mockFetch = vi.fn();
vi.stubGlobal("fetch", mockFetch);
/** Digest length in bytes, read from the trailing field of the encoded hash. */
function getDigestLength(encodedHash: string) {
const digest = encodedHash.split("$").pop() as string;
return atob(digest.replace(/-/g, "+").replace(/_/g, "/")).length;
}
/** Runs a validation and returns the hash that was sent to the server. */
async function getHashSentFor(accessKey: string) {
const { validateAccessKey } = await import("./accessKey");
mockFetch.mockResolvedValue({
ok: true,
json: vi.fn().mockResolvedValue({ valid: true }),
});
await validateAccessKey(accessKey);
const [, requestInit] = mockFetch.mock.calls[0];
return JSON.parse(requestInit.body).accessKeyHash as string;
}
vi.mock("./logEntries", () => ({
addLogEntry: vi.fn(),
}));
const TIMEOUT_HOURS = 24;
describe("Access Key Module", () => {
beforeEach(() => {
vi.clearAllMocks();
localStorage.clear();
});
afterEach(() => {
vi.restoreAllMocks();
localStorage.clear();
});
describe("validateAccessKey", () => {
it("should return true for valid access key", async () => {
const { validateAccessKey } = await import("./accessKey");
mockFetch.mockResolvedValue({
ok: true,
json: vi.fn().mockResolvedValue({ valid: true }),
});
const result = await validateAccessKey("test-key-123");
expect(result).toBe(true);
expect(mockFetch).toHaveBeenCalled();
});
it("should return false for invalid access key", async () => {
const { validateAccessKey } = await import("./accessKey");
mockFetch.mockResolvedValue({
ok: true,
json: vi.fn().mockResolvedValue({ valid: false }),
});
const result = await validateAccessKey("invalid-key");
expect(result).toBe(false);
});
it("should return false on network error", async () => {
const { validateAccessKey } = await import("./accessKey");
mockFetch.mockRejectedValue(new Error("Network error"));
const result = await validateAccessKey("test-key");
expect(result).toBe(false);
});
it("should send a hash the server can verify against the access key", async () => {
const hash = await getHashSentFor("test-key-123");
// Mirrors the server-side check in validateAccessKeyServerHook.ts
await expect(
argon2Verify({ password: "test-key-123", hash }),
).resolves.toBe(true);
await expect(
argon2Verify({ password: "another-key", hash }),
).resolves.toBe(false);
});
it("should use a digest long enough to resist blind forgery", async () => {
expect(getDigestLength(await getHashSentFor("test-key-123"))).toBe(32);
});
it("should return false when response is not ok", async () => {
const { validateAccessKey } = await import("./accessKey");
mockFetch.mockResolvedValue({
ok: false,
status: 401,
});
const result = await validateAccessKey("test-key");
expect(result).toBe(false);
});
});
describe("verifyStoredAccessKey", () => {
it("should return true when stored key is valid", async () => {
const { verifyStoredAccessKey } = await import("./accessKey");
mockFetch.mockResolvedValue({
ok: true,
json: vi.fn().mockResolvedValue({ valid: true }),
});
localStorage.setItem(
"accessKeyHash",
JSON.stringify({ hash: "test-hash", timestamp: Date.now() }),
);
const result = await verifyStoredAccessKey(TIMEOUT_HOURS);
expect(result).toBe(true);
});
it("should return false when no key is stored", async () => {
const { verifyStoredAccessKey } = await import("./accessKey");
const result = await verifyStoredAccessKey(TIMEOUT_HOURS);
expect(result).toBe(false);
});
it("should return false when stored key is invalid", async () => {
const { verifyStoredAccessKey } = await import("./accessKey");
mockFetch.mockResolvedValue({
ok: true,
json: vi.fn().mockResolvedValue({ valid: false }),
});
localStorage.setItem(
"accessKeyHash",
JSON.stringify({ hash: "invalid-hash", timestamp: Date.now() }),
);
const result = await verifyStoredAccessKey(TIMEOUT_HOURS);
expect(result).toBe(false);
});
it("should return false without asking the server when the timeout is zero", async () => {
const { verifyStoredAccessKey } = await import("./accessKey");
localStorage.setItem(
"accessKeyHash",
JSON.stringify({ hash: "test-hash", timestamp: Date.now() }),
);
const result = await verifyStoredAccessKey(0);
expect(result).toBe(false);
expect(mockFetch).not.toHaveBeenCalled();
});
it("should return false when stored key is expired", async () => {
const { verifyStoredAccessKey } = await import("./accessKey");
const expiredTimestamp = Date.now() - 25 * 60 * 60 * 1000;
localStorage.setItem(
"accessKeyHash",
JSON.stringify({ hash: "old-hash", timestamp: expiredTimestamp }),
);
const result = await verifyStoredAccessKey(TIMEOUT_HOURS);
expect(result).toBe(false);
});
});
});
|