Initial Commit

2026-09-18 23:15:05 -04:00
commit fdcc4863f5
118 changed files with 16868 additions and 0 deletions
@@ -0,0 +1,22 @@
+import assert from 'node:assert/strict';
+
+const base = process.env.SMOKE_WEB_BASE ?? 'http://127.0.0.1:5173';
+const origin = process.env.APP_ORIGIN ?? 'https://dev.evebot.app';
+for (const path of ['/', '/assets', '/characters']) {
+  const response = await fetch(`${base}${path}`, { redirect: 'manual' });
+  assert.equal(response.status, 200, `SSR ${path}`);
+  assert(!(await response.text()).includes('FIXTURE DEMO'), 'live app must not be demo mode');
+}
+for (const message of ['/assets', '/value']) {
+  const response = await fetch(`${base}/api/chat`, {
+    method: 'POST', headers: { origin, 'content-type': 'application/json' },
+    body: JSON.stringify({ message, requestId: crypto.randomUUID() }),
+  });
+  assert.equal(response.status, 200);
+  const result = await response.json();
+  assert.equal(result.status, 'authentication_required');
+  assert.equal(result.operation?.status, 'authentication_required');
+}
+assert.equal((await fetch(`${base}/api/session/token`)).status, 401);
+assert.equal((await fetch(`${base}/api/sync`, { method: 'POST', headers: { origin: 'https://untrusted.example' } })).status, 403);
+console.log('Live anonymous web smoke passed: SSR, no demo fallback, asset/chat authentication gates, session-token protection, and CSRF. No EVE login or character data accessed.');