23 lines
1.3 KiB
TypeScript
23 lines
1.3 KiB
TypeScript
import assert from 'node:assert/strict';
|
|
|
|
const base = process.env.SMOKE_WEB_BASE ?? 'http://127.0.0.1:5173';
|
|
const origin = process.env.APP_ORIGIN ?? 'https://dev.evebot.app';
|
|
for (const path of ['/', '/assets', '/characters']) {
|
|
const response = await fetch(`${base}${path}`, { redirect: 'manual' });
|
|
assert.equal(response.status, 200, `SSR ${path}`);
|
|
assert(!(await response.text()).includes('FIXTURE DEMO'), 'live app must not be demo mode');
|
|
}
|
|
for (const message of ['/assets', '/value']) {
|
|
const response = await fetch(`${base}/api/chat`, {
|
|
method: 'POST', headers: { origin, 'content-type': 'application/json' },
|
|
body: JSON.stringify({ message, requestId: crypto.randomUUID() }),
|
|
});
|
|
assert.equal(response.status, 200);
|
|
const result = await response.json();
|
|
assert.equal(result.status, 'authentication_required');
|
|
assert.equal(result.operation?.status, 'authentication_required');
|
|
}
|
|
assert.equal((await fetch(`${base}/api/session/token`)).status, 401);
|
|
assert.equal((await fetch(`${base}/api/sync`, { method: 'POST', headers: { origin: 'https://untrusted.example' } })).status, 403);
|
|
console.log('Live anonymous web smoke passed: SSR, no demo fallback, asset/chat authentication gates, session-token protection, and CSRF. No EVE login or character data accessed.');
|