33 lines
2.1 KiB
TypeScript
33 lines
2.1 KiB
TypeScript
import { afterEach, expect, test } from 'bun:test';
|
|
import { POST } from '../src/routes/api/sync/cancel/+server';
|
|
|
|
const originalEnv = { APP_MODE: process.env.APP_MODE, APP_ORIGIN: process.env.APP_ORIGIN, APP_CAPABILITY_ALLOWLIST: process.env.APP_CAPABILITY_ALLOWLIST };
|
|
|
|
afterEach(() => {
|
|
for (const [key, value] of Object.entries(originalEnv)) { if (value === undefined) delete process.env[key]; else process.env[key] = value; }
|
|
});
|
|
|
|
function event(request: Request): Parameters<typeof POST>[0] {
|
|
return { request, url: new URL(request.url), cookies: { get: () => undefined } as any, getClientAddress: () => '127.0.0.1' } as Parameters<typeof POST>[0];
|
|
}
|
|
|
|
test('sync cancellation rejects hostile origins before session or body work', async () => {
|
|
process.env.APP_MODE = 'live'; process.env.APP_ORIGIN = 'http://localhost:5173';
|
|
process.env.APP_CAPABILITY_ALLOWLIST = 'asset_sync';
|
|
await expect(POST(event(new Request('http://localhost:5173/api/sync/cancel', { method: 'POST', headers: { origin: 'https://evil.example', 'content-type': 'application/json' }, body: '{}' })))).rejects.toMatchObject({ status: 403 });
|
|
});
|
|
|
|
test('sync cancellation returns unauthenticated before reading a request body', async () => {
|
|
process.env.APP_MODE = 'live'; process.env.APP_ORIGIN = 'http://localhost:5173';
|
|
process.env.APP_CAPABILITY_ALLOWLIST = 'asset_sync';
|
|
const response = await POST(event(new Request('http://localhost:5173/api/sync/cancel', { method: 'POST', headers: { origin: 'http://localhost:5173', 'content-type': 'application/json' }, body: '{}' })));
|
|
expect(response.status).toBe(401);
|
|
});
|
|
|
|
test('sync cancellation applies the bounded JSON byte cap', async () => {
|
|
process.env.APP_MODE = 'demo'; process.env.APP_ORIGIN = 'http://localhost:5173';
|
|
process.env.APP_CAPABILITY_ALLOWLIST = 'asset_sync';
|
|
const response = POST(event(new Request('http://localhost:5173/api/sync/cancel', { method: 'POST', headers: { origin: 'http://localhost:5173', 'content-type': 'application/json' }, body: JSON.stringify({ jobId: 'x'.repeat(17_000) }) })));
|
|
await expect(response).rejects.toMatchObject({ status: 413 });
|
|
});
|