Something went wrong. Try again.
This repository has no description
Something went wrong. Try again.
JavaScript
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172import assert from "node:assert/strict";import { test } from "node:test";import { Secret } from "../configuration/secrets.ts";import { customDomainOrigin } from "../shared/domain-origin.ts";import { authorizeRuntimeRequest, createOwnerSession, verifyOwnerSession,} from "../worker/session.ts";
const management = "https://flarebot-0123456789abcdef0123456789abcdef.example.workers.dev";const custom = "https://bot.example.com";const installation = { schemaVersion: 1, installationId: "0123456789abcdef0123456789abcdef", ownerSubject: "owner", runtimeOrigin: custom, controlPlaneOrigin: "https://control.example.com",};const secret = new Secret("a-session-secret-that-is-at-least-32-bytes");
test("custom domain origins are canonical HTTPS DNS origins", () => { assert.equal(customDomainOrigin(custom), custom); for (const origin of [ "http://bot.example.com", "https://bot.example.com/route", "https://bot.example.com:8443", "https://127.0.0.1", "https://bot.example.workers.dev", "https://*.example.com", "https://BOT.example.com", ]) assert.equal(customDomainOrigin(origin), null, origin);});
test("owner session and state-changing requests bind the exact custom origin", async () => { const setCookie = await createOwnerSession(secret, installation); const cookie = setCookie.split(";")[0]; const request = (url, origin = custom, method = "GET") => new Request(url, { method, headers: { Cookie: cookie, Origin: origin } }); assert.ok( await verifyOwnerSession(request(`${custom}/api`), secret, installation), ); assert.equal( await verifyOwnerSession( request(`${management}/api`, management), secret, installation, ), null, ); assert.equal( await authorizeRuntimeRequest( request(`${custom}/api`, management, "POST"), secret, installation, ).then((response) => response?.status), 403, ); assert.equal( await authorizeRuntimeRequest( new Request(`${custom}/agents/personal`, { headers: { Cookie: cookie, Origin: management, Upgrade: "websocket" }, }), secret, installation, ).then((response) => response?.status), 403, );});