Something went wrong. Try again.
[READ-ONLY] Mirror of https://github.com/openstatusHQ/openstatus. 🫖 Status page with uptime monitoring & API monitoring as code 🫖 openstatus.dev
bun drizzle-orm monitoring monitoring-as-code nextjs observability on-call open-source shadcn-ui status-page statuspage synthetic-monitoring tinybird turso uptime uptime-checker uptime-monitor
Something went wrong. Try again.
1.7 kB · 41 lines
TypeScript
123456789101112131415161718192021222324252627282930313233343536373839404142import { expect } from "@std/expect";import { describe, test } from "@std/testing/bdd";
import { validateKey } from "./auth";
/** * `validateKey` has three production branches (custom DB key, Unkey * fallback, super-admin) and one dev fallback. Tests here cover the * dev fallback exhaustively. The production branches require flipping * `NODE_ENV` at module-load time, which reroutes other middleware in * this app (see `routes/mcp/handler.test.ts` for the same caveat) — a * dedicated production-mode test harness is out of scope. * * What we DO assert structurally even without that harness: * - dev fallback returns scopes `['*']` (so local dev mirrors super- * admin and isn't accidentally locked out by scope checks) * - the `keyId` round-trips so audit attribution holds */describe("validateKey (dev fallback)", () => { test("returns scopes ['*'] so local dev mirrors super-admin", async () => { const { result, error } = await validateKey("anything"); expect(error).toBeUndefined(); expect(result.valid).toBe(true); expect(result.scopes).toEqual(["*"]); });
test("uses the input string as both ownerId and keyId", async () => { const { result } = await validateKey("dev-key-42"); expect(result.ownerId).toBe("dev-key-42"); expect(result.keyId).toBe("dev-key-42"); expect(result.authMethod).toBe("dev"); });});
describe("validateKey (oauth access tokens)", () => { test("rejects an unknown os_oat_ token before the dev fallback", async () => { const { result, error } = await validateKey("os_oat_not-a-real-token"); expect(result.valid).toBe(false); expect(error?.message).toContain("access token"); });});