Something went wrong. Try again.
[READ-ONLY] Mirror of https://github.com/openstatusHQ/openstatus. 🫖 Status page with uptime monitoring & API monitoring as code 🫖 openstatus.dev
bun drizzle-orm monitoring monitoring-as-code nextjs observability on-call open-source shadcn-ui status-page statuspage synthetic-monitoring tinybird turso uptime uptime-checker uptime-monitor
Something went wrong. Try again.
5.8 kB · 198 lines
TypeScript
at main
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199import { expect } from "@std/expect";import { describe, test } from "@std/testing/bdd";
import { isEmailDomainAuthorized, isIpAuthorized, isPasswordAuthorized,} from "./access-predicates";
describe("isPasswordAuthorized", () => { test("matching cookie authorizes", () => { expect( isPasswordAuthorized({ stored: "s3cret", queryPassword: null, cookiePassword: "s3cret", }), ).toBe(true); });
test("matching query param authorizes", () => { expect( isPasswordAuthorized({ stored: "s3cret", queryPassword: "s3cret", cookiePassword: null, }), ).toBe(true); });
test("a wrong query param does not fall through to a valid cookie", () => { expect( isPasswordAuthorized({ stored: "s3cret", queryPassword: "nope", cookiePassword: "s3cret", }), ).toBe(false); });
test("an empty query param counts as submitted and loses", () => { expect( isPasswordAuthorized({ stored: "s3cret", queryPassword: "", cookiePassword: "s3cret", }), ).toBe(false); });
test("an absent query param defers to the cookie", () => { expect( isPasswordAuthorized({ stored: "s3cret", queryPassword: undefined, cookiePassword: "s3cret", }), ).toBe(true); });
test("no stored password never authorizes, whatever is submitted", () => { for (const stored of [null, undefined, ""]) { expect( isPasswordAuthorized({ stored, queryPassword: "", cookiePassword: "", }), ).toBe(false); expect( isPasswordAuthorized({ stored, queryPassword: "anything", cookiePassword: null, }), ).toBe(false); } });
test("nothing submitted → denied", () => { expect( isPasswordAuthorized({ stored: "s3cret", queryPassword: null, cookiePassword: undefined, }), ).toBe(false); });
test("comparison is exact: case, whitespace, prefixes and length all count", () => { const deny = (submitted: string) => isPasswordAuthorized({ stored: "s3cret", queryPassword: submitted, cookiePassword: null, }); expect(deny("S3CRET")).toBe(false); expect(deny(" s3cret")).toBe(false); expect(deny("s3cret ")).toBe(false); expect(deny("s3cre")).toBe(false); expect(deny("s3cretx")).toBe(false); expect(deny("")).toBe(false); });
test("non-ASCII passwords compare by code unit", () => { expect( isPasswordAuthorized({ stored: "pässwörd✅", queryPassword: "pässwörd✅", cookiePassword: null, }), ).toBe(true); expect( isPasswordAuthorized({ stored: "pässwörd✅", queryPassword: "passwörd✅", cookiePassword: null, }), ).toBe(false); });});
describe("isEmailDomainAuthorized", () => { test("domain in the allow-list authorizes", () => { expect(isEmailDomainAuthorized("dev@acme.com", ["acme.com"])).toBe(true); });
test("matching is case-insensitive on both sides", () => { expect(isEmailDomainAuthorized("Dev@ACME.com", ["acme.com"])).toBe(true); expect(isEmailDomainAuthorized("dev@acme.com", ["ACME.COM"])).toBe(true); });
test("a subdomain of an allowed domain is not allowed", () => { expect(isEmailDomainAuthorized("dev@mail.acme.com", ["acme.com"])).toBe( false, ); });
test("a suffix look-alike is not allowed", () => { expect(isEmailDomainAuthorized("dev@evilacme.com", ["acme.com"])).toBe( false, ); expect(isEmailDomainAuthorized("dev@acme.com.evil.com", ["acme.com"])).toBe( false, ); });
test("empty or missing allow-list denies", () => { expect(isEmailDomainAuthorized("dev@acme.com", [])).toBe(false); expect(isEmailDomainAuthorized("dev@acme.com", null)).toBe(false); expect(isEmailDomainAuthorized("dev@acme.com", undefined)).toBe(false); });
test("no session email denies", () => { expect(isEmailDomainAuthorized(null, ["acme.com"])).toBe(false); expect(isEmailDomainAuthorized(undefined, ["acme.com"])).toBe(false); expect(isEmailDomainAuthorized("", ["acme.com"])).toBe(false); });
test("an address without a domain denies", () => { expect(isEmailDomainAuthorized("dev", ["acme.com"])).toBe(false); expect(isEmailDomainAuthorized("dev@", ["acme.com"])).toBe(false); });
test("only the first domain of a multi-@ address is read", () => { // `split("@")[1]` — "a@b@acme.com" checks "b", not "acme.com". expect(isEmailDomainAuthorized("a@b@acme.com", ["acme.com"])).toBe(false); expect(isEmailDomainAuthorized("a@acme.com@b", ["acme.com"])).toBe(true); });});
describe("isIpAuthorized", () => { test("IP inside an allowed range authorizes", () => { expect(isIpAuthorized("192.168.1.42", ["192.168.1.0/24"])).toBe(true); });
test("IP outside every range denies", () => { expect(isIpAuthorized("10.0.0.1", ["192.168.1.0/24"])).toBe(false); });
test("no ranges configured denies (fail closed)", () => { expect(isIpAuthorized("192.168.1.42", [])).toBe(false); expect(isIpAuthorized("192.168.1.42", null)).toBe(false); expect(isIpAuthorized("192.168.1.42", undefined)).toBe(false); });
test("no client IP denies (fail closed)", () => { expect(isIpAuthorized(null, ["0.0.0.0/0"])).toBe(false); expect(isIpAuthorized(undefined, ["0.0.0.0/0"])).toBe(false); expect(isIpAuthorized("", ["0.0.0.0/0"])).toBe(false); });
test("a malformed range is skipped, the rest still evaluated", () => { expect( isIpAuthorized("192.168.1.42", ["not-a-cidr", "192.168.1.0/24"]), ).toBe(true); });});