124 lines
3.6 KiB
TypeScript
124 lines
3.6 KiB
TypeScript
import { describe, expect, test } from "bun:test";
|
|
import worker from "../apps/api/src/index";
|
|
|
|
const executionContext = {
|
|
passThroughOnException() {},
|
|
waitUntil() {},
|
|
props: {},
|
|
} as unknown as ExecutionContext;
|
|
|
|
const createDatabase = (options: { userId?: string; error?: Error } = {}) =>
|
|
({
|
|
prepare() {
|
|
return {
|
|
async first() {
|
|
if (options.error) throw options.error;
|
|
return options.userId ? { id: options.userId } : null;
|
|
},
|
|
};
|
|
},
|
|
}) as unknown as D1Database;
|
|
|
|
const fetchApi = (path: string, env: Record<string, unknown>) =>
|
|
worker.fetch(
|
|
new Request(`https://edgeever.test${path}`),
|
|
env as never,
|
|
executionContext,
|
|
);
|
|
|
|
describe("production authentication guard", () => {
|
|
test("returns a diagnosable 503 instead of opening an empty production instance", async () => {
|
|
const response = await fetchApi("/api/v1/auth/session", { DB: createDatabase() });
|
|
|
|
expect(response.status).toBe(503);
|
|
expect(await response.json()).toEqual({
|
|
error: {
|
|
code: "auth_not_configured",
|
|
message: "Authentication is not configured. Set EDGE_EVER_AUTH_PASSWORD as a Worker Secret and redeploy.",
|
|
},
|
|
});
|
|
});
|
|
|
|
test("reports unapplied D1 migrations as database_not_ready", async () => {
|
|
const response = await fetchApi("/api/health", {
|
|
DB: createDatabase({ error: new Error("D1_ERROR: no such table: users") }),
|
|
});
|
|
|
|
expect(response.status).toBe(503);
|
|
expect((await response.json()) as { error: { code: string } }).toMatchObject({
|
|
error: { code: "database_not_ready" },
|
|
});
|
|
});
|
|
|
|
test("keeps passwordless access behind the explicit local-only flag", async () => {
|
|
const response = await fetchApi("/api/v1/auth/session", {
|
|
DB: createDatabase(),
|
|
EDGE_EVER_ALLOW_UNAUTHENTICATED: "true",
|
|
});
|
|
|
|
expect(response.status).toBe(200);
|
|
expect(await response.json()).toMatchObject({
|
|
authRequired: false,
|
|
authenticated: true,
|
|
});
|
|
});
|
|
|
|
test("keeps first-login bootstrap protected when the users table is empty", async () => {
|
|
const response = await fetchApi("/api/v1/auth/session", {
|
|
DB: createDatabase(),
|
|
EDGE_EVER_AUTH_PASSWORD: "admin123",
|
|
});
|
|
|
|
expect(response.status).toBe(200);
|
|
expect(await response.json()).toMatchObject({
|
|
authRequired: true,
|
|
authenticated: false,
|
|
});
|
|
});
|
|
|
|
test("rejects a manually inserted plaintext password with an actionable error", async () => {
|
|
const database = {
|
|
prepare(sql: string) {
|
|
return {
|
|
bind() {
|
|
return this;
|
|
},
|
|
async first() {
|
|
if (sql.includes("password_hash")) {
|
|
return {
|
|
id: "usr_owner",
|
|
username: "admin",
|
|
password_hash: "admin123",
|
|
display_name: "Admin",
|
|
is_disabled: 0,
|
|
};
|
|
}
|
|
return { id: "usr_owner" };
|
|
},
|
|
async all() {
|
|
return { results: [] };
|
|
},
|
|
async run() {
|
|
return { success: true };
|
|
},
|
|
};
|
|
},
|
|
} as unknown as D1Database;
|
|
|
|
const response = await worker.fetch(
|
|
new Request("https://edgeever.test/api/v1/auth/login", {
|
|
method: "POST",
|
|
headers: { "Content-Type": "application/json" },
|
|
body: JSON.stringify({ username: "admin", password: "admin123" }),
|
|
}),
|
|
{ DB: database } as never,
|
|
executionContext,
|
|
);
|
|
|
|
expect(response.status).toBe(503);
|
|
expect((await response.json()) as { error: { code: string } }).toMatchObject({
|
|
error: { code: "password_hash_invalid" },
|
|
});
|
|
});
|
|
});
|