Juno ChowandClaude Fable 5.1
f665082dad
前端（Vite + React）、API/worker（Fastify + BullMQ）、api-contracts 契约包、 迁移脚本、测试与自托管 docker-compose 示例。 开源准备：运维脚本与机器信息已拆到私有仓库；公司名、备案号、隐私邮箱改读 publicCompliance.local.json（仓库只保留占位模板）；站点地址与客服二维码改为 VITE_ 环境变量；fixtures 中的真实用户标识已匿名化；三个 package.json 标注 Apache-2.0。 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
41 lines
1.2 KiB
TypeScript
41 lines
1.2 KiB
TypeScript
import { describe, expect, it } from 'vitest';
|
||
import { resolveTrustedAppOrigin } from '../src/config/requestOrigin.js';
|
||
|
||
const configuration = {
|
||
CORS_ORIGIN: [
|
||
'https://lindyson.com',
|
||
'https://www.lindyson.com',
|
||
'https://lindyson.cn',
|
||
'https://www.lindyson.cn',
|
||
].join(','),
|
||
APP_BASE_URL: 'https://www.lindyson.com',
|
||
};
|
||
|
||
describe('可信请求应用来源', () => {
|
||
it.each([
|
||
'https://lindyson.com',
|
||
'https://www.lindyson.com',
|
||
'https://lindyson.cn',
|
||
'https://www.lindyson.cn',
|
||
])('只要来源在 CORS 白名单内就原样使用：%s', origin => {
|
||
expect(resolveTrustedAppOrigin(origin, configuration)).toBe(origin);
|
||
});
|
||
|
||
it.each([
|
||
undefined,
|
||
'null',
|
||
'https://www.lindyson.cn.evil.example',
|
||
'https://www.lindyson.cn/path',
|
||
'not-an-origin',
|
||
])('缺失或不可信来源回退 APP_BASE_URL：%s', origin => {
|
||
expect(resolveTrustedAppOrigin(origin, configuration)).toBe('https://www.lindyson.com');
|
||
});
|
||
|
||
it('CORS 通配符不把任意 Origin 提升为密码或支付返回来源', () => {
|
||
expect(resolveTrustedAppOrigin('https://evil.example', {
|
||
CORS_ORIGIN: '*',
|
||
APP_BASE_URL: 'https://www.lindyson.com/app',
|
||
})).toBe('https://www.lindyson.com');
|
||
});
|
||
});
|