File size: 2,558 Bytes
2b64d42 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 | import { afterEach, describe, it } from 'node:test';
import assert from 'node:assert/strict';
import { config } from '../src/config.js';
import {
addAccountByKey,
configureBindHost,
getAccountList,
removeAccount,
shouldEmitNoAuthWarning,
validateApiKey,
} from '../src/auth.js';
const originalApiKey = config.apiKey;
const createdAccountIds = [];
afterEach(() => {
config.apiKey = originalApiKey;
configureBindHost('0.0.0.0');
while (createdAccountIds.length) removeAccount(createdAccountIds.pop());
});
describe('shouldEmitNoAuthWarning', () => {
it('warns when unauthenticated service binds all interfaces', () => {
assert.equal(shouldEmitNoAuthWarning('0.0.0.0', false), true);
assert.equal(shouldEmitNoAuthWarning('::', false), true);
});
it('does not warn for localhost or configured auth', () => {
assert.equal(shouldEmitNoAuthWarning('127.0.0.1', false), false);
assert.equal(shouldEmitNoAuthWarning('0.0.0.0', true), false);
});
it('allows missing API_KEY only on local binds', () => {
config.apiKey = '';
configureBindHost('127.0.0.1');
assert.equal(validateApiKey(''), true);
configureBindHost('::1');
assert.equal(validateApiKey(''), true);
configureBindHost('[::1]');
assert.equal(validateApiKey(''), true);
configureBindHost('::ffff:127.0.0.1');
assert.equal(validateApiKey(''), true);
// Empty bindHost is "didn't configure / Node defaults to all interfaces"
// which is non-local. Must fail closed.
configureBindHost('');
assert.equal(validateApiKey(''), false);
configureBindHost('0.0.0.0');
assert.equal(validateApiKey(''), false);
configureBindHost('192.168.1.10');
assert.equal(validateApiKey('anything'), false);
});
it('compares configured API_KEY without default-allowing missing or wrong keys', () => {
config.apiKey = 'server-secret';
configureBindHost('0.0.0.0');
assert.equal(validateApiKey('server-secret'), true);
assert.equal(validateApiKey('wrong'), false);
assert.equal(validateApiKey(''), false);
});
it('returns masked account keys without the raw upstream apiKey', () => {
const key = `abcd1234efgh5678-${Date.now()}`;
const account = addAccountByKey(key, 'masked-list');
createdAccountIds.push(account.id);
const listed = getAccountList().find(a => a.id === account.id);
assert.equal(listed.apiKey, undefined);
assert.equal(listed.apiKey_masked, `${key.slice(0, 8)}...${key.slice(-4)}`);
assert.equal(listed.keyPrefix, 'abcd1234...');
});
});
|