hikmettan/ihaleist
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

verify CORS origin allowlist

Browse Source
This commit is contained in:
hikmettan
2026-09-06 18:17:25 +03:00
parent 089f5c36f0
commit 7a3915a679
2 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/http-state.test.mjs
+4 -1
View File
@@ -20,7 +20,7 @@ const request=async(path,method='GET',body,auth=token)=>{
before(async()=>{
const socket=createServer();await new Promise(r=>socket.listen(0,'127.0.0.1',r));const port=socket.address().port;await new Promise(r=>socket.close(r));
base='http://127.0.0.1:'+port;
child=spawn(process.execPath,['server/index.js'],{cwd:new URL('..',import.meta.url),env:{...process.env,NODE_ENV:'test',TELEGRAM_BOT_TOKEN:'',PORT:String(port),IHALEIST_USER_DATA_DIR:dir,IHALEIST_SHARED_DATA_DIR:join(dir,'shared'),UYUM_GOMME:'0'},stdio:'ignore'});
child=spawn(process.execPath,['server/index.js'],{cwd:new URL('..',import.meta.url),env:{...process.env,NODE_ENV:'test',CORS_ORIGINS:'https://client.example,https://admin.example',TELEGRAM_BOT_TOKEN:'',PORT:String(port),IHALEIST_USER_DATA_DIR:dir,IHALEIST_SHARED_DATA_DIR:join(dir,'shared'),UYUM_GOMME:'0'},stdio:'ignore'});
for(let i=0;i<100;i++){try{await fetch(base+'/api/auth/google/config');return;}catch{await new Promise(r=>setTimeout(r,50));}}
throw new Error('QA API did not start');
});
@@ -28,7 +28,10 @@ after(async()=>{if(child){child.kill();await new Promise(r=>child.once('exit',r)
test('HTTP preparation requires auth, persists draft and rejects stale revisions',async()=>{
const preflight=await fetch(base+'/api/me/plan',{method:'OPTIONS',headers:{Origin:'https://client.example', 'Access-Control-Request-Method':'GET', 'Access-Control-Request-Headers':'authorization,content-type'}});
assert.equal(preflight.status,204);
assert.equal(preflight.headers.get('access-control-allow-origin'),'https://client.example');
assert.equal(preflight.headers.get('access-control-allow-headers'),'Authorization,Content-Type');
const denied=await fetch(base+'/api/me/plan',{method:'OPTIONS',headers:{Origin:'https://untrusted.example','Access-Control-Request-Method':'GET'}});
assert.equal(denied.status,204);assert.equal(denied.headers.get('access-control-allow-origin'),null);
const unauthorized=await request('/api/me/tender-state','GET',null,null);
assert.equal(unauthorized.status,401);
assert.equal(unauthorized.headers.get('x-content-type-options'),'nosniff');