79 lines
2.6 KiB
TypeScript
79 lines
2.6 KiB
TypeScript
import { readFileSync } from "node:fs";
|
|
|
|
import { describe, expect, it } from "vitest";
|
|
|
|
import { createApp } from "../../apps/api/src/app.js";
|
|
|
|
describe("TDD-WP0-BND-001 loopback origin", () => {
|
|
it("serves only the minimal gate shell on the fixed loopback authority", async () => {
|
|
const app = await createApp();
|
|
const response = await app.inject({
|
|
headers: { host: "127.0.0.1:43121" },
|
|
method: "GET",
|
|
url: "/",
|
|
});
|
|
|
|
expect(response.statusCode).toBe(200);
|
|
expect(response.headers["accept-ch"]).toContain("Sec-CH-UA-Full-Version-List");
|
|
expect(response.headers["content-security-policy"]).toContain("default-src 'self'");
|
|
expect(response.body).toContain("当前浏览器无法使用 Dada");
|
|
expect(response.body).not.toContain("/src/main.tsx");
|
|
expect(response.body).toContain("没有“仍然继续”入口，也不会提供绕过令牌或参数。");
|
|
expect(response.body).not.toMatch(/<(?:a|button)[^>]*>[^<]*仍然继续/u);
|
|
await app.close();
|
|
});
|
|
|
|
it.each([
|
|
{
|
|
headers: { host: "192.168.1.10:43121" },
|
|
method: "GET" as const,
|
|
name: "LAN Host",
|
|
url: "/",
|
|
},
|
|
{
|
|
headers: {
|
|
host: "127.0.0.1:43121",
|
|
origin: "http://attacker.invalid",
|
|
},
|
|
method: "POST" as const,
|
|
name: "foreign Origin",
|
|
url: "/api/v1/support/check",
|
|
},
|
|
{
|
|
headers: {
|
|
"access-control-request-method": "POST",
|
|
host: "127.0.0.1:43121",
|
|
origin: "http://attacker.invalid",
|
|
},
|
|
method: "OPTIONS" as const,
|
|
name: "CORS preflight",
|
|
url: "/api/v1/support/check",
|
|
},
|
|
])("rejects $name without a CORS grant", async ({ headers, method, url }) => {
|
|
const app = await createApp();
|
|
const response = await app.inject({ headers, method, url });
|
|
|
|
expect(response.statusCode).toBe(426);
|
|
expect(response.headers).not.toHaveProperty("access-control-allow-origin");
|
|
expect(response.json()).toMatchObject({
|
|
error: {
|
|
code: "BROWSER_UNSUPPORTED",
|
|
details: { reason: "identity_unavailable" },
|
|
message_key: "browser.unsupported",
|
|
},
|
|
});
|
|
await app.close();
|
|
});
|
|
|
|
it("keeps the production and Supervisor endpoint fixed", () => {
|
|
const main = readFileSync("apps/api/src/main.ts", "utf8");
|
|
const supervisor = readFileSync("supervisor/Dada.Supervisor/LoopbackEndpoint.cs", "utf8");
|
|
|
|
expect(main).toContain('host: "127.0.0.1"');
|
|
expect(main).toContain("port: 43121");
|
|
expect(supervisor).toContain('Host = "127.0.0.1"');
|
|
expect(supervisor).toContain("Port = 43121");
|
|
expect(supervisor).not.toContain("0.0.0.0");
|
|
});
|
|
});
|