buenosair/lvmh
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

test: ≥95% coverage — daemon 96.9% (go), web 95.5-99% (vitest 142 tests); store.ts hooks-order crash fix

Browse Source
This commit is contained in:
Raphael Westphal
2026-08-18 14:56:08 +02:00
parent ecb91e941c
commit 0ecef2a9bd
30 changed files with 6305 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files
e2e/scenarios/auth.mjs
+46 -28
View File
@@ -6,37 +6,55 @@
import { agentHello, rest, sessionSnapshot, sid, WSSock } from "../lib.mjs";
export async function run(ctx) {
const { r, base, token, agentUrl, webUrl } = ctx;
const { r, base, token, agentUrl, webUrl } = ctx;
const noToken = await rest(base, null, "/api/sessions");
r.check("REST without token → 401", noToken.status === 401, `got ${noToken.status}`);
const noToken = await rest(base, null, "/api/sessions");
r.check(
"REST without token → 401",
noToken.status === 401,
`got ${noToken.status}`,
);
const badToken = await rest(base, "definitely-wrong", "/api/sessions");
r.check("REST with bad token → 401", badToken.status === 401, `got ${badToken.status}`);
const badToken = await rest(base, "definitely-wrong", "/api/sessions");
r.check(
"REST with bad token → 401",
badToken.status === 401,
`got ${badToken.status}`,
);
const goodToken = await rest(base, token, "/api/sessions");
r.check("REST with correct token → 200", goodToken.status === 200, `got ${goodToken.status}`);
const goodToken = await rest(base, token, "/api/sessions");
r.check(
"REST with correct token → 200",
goodToken.status === 200,
`got ${goodToken.status}`,
);
// Web WS: token arrives as ?token= query param (browsers cannot set headers).
const badWeb = new WSSock(`${webUrl}?token=wrong-token`);
const webOpened = await badWeb.opened();
r.check("web WS with bad ?token= rejected before upgrade", !webOpened, "connection accepted");
badWeb.close();
// Web WS: token arrives as ?token= query param (browsers cannot set headers).
const badWeb = new WSSock(`${webUrl}?token=wrong-token`);
const webOpened = await badWeb.opened();
r.check(
"web WS with bad ?token= rejected before upgrade",
!webOpened,
"connection accepted",
);
badWeb.close();
// Agent WS with bad bearer must be rejected: PROTOCOL.md §Auth requires
// closing the upgrade on mismatch (fixed: Routes() wraps /agent/ws in
// s.bearerAuth).
const badAgent = new WSSock(agentUrl, { headers: { Authorization: `Bearer wrong-token` } });
const agentOpened = await badAgent.opened();
let welcomed = null;
if (agentOpened) {
agentHello(badAgent, sessionSnapshot(sid("e2e-auth-bad")));
welcomed = await badAgent.waitForFrame((f) => f.type === "welcome");
}
r.check(
"agent WS with bad token rejected (closed before welcome)",
!agentOpened || welcomed === null,
welcomed ? "welcome received despite wrong bearer" : "",
);
badAgent.close();
// Agent WS with bad bearer must be rejected: PROTOCOL.md §Auth requires
// closing the upgrade on mismatch (fixed: Routes() wraps /agent/ws in
// s.bearerAuth).
const badAgent = new WSSock(agentUrl, {
headers: { Authorization: `Bearer wrong-token` },
});
const agentOpened = await badAgent.opened();
let welcomed = null;
if (agentOpened) {
agentHello(badAgent, sessionSnapshot(sid("e2e-auth-bad")));
welcomed = await badAgent.waitForFrame((f) => f.type === "welcome");
}
r.check(
"agent WS with bad token rejected (closed before welcome)",
!agentOpened || welcomed === null,
welcomed ? "welcome received despite wrong bearer" : "",
);
badAgent.close();
}