e2e: integration harness (69/69 green) + fix /agent/ws missing bearer auth (BUG-1)

2026-08-18 14:13:15 +02:00
parent 6ba718730e
commit ecb91e941c
17 changed files with 1129 additions and 2 deletions
@@ -0,0 +1,42 @@
+// scenarios/auth.mjs — bearer auth seams: REST 401s, WS rejection.
+// PROTOCOL.md §Auth: "All requests (WS upgrade and REST) carry
+// Authorization: Bearer … Daemon rejects with 401 (REST) or closes the WS
+// (upgrade) on mismatch."
+
+import { agentHello, rest, sessionSnapshot, sid, WSSock } from "../lib.mjs";
+
+export async function run(ctx) {
+  const { r, base, token, agentUrl, webUrl } = ctx;
+
+  const noToken = await rest(base, null, "/api/sessions");
+  r.check("REST without token → 401", noToken.status === 401, `got ${noToken.status}`);
+
+  const badToken = await rest(base, "definitely-wrong", "/api/sessions");
+  r.check("REST with bad token → 401", badToken.status === 401, `got ${badToken.status}`);
+
+  const goodToken = await rest(base, token, "/api/sessions");
+  r.check("REST with correct token → 200", goodToken.status === 200, `got ${goodToken.status}`);
+
+  // Web WS: token arrives as ?token= query param (browsers cannot set headers).
+  const badWeb = new WSSock(`${webUrl}?token=wrong-token`);
+  const webOpened = await badWeb.opened();
+  r.check("web WS with bad ?token= rejected before upgrade", !webOpened, "connection accepted");
+  badWeb.close();
+
+  // Agent WS with bad bearer must be rejected: PROTOCOL.md §Auth requires
+  // closing the upgrade on mismatch (fixed: Routes() wraps /agent/ws in
+  // s.bearerAuth).
+  const badAgent = new WSSock(agentUrl, { headers: { Authorization: `Bearer wrong-token` } });
+  const agentOpened = await badAgent.opened();
+  let welcomed = null;
+  if (agentOpened) {
+    agentHello(badAgent, sessionSnapshot(sid("e2e-auth-bad")));
+    welcomed = await badAgent.waitForFrame((f) => f.type === "welcome");
+  }
+  r.check(
+    "agent WS with bad token rejected (closed before welcome)",
+    !agentOpened || welcomed === null,
+    welcomed ? "welcome received despite wrong bearer" : "",
+  );
+  badAgent.close();
+}