61 lines
1.8 KiB
JavaScript
61 lines
1.8 KiB
JavaScript
// scenarios/auth.mjs — bearer auth seams: REST 401s, WS rejection.
|
|
// PROTOCOL.md §Auth: "All requests (WS upgrade and REST) carry
|
|
// Authorization: Bearer … Daemon rejects with 401 (REST) or closes the WS
|
|
// (upgrade) on mismatch."
|
|
|
|
import { agentHello, rest, sessionSnapshot, sid, WSSock } from "../lib.mjs";
|
|
|
|
export async function run(ctx) {
|
|
const { r, base, token, agentUrl, webUrl } = ctx;
|
|
|
|
const noToken = await rest(base, null, "/api/sessions");
|
|
r.check(
|
|
"REST without token → 401",
|
|
noToken.status === 401,
|
|
`got ${noToken.status}`,
|
|
);
|
|
|
|
const badToken = await rest(base, "definitely-wrong", "/api/sessions");
|
|
r.check(
|
|
"REST with bad token → 401",
|
|
badToken.status === 401,
|
|
`got ${badToken.status}`,
|
|
);
|
|
|
|
const goodToken = await rest(base, token, "/api/sessions");
|
|
r.check(
|
|
"REST with correct token → 200",
|
|
goodToken.status === 200,
|
|
`got ${goodToken.status}`,
|
|
);
|
|
|
|
// Web WS: token arrives as ?token= query param (browsers cannot set headers).
|
|
const badWeb = new WSSock(`${webUrl}?token=wrong-token`);
|
|
const webOpened = await badWeb.opened();
|
|
r.check(
|
|
"web WS with bad ?token= rejected before upgrade",
|
|
!webOpened,
|
|
"connection accepted",
|
|
);
|
|
badWeb.close();
|
|
|
|
// Agent WS with bad bearer must be rejected: PROTOCOL.md §Auth requires
|
|
// closing the upgrade on mismatch (fixed: Routes() wraps /agent/ws in
|
|
// s.bearerAuth).
|
|
const badAgent = new WSSock(agentUrl, {
|
|
headers: { Authorization: `Bearer wrong-token` },
|
|
});
|
|
const agentOpened = await badAgent.opened();
|
|
let welcomed = null;
|
|
if (agentOpened) {
|
|
agentHello(badAgent, sessionSnapshot(sid("e2e-auth-bad")));
|
|
welcomed = await badAgent.waitForFrame((f) => f.type === "welcome");
|
|
}
|
|
r.check(
|
|
"agent WS with bad token rejected (closed before welcome)",
|
|
!agentOpened || welcomed === null,
|
|
welcomed ? "welcome received despite wrong bearer" : "",
|
|
);
|
|
badAgent.close();
|
|
}
|