6c7eed7580
Fresh history cut from cynarAI/evoo antigravity-handoff/project-timeline (Voice First + project timeline). Brand docs/titles as evOo; keep @rakazo/* packages as tech debt. Excludes node_modules, caches, secrets, voice blobs.
66 lines
1.9 KiB
TypeScript
66 lines
1.9 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
import { BotSecretDestination, SecretHttpRequest } from "./bot-secrets.js";
|
|
|
|
const destination = {
|
|
name: "example_api",
|
|
origin: "https://api.example.test",
|
|
auth: { type: "bearer" },
|
|
};
|
|
|
|
describe("credential contracts", () => {
|
|
it.each([
|
|
"http://api.example.test",
|
|
"https://user:pass@api.example.test",
|
|
"https://api.example.test/path",
|
|
"https://api.example.test?query=1",
|
|
"https://api.example.test#fragment",
|
|
])("rejects non-origin destination %s", (origin) => {
|
|
expect(BotSecretDestination.safeParse({ ...destination, origin }).success).toBe(false);
|
|
});
|
|
it.each([
|
|
"Host",
|
|
"Connection",
|
|
"Content-Length",
|
|
"Cookie",
|
|
"Proxy-Authorization",
|
|
"X-Forwarded-Host",
|
|
"Sec-Fetch-Site",
|
|
"X-Key\r\nHost",
|
|
])("rejects reserved or malformed header %s", (name) => {
|
|
expect(
|
|
BotSecretDestination.safeParse({ ...destination, auth: { type: "header", name } }).success,
|
|
).toBe(false);
|
|
});
|
|
it.each(["GET", "HEAD"])("rejects even an empty body on %s", (method) => {
|
|
expect(
|
|
SecretHttpRequest.safeParse({
|
|
name: "example_api",
|
|
url: destination.origin,
|
|
method,
|
|
body: "",
|
|
}).success,
|
|
).toBe(false);
|
|
});
|
|
it("accepts ordinary authentication and bounds request inputs", () => {
|
|
expect(BotSecretDestination.parse(destination)).toEqual(destination);
|
|
expect(
|
|
BotSecretDestination.safeParse({
|
|
...destination,
|
|
auth: { type: "header", name: "X-Api-Key" },
|
|
}).success,
|
|
).toBe(true);
|
|
expect(
|
|
SecretHttpRequest.safeParse({ name: "example_api", url: destination.origin, body: "body" })
|
|
.success,
|
|
).toBe(false);
|
|
expect(
|
|
SecretHttpRequest.safeParse({
|
|
name: "example_api",
|
|
url: destination.origin,
|
|
method: "POST",
|
|
body: "x".repeat(100_001),
|
|
}).success,
|
|
).toBe(false);
|
|
});
|
|
});
|