62 lines
2.2 KiB
TypeScript
62 lines
2.2 KiB
TypeScript
import { describe, it, expect, vi } from 'vitest';
|
|
import { NextRequest } from 'next/server';
|
|
|
|
/**
|
|
* The admin session cookie is `Secure` only when the visitor came over HTTPS
|
|
* (#664). Keyed on NODE_ENV it was always `Secure` in the Docker image, so an
|
|
* instance opened at `http://host:7211` logged in with a 200 and then lost the
|
|
* cookie — every admin request after that was a 401.
|
|
*/
|
|
|
|
vi.mock('@/lib/admin/auth', () => ({
|
|
verifyAdminPassword: vi.fn(async () => true),
|
|
createAdminToken: vi.fn(() => 'session-token'),
|
|
isAdminAuthenticated: vi.fn(async () => true),
|
|
isAdminEnabled: vi.fn(() => true),
|
|
COOKIE_NAME: 'folio_admin_session',
|
|
SESSION_DURATION_MS: 24 * 60 * 60 * 1000,
|
|
MAX_PASSWORD_LENGTH: 1024,
|
|
}));
|
|
|
|
vi.mock('@/lib/rate-limit', () => ({
|
|
checkRateLimit: vi.fn(() => ({ success: true, resetAt: 0 })),
|
|
getClientIp: vi.fn(() => '127.0.0.1'),
|
|
retryAfterSeconds: vi.fn(() => 60),
|
|
}));
|
|
|
|
import { POST, DELETE } from '../auth/route';
|
|
|
|
function login(url: string, headers: Record<string, string> = {}) {
|
|
return new NextRequest(url, {
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'application/json', ...headers },
|
|
body: JSON.stringify({ password: 'hunter2' }),
|
|
});
|
|
}
|
|
|
|
describe('admin session cookie', () => {
|
|
it('is not Secure when the admin is reached over plain HTTP', async () => {
|
|
const res = await POST(login('http://192.168.1.10:7211/api/admin/auth'));
|
|
expect(res.status).toBe(200);
|
|
const cookie = res.headers.get('set-cookie') ?? '';
|
|
expect(cookie).toContain('folio_admin_session=session-token');
|
|
expect(cookie.toLowerCase()).not.toContain('secure');
|
|
});
|
|
|
|
it('is Secure behind an HTTPS reverse proxy', async () => {
|
|
const res = await POST(
|
|
login('http://folio:3000/api/admin/auth', { 'x-forwarded-proto': 'https' }),
|
|
);
|
|
expect((res.headers.get('set-cookie') ?? '').toLowerCase()).toContain('secure');
|
|
});
|
|
|
|
it('clears the cookie with the same flag it was set with', async () => {
|
|
const res = await DELETE(
|
|
new NextRequest('http://192.168.1.10:7211/api/admin/auth', { method: 'DELETE' }),
|
|
);
|
|
const cookie = res.headers.get('set-cookie') ?? '';
|
|
expect(cookie).toContain('folio_admin_session=');
|
|
expect(cookie.toLowerCase()).not.toContain('secure');
|
|
});
|
|
});
|