first commit

2026-09-22 16:13:21 -04:00
commit 7e49be27f1
297 changed files with 63162 additions and 0 deletions
@@ -0,0 +1,80 @@
+import {describe, expect, test} from 'bun:test'
+import server from './index'
+
+const KMS_ENCRYPT_URL = 'http://localhost/api/clouds/aws/services/kms/resources/key-1/encrypt'
+const AZURE_KMS_DECRYPT_URL = 'http://localhost/api/clouds/azure/services/kms/resources/key-1/decrypt'
+const KMS_SCHEMA_URL = 'http://localhost/api/clouds/aws/services/kms/schema'
+const TRUSTED_ORIGIN = 'http://localhost:3000'
+const UNTRUSTED_ORIGIN = 'https://example.invalid'
+
+describe('credentialed route CORS', () => {
+    test('allows a trusted KMS crypto preflight', async () => {
+        const res = await server.fetch(new Request(KMS_ENCRYPT_URL, {
+            method: 'OPTIONS',
+            headers: {
+                origin: TRUSTED_ORIGIN,
+                'access-control-request-method': 'POST',
+                'access-control-request-headers': 'content-type',
+            },
+        }))
+
+        expect(res.headers.get('access-control-allow-origin')).toBe(TRUSTED_ORIGIN)
+        expect(res.headers.get('access-control-allow-methods')).toContain('POST')
+    })
+
+    test('does not allow an untrusted or null KMS crypto origin', async () => {
+        for (const url of [KMS_ENCRYPT_URL, AZURE_KMS_DECRYPT_URL]) {
+            for (const origin of [UNTRUSTED_ORIGIN, 'null']) {
+                const res = await server.fetch(new Request(url, {
+                    method: 'OPTIONS',
+                    headers: {origin, 'access-control-request-method': 'POST'},
+                }))
+                expect(res.headers.get('access-control-allow-origin')).toBeNull()
+            }
+        }
+    })
+
+    test('applies the allow-list to a real KMS crypto request', async () => {
+        const body = JSON.stringify({})
+        const trusted = await server.fetch(new Request(KMS_ENCRYPT_URL, {
+            method: 'POST',
+            headers: {origin: TRUSTED_ORIGIN, 'content-type': 'application/json'},
+            body,
+        }))
+        const untrusted = await server.fetch(new Request(KMS_ENCRYPT_URL, {
+            method: 'POST',
+            headers: {origin: UNTRUSTED_ORIGIN, 'content-type': 'application/json'},
+            body,
+        }))
+
+        expect(trusted.status).toBe(400)
+        expect(trusted.headers.get('access-control-allow-origin')).toBe(TRUSTED_ORIGIN)
+        expect(untrusted.status).toBe(400)
+        expect(untrusted.headers.get('access-control-allow-origin')).toBeNull()
+    })
+
+    test('keeps same-origin requests usable and unrelated routes permissive', async () => {
+        const sameOrigin = await server.fetch(new Request(KMS_ENCRYPT_URL, {
+            method: 'POST',
+            headers: {'content-type': 'application/json'},
+            body: JSON.stringify({}),
+        }))
+        const unrelated = await server.fetch(new Request('http://localhost/api/clouds', {
+            headers: {origin: UNTRUSTED_ORIGIN},
+        }))
+
+        expect(sameOrigin.status).toBe(400)
+        expect(sameOrigin.headers.get('access-control-allow-origin')).toBeNull()
+        expect(unrelated.status).toBe(200)
+        expect(unrelated.headers.get('access-control-allow-origin')).toBe('*')
+    })
+
+    test('keeps existing non-crypto KMS routes permissive', async () => {
+        const schema = await server.fetch(new Request(KMS_SCHEMA_URL, {
+            headers: {origin: UNTRUSTED_ORIGIN},
+        }))
+
+        expect(schema.status).toBe(200)
+        expect(schema.headers.get('access-control-allow-origin')).toBe('*')
+    })
+})