Zakaria
81 lines
3.4 KiB
TypeScript
81 lines
3.4 KiB
TypeScript
import {describe, expect, test} from 'bun:test'
|
|
import server from './index'
|
|
|
|
const KMS_ENCRYPT_URL = 'http://localhost/api/clouds/aws/services/kms/resources/key-1/encrypt'
|
|
const AZURE_KMS_DECRYPT_URL = 'http://localhost/api/clouds/azure/services/kms/resources/key-1/decrypt'
|
|
const KMS_SCHEMA_URL = 'http://localhost/api/clouds/aws/services/kms/schema'
|
|
const TRUSTED_ORIGIN = 'http://localhost:3000'
|
|
const UNTRUSTED_ORIGIN = 'https://example.invalid'
|
|
|
|
describe('credentialed route CORS', () => {
|
|
test('allows a trusted KMS crypto preflight', async () => {
|
|
const res = await server.fetch(new Request(KMS_ENCRYPT_URL, {
|
|
method: 'OPTIONS',
|
|
headers: {
|
|
origin: TRUSTED_ORIGIN,
|
|
'access-control-request-method': 'POST',
|
|
'access-control-request-headers': 'content-type',
|
|
},
|
|
}))
|
|
|
|
expect(res.headers.get('access-control-allow-origin')).toBe(TRUSTED_ORIGIN)
|
|
expect(res.headers.get('access-control-allow-methods')).toContain('POST')
|
|
})
|
|
|
|
test('does not allow an untrusted or null KMS crypto origin', async () => {
|
|
for (const url of [KMS_ENCRYPT_URL, AZURE_KMS_DECRYPT_URL]) {
|
|
for (const origin of [UNTRUSTED_ORIGIN, 'null']) {
|
|
const res = await server.fetch(new Request(url, {
|
|
method: 'OPTIONS',
|
|
headers: {origin, 'access-control-request-method': 'POST'},
|
|
}))
|
|
expect(res.headers.get('access-control-allow-origin')).toBeNull()
|
|
}
|
|
}
|
|
})
|
|
|
|
test('applies the allow-list to a real KMS crypto request', async () => {
|
|
const body = JSON.stringify({})
|
|
const trusted = await server.fetch(new Request(KMS_ENCRYPT_URL, {
|
|
method: 'POST',
|
|
headers: {origin: TRUSTED_ORIGIN, 'content-type': 'application/json'},
|
|
body,
|
|
}))
|
|
const untrusted = await server.fetch(new Request(KMS_ENCRYPT_URL, {
|
|
method: 'POST',
|
|
headers: {origin: UNTRUSTED_ORIGIN, 'content-type': 'application/json'},
|
|
body,
|
|
}))
|
|
|
|
expect(trusted.status).toBe(400)
|
|
expect(trusted.headers.get('access-control-allow-origin')).toBe(TRUSTED_ORIGIN)
|
|
expect(untrusted.status).toBe(400)
|
|
expect(untrusted.headers.get('access-control-allow-origin')).toBeNull()
|
|
})
|
|
|
|
test('keeps same-origin requests usable and unrelated routes permissive', async () => {
|
|
const sameOrigin = await server.fetch(new Request(KMS_ENCRYPT_URL, {
|
|
method: 'POST',
|
|
headers: {'content-type': 'application/json'},
|
|
body: JSON.stringify({}),
|
|
}))
|
|
const unrelated = await server.fetch(new Request('http://localhost/api/clouds', {
|
|
headers: {origin: UNTRUSTED_ORIGIN},
|
|
}))
|
|
|
|
expect(sameOrigin.status).toBe(400)
|
|
expect(sameOrigin.headers.get('access-control-allow-origin')).toBeNull()
|
|
expect(unrelated.status).toBe(200)
|
|
expect(unrelated.headers.get('access-control-allow-origin')).toBe('*')
|
|
})
|
|
|
|
test('keeps existing non-crypto KMS routes permissive', async () => {
|
|
const schema = await server.fetch(new Request(KMS_SCHEMA_URL, {
|
|
headers: {origin: UNTRUSTED_ORIGIN},
|
|
}))
|
|
|
|
expect(schema.status).toBe(200)
|
|
expect(schema.headers.get('access-control-allow-origin')).toBe('*')
|
|
})
|
|
})
|