31 lines
1.4 KiB
JavaScript
31 lines
1.4 KiB
JavaScript
import assert from "node:assert/strict";
|
|
import test from "node:test";
|
|
import { forwardMarketBatch, rejectNonLocalRequest } from "../vite.config.js";
|
|
|
|
test("keeps the import token in the local server-side forwarder", async () => {
|
|
let forwarded;
|
|
const response = await forwardMarketBatch('{"batchId":"one"}', {
|
|
url: "https://l2.example/api/l2/market/import",
|
|
token: "secret",
|
|
fetchImpl: async (url, init) => {
|
|
forwarded = { url, init };
|
|
return Response.json({ imported: true });
|
|
},
|
|
});
|
|
|
|
assert.equal(response.status, 200);
|
|
assert.equal(forwarded.url, "https://l2.example/api/l2/market/import");
|
|
assert.equal(forwarded.init.headers.Authorization, "Bearer secret");
|
|
assert.equal(forwarded.init.body, '{"batchId":"one"}');
|
|
assert.equal((await forwardMarketBatch("{}", {})).status, 503);
|
|
});
|
|
|
|
test("rejects cross-site and non-JSON calls before using the import token", () => {
|
|
assert.equal(
|
|
rejectNonLocalRequest({ headers: { host: "127.0.0.1:5173", origin: "http://127.0.0.1:5173", "content-type": "application/json" } }),
|
|
null,
|
|
);
|
|
assert.equal(rejectNonLocalRequest({ headers: { host: "127.0.0.1:5173", origin: "https://evil.example", "content-type": "application/json" } }), 403);
|
|
assert.equal(rejectNonLocalRequest({ headers: { host: "127.0.0.1:5173", origin: "http://127.0.0.1:5173", "content-type": "text/plain" } }), 415);
|
|
});
|