51 lines
2.6 KiB
JavaScript
51 lines
2.6 KiB
JavaScript
// Q284 / #385: returning header-preview writer support must fail this regression.
|
|
// No OIDC, broker, credentials or host configuration are constructed by these tests.
|
|
import test from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { spawnSync } from 'node:child_process';
|
|
import { startServer } from '../src/serve.mjs';
|
|
|
|
const preview = { host: 'console.example.test', header: 'x-authentik-username', user: 'jason' };
|
|
const cli = new URL('../src/cli.mjs', import.meta.url);
|
|
const service = new URL('../../../scripts/webui-service.sh', import.meta.url);
|
|
const send = async () => { assert.fail('refused configuration must never invoke its writer'); };
|
|
|
|
for (const [name, proof] of [['without proof', null], ['with proof', { header: 'x-console-proof', value: Buffer.from('fixture-proof-value-that-does-not-authenticate-a-human') }]]) {
|
|
test(`header-preview cannot bind a human writer ${name}`, async () => {
|
|
let web;
|
|
try {
|
|
web = await startServer({ port: 0, preview, proof, send });
|
|
assert.fail('header-preview writer configuration was accepted');
|
|
} catch (error) {
|
|
assert.match(error.message, /--send needs --sso/);
|
|
} finally {
|
|
if (web) await new Promise(resolve => web.close(resolve));
|
|
}
|
|
});
|
|
}
|
|
|
|
test('CLI refuses header-preview writes before loading the system configuration', () => {
|
|
const env = { ...process.env, MOSAIC_CONFIG: '/fixture-q284-missing-config/config.json' };
|
|
for (const flags of [['--public-host', preview.host, '--auth-header', preview.header, '--allow-user', preview.user], []]) {
|
|
const r = spawnSync(process.execPath, [cli.pathname, 'serve', '--port', '0', '--send', ...flags], { env, encoding: 'utf8', timeout: 5000 });
|
|
assert.equal(r.error, undefined);
|
|
assert.equal(r.status, 2);
|
|
assert.match(r.stderr, /refused: --send needs --sso/);
|
|
assert.equal(r.stdout, '');
|
|
assert.doesNotMatch(r.stderr, /fixture-q284-missing-config/);
|
|
}
|
|
});
|
|
|
|
test('read-only preview can still bind without any human writer', async () => {
|
|
const web = await startServer({ port: 0, preview });
|
|
await new Promise(resolve => web.close(resolve));
|
|
});
|
|
|
|
test('service renderer cannot produce a header-preview human-writer unit', () => {
|
|
const r = spawnSync(service.pathname, ['render', '--public-host', preview.host, '--auth-header', preview.header, '--allow-user', preview.user, '--send'], { env: { PATH: '/usr/bin:/bin', HOME: '/fixture-q284-no-home' }, encoding: 'utf8', timeout: 5000 });
|
|
assert.equal(r.error, undefined);
|
|
assert.equal(r.status, 1);
|
|
assert.match(r.stderr, /--send needs --sso/);
|
|
assert.equal(r.stdout, '');
|
|
});
|