40 lines
2.2 KiB
JavaScript
40 lines
2.2 KiB
JavaScript
import { test } from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
const secret = 'sk-test-NOT-A-SECRET-1234';
|
|
// JSON.parse quotes a prefix near this fault on Node 26; check partial leaks too.
|
|
function safe(label, ErrorType, properties = {}) {
|
|
return error => {
|
|
assert.ok(error instanceof ErrorType);
|
|
for (const [key, value] of Object.entries(properties)) assert.equal(error[key], value);
|
|
assert.ok(error.message.includes(label), error.message);
|
|
assert.doesNotMatch(error.message, /sk-test|Unexpected token/);
|
|
assert.doesNotMatch(error.stack, /sk-test/);
|
|
assert.equal(error.cause, undefined);
|
|
return true;
|
|
};
|
|
}
|
|
import { BusinessError } from '../src/errors.mjs';
|
|
import { requireId, requirePositiveInt, requireDate } from '../src/util.mjs';
|
|
import { checkAccess } from '../src/access.mjs';
|
|
for (const [field, check, value] of [
|
|
['id', requireId, secret], ['revision', requirePositiveInt, secret], ['rotateBy', requireDate, secret],
|
|
// Arbitrary sentinel bytes cannot pass the date-shape check to reach this branch.
|
|
['rotateBy', requireDate, '2026-02-30'],
|
|
]) test(`${field} rejects ${check.name} input without its value`, () => {
|
|
assert.throws(() => check(value, field), error => {
|
|
safe(field, BusinessError, { exitCode: 2 })(error);
|
|
assert.ok(!error.message.includes(value), error.message);
|
|
return true;
|
|
});
|
|
});
|
|
function access() { return { accessVersion: 1, revision: 1, users: [{ id: 'bean', home: 'local', subjects: [{ provider: 'test', sub: 'user' }] }], grants: [{ id: 'grant', user: 'bean', business: 'acme', projects: ['*'], instances: ['coder'], level: 'viewer' }] }; }
|
|
const context = { providers: ['test'], peers: [], businesses: { acme: { human: 'jason', instances: ['coder'] } }, ssoSubjects: [] };
|
|
for (const [field, value] of [['expires', secret], ['expires', '2026-02-30T00:00:00Z'], ['instances', [secret]]]) test(`grant ${field} refusal omits its value ${JSON.stringify(value)}`, () => {
|
|
const doc = access(); doc.grants[0][field] = value;
|
|
assert.throws(() => checkAccess(doc, context), error => {
|
|
safe(`grants[0].${field}`, BusinessError, { exitCode: 2 })(error);
|
|
assert.ok(!error.message.includes(Array.isArray(value) ? value[0] : value), error.message);
|
|
return true;
|
|
});
|
|
});
|