39 lines
1.5 KiB
JavaScript
39 lines
1.5 KiB
JavaScript
// @vitest-environment jsdom
|
|
import { describe, expect, it } from "vitest";
|
|
|
|
import {
|
|
sanitizeBrokerAuthMode,
|
|
validatePublicBrokerUrl,
|
|
} from "@/features/edgeGateways/edgeGatewayBrokerConfigSecurity.js";
|
|
|
|
describe("edge gateway broker config security", () => {
|
|
it("rejects attacker-controlled public broker origins and non-TLS schemes", () => {
|
|
expect(validatePublicBrokerUrl("wss://evil.example/ws")).toMatchObject({
|
|
ok: false,
|
|
message: "Public broker URL origin is not approved for browser edge gateway sessions.",
|
|
});
|
|
expect(validatePublicBrokerUrl("http://localhost:4300/ws")).toMatchObject({
|
|
ok: false,
|
|
message: "Public broker URL must use HTTPS or WSS.",
|
|
});
|
|
});
|
|
|
|
it("allows blank, same-origin, or production edge broker TLS public broker URLs", () => {
|
|
expect(validatePublicBrokerUrl("")).toEqual({ ok: true, value: "" });
|
|
expect(validatePublicBrokerUrl(`wss://${window.location.host}/edge-broker`)).toEqual({
|
|
ok: true,
|
|
value: `wss://${window.location.host}/edge-broker`,
|
|
});
|
|
expect(validatePublicBrokerUrl("https://api.truckwash.io:4433/edge-broker")).toEqual({
|
|
ok: true,
|
|
value: "https://api.truckwash.io:4433/edge-broker",
|
|
});
|
|
});
|
|
|
|
it("keeps manager auth mode unchanged and only allows stub in gated test/dev builds", () => {
|
|
expect(sanitizeBrokerAuthMode("manager")).toBe("manager");
|
|
expect(sanitizeBrokerAuthMode("unexpected")).toBe("manager");
|
|
expect(sanitizeBrokerAuthMode("stub")).toBe("stub");
|
|
});
|
|
});
|