Jesse_Chen
71 lines
3.0 KiB
TypeScript
71 lines
3.0 KiB
TypeScript
import assert from "node:assert/strict";
|
|
import { existsSync, readFileSync, readdirSync } from "node:fs";
|
|
import { extname, join } from "node:path";
|
|
import test from "node:test";
|
|
|
|
const root = new URL("../", import.meta.url);
|
|
|
|
function source(path: string) {
|
|
return readFileSync(new URL(path, root), "utf8");
|
|
}
|
|
|
|
function sourceFiles(path: string): string[] {
|
|
const directory = new URL(path, root);
|
|
return readdirSync(directory, { withFileTypes: true }).flatMap((entry) => {
|
|
const child = join(directory.pathname, entry.name);
|
|
if (entry.isDirectory()) {
|
|
return sourceFiles(`${path}/${entry.name}`);
|
|
}
|
|
return [".ts", ".tsx"].includes(extname(entry.name)) ? [child] : [];
|
|
});
|
|
}
|
|
|
|
test("operation-level admin email reauthentication is removed from routes and UI", () => {
|
|
assert.equal(existsSync(new URL("src/app/api/admin/reauth/route.ts", root)), false);
|
|
|
|
const adminSources = [
|
|
...sourceFiles("src/app/api/admin"),
|
|
...sourceFiles("src/components/admin"),
|
|
...sourceFiles("src/lib/admin"),
|
|
];
|
|
for (const file of adminSources) {
|
|
const contents = readFileSync(file, "utf8");
|
|
assert.doesNotMatch(
|
|
contents,
|
|
/requireHighRiskAdminMutation|reauthPermission|\/api\/admin\/reauth|HIGH_RISK_ADMIN|issueHighRisk|verifyHighRisk/,
|
|
file,
|
|
);
|
|
}
|
|
});
|
|
|
|
test("admin mutations retain session, permission, trusted-origin, server audit, request-id, and audit boundaries", () => {
|
|
const http = source("src/lib/admin/http.ts");
|
|
const codesRoute = source("src/app/api/admin/codes/route.ts");
|
|
const codesHelper = source("src/lib/admin/codes.ts");
|
|
const codesUi = source("src/components/admin/codes-resource.tsx");
|
|
assert.equal(existsSync(new URL("src/components/admin/confirm-action-modal.tsx", root)), false);
|
|
|
|
assert.match(http, /requirePermission\(permission, request\.headers\)/);
|
|
assert.match(http, /isTrustedAdminMutationRequest\(request, process\.env\.ADMIN_USER_ORIGIN\)/);
|
|
assert.match(codesRoute, /requireAdminMutation\([\s\S]*"admin\.access"/);
|
|
assert.doesNotMatch(codesRoute, /reason:\s*z\.string/);
|
|
assert.match(codesRoute, /p_reason:\s*"admin_console_create_redemption_codes"/);
|
|
assert.match(codesHelper, /JSON\.stringify\(input\.p_codes\)/);
|
|
assert.match(codesRoute, /requestId\(request\)/);
|
|
assert.match(codesRoute, /admin_create_redemption_codes/);
|
|
assert.match(codesUi, /permissions\.includes\("admin\.access"\)/);
|
|
assert.match(codesUi, /onFinish=\{\(values\) => void submitCreate\(values\)\}/);
|
|
assert.doesNotMatch(codesUi, /ConfirmActionModal|pendingCreate|pendingEdit|revokeRecord/);
|
|
});
|
|
|
|
test("account-level TOTP MFA and customer login email OTP remain available", () => {
|
|
const mfaRoute = source("src/app/api/admin/mfa/route.ts");
|
|
const mfaUi = source("src/components/admin/mfa-security.tsx");
|
|
const loginUi = source("src/components/email-otp-login.tsx");
|
|
|
|
assert.match(mfaRoute, /verifyTOTP|verifyBackupCode/);
|
|
assert.match(mfaUi, /认证器验证码/);
|
|
assert.match(loginUi, /邮箱验证码登录/);
|
|
assert.match(loginUi, /验证并登录/);
|
|
});
|