Matthias Giesselmann
b90ff252d1
Public archive with sidebar navigation, project pages, month archive, search and entry pages with image blocks. Admin area for brands, projects, post types, users, api clients, media and the entry editor with drag and drop images, preview per audience, scheduling and publish checks. Read and write API with bearer tokens, audience scoping, idempotent creation, OpenAPI document and editorial guide. Magic link login with configurable allowed domains, whole app behind the session gate. 456 tests including design rule checks.
50 lines
1.5 KiB
TypeScript
50 lines
1.5 KiB
TypeScript
import { describe, expect, it } from 'vitest'
|
|
import { db } from '~/data/db'
|
|
import { apiClients } from '~/data/schema'
|
|
import { hashToken, resolveClient } from '~/lib/api-auth'
|
|
|
|
async function seedClient(token: string, revoked = false) {
|
|
const [client] = await db.insert(apiClients).values({
|
|
name: 'Trakk Leseclient',
|
|
tokenHash: hashToken(token),
|
|
mode: 'read',
|
|
scope: 'internal',
|
|
revokedAt: revoked ? new Date() : null,
|
|
}).returning()
|
|
return client!
|
|
}
|
|
|
|
describe('resolveClient', () => {
|
|
it('findet den Client zu einem gültigen Bearer-Token', async () => {
|
|
const client = await seedClient('lb_live_abc')
|
|
const request = new Request('http://localhost/api/v1/posts', {
|
|
headers: { authorization: 'Bearer lb_live_abc' },
|
|
})
|
|
|
|
await expect(resolveClient(request)).resolves.toMatchObject({ id: client.id })
|
|
})
|
|
|
|
it('liefert nichts ohne Kopfzeile', async () => {
|
|
await seedClient('lb_live_abc')
|
|
const request = new Request('http://localhost/api/v1/posts')
|
|
|
|
await expect(resolveClient(request)).resolves.toBeUndefined()
|
|
})
|
|
|
|
it('liefert nichts für ein widerrufenes Token', async () => {
|
|
await seedClient('lb_live_abc', true)
|
|
const request = new Request('http://localhost/api/v1/posts', {
|
|
headers: { authorization: 'Bearer lb_live_abc' },
|
|
})
|
|
|
|
await expect(resolveClient(request)).resolves.toBeUndefined()
|
|
})
|
|
|
|
it('speichert das Token niemals im Klartext', async () => {
|
|
await seedClient('lb_live_abc')
|
|
const rows = await db.select().from(apiClients)
|
|
|
|
expect(rows[0]!.tokenHash).not.toContain('lb_live_abc')
|
|
})
|
|
})
|