Your Name
b0f5d6a51c
Split platform admin and ops APIs into standalone admin-server.mjs with network guards; simplify billing to RMB token pricing, refactor user auth, and add rsync deploy plus local-test scripts and docs. Co-authored-by: Cursor <cursoragent@cursor.com>
68 lines
2.4 KiB
JavaScript
68 lines
2.4 KiB
JavaScript
import test from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import {
|
|
parseList,
|
|
hostAllowed,
|
|
ipMatches,
|
|
ipAllowed,
|
|
buildNetworkGuard,
|
|
} from './admin-guard.mjs';
|
|
|
|
test('parseList splits, trims, and drops empties', () => {
|
|
assert.deepEqual(parseList('a, b ,,c'), ['a', 'b', 'c']);
|
|
assert.deepEqual(parseList(''), []);
|
|
assert.deepEqual(parseList(undefined), []);
|
|
});
|
|
|
|
test('hostAllowed: empty list allows all, otherwise matches hostname ignoring port/case', () => {
|
|
assert.equal(hostAllowed('gadm.tkmind.cn:8082', []), true);
|
|
assert.equal(hostAllowed('GADM.tkmind.cn', ['gadm.tkmind.cn']), true);
|
|
assert.equal(hostAllowed('evil.example.com', ['gadm.tkmind.cn']), false);
|
|
assert.equal(hostAllowed('gadm.tkmind.cn:443', ['gadm.tkmind.cn', 'localhost']), true);
|
|
});
|
|
|
|
test('ipMatches: exact and IPv4-mapped IPv6', () => {
|
|
assert.equal(ipMatches('127.0.0.1', '127.0.0.1'), true);
|
|
assert.equal(ipMatches('::ffff:127.0.0.1', '127.0.0.1'), true);
|
|
assert.equal(ipMatches('10.0.0.5', '10.0.0.6'), false);
|
|
});
|
|
|
|
test('ipMatches: CIDR ranges', () => {
|
|
assert.equal(ipMatches('10.1.2.3', '10.0.0.0/8'), true);
|
|
assert.equal(ipMatches('11.1.2.3', '10.0.0.0/8'), false);
|
|
assert.equal(ipMatches('192.168.1.50', '192.168.1.0/24'), true);
|
|
assert.equal(ipMatches('192.168.2.50', '192.168.1.0/24'), false);
|
|
assert.equal(ipMatches('203.0.113.9', '0.0.0.0/0'), true);
|
|
assert.equal(ipMatches('not-an-ip', '10.0.0.0/8'), false);
|
|
});
|
|
|
|
test('ipAllowed: empty list allows all', () => {
|
|
assert.equal(ipAllowed('1.2.3.4', []), true);
|
|
assert.equal(ipAllowed('1.2.3.4', ['10.0.0.0/8']), false);
|
|
assert.equal(ipAllowed('10.9.9.9', ['10.0.0.0/8', '127.0.0.1']), true);
|
|
});
|
|
|
|
test('buildNetworkGuard returns null when nothing configured', () => {
|
|
assert.equal(buildNetworkGuard({ onDeny: () => {} }), null);
|
|
});
|
|
|
|
test('buildNetworkGuard denies on host then ip, allows when both pass', () => {
|
|
const guard = buildNetworkGuard({
|
|
allowedHosts: ['gadm.tkmind.cn'],
|
|
ipAllowlist: ['10.0.0.0/8'],
|
|
onDeny: (_res, _req, reason) => `deny:${reason}`,
|
|
});
|
|
const mk = (host, ip) => ({ get: () => host, ip });
|
|
|
|
let nexted = false;
|
|
const next = () => {
|
|
nexted = true;
|
|
};
|
|
|
|
assert.equal(guard(mk('evil.com', '10.1.1.1'), {}, next), 'deny:host');
|
|
assert.equal(guard(mk('gadm.tkmind.cn', '8.8.8.8'), {}, next), 'deny:ip');
|
|
assert.equal(nexted, false);
|
|
guard(mk('gadm.tkmind.cn', '10.1.1.1'), {}, next);
|
|
assert.equal(nexted, true);
|
|
});
|