john
47 lines
1.5 KiB
JavaScript
47 lines
1.5 KiB
JavaScript
import assert from 'node:assert/strict';
|
|
import test from 'node:test';
|
|
|
|
import {
|
|
assertNonProductionTarget,
|
|
assertSafeGateEnvironment,
|
|
assertSafePortalBase,
|
|
isProductionTarget,
|
|
} from './safety.mjs';
|
|
|
|
test('production IP, public domains, and production paths are refused', () => {
|
|
for (const target of [
|
|
'58.38.22.103',
|
|
'ssh://58.38.22.103',
|
|
'https://m.tkmind.cn',
|
|
'https://plaza.tkmind.cn/page',
|
|
'/Users/john/Project/Memind',
|
|
]) {
|
|
assert.equal(isProductionTarget(target), true, target);
|
|
assert.throws(() => assertNonProductionTarget(target), /refused production/);
|
|
}
|
|
});
|
|
|
|
test('scenario Portal target must be loopback', () => {
|
|
assert.equal(assertSafePortalBase('http://127.0.0.1:8081'), 'http://127.0.0.1:8081');
|
|
assert.equal(assertSafePortalBase('http://localhost:9000/'), 'http://localhost:9000');
|
|
assert.throws(() => assertSafePortalBase('http://192.168.1.9:8081'), /isolated loopback/);
|
|
assert.throws(() => assertSafePortalBase('https://m.tkmind.cn'), /production/);
|
|
});
|
|
|
|
test('unsafe environment keys are reported without exposing values', () => {
|
|
assert.throws(
|
|
() => assertSafeGateEnvironment({
|
|
env: {
|
|
DATABASE_URL: 'postgres://secret@58.38.22.103/prod',
|
|
STUDIO_HOST: '58.38.22.103',
|
|
},
|
|
}),
|
|
(error) => {
|
|
assert.match(error.message, /DATABASE_URL/);
|
|
assert.match(error.message, /STUDIO_HOST/);
|
|
assert.doesNotMatch(error.message, /secret/);
|
|
return true;
|
|
},
|
|
);
|
|
});
|