john
75 lines
2.9 KiB
JavaScript
75 lines
2.9 KiB
JavaScript
import assert from 'node:assert/strict';
|
|
import test from 'node:test';
|
|
import {
|
|
appendPublicAssetTokens,
|
|
normalizePublicAssetReferences,
|
|
preparePublicHtmlAssetDelivery,
|
|
publicAssetToken,
|
|
stripPublicHtmlBaseTag,
|
|
verifyPublicAssetToken,
|
|
} from './mindspace-public-asset-token.mjs';
|
|
|
|
const SECRET = 'internal-agent-secret-for-tests';
|
|
|
|
test('public asset token round-trips for the matching asset id', () => {
|
|
const token = publicAssetToken('asset-1', SECRET);
|
|
assert.equal(verifyPublicAssetToken('asset-1', token, SECRET), true);
|
|
assert.equal(verifyPublicAssetToken('asset-2', token, SECRET), false);
|
|
});
|
|
|
|
test('appendPublicAssetTokens signs public asset download urls without clobbering existing query params', () => {
|
|
const html = [
|
|
'<img src="/api/mindspace/v1/assets/asset-1/download?inline=1&v=2">',
|
|
'<img src="https://m.tkmind.cn/api/mindspace/v1/assets/asset-2/download?inline=1&v=3">',
|
|
].join('');
|
|
|
|
const signed = appendPublicAssetTokens(html, SECRET);
|
|
|
|
assert.match(
|
|
signed,
|
|
/asset-1\/download\?inline=1&v=2&public_token=[A-Za-z0-9_-]+/,
|
|
);
|
|
assert.match(
|
|
signed,
|
|
/asset-2\/download\?inline=1&v=3&public_token=[A-Za-z0-9_-]+/,
|
|
);
|
|
});
|
|
|
|
test('appendPublicAssetTokens preserves existing public tokens', () => {
|
|
const html = '<img src="/api/mindspace/v1/assets/asset-1/download?inline=1&public_token=keep-me">';
|
|
assert.equal(appendPublicAssetTokens(html, SECRET), html);
|
|
});
|
|
|
|
test('normalizePublicAssetReferences rewrites absolute asset urls to same-origin paths', () => {
|
|
const html = [
|
|
'<img src="https://m.tkmind.cn/api/mindspace/v1/assets/asset-1/download?inline=1">',
|
|
'<img src="http://127.0.0.1:5173/api/mindspace/v1/assets/asset-2/download?inline=1&v=3">',
|
|
'<meta property="og:image" content="https://m.tkmind.cn/api/mindspace/v1/assets/asset-3/download?inline=1">',
|
|
].join('');
|
|
|
|
const normalized = normalizePublicAssetReferences(html);
|
|
|
|
assert.match(normalized, /src="\/api\/mindspace\/v1\/assets\/asset-1\/download\?inline=1"/);
|
|
assert.match(normalized, /src="\/api\/mindspace\/v1\/assets\/asset-2\/download\?inline=1&v=3"/);
|
|
assert.match(
|
|
normalized,
|
|
/content="\/api\/mindspace\/v1\/assets\/asset-3\/download\?inline=1"/,
|
|
);
|
|
});
|
|
|
|
test('stripPublicHtmlBaseTag removes base tags blocked by public page CSP', () => {
|
|
const html = '<head><base href="/"><title>demo</title></head>';
|
|
assert.equal(stripPublicHtmlBaseTag(html), '<head><title>demo</title></head>');
|
|
});
|
|
|
|
test('preparePublicHtmlAssetDelivery normalizes asset urls before signing', () => {
|
|
const html = '<head><base href="/"></head><img src="https://m.tkmind.cn/api/mindspace/v1/assets/asset-1/download?inline=1">';
|
|
const prepared = preparePublicHtmlAssetDelivery(html, SECRET);
|
|
|
|
assert.doesNotMatch(prepared, /<base\b/i);
|
|
assert.match(
|
|
prepared,
|
|
/src="\/api\/mindspace\/v1\/assets\/asset-1\/download\?inline=1&public_token=[A-Za-z0-9_-]+"/,
|
|
);
|
|
});
|