81 lines
2.9 KiB
TypeScript
81 lines
2.9 KiB
TypeScript
describe('module-pull-token', () => {
|
|
beforeEach(() => {
|
|
jest.resetModules();
|
|
jest.useFakeTimers();
|
|
jest.setSystemTime(new Date('2026-06-02T00:00:00.000Z'));
|
|
process.env.MODULE_PULL_TOKEN_SECRET = 'm'.repeat(32);
|
|
});
|
|
|
|
afterEach(() => {
|
|
jest.useRealTimers();
|
|
delete process.env.MODULE_PULL_TOKEN_SECRET;
|
|
});
|
|
|
|
it('应生成 15 分钟有效且绑定模块仓库的短期拉包凭证', async () => {
|
|
const { createModulePullCredential, verifyModulePullToken } = await import('../module-pull-token');
|
|
|
|
const { credential, payload } = createModulePullCredential({
|
|
projectCode: 'flnxi',
|
|
licenseId: 'license-1',
|
|
activationId: 'activation-1',
|
|
instanceId: 'instance-1',
|
|
moduleId: 'intranet-penetration-core',
|
|
registryHost: 'registry.test',
|
|
repository: 'flnxi/premium/intranet-penetration-core',
|
|
tag: '1.0.0',
|
|
digest: 'sha256:abc',
|
|
});
|
|
|
|
expect(credential.username).toBe('flnxi-module');
|
|
expect(credential.expiresAt).toBe('2026-06-02T00:15:00.000Z');
|
|
expect(payload.repository).toBe('flnxi/premium/intranet-penetration-core');
|
|
expect(verifyModulePullToken(credential.pullToken)).toEqual(
|
|
expect.objectContaining({
|
|
projectCode: 'flnxi',
|
|
moduleId: 'intranet-penetration-core',
|
|
repository: 'flnxi/premium/intranet-penetration-core',
|
|
digest: 'sha256:abc',
|
|
})
|
|
);
|
|
});
|
|
|
|
it('篡改 token 内容后应拒绝验证', async () => {
|
|
const { createModulePullCredential, verifyModulePullToken } = await import('../module-pull-token');
|
|
const { credential } = createModulePullCredential({
|
|
projectCode: 'flnxi',
|
|
licenseId: 'license-1',
|
|
activationId: 'activation-1',
|
|
instanceId: 'instance-1',
|
|
moduleId: 'intranet-penetration-core',
|
|
registryHost: 'registry.test',
|
|
repository: 'flnxi/premium/intranet-penetration-core',
|
|
tag: '1.0.0',
|
|
digest: null,
|
|
});
|
|
|
|
const [payload, signature] = credential.pullToken.split('.');
|
|
const decoded = JSON.parse(Buffer.from(payload + '==', 'base64url').toString('utf8'));
|
|
decoded.moduleId = 'custom-templates-core';
|
|
const tamperedPayload = Buffer.from(JSON.stringify(decoded), 'utf8').toString('base64url');
|
|
|
|
expect(verifyModulePullToken(`${tamperedPayload}.${signature}`)).toBeNull();
|
|
});
|
|
|
|
it('过期 token 应拒绝验证', async () => {
|
|
const { createModulePullCredential, verifyModulePullToken } = await import('../module-pull-token');
|
|
const { credential } = createModulePullCredential({
|
|
projectCode: 'flnxi',
|
|
licenseId: 'license-1',
|
|
activationId: 'activation-1',
|
|
instanceId: 'instance-1',
|
|
moduleId: 'intranet-penetration-core',
|
|
registryHost: 'registry.test',
|
|
repository: 'flnxi/premium/intranet-penetration-core',
|
|
tag: '1.0.0',
|
|
digest: null,
|
|
});
|
|
|
|
expect(verifyModulePullToken(credential.pullToken, new Date('2026-06-02T00:15:01.000Z'))).toBeNull();
|
|
});
|
|
});
|