61 lines
2.2 KiB
TypeScript
61 lines
2.2 KiB
TypeScript
import { expect, test } from "@playwright/test";
|
|
import {
|
|
generateAccessKey,
|
|
getAccessKeyPrefix,
|
|
hashAccessKey,
|
|
parseBearerAccessKey,
|
|
} from "@/lib/access-keys/token";
|
|
import {
|
|
parseProvisioningBearerSecret,
|
|
verifyProvisioningSecret,
|
|
} from "@/lib/access-keys/provisioning-secret";
|
|
|
|
test.describe("OpenAPI Access Key token helpers", () => {
|
|
test("generates a parseable token without exposing its secret in the prefix", () => {
|
|
const generated = generateAccessKey();
|
|
|
|
expect(generated.token).toMatch(
|
|
/^ydr_live_[a-f0-9]{12}_[A-Za-z0-9_-]{40,}$/
|
|
);
|
|
expect(getAccessKeyPrefix(generated.token)).toBe(generated.tokenPrefix);
|
|
expect(generated.tokenPrefix).not.toContain(generated.token.split("_").at(-1));
|
|
});
|
|
|
|
test("parses only valid Bearer Access Keys", () => {
|
|
const { token } = generateAccessKey();
|
|
|
|
expect(parseBearerAccessKey(`Bearer ${token}`)).toBe(token);
|
|
expect(parseBearerAccessKey(`bearer ${token}`)).toBe(token);
|
|
expect(parseBearerAccessKey(token)).toBeNull();
|
|
expect(parseBearerAccessKey("Bearer invalid")).toBeNull();
|
|
});
|
|
|
|
test("hashes deterministically with a server-side pepper", () => {
|
|
const { token } = generateAccessKey();
|
|
|
|
expect(hashAccessKey(token, "pepper-a")).toBe(
|
|
hashAccessKey(token, "pepper-a")
|
|
);
|
|
expect(hashAccessKey(token, "pepper-a")).not.toBe(
|
|
hashAccessKey(token, "pepper-b")
|
|
);
|
|
});
|
|
});
|
|
|
|
test.describe("third-party provisioning secret helpers", () => {
|
|
const secret = "provisioning-secret-that-is-at-least-32-characters";
|
|
|
|
test("parses a strict Bearer credential", () => {
|
|
expect(parseProvisioningBearerSecret(`Bearer ${secret}`)).toBe(secret);
|
|
expect(parseProvisioningBearerSecret(`bearer ${secret}`)).toBe(secret);
|
|
expect(parseProvisioningBearerSecret(secret)).toBeNull();
|
|
expect(parseProvisioningBearerSecret("Bearer two values")).toBeNull();
|
|
});
|
|
|
|
test("compares provisioning secrets and rejects short configuration", () => {
|
|
expect(verifyProvisioningSecret(secret, secret)).toBe(true);
|
|
expect(verifyProvisioningSecret(`${secret}-wrong`, secret)).toBe(false);
|
|
expect(verifyProvisioningSecret("short", "short")).toBe(false);
|
|
});
|
|
});
|