mirror of
https://github.com/stablyai/orca.git
synced 2026-11-15 18:37:24 +00:00
OrcaWinandOrcaWin
41c301bb6a
* test: remove low-value push and relay coverage * test: delete orphaned fixture and closure support * test: trim runner and mobile recording matrices --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
73 lines
3.2 KiB
TypeScript
73 lines
3.2 KiB
TypeScript
import { createHash, randomBytes } from 'node:crypto'
|
|
import { SignJWT } from 'jose'
|
|
import { describe, expect, it } from 'vitest'
|
|
import { verifyAdminRequest, verifyWith, type AdminOp } from '../src/admin'
|
|
import type { Env } from '../src/env'
|
|
|
|
const KEY = randomBytes(36).toString('base64url')
|
|
const NEXT = randomBytes(36).toString('base64url')
|
|
const ERASE = randomBytes(36).toString('base64url')
|
|
const ISSUER = 'https://director.test.invalid'
|
|
const ERASER = 'https://erasure.test.invalid'
|
|
const BODY = JSON.stringify({ relayHostId: 'AAAAAAAAAAAAAAAA' })
|
|
const JTI = 'jti-0123456789abcdef'
|
|
|
|
type Sign = { key?: string; issuer?: string; op?: AdminOp; jti?: unknown; body?: string }
|
|
|
|
async function sign(opts: Sign = {}): Promise<string> {
|
|
const claims: Record<string, unknown> = {
|
|
purpose: 'edge-admin',
|
|
op: opts.op ?? 'drain',
|
|
bodySha256: createHash('sha256').update(opts.body ?? BODY).digest('base64url')
|
|
}
|
|
if (opts.jti !== undefined) { claims.jti = opts.jti }
|
|
const now = Math.floor(Date.now() / 1000)
|
|
return new SignJWT(claims)
|
|
.setProtectedHeader({ alg: 'HS256' })
|
|
.setIssuer(opts.issuer ?? ISSUER)
|
|
.setAudience('orca-relay-edge-admin')
|
|
.setIssuedAt(now)
|
|
.setExpirationTime(now + 60)
|
|
.sign(new TextEncoder().encode(opts.key ?? KEY))
|
|
}
|
|
|
|
const raw = (body = BODY) => new TextEncoder().encode(body).buffer as ArrayBuffer
|
|
|
|
function request(token: string, body = BODY): Request {
|
|
return new Request('https://edge.test/__admin/drain', {
|
|
method: 'POST',
|
|
headers: { authorization: `Bearer ${token}`, 'content-length': String(new TextEncoder().encode(body).byteLength) },
|
|
body
|
|
})
|
|
}
|
|
|
|
const baseEnv = { ADMIN_SIGNING_KEY: KEY, ADMIN_ISSUER: ISSUER } as Env
|
|
|
|
describe('admin token verify (jti)', () => {
|
|
|
|
it('binds the operation and exact body', async () => {
|
|
expect(await verifyWith(await sign({ jti: JTI, op: 'erase' }), KEY, ISSUER, 'drain', raw())).toBeNull()
|
|
expect(await verifyWith(await sign({ jti: JTI, body: '{}' }), KEY, ISSUER, 'drain', raw())).toBeNull()
|
|
})
|
|
})
|
|
|
|
describe('admin request verify (keys)', () => {
|
|
|
|
it('accepts the primary key and only a configured NEXT key', async () => {
|
|
const env = { ...baseEnv, ADMIN_SIGNING_KEY_NEXT: NEXT } as Env
|
|
expect(await verifyAdminRequest(env, request(await sign({ jti: JTI })), 'drain')).not.toBeNull()
|
|
expect(await verifyAdminRequest(env, request(await sign({ jti: JTI, key: NEXT })), 'drain')).not.toBeNull()
|
|
expect(await verifyAdminRequest(baseEnv, request(await sign({ jti: JTI, key: NEXT })), 'drain')).toBeNull()
|
|
})
|
|
|
|
it('the erasure keys (primary or NEXT) verify only erase, under their own issuer', async () => {
|
|
const next = randomBytes(36).toString('base64url')
|
|
const env = { ...baseEnv, ERASE_SIGNING_KEY: ERASE, ERASE_SIGNING_KEY_NEXT: next, ERASE_ISSUER: ERASER } as Env
|
|
for (const key of [ERASE, next]) {
|
|
expect(await verifyAdminRequest(env, request(await sign({ key, issuer: ERASER, op: 'erase' })), 'erase')).not.toBeNull()
|
|
expect(await verifyAdminRequest(env, request(await sign({ key, issuer: ERASER })), 'drain')).toBeNull()
|
|
expect(await verifyAdminRequest(env, request(await sign({ key, op: 'erase' })), 'erase')).toBeNull()
|
|
}
|
|
})
|
|
})
|