mirror of
https://github.com/stablyai/orca.git
synced 2026-11-13 09:27:29 +00:00
OrcaWinandOrcaWin
88aa9fa82a
* test: remove 155 low-value tests and two relay checkpoints * test: retain schema drift protection and remove dead imports --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
78 lines
3.6 KiB
TypeScript
78 lines
3.6 KiB
TypeScript
import { createHash, randomBytes } from 'node:crypto'
|
|
import { SignJWT } from 'jose'
|
|
import { describe, expect, it } from 'vitest'
|
|
import { verifyAdminRequest, verifyWith, type AdminOp } from '../src/admin'
|
|
import type { Env } from '../src/env'
|
|
|
|
const KEY = randomBytes(36).toString('base64url')
|
|
const NEXT = randomBytes(36).toString('base64url')
|
|
const ERASE = randomBytes(36).toString('base64url')
|
|
const ISSUER = 'https://director.test.invalid'
|
|
const ERASER = 'https://erasure.test.invalid'
|
|
const BODY = JSON.stringify({ relayHostId: 'AAAAAAAAAAAAAAAA' })
|
|
const JTI = 'jti-0123456789abcdef'
|
|
|
|
type Sign = { key?: string; issuer?: string; op?: AdminOp; jti?: unknown; body?: string; iat?: number; exp?: number }
|
|
|
|
async function sign(opts: Sign = {}): Promise<string> {
|
|
const claims: Record<string, unknown> = {
|
|
purpose: 'edge-admin',
|
|
op: opts.op ?? 'drain',
|
|
bodySha256: createHash('sha256').update(opts.body ?? BODY).digest('base64url')
|
|
}
|
|
if (opts.jti !== undefined) { claims.jti = opts.jti }
|
|
const now = Math.floor(Date.now() / 1000)
|
|
return new SignJWT(claims)
|
|
.setProtectedHeader({ alg: 'HS256' })
|
|
.setIssuer(opts.issuer ?? ISSUER)
|
|
.setAudience('orca-relay-edge-admin')
|
|
.setIssuedAt(opts.iat ?? now)
|
|
.setExpirationTime(opts.exp ?? now + 60)
|
|
.sign(new TextEncoder().encode(opts.key ?? KEY))
|
|
}
|
|
|
|
const raw = (body = BODY) => new TextEncoder().encode(body).buffer as ArrayBuffer
|
|
|
|
function request(token: string, body = BODY): Request {
|
|
return new Request('https://edge.test/__admin/drain', {
|
|
method: 'POST',
|
|
headers: { authorization: `Bearer ${token}`, 'content-length': String(new TextEncoder().encode(body).byteLength) },
|
|
body
|
|
})
|
|
}
|
|
|
|
const baseEnv = { ADMIN_SIGNING_KEY: KEY, ADMIN_ISSUER: ISSUER } as Env
|
|
|
|
describe('admin token verify (jti)', () => {
|
|
|
|
it('still binds op, body, key and age', async () => {
|
|
const now = Math.floor(Date.now() / 1000)
|
|
expect(await verifyWith(await sign({ jti: JTI, op: 'erase' }), KEY, ISSUER, 'drain', raw())).toBeNull()
|
|
expect(await verifyWith(await sign({ jti: JTI, body: '{}' }), KEY, ISSUER, 'drain', raw())).toBeNull()
|
|
expect(await verifyWith(await sign({ jti: JTI, key: NEXT }), KEY, ISSUER, 'drain', raw())).toBeNull()
|
|
expect(await verifyWith(await sign({ jti: JTI, iat: now - 180, exp: now + 60 }), KEY, ISSUER, 'drain', raw())).toBeNull()
|
|
})
|
|
})
|
|
|
|
describe('admin request verify (keys)', () => {
|
|
|
|
it('accepts the primary or the NEXT key, nothing else', async () => {
|
|
const env = { ...baseEnv, ADMIN_SIGNING_KEY_NEXT: NEXT } as Env
|
|
expect(await verifyAdminRequest(env, request(await sign({ jti: JTI })), 'drain')).not.toBeNull()
|
|
expect(await verifyAdminRequest(env, request(await sign({ jti: JTI, key: NEXT })), 'drain')).not.toBeNull()
|
|
expect(await verifyAdminRequest(baseEnv, request(await sign({ jti: JTI, key: NEXT })), 'drain')).toBeNull()
|
|
const wrong = randomBytes(36).toString('base64url')
|
|
expect(await verifyAdminRequest(env, request(await sign({ jti: JTI, key: wrong })), 'drain')).toBeNull()
|
|
})
|
|
|
|
it('the erasure keys (primary or NEXT) verify only erase, under their own issuer', async () => {
|
|
const next = randomBytes(36).toString('base64url')
|
|
const env = { ...baseEnv, ERASE_SIGNING_KEY: ERASE, ERASE_SIGNING_KEY_NEXT: next, ERASE_ISSUER: ERASER } as Env
|
|
for (const key of [ERASE, next]) {
|
|
expect(await verifyAdminRequest(env, request(await sign({ key, issuer: ERASER, op: 'erase' })), 'erase')).not.toBeNull()
|
|
expect(await verifyAdminRequest(env, request(await sign({ key, issuer: ERASER })), 'drain')).toBeNull()
|
|
expect(await verifyAdminRequest(env, request(await sign({ key, op: 'erase' })), 'erase')).toBeNull()
|
|
}
|
|
})
|
|
})
|