78 lines
2.6 KiB
TypeScript
78 lines
2.6 KiB
TypeScript
import { describe, it, expect, vi, beforeEach } from 'vitest'
|
|
|
|
const { mockUnsealData } = vi.hoisted(() => ({
|
|
mockUnsealData: vi.fn(),
|
|
}))
|
|
|
|
vi.mock('iron-session', () => ({
|
|
unsealData: mockUnsealData,
|
|
}))
|
|
|
|
vi.mock('@/lib/session', () => ({
|
|
sessionOptions: { cookieName: 'scrum4me-session', password: 'test-secret' },
|
|
}))
|
|
|
|
import { NextRequest } from 'next/server'
|
|
import { proxy } from '@/proxy'
|
|
|
|
const COOKIE_NAME = 'scrum4me-session'
|
|
const RAW_COOKIE = 'sealed-cookie-value'
|
|
|
|
function makeRequest(method: string, path: string, withCookie = false): NextRequest {
|
|
const url = `http://localhost:3000${path}`
|
|
const headers = new Headers()
|
|
if (withCookie) headers.set('Cookie', `${COOKIE_NAME}=${RAW_COOKIE}`)
|
|
return new NextRequest(url, { method, headers })
|
|
}
|
|
|
|
beforeEach(() => {
|
|
vi.clearAllMocks()
|
|
})
|
|
|
|
describe('proxy demo-guard', () => {
|
|
it('demo + POST /api/todos → 403', async () => {
|
|
mockUnsealData.mockResolvedValue({ userId: 'demo-user', isDemo: true })
|
|
const req = makeRequest('POST', '/api/todos', true)
|
|
const res = await proxy(req)
|
|
expect(res?.status).toBe(403)
|
|
const body = await res?.json()
|
|
expect(body.error).toMatch(/demo-modus/i)
|
|
})
|
|
|
|
it('demo + GET /api/todos → passthrough (GET is veilig)', async () => {
|
|
const req = makeRequest('GET', '/api/todos', true)
|
|
const res = await proxy(req)
|
|
// NextResponse.next() heeft geen status 403
|
|
expect(res?.status).not.toBe(403)
|
|
// unsealData nooit aangeroepen voor GET
|
|
expect(mockUnsealData).not.toHaveBeenCalled()
|
|
})
|
|
|
|
it('non-demo + POST /api/todos → passthrough', async () => {
|
|
mockUnsealData.mockResolvedValue({ userId: 'real-user', isDemo: false })
|
|
const req = makeRequest('POST', '/api/todos', true)
|
|
const res = await proxy(req)
|
|
expect(res?.status).not.toBe(403)
|
|
})
|
|
|
|
it('geen cookie + POST /api/todos → passthrough (geen sessie = niet geblokkeerd)', async () => {
|
|
const req = makeRequest('POST', '/api/todos', false)
|
|
const res = await proxy(req)
|
|
expect(mockUnsealData).not.toHaveBeenCalled()
|
|
expect(res?.status).not.toBe(403)
|
|
})
|
|
|
|
it('demo + POST /api/cron/expire-questions → passthrough (cron in allowlist)', async () => {
|
|
const req = makeRequest('POST', '/api/cron/expire-questions', true)
|
|
const res = await proxy(req)
|
|
expect(mockUnsealData).not.toHaveBeenCalled()
|
|
expect(res?.status).not.toBe(403)
|
|
})
|
|
|
|
it('demo + POST /api/auth/pair/start → 403 (M11-keuze: blokken)', async () => {
|
|
mockUnsealData.mockResolvedValue({ userId: 'demo-user', isDemo: true })
|
|
const req = makeRequest('POST', '/api/auth/pair/start', true)
|
|
const res = await proxy(req)
|
|
expect(res?.status).toBe(403)
|
|
})
|
|
})
|