68 lines
2.6 KiB
JavaScript
68 lines
2.6 KiB
JavaScript
import { mkdtempSync, rmSync } from 'node:fs';
|
|
import { tmpdir } from 'node:os';
|
|
import { join } from 'node:path';
|
|
import test from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
|
|
test('login persists authentication and skips the login page on later visits', async () => {
|
|
const testDirectory = mkdtempSync(join(tmpdir(), 'local-kanban-auth-'));
|
|
const token = 'test-only-auth-token';
|
|
process.env.KANBAN_CONFIG = join(testDirectory, 'config.json');
|
|
process.env.KANBAN_STATE = join(testDirectory, 'state.json');
|
|
process.env.KANBAN_AUTH_TOKEN = token;
|
|
process.env.KANBAN_AUTH_SECURE_COOKIE = '1';
|
|
process.env.KANBAN_REQUIRE_HTTPS = '0';
|
|
|
|
const { createKanbanServer } = await import(`../src/server.js?auth-test=${Date.now()}`);
|
|
const server = createKanbanServer();
|
|
|
|
try {
|
|
await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
|
|
const { port } = server.address();
|
|
const origin = `http://127.0.0.1:${port}`;
|
|
|
|
const initialLoginPage = await fetch(`${origin}/login`, { redirect: 'manual' });
|
|
assert.equal(initialLoginPage.status, 200);
|
|
|
|
const rejectedLogin = await fetch(`${origin}/api/auth/login`, {
|
|
method: 'POST',
|
|
headers: { 'content-type': 'application/json' },
|
|
body: JSON.stringify({ token: 'wrong-token' })
|
|
});
|
|
assert.equal(rejectedLogin.status, 401);
|
|
assert.equal(rejectedLogin.headers.get('set-cookie'), null);
|
|
|
|
const loginResponse = await fetch(`${origin}/api/auth/login`, {
|
|
method: 'POST',
|
|
headers: { 'content-type': 'application/json' },
|
|
body: JSON.stringify({ token })
|
|
});
|
|
assert.equal(loginResponse.status, 200);
|
|
|
|
const setCookie = loginResponse.headers.get('set-cookie');
|
|
assert.match(setCookie, /^kanban_session=[^;]+;/);
|
|
const cookie = setCookie.split(';', 1)[0];
|
|
|
|
const laterLoginPage = await fetch(`${origin}/login`, {
|
|
headers: { cookie },
|
|
redirect: 'manual'
|
|
});
|
|
assert.equal(laterLoginPage.status, 302);
|
|
assert.equal(laterLoginPage.headers.get('location'), '/');
|
|
assert.match(setCookie, /Max-Age=31536000/);
|
|
assert.match(setCookie, /HttpOnly/);
|
|
assert.match(setCookie, /Secure/);
|
|
|
|
const logoutResponse = await fetch(`${origin}/api/auth/logout`, {
|
|
method: 'POST',
|
|
headers: { cookie }
|
|
});
|
|
assert.equal(logoutResponse.status, 200);
|
|
assert.match(logoutResponse.headers.get('set-cookie'), /^kanban_session=;/);
|
|
assert.match(logoutResponse.headers.get('set-cookie'), /Max-Age=0/);
|
|
} finally {
|
|
await new Promise((resolve) => server.close(resolve));
|
|
rmSync(testDirectory, { recursive: true, force: true });
|
|
}
|
|
});
|