forked from dsh/panel-auth
101 lines
3.7 KiB
JavaScript
101 lines
3.7 KiB
JavaScript
// Throwaway verification of panel-auth against a server structured exactly
|
|
// like dsh-host-webserver: a createServer callback ('request') plus an
|
|
// 'upgrade' listener. Does not touch the running panel.
|
|
import { createServer } from 'node:http'
|
|
import { strict as assert } from 'node:assert'
|
|
import { createGuard, installGuard } from './index.js'
|
|
import { hashPassword, verifyPassword } from './crypto.js'
|
|
|
|
const cfg = {
|
|
users: [{ username: 'admin', passwordHash: hashPassword('s3cret-pass') }],
|
|
secret: 'unit-test-secret-0123456789abcdef',
|
|
realm: 'Test Realm',
|
|
cookieName: 'test_cookie',
|
|
cookieTtlSeconds: 3600,
|
|
}
|
|
const guard = createGuard({ getConfig: () => cfg, logger: null })
|
|
|
|
let upgradeCount = 0
|
|
const server = createServer((req, res) => {
|
|
res.statusCode = 200
|
|
res.setHeader('Content-Type', 'text/plain')
|
|
res.end('panel')
|
|
})
|
|
server.on('upgrade', (req, socket, head) => {
|
|
upgradeCount++
|
|
socket.end('HTTP/1.1 101 Switching Protocols\r\nUpgrade: test\r\nConnection: Upgrade\r\n\r\n')
|
|
})
|
|
|
|
const disposer = installGuard(server, guard, { logger: null })
|
|
await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve))
|
|
const base = `http://127.0.0.1:${server.address().port}`
|
|
|
|
const raw = (path, headers = {}) => fetch(base + path, { headers, redirect: 'manual' })
|
|
const upgrade = async (headers = []) => {
|
|
const net = await import('node:net')
|
|
const sock = net.connect(server.address().port, '127.0.0.1')
|
|
const response = await new Promise((resolve) => {
|
|
let buf = ''
|
|
sock.on('data', (d) => {
|
|
buf += d.toString()
|
|
if (buf.includes('\r\n\r\n')) resolve(buf)
|
|
})
|
|
const h = ['GET /api/events.mux HTTP/1.1', 'Host: 127.0.0.1', 'Connection: Upgrade', 'Upgrade: websocket', ...headers]
|
|
sock.write(h.join('\r\n') + '\r\n\r\n')
|
|
})
|
|
sock.destroy()
|
|
return response
|
|
}
|
|
|
|
// 1. anonymous → 401 + challenge
|
|
let r = await raw('/')
|
|
assert.equal(r.status, 401)
|
|
assert.match(r.headers.get('www-authenticate'), /^Basic realm="Test Realm"/)
|
|
|
|
// 2. wrong password → 401
|
|
r = await raw('/', { authorization: 'Basic ' + Buffer.from('admin:wrong').toString('base64') })
|
|
assert.equal(r.status, 401)
|
|
|
|
// 3. correct password → 200 + Set-Cookie
|
|
r = await raw('/', { authorization: 'Basic ' + Buffer.from('admin:s3cret-pass').toString('base64') })
|
|
assert.equal(r.status, 200)
|
|
assert.equal(await r.text(), 'panel')
|
|
const setCookie = r.headers.get('set-cookie')
|
|
assert.match(setCookie, /^test_cookie=.+; Path=\/; HttpOnly; SameSite=Lax; Max-Age=3600$/)
|
|
const cookieValue = setCookie.split(';')[0].slice('test_cookie='.length)
|
|
|
|
// 4. cookie alone → 200, no new cookie
|
|
r = await raw('/', { cookie: `test_cookie=${cookieValue}` })
|
|
assert.equal(r.status, 200)
|
|
assert.equal(r.headers.get('set-cookie'), null)
|
|
|
|
// 5. tampered cookie → 401
|
|
r = await raw('/', { cookie: 'test_cookie=' + cookieValue.slice(0, -2) + 'xx' })
|
|
assert.equal(r.status, 401)
|
|
|
|
// 6. websocket upgrade anonymous → 401 on socket
|
|
assert.match(await upgrade(), /^HTTP\/1\.1 401 /)
|
|
|
|
// 7. websocket upgrade with cookie → passes through to original handler
|
|
assert.match(await upgrade([`Cookie: test_cookie=${cookieValue}`]), /^HTTP\/1\.1 101 /)
|
|
assert.equal(upgradeCount, 1)
|
|
|
|
// 8. hot-disable via config → anonymous passes through (fail-open)
|
|
cfg.users = []
|
|
r = await raw('/')
|
|
assert.equal(r.status, 200)
|
|
cfg.users = [{ username: 'admin', passwordHash: hashPassword('s3cret-pass') }]
|
|
|
|
// 9. dispose restores original behavior (anonymous → 200 again)
|
|
disposer()
|
|
r = await raw('/')
|
|
assert.equal(r.status, 200)
|
|
assert.equal(await r.text(), 'panel')
|
|
|
|
// 10. hash round-trip sanity
|
|
assert.equal(verifyPassword('s3cret-pass', cfg.users[0].passwordHash), true)
|
|
assert.equal(verifyPassword('other', cfg.users[0].passwordHash), false)
|
|
|
|
server.close()
|
|
console.log('ALL PANEL-AUTH TESTS PASSED')
|