Blame · Line-by-line history

`api-write-auth.test.ts`

Each line is annotated with the commit that last touched it. Click any SHA to jump to that commit and see the surrounding change.

api-write-auth.test.tsBlame97 lines · 1 contributor

Normal view Raw

754596cccantynz-alt	1	/**
	2	* Unauthenticated write endpoints on the legacy /api surface.
	3	*
	4	* POST /api/repos had no auth middleware at all and took the target namespace
	5	* from `owner` in the request body — anyone on the internet could create a
	6	* repository inside any user's namespace. csrfProtect does not mitigate it:
	7	* src/middleware/csrf.ts explicitly returns next() for paths under /api/.
	8	*
	9	* POST /api/setup was likewise open and upserts a user, seeding any username
	10	* that does not yet exist with the fixed password "changeme" — anonymous
	11	* account creation and username squatting on a populated instance.
	12	*/
	13
	14	import { describe, expect, it } from "bun:test";
	15	import app from "../app";
	16	import { readFileSync } from "fs";
	17
	18	async function postJson(path: string, body: unknown, headers: Record<string, string> = {}) {
	19	return app.fetch(
	20	new Request(`http://localhost${path}`, {
	21	method: "POST",
	22	headers: { "content-type": "application/json", ...headers },
	23	body: JSON.stringify(body),
	24	})
	25	);
	26	}
	27
	28	describe("POST /api/repos requires authentication", () => {
	29	it("rejects an anonymous caller with 401, not 400/500", async () => {
	30	const res = await postJson("/api/repos", {
	31	name: "pwned",
	32	owner: "someoneelse",
	33	});
	34	expect(res.status).toBe(401);
	35	const body = await res.json();
	36	expect(body.error).toBe("Authentication required");
	37	});
	38
	39	it("rejects before parsing the body, so a malformed body still 401s", async () => {
	40	// Auth must be the first gate — otherwise the shape of the error leaks
	41	// whether the endpoint would have accepted the request.
	42	const res = await app.fetch(
	43	new Request("http://localhost/api/repos", {
	44	method: "POST",
	45	headers: { "content-type": "application/json" },
	46	body: "{not json",
	47	})
	48	);
	49	expect(res.status).toBe(401);
	50	});
	51
	52	it("an invalid bearer token does not pass as authenticated", async () => {
	53	const res = await postJson(
	54	"/api/repos",
	55	{ name: "pwned" },
	56	{ authorization: "Bearer glc_deadbeefdeadbeefdeadbeefdeadbeef" }
	57	);
	58	expect(res.status).toBe(401);
	59	});
	60	});
	61
	62	describe("POST /api/setup is first-run only", () => {
	63	it("404s on an instance that already has users", async () => {
	64	const res = await postJson("/api/setup", {
	65	username: "squatter",
	66	email: "a@b.c",
	67	repoName: "x",
	68	});
	69	// 404 (not 403) so a live instance does not advertise the endpoint.
	70	// 503 is acceptable here: no DATABASE_URL in the unit-test environment
	71	// means the user-count probe cannot run, and it must not fall through.
	72	expect([404, 503]).toContain(res.status);
	73	expect(res.status).not.toBe(200);
	74	});
	75	});
	76
	77	describe("the namespace check itself", () => {
	78	const SRC = readFileSync("src/routes/api.ts", "utf8");
	79	const handler = SRC.slice(
	80	SRC.indexOf('api.post("/repos"'),
	81	SRC.indexOf('api.get("/repos")') > 0
	82	? SRC.indexOf('api.get("/repos")')
	83	: SRC.indexOf('api.get("/users/:username/repos"')
	84	);
	85
	86	it("forces the owner to the authenticated user", () => {
	87	expect(handler).toContain("body.owner = viewer.username");
	88	});
	89
	90	it("refuses a mismatched owner rather than silently rewriting it", () => {
	91	// Silently rewriting would make a forged request look like it succeeded
	92	// against the attacker's own namespace.
	93	expect(handler).toContain("body.owner !== viewer.username");
	94	expect(handler).toContain("403");
	95	});
	96	});
	97