CodeIssuesDiscussionsWikiPull RequestsProjectsCommitsActionsReleasesContributorsPulse● GatesSecuritySettingsDeploymentsPipelineInsightsAgents✨ Explain✨ Ask AI✨ Workspace✨ Spec✨ Tests▓ Debt Map✨ NL Search🏛 Archaeology
Blame · Line-by-line history
admin-security.test.ts
Each line is annotated with the commit that last touched it. Click any SHA to jump to that commit and see the surrounding change.
| 7b0a81b | 1 | /** |
| 2 | * Regression coverage for a real production security bug: the auth guard | |
| 3 | * on /admin/security and /admin/soc2 was registered with a glued wildcard | |
| 4 | * pattern ("/admin/security*", no slash before the *) that doesn't match | |
| 5 | * in this Hono version -- confirmed via a standalone Hono reproduction and | |
| 6 | * live: an unauthenticated GET to both pages returned a real 200 with the | |
| 7 | * SOC 2 evidence dashboard (failed logins, locked accounts, MFA status, | |
| 8 | * active sessions, account deletions) in production. Found via a full | |
| 9 | * production HTTP sweep, not a doc or a prior test -- there was no test | |
| 10 | * file for this route at all before this one. | |
| 11 | */ | |
| 12 | import { describe, it, expect } from "bun:test"; | |
| 13 | ||
| 14 | describe("admin-security — auth gate", () => { | |
| 15 | it("GET /admin/security without auth redirects to login, not 200", async () => { | |
| 16 | const app = (await import("../app")).default; | |
| 17 | const res = await app.request("/admin/security"); | |
| 18 | expect(res.status).toBe(302); | |
| 19 | expect(res.headers.get("location") || "").toContain("/login"); | |
| 20 | }); | |
| 21 | ||
| 22 | it("GET /admin/soc2 without auth redirects to login, not 200", async () => { | |
| 23 | const app = (await import("../app")).default; | |
| 24 | const res = await app.request("/admin/soc2"); | |
| 25 | expect(res.status).toBe(302); | |
| 26 | expect(res.headers.get("location") || "").toContain("/login"); | |
| 27 | }); | |
| 28 | }); |