pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-09-14 02:42:24 +03:00
Code Issues Packages Projects Releases Wiki Activity

test(auth): session fixtures mint the real login shape (authenticated: true)

Browse Source 
Refs #13298
This commit is contained in:
diegosouzapw
2026-09-11 18:23:08 -03:00
parent 28d320b5e3
commit 5d29ac1371
12 changed files with 15 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
tests/unit/cli-tools-apply-opencode-jsonc.test.ts
View File

@@ -24,7 +24,7 @@ const testRoots = new Set<string>();
async function createAuthCookie(): Promise<string> {
process.env.JWT_SECRET = "test-cli-tools-apply-secret";
const secret = new TextEncoder().encode(process.env.JWT_SECRET);
const token = await new SignJWT({ sub: "test-user" })
const token = await new SignJWT({ authenticated: true, sub: "test-user" })
.setProtectedHeader({ alg: "HS256" })
.setIssuedAt()
.setExpirationTime("1h")

2
tests/unit/cli-tools-keys-route.test.ts
View File

@@ -12,7 +12,7 @@ const originalApiKeySecret = process.env.API_KEY_SECRET;
async function createAuthCookie() {
process.env.JWT_SECRET = "test-cli-tools-keys-secret";
const secret = new TextEncoder().encode(process.env.JWT_SECRET);
const token = await new SignJWT({ sub: "test-user" })
const token = await new SignJWT({ authenticated: true, sub: "test-user" })
.setProtectedHeader({ alg: "HS256" })
.setIssuedAt()
.setExpirationTime("1h")

2
tests/unit/codex-settings-wire-api-default.test.ts
View File

@@ -18,7 +18,7 @@ const route = await import("../../src/app/api/cli-tools/codex-settings/route.ts"
const authCookie = async (): Promise<string> => {
process.env.JWT_SECRET = "codex-wire-api-default-test-secret";
const token = await new SignJWT({ sub: "codex-wire-api-default-test" })
const token = await new SignJWT({ authenticated: true, sub: "codex-wire-api-default-test" })
.setProtectedHeader({ alg: "HS256" })
.setIssuedAt()
.setExpirationTime("1h")

1
tests/unit/dashboard-session-token-13298.test.ts
View File

@@ -5,6 +5,7 @@
* secret — notably the Cursor CLI passthrough token (iss "omniroute", aud
* "cursor-cli", no claim) — is NOT a session.
*/
import "../_setup/isolateDataDir.ts";
import { test } from "node:test";
import assert from "node:assert/strict";
import { SignJWT } from "jose";

8
tests/unit/dashboard-session-verifier-source-guard.test.ts
View File

@@ -1,8 +1,8 @@
/**
* #13298 source guard: every consumer of the `auth_token` cookie must verify it
* through verifyDashboardSessionToken (which requires `authenticated: true`).
* A bare jose `jwtVerify(` in one of these files re-opens the forgeable-session
* hole (Cursor CLI tokens share JWT_SECRET).
* A bare jose `jwtVerify` (called or aliased) in one of these files re-opens the
* forgeable-session hole (Cursor CLI tokens share JWT_SECRET).
*/
import { test } from "node:test";
import assert from "node:assert/strict";
@@ -22,8 +22,8 @@ const VERIFIERS = [
for (const rel of VERIFIERS) {
test(`${rel} verifies auth_token only through verifyDashboardSessionToken`, () => {
const src = fs.readFileSync(path.join(ROOT, rel), "utf8");
assert.match(src, /verifyDashboardSessionToken/, "must import/use the shared verifier");
assert.doesNotMatch(src, /\bjwtVerify\s*\(/, "bare jwtVerify( is the #13298 regression");
assert.match(src, /verifyDashboardSessionToken\s*\(/, "must call the shared verifier");
assert.doesNotMatch(src, /\bjwtVerify\b/, "any bare jwtVerify is the #13298 regression");
});
}

2
tests/unit/embeddings-route-apikeymeta-6929.test.ts
View File

@@ -49,7 +49,7 @@ test.after(() => {
async function sessionCookie(): Promise<string> {
const secret = new TextEncoder().encode(process.env.JWT_SECRET);
const jwt = await new SignJWT({ sub: "admin" })
const jwt = await new SignJWT({ authenticated: true, sub: "admin" })
.setProtectedHeader({ alg: "HS256" })
.setExpirationTime("1h")
.sign(secret);

2
tests/unit/feature-flags-route-virtual-lanes.test.ts
View File

@@ -37,7 +37,7 @@ type FlagPayload = {
async function authCookie(): Promise<string> {
process.env.JWT_SECRET = "test-feature-flags-route-secret";
const secret = new TextEncoder().encode(process.env.JWT_SECRET);
const token = await new SignJWT({ sub: "test-user" })
const token = await new SignJWT({ authenticated: true, sub: "test-user" })
.setProtectedHeader({ alg: "HS256" })
.setIssuedAt()
.setExpirationTime("1h")

2
tests/unit/guide-settings-route.test.ts
View File

@@ -21,7 +21,7 @@ const originalJwtSecret = process.env.JWT_SECRET;
async function createAuthCookie() {
process.env.JWT_SECRET = "test-cli-tools-secret";
const secret = new TextEncoder().encode(process.env.JWT_SECRET);
const token = await new SignJWT({ sub: "test-user" })
const token = await new SignJWT({ authenticated: true, sub: "test-user" })
.setProtectedHeader({ alg: "HS256" })
.setIssuedAt()
.setExpirationTime("1h")

2
tests/unit/hermes-agent-settings-route-keyid-10711.test.ts
View File

@@ -45,7 +45,7 @@ test.after(() => {
async function authCookie(): Promise<string> {
const secret = new TextEncoder().encode(process.env.JWT_SECRET);
const jwt = await new SignJWT({ sub: "admin" })
const jwt = await new SignJWT({ authenticated: true, sub: "admin" })
.setProtectedHeader({ alg: "HS256" })
.setExpirationTime("1h")
.sign(secret);

2
tests/unit/image-generation-route-auth.test.ts
View File

@@ -203,7 +203,7 @@ test("v1 image generation POST accepts a dashboard session when REQUIRE_API_KEY
try {
const { SignJWT } = await import("jose");
const token = await new SignJWT({ sub: "dashboard" })
const token = await new SignJWT({ authenticated: true, sub: "dashboard" })
.setProtectedHeader({ alg: "HS256" })
.setExpirationTime("1h")
.sign(new TextEncoder().encode(process.env.JWT_SECRET));

2
tests/unit/playground-key-policy-3503.test.ts
View File

@@ -32,7 +32,7 @@ const KEY_SECRET = created.key;
async function sessionCookie(): Promise<string> {
const secret = new TextEncoder().encode(process.env.JWT_SECRET);
const jwt = await new SignJWT({ sub: "admin" })
const jwt = await new SignJWT({ authenticated: true, sub: "admin" })
.setProtectedHeader({ alg: "HS256" })
.setExpirationTime("1h")
.sign(secret);

2
tests/unit/qwen-settings-route.test.ts
View File

@@ -19,7 +19,7 @@ const route = await import("../../src/app/api/cli-tools/qwen-settings/route.ts")
const authCookie = async (): Promise<string> => {
process.env.JWT_SECRET = "qwen-settings-route-test-secret";
const token = await new SignJWT({ sub: "qwen-route-test" })
const token = await new SignJWT({ authenticated: true, sub: "qwen-route-test" })
.setProtectedHeader({ alg: "HS256" })
.setIssuedAt()
.setExpirationTime("1h")