mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-09-17 20:32:25 +03:00
21fcb19f96
Reject repair and Remove CA when no sudo password is supplied or cached, instead of spawning sudo -S with an empty string. Add a password modal to AgentBridgeMaintenanceCard and regression tests for the 400 gate. Address PR review feedback: reject whitespace-only sudoPassword values, avoid caching unusable passwords, extract closePasswordModal helper, and replace the route test that invoked real sudo with pure gate assertions. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
30 lines
1.1 KiB
TypeScript
30 lines
1.1 KiB
TypeScript
/**
|
|
* POST /api/tools/agent-bridge/repair validates its body with RepairBodySchema
|
|
* via safeParse (route validation gate t06) and rejects privileged repair when
|
|
* no sudo password is supplied or cached (#7836). These tests pin that schema
|
|
* contract. (Gap 7.)
|
|
*/
|
|
import test from "node:test";
|
|
import assert from "node:assert/strict";
|
|
|
|
const { RepairBodySchema } = await import(
|
|
"../../src/app/api/tools/agent-bridge/repair/route.ts"
|
|
);
|
|
|
|
test("accepts a body with a string sudoPassword", () => {
|
|
const parsed = RepairBodySchema.safeParse({ sudoPassword: "hunter2" });
|
|
assert.equal(parsed.success, true);
|
|
assert.equal(parsed.success && parsed.data.sudoPassword, "hunter2");
|
|
});
|
|
|
|
test("accepts an empty body (sudoPassword optional, falls back to cached)", () => {
|
|
const parsed = RepairBodySchema.safeParse({});
|
|
assert.equal(parsed.success, true);
|
|
assert.equal(parsed.success && parsed.data.sudoPassword, undefined);
|
|
});
|
|
|
|
test("rejects a non-string sudoPassword instead of trusting raw input", () => {
|
|
const parsed = RepairBodySchema.safeParse({ sudoPassword: 12345 });
|
|
assert.equal(parsed.success, false);
|
|
});
|