mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-09-15 19:32:20 +03:00
f131b64a6e
Validated on the combined batch board (gates + typecheck clean) and this branch: security-route-guard-tiers green. Regression coverage for the Hard Rule #15/#17 contract — Tier 1 process-spawning prefixes (/api/services/, /api/mcp/, /api/cli-tools/runtime/) must stay LOCAL_ONLY before any auth check. Conflict with the tip was only stale provider-count docs. Thank you @rqzbeh!
11 lines
522 B
TypeScript
11 lines
522 B
TypeScript
import assert from "node:assert/strict";
|
|
import { test } from "node:test";
|
|
import { isLocalOnlyPath } from "../../src/server/authz/routeGuard.ts";
|
|
|
|
test("isLocalOnlyPath correctly classifies process-spawning endpoints under Tier 1 LOCAL_ONLY", () => {
|
|
assert.equal(isLocalOnlyPath("/api/services/dario/start"), true);
|
|
assert.equal(isLocalOnlyPath("/api/mcp/stream"), true);
|
|
assert.equal(isLocalOnlyPath("/api/cli-tools/runtime/status"), true);
|
|
assert.equal(isLocalOnlyPath("/api/v1/chat/completions"), false);
|
|
});
|