mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-22 15:12:23 +03:00
621f30a188
Obrigado por restaurar e endurecer a autenticação por machine-token no CLI empacotado. Validação (worktree combinado a partir de origin/release/v3.8.50, merge limpo, 0 conflitos — 34 arquivos, +1078/-247): - `npm run typecheck:core` — limpo - `node scripts/check/check-complexity.mjs` — OK (2558 violações vs baseline 2774) - `node scripts/check/check-cognitive-complexity.mjs` — OK (1152 violações vs baseline 1223) - `node scripts/check/check-file-size.mjs` — OK - `node scripts/check/check-changelog-integrity.mjs` — OK - Testes focados (8 arquivos: cli-doctor-command, cli-machine-token, lib/machineToken, lib/managementCliToken, agentSkills-generator, api/settings-audit, check-pack-boot, next-config) — 95/95 passando Os dois achados de segurança do maintainer-feedback original (checagem de loopback tipo SSRF, escopo de cookie/CSRF) já estavam corrigidos e cobertos por teste no commit `2b785f0068a862fbd867221294325ad921787782` desta branch.
46 lines
1.6 KiB
TypeScript
46 lines
1.6 KiB
TypeScript
import { test } from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import {
|
|
deriveLegacyCliToken,
|
|
deriveMachineToken,
|
|
getMachineTokenSync,
|
|
} from "../../../src/lib/machineToken.ts";
|
|
|
|
test("machine-token derivation fails closed for a missing machine ID", () => {
|
|
assert.equal(deriveMachineToken("", "omniroute-cli-auth-v1"), "");
|
|
assert.equal(deriveLegacyCliToken("", "omniroute-cli-auth-v1"), "");
|
|
});
|
|
|
|
test("getMachineTokenSync returns a 64-character hex string (full SHA-256)", () => {
|
|
const token = getMachineTokenSync();
|
|
assert.match(token, /^[0-9a-f]{64}$/, "token must be 64 lowercase hex chars (HMAC-SHA256)");
|
|
});
|
|
|
|
test("getMachineTokenSync is deterministic", () => {
|
|
assert.equal(getMachineTokenSync(), getMachineTokenSync());
|
|
});
|
|
|
|
test("getMachineTokenSync produces different values for different salts", () => {
|
|
const t1 = getMachineTokenSync("salt-a");
|
|
const t2 = getMachineTokenSync("salt-b");
|
|
assert.notEqual(t1, t2);
|
|
});
|
|
|
|
test("getMachineTokenSync with empty string salt does not throw", () => {
|
|
assert.doesNotThrow(() => getMachineTokenSync(""));
|
|
});
|
|
|
|
test("getMachineTokenSync respects OMNIROUTE_CLI_SALT env var", () => {
|
|
const previous = process.env.OMNIROUTE_CLI_SALT;
|
|
try {
|
|
const before = getMachineTokenSync();
|
|
process.env.OMNIROUTE_CLI_SALT = "__test_salt__";
|
|
const withEnv = getMachineTokenSync();
|
|
assert.notEqual(before, withEnv, "env salt must produce a different token");
|
|
assert.match(withEnv, /^[0-9a-f]{64}$/, "env-derived token must still be 64-char hex");
|
|
} finally {
|
|
if (previous === undefined) delete process.env.OMNIROUTE_CLI_SALT;
|
|
else process.env.OMNIROUTE_CLI_SALT = previous;
|
|
}
|
|
});
|