mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-09-19 13:23:50 +03:00
db6feb6fad
Merged as part of the owner batch of 2026-09-11. This PR had a live worktree in another session, so it sat outside the main 39. Merged on your explicit call, validated first rather than taken on trust: boarded with the other 10 worktree-held PRs into a consolidated worktree off `release/v3.8.51`. - ESLint over every changed file: no errors - `typecheck:core` clean; `check:dashboard-typecheck` OK; `check:changelog-integrity` OK - complexity 2821 / baseline 3218 and cognitive-complexity 1272 / baseline 1437 - 203 of 208 assertions green. The 5 remaining (`guide-settings-route` ×4, `hard-session-lease-bypass-inventory` ×1) reproduce on the pure tip with nothing from this batch applied. - `imageGeneration.ts` rebaselined 3259 → 3293 for #12945's image-only-model guard, landed separately in #13392 so nothing was pushed onto a live branch. ⚠️ base-red inherited: #12732 — provider count 356 vs 358 and `open-sse/utils/stream.ts` 3115 > frozen 3098, both reproducing on the pure tip.
38 lines
1.4 KiB
TypeScript
38 lines
1.4 KiB
TypeScript
/**
|
|
* #13298 source guard: every consumer of the `auth_token` cookie must verify it
|
|
* through verifyDashboardSessionToken (which requires `authenticated: true`).
|
|
* A bare jose `jwtVerify` (called or aliased) in one of these files re-opens the
|
|
* forgeable-session hole (Cursor CLI tokens share JWT_SECRET).
|
|
*/
|
|
import { test } from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import fs from "node:fs";
|
|
import path from "node:path";
|
|
|
|
const ROOT = path.resolve(import.meta.dirname, "../..");
|
|
const VERIFIERS = [
|
|
"src/shared/utils/apiAuth.ts",
|
|
"src/server/authz/pipeline.ts",
|
|
"src/lib/ws/handshake.ts",
|
|
"src/server/ws/liveServer.ts",
|
|
"src/app/api/settings/require-login/route.ts",
|
|
"src/app/api/auth/status/route.ts",
|
|
];
|
|
|
|
for (const rel of VERIFIERS) {
|
|
test(`${rel} verifies auth_token only through verifyDashboardSessionToken`, () => {
|
|
const src = fs.readFileSync(path.join(ROOT, rel), "utf8");
|
|
assert.match(src, /verifyDashboardSessionToken\s*\(/, "must call the shared verifier");
|
|
assert.doesNotMatch(src, /\bjwtVerify\b/, "any bare jwtVerify is the #13298 regression");
|
|
});
|
|
}
|
|
|
|
test("the helper itself is the only src file that calls jwtVerify on the dashboard cookie", () => {
|
|
const helper = fs.readFileSync(
|
|
path.join(ROOT, "src/shared/utils/dashboardSessionToken.ts"),
|
|
"utf8"
|
|
);
|
|
assert.match(helper, /jwtVerify\(token, secret\)/);
|
|
assert.match(helper, /=== true/);
|
|
});
|