mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-09-14 02:42:24 +03:00
026d26edb7
Validated in a combined 3-PR batch worktree off release/v3.8.51 tip (a sibling PR from the same author, #11495, was held out — see its own comment for the isolated finding, unrelated to this diff). - Focused test: web-cookie-expiry.test.ts — part of batch's 94/94 node:test run - typecheck:core, file-size, changelog-integrity, complexity, cognitive-complexity — all OK - Full-repo lint: 228 pre-existing dashboard react-hooks/* findings, unrelated to this diff Thanks for closing a real trust gap — operators deserve to know a cookie is about to expire before a live request fails.
92 lines
3.5 KiB
TypeScript
92 lines
3.5 KiB
TypeScript
import { describe, it } from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import {
|
|
decodeJwtPayloadExp,
|
|
deriveCookieExpiryIso,
|
|
readCookieExpiresAt,
|
|
withDerivedCookieExpiry,
|
|
} from "../../src/shared/utils/webCookieExpiry.ts";
|
|
|
|
function jwt(payload: object): string {
|
|
const enc = (obj: object) =>
|
|
Buffer.from(JSON.stringify(obj)).toString("base64url");
|
|
return `${enc({ alg: "HS256", typ: "JWT" })}.${enc(payload)}.sig`;
|
|
}
|
|
|
|
const EXP_AT = 1_800_000_000_000; // 2027-01-15T06:40:00.000Z
|
|
|
|
describe("web-cookie expiry derivation (#11497)", () => {
|
|
it("decodes a standard JWT exp into epoch ms", () => {
|
|
assert.equal(decodeJwtPayloadExp(jwt({ exp: EXP_AT / 1000 })), EXP_AT);
|
|
});
|
|
|
|
it("accepts url-safe base64 without padding", () => {
|
|
const seg = Buffer.from(JSON.stringify({ exp: 1234567890 }))
|
|
.toString("base64")
|
|
.replace(/\+/g, "-")
|
|
.replace(/\//g, "_")
|
|
.replace(/=+$/, "");
|
|
const token = `aaa.${seg}.bbb`;
|
|
assert.equal(decodeJwtPayloadExp(token), 1234567890000);
|
|
});
|
|
|
|
it("scans cookie-pair values of a pasted Cookie header", () => {
|
|
const header = `cf_clearance=x.y.z; __Secure-next-auth.session-token=${jwt({
|
|
exp: EXP_AT / 1000,
|
|
})}; other=1`;
|
|
assert.equal(deriveCookieExpiryIso(header), new Date(EXP_AT).toISOString());
|
|
});
|
|
|
|
it("returns null for opaque cookies (claude sessionKey, grok sso)", () => {
|
|
assert.equal(decodeJwtPayloadExp("sk-ant-sid01-abcdef"), null);
|
|
assert.equal(
|
|
deriveCookieExpiryIso("sso=eyJhbGciOiJIUzUxMiJ9.notjson.sig; sso-rw=1"),
|
|
null
|
|
);
|
|
});
|
|
|
|
it("returns null for malformed or non-positive payloads", () => {
|
|
assert.equal(decodeJwtPayloadExp("a.b"), null);
|
|
assert.equal(decodeJwtPayloadExp("a.b.c"), null);
|
|
assert.equal(decodeJwtPayloadExp(jwt({})), null);
|
|
assert.equal(decodeJwtPayloadExp(jwt({ exp: 0 })), null);
|
|
assert.equal(decodeJwtPayloadExp(jwt({ exp: -5 })), null);
|
|
assert.equal(decodeJwtPayloadExp(`a.${Buffer.from("[1]").toString("base64url")}.c`), null);
|
|
assert.equal(decodeJwtPayloadExp(`a.${Buffer.from("null").toString("base64url")}.c`), null);
|
|
assert.equal(decodeJwtPayloadExp(null), null);
|
|
assert.equal(decodeJwtPayloadExp(42), null);
|
|
});
|
|
|
|
it("readCookieExpiresAt only accepts non-empty strings", () => {
|
|
assert.equal(readCookieExpiresAt({ cookieExpiresAt: "2027-01-01T00:00:00.000Z" }), "2027-01-01T00:00:00.000Z");
|
|
assert.equal(readCookieExpiresAt({ cookieExpiresAt: "" }), null);
|
|
assert.equal(readCookieExpiresAt({}), null);
|
|
assert.equal(readCookieExpiresAt(null), null);
|
|
assert.equal(readCookieExpiresAt("str"), null);
|
|
});
|
|
|
|
it("withDerivedCookieExpiry sets the date and preserves sibling keys", () => {
|
|
const out = withDerivedCookieExpiry(
|
|
{ spaceId: "s1" },
|
|
jwt({ exp: EXP_AT / 1000 })
|
|
);
|
|
assert.equal(out.cookieExpiresAt, new Date(EXP_AT).toISOString());
|
|
assert.equal(out.spaceId, "s1");
|
|
});
|
|
|
|
it("withDerivedCookieExpiry drops the stale date when replaced by an opaque cookie", () => {
|
|
const out = withDerivedCookieExpiry(
|
|
{ cookieExpiresAt: "2020-01-01T00:00:00.000Z", spaceId: "s1" },
|
|
"sk-ant-sid01-new-opaque"
|
|
);
|
|
assert.equal("cookieExpiresAt" in out, false);
|
|
assert.equal(out.spaceId, "s1");
|
|
});
|
|
|
|
it("withDerivedCookieExpiry leaves data untouched when no credential is present", () => {
|
|
const original = { cookieExpiresAt: "2020-01-01T00:00:00.000Z" };
|
|
const out = withDerivedCookieExpiry(original, "");
|
|
assert.deepEqual(out, original);
|
|
});
|
|
});
|