mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-31 12:22:14 +03:00
55659d92be
- management.ts: replace === with timingSafeEqual for CLI token comparison - machineToken.ts: salt upgraded to omniroute-cli-auth-v1; OMNIROUTE_CLI_SALT env var honoured for rotation; full 64-char SHA-256 hex token - tray.ps1: accept .png via GDI+ Bitmap->Icon handle; Windows tray works without .ico - tray.ts: getIconPath() tries icon.ico then icon.png on Windows - compression/types.ts: DEFAULT_CAVEMAN_CONFIG.preservePatterns filled with six defaults (fenced code, inline code, URLs, paths, error lines, stack traces) - CLAUDE.md: Hard Rule #15 — spawn-capable routes must use isLocalOnlyPath() - .env.example + docs/reference/ENVIRONMENT.md: document OMNIROUTE_CLI_SALT - docs/security/CLI_TOKEN.md: new (was referenced in changelog but missing) - docs/security/ROUTE_GUARD_TIERS.md: new (was referenced in changelog but missing) - tests/unit/lib/machineToken.test.ts: updated for 64-char token; added OMNIROUTE_CLI_SALT env-var rotation test
32 lines
1.2 KiB
TypeScript
32 lines
1.2 KiB
TypeScript
import { test } from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import { getMachineTokenSync } from "../../../src/lib/machineToken.ts";
|
|
|
|
test("getMachineTokenSync returns a 64-character hex string (full SHA-256)", () => {
|
|
const token = getMachineTokenSync();
|
|
assert.match(token, /^[0-9a-f]{64}$/, "token must be 64 lowercase hex chars (HMAC-SHA256)");
|
|
});
|
|
|
|
test("getMachineTokenSync is deterministic", () => {
|
|
assert.equal(getMachineTokenSync(), getMachineTokenSync());
|
|
});
|
|
|
|
test("getMachineTokenSync produces different values for different salts", () => {
|
|
const t1 = getMachineTokenSync("salt-a");
|
|
const t2 = getMachineTokenSync("salt-b");
|
|
assert.notEqual(t1, t2);
|
|
});
|
|
|
|
test("getMachineTokenSync with empty string salt does not throw", () => {
|
|
assert.doesNotThrow(() => getMachineTokenSync(""));
|
|
});
|
|
|
|
test("getMachineTokenSync respects OMNIROUTE_CLI_SALT env var", () => {
|
|
const before = getMachineTokenSync();
|
|
process.env.OMNIROUTE_CLI_SALT = "__test_salt__";
|
|
const withEnv = getMachineTokenSync();
|
|
delete process.env.OMNIROUTE_CLI_SALT;
|
|
assert.notEqual(before, withEnv, "env salt must produce a different token");
|
|
assert.match(withEnv, /^[0-9a-f]{64}$/, "env-derived token must still be 64-char hex");
|
|
});
|