more tests + half cache plugins

2026-05-07 09:52:20 -05:00
parent b0c88f8c08
commit bdc55f89fd
6 changed files with 503 additions and 4 deletions
@@ -0,0 +1,80 @@
+import { describe, expect, test, afterEach } from "bun:test";
+import { isAuthorizedAgentRequest } from "./agent-auth";
+
+function makeReq(headers: Record<string, string> = {}): Request {
+  return new Request("https://localhost/ws", { headers });
+}
+
+function makeUrl(query: Record<string, string> = {}): URL {
+  const u = new URL("https://localhost/ws");
+  for (const [k, v] of Object.entries(query)) u.searchParams.set(k, v);
+  return u;
+}
+
+describe("isAuthorizedAgentRequest", () => {
+  const originalEnv: Record<string, string | undefined> = {};
+
+  function setEnv(key: string, value: string | undefined) {
+    if (!(key in originalEnv)) originalEnv[key] = process.env[key];
+    if (value === undefined) delete process.env[key];
+    else process.env[key] = value;
+  }
+
+  afterEach(() => {
+    for (const [k, v] of Object.entries(originalEnv)) {
+      if (v === undefined) delete process.env[k];
+      else process.env[k] = v;
+    }
+    for (const k of Object.keys(originalEnv)) delete originalEnv[k];
+  });
+
+  test("returns true when agentToken is empty/undefined", () => {
+    expect(isAuthorizedAgentRequest(makeReq(), makeUrl(), "")).toBe(true);
+    expect(isAuthorizedAgentRequest(makeReq(), makeUrl(), undefined)).toBe(true);
+  });
+
+  test("authenticates via x-agent-token header", () => {
+    const token = "secret-agent-token-abc123";
+    const req = makeReq({ "x-agent-token": token });
+    expect(isAuthorizedAgentRequest(req, makeUrl(), token)).toBe(true);
+  });
+
+  test("authenticates via query string token", () => {
+    const token = "secret-agent-token-abc123";
+    const url = makeUrl({ token });
+    expect(isAuthorizedAgentRequest(makeReq(), url, token)).toBe(true);
+  });
+
+  test("rejects wrong header token", () => {
+    const req = makeReq({ "x-agent-token": "wrong" });
+    expect(isAuthorizedAgentRequest(req, makeUrl(), "correct-token")).toBe(false);
+  });
+
+  test("rejects wrong query token", () => {
+    const url = makeUrl({ token: "wrong" });
+    expect(isAuthorizedAgentRequest(makeReq(), url, "correct-token")).toBe(false);
+  });
+
+  test("rejects when no token is provided but agentToken is set", () => {
+    expect(isAuthorizedAgentRequest(makeReq(), makeUrl(), "required-token")).toBe(false);
+  });
+
+  test("OVERLORD_DISABLE_AGENT_AUTH bypasses in non-production", () => {
+    setEnv("OVERLORD_DISABLE_AGENT_AUTH", "true");
+    setEnv("NODE_ENV", "development");
+    expect(isAuthorizedAgentRequest(makeReq(), makeUrl(), "secret")).toBe(true);
+  });
+
+  test("OVERLORD_DISABLE_AGENT_AUTH is ignored in production", () => {
+    setEnv("OVERLORD_DISABLE_AGENT_AUTH", "true");
+    setEnv("NODE_ENV", "production");
+    expect(isAuthorizedAgentRequest(makeReq(), makeUrl(), "secret")).toBe(false);
+  });
+
+  test("header token takes priority when both header and query are present", () => {
+    const token = "the-real-token";
+    const req = makeReq({ "x-agent-token": token });
+    const url = makeUrl({ token: "wrong-query-token" });
+    expect(isAuthorizedAgentRequest(req, url, token)).toBe(true);
+  });
+});