Gronod
5fd55b4e1a
Framework:
- Vitest v4 as test runner (fast ESM/CJS support, V8 coverage built-in)
- supertest for integration tests against createApp() factory
- nock for HTTP interception (works with CJS require('axios'), unlike vi.mock)
New files:
- vitest.config.js — test config: node env, isolate, V8 coverage, per-file thresholds
- tests/setup.js — isolated DATA_DIR per worker, SKIP_RATE_LIMIT, console suppression
- tests/README.md — approach, structure, design decisions
- server/app.js — testable Express factory (extracted from index.js side-effects)
Unit tests (91 tests):
- tests/unit/sanitizeError.test.js — secret redaction: apikey, token, bearer, basic-auth URLs
- tests/unit/config.test.js — JSON array + legacy single-instance config parsing
- tests/unit/requireAuth.test.js — valid/invalid/tampered cookies, schema validation
- tests/unit/verifyCsrf.test.js — double-submit pattern, timing-safe compare, safe methods
- tests/unit/qbittorrent.test.js — formatBytes, formatEta, mapTorrentToDownload state map
- tests/unit/tokenStore.test.js — store/get/clear lifecycle, TTL expiry, atomic disk write
Integration tests (24 tests):
- tests/integration/health.test.js — /health and /ready endpoints
- tests/integration/auth.test.js — full login/logout/me/csrf flows, input validation,
cookie attributes, no token leakage, Emby mock via nock
Production code changes (minimal, no behaviour change):
- server/routes/auth.js: EMBY_URL captured at request-time (not module load) for testability
- server/routes/auth.js: loginLimiter max → Number.MAX_SAFE_INTEGER when SKIP_RATE_LIMIT set
- server/utils/sanitizeError.js: fix HEADER_PATTERN to redact full line (not just first token)
CI:
- .gitea/workflows/ci.yml: add parallel 'test' job (npm run test:coverage, artifact upload)
- package.json: add test/test:watch/test:coverage/test:ui scripts
- .gitignore: add coverage/
85 lines
2.6 KiB
JavaScript
85 lines
2.6 KiB
JavaScript
/**
|
|
* Tests for server/middleware/verifyCsrf.js
|
|
*
|
|
* CSRF protection via the double-submit cookie pattern. These tests verify
|
|
* that the timing-safe comparison works correctly and that safe HTTP methods
|
|
* are correctly exempted.
|
|
*/
|
|
|
|
import verifyCsrf from '../../server/middleware/verifyCsrf.js';
|
|
|
|
function makeReq(method, cookieToken, headerToken) {
|
|
return {
|
|
method,
|
|
cookies: { csrf_token: cookieToken },
|
|
headers: { 'x-csrf-token': headerToken }
|
|
};
|
|
}
|
|
|
|
function makeRes() {
|
|
const res = {
|
|
statusCode: null,
|
|
body: null,
|
|
status(code) { this.statusCode = code; return this; },
|
|
json(body) { this.body = body; return this; }
|
|
};
|
|
return res;
|
|
}
|
|
|
|
describe('verifyCsrf middleware', () => {
|
|
describe('safe methods are exempted', () => {
|
|
for (const method of ['GET', 'HEAD', 'OPTIONS']) {
|
|
it(`allows ${method} with no CSRF token`, () => {
|
|
const next = vi.fn();
|
|
verifyCsrf(makeReq(method, undefined, undefined), makeRes(), next);
|
|
expect(next).toHaveBeenCalledOnce();
|
|
});
|
|
}
|
|
});
|
|
|
|
describe('mutating methods require valid token', () => {
|
|
const TOKEN = 'a'.repeat(64); // 64 hex chars = 32 bytes
|
|
|
|
for (const method of ['POST', 'PUT', 'PATCH', 'DELETE']) {
|
|
it(`allows ${method} with matching tokens`, () => {
|
|
const next = vi.fn();
|
|
const res = makeRes();
|
|
verifyCsrf(makeReq(method, TOKEN, TOKEN), res, next);
|
|
expect(next).toHaveBeenCalledOnce();
|
|
expect(res.statusCode).toBeNull();
|
|
});
|
|
|
|
it(`blocks ${method} with mismatched tokens`, () => {
|
|
const next = vi.fn();
|
|
const res = makeRes();
|
|
verifyCsrf(makeReq(method, TOKEN, TOKEN.replace('a', 'b')), res, next);
|
|
expect(res.statusCode).toBe(403);
|
|
expect(next).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it(`blocks ${method} with missing cookie token`, () => {
|
|
const next = vi.fn();
|
|
const res = makeRes();
|
|
verifyCsrf(makeReq(method, undefined, TOKEN), res, next);
|
|
expect(res.statusCode).toBe(403);
|
|
expect(res.body.error).toBe('CSRF token missing');
|
|
});
|
|
|
|
it(`blocks ${method} with missing header token`, () => {
|
|
const next = vi.fn();
|
|
const res = makeRes();
|
|
verifyCsrf(makeReq(method, TOKEN, undefined), res, next);
|
|
expect(res.statusCode).toBe(403);
|
|
});
|
|
}
|
|
|
|
it('blocks when tokens have different lengths (timing-safe path)', () => {
|
|
const next = vi.fn();
|
|
const res = makeRes();
|
|
verifyCsrf(makeReq('POST', 'short', 'much-longer-token-here'), res, next);
|
|
expect(res.statusCode).toBe(403);
|
|
expect(res.body.error).toBe('CSRF token invalid');
|
|
});
|
|
});
|
|
});
|