George Lambert
9cc0018708
Some checks are pending
offline / test (push) Waiting to run
Account-balance stores display names and looks up by name. Edge writes names on customer create/edit; staff UIs join from edge when needed. New verae-staff-session issues a host cookie; department HTML redirects when STAFF_AUTH=1. JOBS_EVENTS_EXCLUSIVE lets jobs-events own the durable consumer. Catalog index is cards; disabled fleet machines are grey.
11 lines
526 B
JavaScript
11 lines
526 B
JavaScript
import { test } from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { sessionToken, cookieOk, headerOk } from '../src/token.js';
|
|
|
|
test('cookie matches HMAC of staff key', () => {
|
|
const tok = sessionToken();
|
|
assert.equal(tok.length, 64);
|
|
assert.equal(cookieOk({ headers: { cookie: `staff_session=${tok}` } }), true);
|
|
assert.equal(cookieOk({ headers: { cookie: 'staff_session=nope' } }), false);
|
|
assert.equal(headerOk({ headers: { 'x-staff-key': process.env.STAFF_KEY || 'admin-dev-key' } }), true);
|
|
});
|