George Lambert
d8efffe8be
Some checks are pending
offline / test (push) Waiting to run
verae-staff-ui holds one review template for CS and access-staff. Staff cookies take STAFF_COOKIE_DOMAIN for a reverse-proxy host. /docs stays vendor Swagger with an integrator banner only.
19 lines
838 B
JavaScript
19 lines
838 B
JavaScript
import { test } from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { sessionToken, cookieOk, headerOk, cookieHeader } from '../src/token.js';
|
|
|
|
test('cookie matches HMAC of staff key', () => {
|
|
const tok = sessionToken();
|
|
assert.equal(tok.length, 64);
|
|
assert.equal(cookieOk({ headers: { cookie: `staff_session=${tok}` } }), true);
|
|
assert.equal(cookieOk({ headers: { cookie: 'staff_session=nope' } }), false);
|
|
assert.equal(headerOk({ headers: { 'x-staff-key': process.env.STAFF_KEY || 'admin-dev-key' } }), true);
|
|
});
|
|
|
|
test('cookie Domain is optional', () => {
|
|
delete process.env.STAFF_COOKIE_DOMAIN;
|
|
assert.equal(cookieHeader().includes('Domain='), false);
|
|
process.env.STAFF_COOKIE_DOMAIN = '.example.com';
|
|
assert.match(cookieHeader(), /Domain=\.example.com/);
|
|
delete process.env.STAFF_COOKIE_DOMAIN;
|
|
});
|