Mattsson
550cadcb06
- Replace === with crypto.timingSafeEqual in all 7 cron routes via shared lib/auth/cron.ts - Add in-memory rate limiting (60 req/min) and expires_at support to calendar feed - Add exponential backoff on MFA verify after 3 failed attempts - Add 60s cooldown on password reset requests - Validate bank callback auth code format before API call - Redact session IDs from bank sync and callback logs - Validate OAuth redirect_uris against allowlist (claude.ai, claude.com, localhost) - Remove excessive PII/debug console logging from login page Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
65 lines
2.1 KiB
TypeScript
65 lines
2.1 KiB
TypeScript
import { describe, it, expect, beforeEach, vi } from 'vitest'
|
|
import { verifyCronSecret } from '../cron'
|
|
|
|
describe('verifyCronSecret', () => {
|
|
beforeEach(() => {
|
|
vi.unstubAllEnvs()
|
|
})
|
|
|
|
it('returns 401 when CRON_SECRET is not set', () => {
|
|
vi.stubEnv('CRON_SECRET', '')
|
|
const request = new Request('http://localhost/api/cron', {
|
|
headers: { authorization: 'Bearer test-secret' },
|
|
})
|
|
const result = verifyCronSecret(request)
|
|
expect(result).not.toBeNull()
|
|
expect(result!.status).toBe(401)
|
|
})
|
|
|
|
it('returns 401 when no authorization header is provided', () => {
|
|
vi.stubEnv('CRON_SECRET', 'test-secret')
|
|
const request = new Request('http://localhost/api/cron')
|
|
const result = verifyCronSecret(request)
|
|
expect(result).not.toBeNull()
|
|
expect(result!.status).toBe(401)
|
|
})
|
|
|
|
it('returns 401 when token does not match', () => {
|
|
vi.stubEnv('CRON_SECRET', 'correct-secret')
|
|
const request = new Request('http://localhost/api/cron', {
|
|
headers: { authorization: 'Bearer wrong-secret' },
|
|
})
|
|
const result = verifyCronSecret(request)
|
|
expect(result).not.toBeNull()
|
|
expect(result!.status).toBe(401)
|
|
})
|
|
|
|
it('returns null (authorized) when Bearer token matches', () => {
|
|
vi.stubEnv('CRON_SECRET', 'correct-secret')
|
|
const request = new Request('http://localhost/api/cron', {
|
|
headers: { authorization: 'Bearer correct-secret' },
|
|
})
|
|
const result = verifyCronSecret(request)
|
|
expect(result).toBeNull()
|
|
})
|
|
|
|
it('returns null (authorized) when bare token matches', () => {
|
|
vi.stubEnv('CRON_SECRET', 'correct-secret')
|
|
const request = new Request('http://localhost/api/cron', {
|
|
headers: { authorization: 'correct-secret' },
|
|
})
|
|
const result = verifyCronSecret(request)
|
|
expect(result).toBeNull()
|
|
})
|
|
|
|
it('handles tokens of different lengths safely', () => {
|
|
vi.stubEnv('CRON_SECRET', 'short')
|
|
const request = new Request('http://localhost/api/cron', {
|
|
headers: { authorization: 'Bearer a-much-longer-token-that-differs-in-length' },
|
|
})
|
|
const result = verifyCronSecret(request)
|
|
expect(result).not.toBeNull()
|
|
expect(result!.status).toBe(401)
|
|
})
|
|
})
|