113 lines
3.7 KiB
TypeScript
113 lines
3.7 KiB
TypeScript
import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
|
|
import {
|
|
validateCorsOrigin,
|
|
parseCorsAllowlist,
|
|
} from "~/server/lib/cors-validation";
|
|
|
|
describe("validateCorsOrigin", () => {
|
|
describe("accepted origins", () => {
|
|
it("accepts valid HTTPS origins", () => {
|
|
expect(validateCorsOrigin("https://app.kordant.com")).toBe(true);
|
|
expect(validateCorsOrigin("https://admin.kordant.com")).toBe(true);
|
|
expect(validateCorsOrigin("https://localhost:3000")).toBe(true);
|
|
});
|
|
|
|
it("accepts valid HTTP origins", () => {
|
|
expect(validateCorsOrigin("http://localhost:3000")).toBe(true);
|
|
expect(validateCorsOrigin("http://localhost:3001")).toBe(true);
|
|
expect(validateCorsOrigin("http://127.0.0.1:8080")).toBe(true);
|
|
});
|
|
|
|
it("accepts origins with ports", () => {
|
|
expect(validateCorsOrigin("https://app.kordant.com:8443")).toBe(true);
|
|
expect(validateCorsOrigin("http://localhost:5173")).toBe(true);
|
|
});
|
|
|
|
it("accepts origins with paths", () => {
|
|
expect(validateCorsOrigin("https://app.kordant.com/api")).toBe(true);
|
|
});
|
|
});
|
|
|
|
describe("rejected origins", () => {
|
|
it("rejects wildcard", () => {
|
|
expect(validateCorsOrigin("*")).toBe(false);
|
|
});
|
|
|
|
it("rejects missing scheme", () => {
|
|
expect(validateCorsOrigin("evil.com")).toBe(false);
|
|
expect(validateCorsOrigin("localhost")).toBe(false);
|
|
expect(validateCorsOrigin("app.kordant.com")).toBe(false);
|
|
});
|
|
|
|
it("rejects non-HTTP schemes", () => {
|
|
expect(validateCorsOrigin("ftp://evil.com")).toBe(false);
|
|
expect(validateCorsOrigin("file:///etc/passwd")).toBe(false);
|
|
expect(validateCorsOrigin("javascript:alert(1)")).toBe(false);
|
|
expect(validateCorsOrigin("data:text/html,test")).toBe(false);
|
|
});
|
|
|
|
it("rejects empty and whitespace strings", () => {
|
|
expect(validateCorsOrigin("")).toBe(false);
|
|
expect(validateCorsOrigin(" ")).toBe(false);
|
|
expect(validateCorsOrigin("\t")).toBe(false);
|
|
});
|
|
|
|
it("rejects malformed URLs", () => {
|
|
expect(validateCorsOrigin("not a url")).toBe(false);
|
|
expect(validateCorsOrigin("://missing-protocol")).toBe(false);
|
|
});
|
|
});
|
|
});
|
|
|
|
describe("parseCorsAllowlist", () => {
|
|
beforeEach(() => {
|
|
vi.spyOn(console, "warn").mockImplementation(() => {});
|
|
});
|
|
|
|
afterEach(() => {
|
|
vi.restoreAllMocks();
|
|
});
|
|
|
|
it("returns empty array for undefined/null/empty input", () => {
|
|
expect(parseCorsAllowlist(undefined)).toEqual([]);
|
|
expect(parseCorsAllowlist(null)).toEqual([]);
|
|
expect(parseCorsAllowlist("")).toEqual([]);
|
|
expect(parseCorsAllowlist(" ")).toEqual([]);
|
|
});
|
|
|
|
it("parses and validates a comma-separated list of origins", () => {
|
|
const result = parseCorsAllowlist(
|
|
"https://app.kordant.com,https://admin.kordant.com",
|
|
);
|
|
expect(result).toEqual([
|
|
"https://app.kordant.com",
|
|
"https://admin.kordant.com",
|
|
]);
|
|
});
|
|
|
|
it("filters out invalid origins and warns", () => {
|
|
const result = parseCorsAllowlist(
|
|
"https://app.kordant.com,evil.com,*,ftp://bad.com",
|
|
);
|
|
expect(result).toEqual(["https://app.kordant.com"]);
|
|
expect(console.warn).toHaveBeenCalledTimes(3);
|
|
});
|
|
|
|
it("rejects http://localhost:9999 when not in the allowlist", () => {
|
|
// This origin is not in the configured list
|
|
const result = parseCorsAllowlist("https://app.kordant.com");
|
|
expect(result).not.toContain("http://localhost:9999");
|
|
expect(result).toEqual(["https://app.kordant.com"]);
|
|
});
|
|
|
|
it("handles whitespace around commas", () => {
|
|
const result = parseCorsAllowlist(
|
|
" https://app.kordant.com , https://admin.kordant.com ",
|
|
);
|
|
expect(result).toEqual([
|
|
"https://app.kordant.com",
|
|
"https://admin.kordant.com",
|
|
]);
|
|
});
|
|
});
|