mirror of
https://github.com/hanzoai/chat.git
synced 2026-09-30 20:51:17 +00:00
zeekay
551236b1a5
Five things answered outside /v1/chat/. Four of them are chat's; they move.
/health -> /v1/chat/health
POST /oauth/iam/session-> POST /v1/chat/auth/iam/session (it is auth)
GET /oauth/openid[/callback], /oauth/error
-> /v1/chat/auth/openid[/callback], /v1/chat/auth/error
/images/ -> /v1/chat/images/
The fifth — the built assets at / and the SPA catch-all — is the SPA's, and
stays. Every caller moved in the same commit: api-endpoints (health, iamSession),
the metrics + telemetry health filter, the helm probes, the PR-preview workflow,
the PWA nav-fallback denylist. `ErrorController` matched a failed OIDC callback
by the substring '/oauth/', which the move would have silently broken; it now
matches the route.
Images are the one persisted case: a conversation stores the served path, and
history is immutable. New writes emit /v1/chat/images/…; /images/* answers one
permanent redirect; `isServedImage` (data-provider, the one place that knows the
namespace) recognises both. Local deletion maps the served path back to disk.
Two routers were written, tested, advertised to the browser — and never mounted,
so both were a guaranteed 404: skills (types say /v1/chat/skills) and the RUM
OTLP proxy (`rum/proxy` advertises /v1/chat/rum). Mounted where they said.
Deleted, with zero callers: server/experimental.js — a drifted second copy of
the whole mount table, still referencing a router that no longer exists, that
would have silently absorbed this move and diverged again; and nginx.hanzo.conf,
referenced by no compose/Dockerfile/chart, whose own /health shadowed chat's.
Gates collapsed to their one behavior, and the env deleted:
ALLOW_SOCIAL_LOGIN IAM is the one identity provider; false produced a
server with no way to sign in. socialLogins.js is now
iamLogin.js — one name for one thing.
CONTINUE_ON_UNCAUGHT_EXCEPTION keeps a process alive in an unknown state
instead of letting the kubelet replace it.
CONFIG_BYPASS_VALIDATION boots on invalid config, on request.
MCP_SKIP_CODE_CHALLENGE_CHECK turns off PKCE verification.
OPENID_JWKS_URL_CACHE_ENABLED read as `isEnabled(x) || true` — never off.
A second, differently-defaulted read lived in
remoteAgentAuth; both are now just on.
NO_INDEX a third boolean idiom for a header we always want.
DISABLE_COMPRESSION, ENABLE_IMAGE_OUTPUT_GZIP_SCAN — we write these images
ourselves, as PNG/GIF; none is gzipped on disk.
Tests fail without the change: the auth router spec (6 of 7) against the old
router, the static spec against the old env-gated one, the config spec now sets
CONFIG_BYPASS_VALIDATION=true and still expects the exit, the error spec against
the '/oauth/' matcher, and index.spec asserts the top level serves HTML — so a
probe or caller left behind fails loudly instead of looking green.
475 lines
19 KiB
JavaScript
475 lines
19 KiB
JavaScript
const jwt = require('jsonwebtoken');
|
|
const createValidateImageRequest = require('~/server/middleware/validateImageRequest');
|
|
|
|
// Mock only isEnabled, keep getBasePath real so it reads process.env.DOMAIN_CLIENT
|
|
jest.mock('@hanzochat/api', () => ({
|
|
...jest.requireActual('@hanzochat/api'),
|
|
isEnabled: jest.fn(),
|
|
}));
|
|
|
|
const { isEnabled } = require('@hanzochat/api');
|
|
|
|
describe('validateImageRequest middleware', () => {
|
|
let req, res, next, validateImageRequest;
|
|
const validObjectId = '65cfb246f7ecadb8b1e8036b';
|
|
|
|
beforeEach(() => {
|
|
jest.clearAllMocks();
|
|
req = {
|
|
headers: {},
|
|
originalUrl: '',
|
|
};
|
|
res = {
|
|
status: jest.fn().mockReturnThis(),
|
|
send: jest.fn(),
|
|
};
|
|
next = jest.fn();
|
|
process.env.JWT_REFRESH_SECRET = 'test-secret';
|
|
process.env.OPENID_REUSE_TOKENS = 'false';
|
|
delete process.env.DOMAIN_CLIENT; // Clear for tests without basePath
|
|
|
|
// Default: OpenID token reuse disabled
|
|
isEnabled.mockReturnValue(false);
|
|
});
|
|
|
|
afterEach(() => {
|
|
jest.clearAllMocks();
|
|
});
|
|
|
|
describe('Factory function', () => {
|
|
test('should return a pass-through middleware if secureImageLinks is false', async () => {
|
|
const middleware = createValidateImageRequest(false);
|
|
await middleware(req, res, next);
|
|
expect(next).toHaveBeenCalled();
|
|
expect(res.status).not.toHaveBeenCalled();
|
|
});
|
|
|
|
test('should return validation middleware if secureImageLinks is true', async () => {
|
|
validateImageRequest = createValidateImageRequest(true);
|
|
await validateImageRequest(req, res, next);
|
|
expect(res.status).toHaveBeenCalledWith(401);
|
|
expect(res.send).toHaveBeenCalledWith('Unauthorized');
|
|
});
|
|
});
|
|
|
|
describe('Standard Chat token flow', () => {
|
|
beforeEach(() => {
|
|
validateImageRequest = createValidateImageRequest(true);
|
|
});
|
|
|
|
test('should return 401 if refresh token is not provided', async () => {
|
|
await validateImageRequest(req, res, next);
|
|
expect(res.status).toHaveBeenCalledWith(401);
|
|
expect(res.send).toHaveBeenCalledWith('Unauthorized');
|
|
});
|
|
|
|
test('should return 403 if refresh token is invalid', async () => {
|
|
req.headers.cookie = 'refreshToken=invalid-token';
|
|
await validateImageRequest(req, res, next);
|
|
expect(res.status).toHaveBeenCalledWith(403);
|
|
expect(res.send).toHaveBeenCalledWith('Access Denied');
|
|
});
|
|
|
|
test('should return 403 if refresh token is expired', async () => {
|
|
const expiredToken = jwt.sign(
|
|
{ id: validObjectId, exp: Math.floor(Date.now() / 1000) - 3600 },
|
|
process.env.JWT_REFRESH_SECRET,
|
|
);
|
|
req.headers.cookie = `refreshToken=${expiredToken}`;
|
|
await validateImageRequest(req, res, next);
|
|
expect(res.status).toHaveBeenCalledWith(403);
|
|
expect(res.send).toHaveBeenCalledWith('Access Denied');
|
|
});
|
|
|
|
test('should call next() for valid image path', async () => {
|
|
const validToken = jwt.sign(
|
|
{ id: validObjectId, exp: Math.floor(Date.now() / 1000) + 3600 },
|
|
process.env.JWT_REFRESH_SECRET,
|
|
);
|
|
req.headers.cookie = `refreshToken=${validToken}`;
|
|
req.originalUrl = `/v1/chat/images/${validObjectId}/example.jpg`;
|
|
await validateImageRequest(req, res, next);
|
|
expect(next).toHaveBeenCalled();
|
|
});
|
|
|
|
test('should return 403 for invalid image path', async () => {
|
|
const validToken = jwt.sign(
|
|
{ id: validObjectId, exp: Math.floor(Date.now() / 1000) + 3600 },
|
|
process.env.JWT_REFRESH_SECRET,
|
|
);
|
|
req.headers.cookie = `refreshToken=${validToken}`;
|
|
req.originalUrl = '/v1/chat/images/65cfb246f7ecadb8b1e8036c/example.jpg'; // Different ObjectId
|
|
await validateImageRequest(req, res, next);
|
|
expect(res.status).toHaveBeenCalledWith(403);
|
|
expect(res.send).toHaveBeenCalledWith('Access Denied');
|
|
});
|
|
|
|
test('should allow agent avatar pattern for any valid ObjectId', async () => {
|
|
const validToken = jwt.sign(
|
|
{ id: validObjectId, exp: Math.floor(Date.now() / 1000) + 3600 },
|
|
process.env.JWT_REFRESH_SECRET,
|
|
);
|
|
req.headers.cookie = `refreshToken=${validToken}`;
|
|
req.originalUrl = '/v1/chat/images/65cfb246f7ecadb8b1e8036c/agent-avatar-12345.png';
|
|
await validateImageRequest(req, res, next);
|
|
expect(next).toHaveBeenCalled();
|
|
});
|
|
|
|
test('should prevent file traversal attempts', async () => {
|
|
const validToken = jwt.sign(
|
|
{ id: validObjectId, exp: Math.floor(Date.now() / 1000) + 3600 },
|
|
process.env.JWT_REFRESH_SECRET,
|
|
);
|
|
req.headers.cookie = `refreshToken=${validToken}`;
|
|
|
|
const traversalAttempts = [
|
|
`/v1/chat/images/${validObjectId}/../../../etc/passwd`,
|
|
`/v1/chat/images/${validObjectId}/..%2F..%2F..%2Fetc%2Fpasswd`,
|
|
`/v1/chat/images/${validObjectId}/image.jpg/../../../etc/passwd`,
|
|
`/v1/chat/images/${validObjectId}/%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd`,
|
|
];
|
|
|
|
for (const attempt of traversalAttempts) {
|
|
req.originalUrl = attempt;
|
|
await validateImageRequest(req, res, next);
|
|
expect(res.status).toHaveBeenCalledWith(403);
|
|
expect(res.send).toHaveBeenCalledWith('Access Denied');
|
|
jest.clearAllMocks();
|
|
// Reset mocks for next iteration
|
|
res.status = jest.fn().mockReturnThis();
|
|
res.send = jest.fn();
|
|
}
|
|
});
|
|
|
|
test('should handle URL encoded characters in valid paths', async () => {
|
|
const validToken = jwt.sign(
|
|
{ id: validObjectId, exp: Math.floor(Date.now() / 1000) + 3600 },
|
|
process.env.JWT_REFRESH_SECRET,
|
|
);
|
|
req.headers.cookie = `refreshToken=${validToken}`;
|
|
req.originalUrl = `/v1/chat/images/${validObjectId}/image%20with%20spaces.jpg`;
|
|
await validateImageRequest(req, res, next);
|
|
expect(next).toHaveBeenCalled();
|
|
});
|
|
});
|
|
|
|
describe('OpenID token flow', () => {
|
|
beforeEach(() => {
|
|
validateImageRequest = createValidateImageRequest(true);
|
|
// Enable OpenID token reuse
|
|
isEnabled.mockReturnValue(true);
|
|
process.env.OPENID_REUSE_TOKENS = 'true';
|
|
});
|
|
|
|
test('should return 403 if no OpenID user ID cookie when token_provider is openid', async () => {
|
|
req.headers.cookie = 'refreshToken=dummy-token; token_provider=openid';
|
|
await validateImageRequest(req, res, next);
|
|
expect(res.status).toHaveBeenCalledWith(403);
|
|
expect(res.send).toHaveBeenCalledWith('Access Denied');
|
|
});
|
|
|
|
test('should validate JWT-signed user ID for OpenID flow', async () => {
|
|
const signedUserId = jwt.sign(
|
|
{ id: validObjectId, exp: Math.floor(Date.now() / 1000) + 3600 },
|
|
process.env.JWT_REFRESH_SECRET,
|
|
);
|
|
req.headers.cookie = `refreshToken=dummy-token; token_provider=openid; openid_user_id=${signedUserId}`;
|
|
req.originalUrl = `/v1/chat/images/${validObjectId}/example.jpg`;
|
|
await validateImageRequest(req, res, next);
|
|
expect(next).toHaveBeenCalled();
|
|
});
|
|
|
|
test('should return 403 for invalid JWT-signed user ID', async () => {
|
|
req.headers.cookie =
|
|
'refreshToken=dummy-token; token_provider=openid; openid_user_id=invalid-jwt';
|
|
await validateImageRequest(req, res, next);
|
|
expect(res.status).toHaveBeenCalledWith(403);
|
|
expect(res.send).toHaveBeenCalledWith('Access Denied');
|
|
});
|
|
|
|
test('should return 403 for expired JWT-signed user ID', async () => {
|
|
const expiredSignedUserId = jwt.sign(
|
|
{ id: validObjectId, exp: Math.floor(Date.now() / 1000) - 3600 },
|
|
process.env.JWT_REFRESH_SECRET,
|
|
);
|
|
req.headers.cookie = `refreshToken=dummy-token; token_provider=openid; openid_user_id=${expiredSignedUserId}`;
|
|
await validateImageRequest(req, res, next);
|
|
expect(res.status).toHaveBeenCalledWith(403);
|
|
expect(res.send).toHaveBeenCalledWith('Access Denied');
|
|
});
|
|
|
|
test('should validate image path against JWT-signed user ID', async () => {
|
|
const signedUserId = jwt.sign(
|
|
{ id: validObjectId, exp: Math.floor(Date.now() / 1000) + 3600 },
|
|
process.env.JWT_REFRESH_SECRET,
|
|
);
|
|
const differentObjectId = '65cfb246f7ecadb8b1e8036c';
|
|
req.headers.cookie = `refreshToken=dummy-token; token_provider=openid; openid_user_id=${signedUserId}`;
|
|
req.originalUrl = `/v1/chat/images/${differentObjectId}/example.jpg`;
|
|
await validateImageRequest(req, res, next);
|
|
expect(res.status).toHaveBeenCalledWith(403);
|
|
expect(res.send).toHaveBeenCalledWith('Access Denied');
|
|
});
|
|
|
|
test('should allow agent avatars in OpenID flow', async () => {
|
|
const signedUserId = jwt.sign(
|
|
{ id: validObjectId, exp: Math.floor(Date.now() / 1000) + 3600 },
|
|
process.env.JWT_REFRESH_SECRET,
|
|
);
|
|
req.headers.cookie = `refreshToken=dummy-token; token_provider=openid; openid_user_id=${signedUserId}`;
|
|
req.originalUrl = '/v1/chat/images/65cfb246f7ecadb8b1e8036c/agent-avatar-12345.png';
|
|
await validateImageRequest(req, res, next);
|
|
expect(next).toHaveBeenCalled();
|
|
});
|
|
});
|
|
|
|
describe('Security edge cases', () => {
|
|
let validToken;
|
|
|
|
beforeEach(() => {
|
|
validateImageRequest = createValidateImageRequest(true);
|
|
validToken = jwt.sign(
|
|
{ id: validObjectId, exp: Math.floor(Date.now() / 1000) + 3600 },
|
|
process.env.JWT_REFRESH_SECRET,
|
|
);
|
|
});
|
|
|
|
test('should handle very long image filenames', async () => {
|
|
const longFilename = 'a'.repeat(1000) + '.jpg';
|
|
req.headers.cookie = `refreshToken=${validToken}`;
|
|
req.originalUrl = `/v1/chat/images/${validObjectId}/${longFilename}`;
|
|
await validateImageRequest(req, res, next);
|
|
expect(next).toHaveBeenCalled();
|
|
});
|
|
|
|
test('should handle URLs with maximum practical length', async () => {
|
|
// Most browsers support URLs up to ~2000 characters
|
|
const longFilename = 'x'.repeat(1900) + '.jpg';
|
|
req.headers.cookie = `refreshToken=${validToken}`;
|
|
req.originalUrl = `/v1/chat/images/${validObjectId}/${longFilename}`;
|
|
await validateImageRequest(req, res, next);
|
|
expect(next).toHaveBeenCalled();
|
|
});
|
|
|
|
test('should accept URLs just under the 2048 limit', async () => {
|
|
// Create a URL exactly 2047 characters long
|
|
const baseLength = `/v1/chat/images/${validObjectId}/`.length + '.jpg'.length;
|
|
const filenameLength = 2047 - baseLength;
|
|
const filename = 'a'.repeat(filenameLength) + '.jpg';
|
|
req.headers.cookie = `refreshToken=${validToken}`;
|
|
req.originalUrl = `/v1/chat/images/${validObjectId}/${filename}`;
|
|
await validateImageRequest(req, res, next);
|
|
expect(next).toHaveBeenCalled();
|
|
});
|
|
|
|
test('should handle malformed URL encoding gracefully', async () => {
|
|
req.headers.cookie = `refreshToken=${validToken}`;
|
|
req.originalUrl = `/v1/chat/images/${validObjectId}/test%ZZinvalid.jpg`;
|
|
await validateImageRequest(req, res, next);
|
|
expect(res.status).toHaveBeenCalledWith(403);
|
|
expect(res.send).toHaveBeenCalledWith('Access Denied');
|
|
});
|
|
|
|
test('should reject URLs with null bytes', async () => {
|
|
req.headers.cookie = `refreshToken=${validToken}`;
|
|
req.originalUrl = `/v1/chat/images/${validObjectId}/test\x00.jpg`;
|
|
await validateImageRequest(req, res, next);
|
|
expect(res.status).toHaveBeenCalledWith(403);
|
|
expect(res.send).toHaveBeenCalledWith('Access Denied');
|
|
});
|
|
|
|
test('should handle URLs with repeated slashes', async () => {
|
|
req.headers.cookie = `refreshToken=${validToken}`;
|
|
req.originalUrl = `/v1/chat/images/${validObjectId}//test.jpg`;
|
|
await validateImageRequest(req, res, next);
|
|
expect(res.status).toHaveBeenCalledWith(403);
|
|
expect(res.send).toHaveBeenCalledWith('Access Denied');
|
|
});
|
|
|
|
test('should reject extremely long URLs as potential DoS', async () => {
|
|
// Create a URL longer than 2048 characters
|
|
const baseLength = `/v1/chat/images/${validObjectId}/`.length + '.jpg'.length;
|
|
const filenameLength = 2049 - baseLength; // Ensure total length exceeds 2048
|
|
const extremelyLongFilename = 'x'.repeat(filenameLength) + '.jpg';
|
|
req.headers.cookie = `refreshToken=${validToken}`;
|
|
req.originalUrl = `/v1/chat/images/${validObjectId}/${extremelyLongFilename}`;
|
|
// Verify our test URL is actually too long
|
|
expect(req.originalUrl.length).toBeGreaterThan(2048);
|
|
await validateImageRequest(req, res, next);
|
|
expect(res.status).toHaveBeenCalledWith(403);
|
|
expect(res.send).toHaveBeenCalledWith('Access Denied');
|
|
});
|
|
});
|
|
|
|
describe('basePath functionality', () => {
|
|
let originalDomainClient;
|
|
|
|
beforeEach(() => {
|
|
originalDomainClient = process.env.DOMAIN_CLIENT;
|
|
});
|
|
|
|
afterEach(() => {
|
|
process.env.DOMAIN_CLIENT = originalDomainClient;
|
|
});
|
|
|
|
test('should validate image paths with base path', async () => {
|
|
process.env.DOMAIN_CLIENT = 'http://localhost:3080/chat';
|
|
const validToken = jwt.sign(
|
|
{ id: validObjectId, exp: Math.floor(Date.now() / 1000) + 3600 },
|
|
process.env.JWT_REFRESH_SECRET,
|
|
);
|
|
req.headers.cookie = `refreshToken=${validToken}`;
|
|
req.originalUrl = `/chat/v1/chat/images/${validObjectId}/test.jpg`;
|
|
|
|
await validateImageRequest(req, res, next);
|
|
expect(next).toHaveBeenCalled();
|
|
});
|
|
|
|
test('should validate agent avatar paths with base path', async () => {
|
|
process.env.DOMAIN_CLIENT = 'http://localhost:3080/chat';
|
|
const validToken = jwt.sign(
|
|
{ id: validObjectId, exp: Math.floor(Date.now() / 1000) + 3600 },
|
|
process.env.JWT_REFRESH_SECRET,
|
|
);
|
|
req.headers.cookie = `refreshToken=${validToken}`;
|
|
req.originalUrl = `/chat/v1/chat/images/${validObjectId}/agent-avatar.png`;
|
|
|
|
await validateImageRequest(req, res, next);
|
|
expect(next).toHaveBeenCalled();
|
|
});
|
|
|
|
test('should reject image paths without base path when DOMAIN_CLIENT is set', async () => {
|
|
process.env.DOMAIN_CLIENT = 'http://localhost:3080/chat';
|
|
const validToken = jwt.sign(
|
|
{ id: validObjectId, exp: Math.floor(Date.now() / 1000) + 3600 },
|
|
process.env.JWT_REFRESH_SECRET,
|
|
);
|
|
req.headers.cookie = `refreshToken=${validToken}`;
|
|
req.originalUrl = `/v1/chat/images/${validObjectId}/test.jpg`;
|
|
|
|
await validateImageRequest(req, res, next);
|
|
expect(res.status).toHaveBeenCalledWith(403);
|
|
expect(res.send).toHaveBeenCalledWith('Access Denied');
|
|
});
|
|
|
|
test('should handle empty base path (root deployment)', async () => {
|
|
process.env.DOMAIN_CLIENT = 'http://localhost:3080/';
|
|
const validToken = jwt.sign(
|
|
{ id: validObjectId, exp: Math.floor(Date.now() / 1000) + 3600 },
|
|
process.env.JWT_REFRESH_SECRET,
|
|
);
|
|
req.headers.cookie = `refreshToken=${validToken}`;
|
|
req.originalUrl = `/v1/chat/images/${validObjectId}/test.jpg`;
|
|
|
|
await validateImageRequest(req, res, next);
|
|
expect(next).toHaveBeenCalled();
|
|
});
|
|
|
|
test('should handle missing DOMAIN_CLIENT', async () => {
|
|
delete process.env.DOMAIN_CLIENT;
|
|
const validToken = jwt.sign(
|
|
{ id: validObjectId, exp: Math.floor(Date.now() / 1000) + 3600 },
|
|
process.env.JWT_REFRESH_SECRET,
|
|
);
|
|
req.headers.cookie = `refreshToken=${validToken}`;
|
|
req.originalUrl = `/v1/chat/images/${validObjectId}/test.jpg`;
|
|
|
|
await validateImageRequest(req, res, next);
|
|
expect(next).toHaveBeenCalled();
|
|
});
|
|
|
|
test('should handle nested subdirectories in base path', async () => {
|
|
process.env.DOMAIN_CLIENT = 'http://localhost:3080/apps/chat';
|
|
const validToken = jwt.sign(
|
|
{ id: validObjectId, exp: Math.floor(Date.now() / 1000) + 3600 },
|
|
process.env.JWT_REFRESH_SECRET,
|
|
);
|
|
req.headers.cookie = `refreshToken=${validToken}`;
|
|
req.originalUrl = `/apps/chat/v1/chat/images/${validObjectId}/test.jpg`;
|
|
|
|
await validateImageRequest(req, res, next);
|
|
expect(next).toHaveBeenCalled();
|
|
});
|
|
|
|
test('should prevent path traversal with base path', async () => {
|
|
process.env.DOMAIN_CLIENT = 'http://localhost:3080/chat';
|
|
const validToken = jwt.sign(
|
|
{ id: validObjectId, exp: Math.floor(Date.now() / 1000) + 3600 },
|
|
process.env.JWT_REFRESH_SECRET,
|
|
);
|
|
req.headers.cookie = `refreshToken=${validToken}`;
|
|
req.originalUrl = `/chat/v1/chat/images/${validObjectId}/../../../etc/passwd`;
|
|
|
|
await validateImageRequest(req, res, next);
|
|
expect(res.status).toHaveBeenCalledWith(403);
|
|
expect(res.send).toHaveBeenCalledWith('Access Denied');
|
|
});
|
|
|
|
test('should handle URLs with query parameters and base path', async () => {
|
|
process.env.DOMAIN_CLIENT = 'http://localhost:3080/chat';
|
|
const validToken = jwt.sign(
|
|
{ id: validObjectId, exp: Math.floor(Date.now() / 1000) + 3600 },
|
|
process.env.JWT_REFRESH_SECRET,
|
|
);
|
|
req.headers.cookie = `refreshToken=${validToken}`;
|
|
req.originalUrl = `/chat/v1/chat/images/${validObjectId}/test.jpg?version=1`;
|
|
|
|
await validateImageRequest(req, res, next);
|
|
expect(next).toHaveBeenCalled();
|
|
});
|
|
|
|
test('should handle URLs with fragments and base path', async () => {
|
|
process.env.DOMAIN_CLIENT = 'http://localhost:3080/chat';
|
|
const validToken = jwt.sign(
|
|
{ id: validObjectId, exp: Math.floor(Date.now() / 1000) + 3600 },
|
|
process.env.JWT_REFRESH_SECRET,
|
|
);
|
|
req.headers.cookie = `refreshToken=${validToken}`;
|
|
req.originalUrl = `/chat/v1/chat/images/${validObjectId}/test.jpg#section`;
|
|
|
|
await validateImageRequest(req, res, next);
|
|
expect(next).toHaveBeenCalled();
|
|
});
|
|
|
|
test('should handle HTTPS URLs with base path', async () => {
|
|
process.env.DOMAIN_CLIENT = 'https://example.com/chat';
|
|
const validToken = jwt.sign(
|
|
{ id: validObjectId, exp: Math.floor(Date.now() / 1000) + 3600 },
|
|
process.env.JWT_REFRESH_SECRET,
|
|
);
|
|
req.headers.cookie = `refreshToken=${validToken}`;
|
|
req.originalUrl = `/chat/v1/chat/images/${validObjectId}/test.jpg`;
|
|
|
|
await validateImageRequest(req, res, next);
|
|
expect(next).toHaveBeenCalled();
|
|
});
|
|
|
|
test('should handle invalid DOMAIN_CLIENT gracefully', async () => {
|
|
process.env.DOMAIN_CLIENT = 'not-a-valid-url';
|
|
const validToken = jwt.sign(
|
|
{ id: validObjectId, exp: Math.floor(Date.now() / 1000) + 3600 },
|
|
process.env.JWT_REFRESH_SECRET,
|
|
);
|
|
req.headers.cookie = `refreshToken=${validToken}`;
|
|
req.originalUrl = `/v1/chat/images/${validObjectId}/test.jpg`;
|
|
|
|
await validateImageRequest(req, res, next);
|
|
expect(next).toHaveBeenCalled();
|
|
});
|
|
|
|
test('should handle OpenID flow with base path', async () => {
|
|
process.env.DOMAIN_CLIENT = 'http://localhost:3080/chat';
|
|
process.env.OPENID_REUSE_TOKENS = 'true';
|
|
const validToken = jwt.sign(
|
|
{ id: validObjectId, exp: Math.floor(Date.now() / 1000) + 3600 },
|
|
process.env.JWT_REFRESH_SECRET,
|
|
);
|
|
req.headers.cookie = `refreshToken=${validToken}; token_provider=openid; openid_user_id=${validToken}`;
|
|
req.originalUrl = `/chat/v1/chat/images/${validObjectId}/test.jpg`;
|
|
|
|
await validateImageRequest(req, res, next);
|
|
expect(next).toHaveBeenCalled();
|
|
});
|
|
});
|
|
});
|