mirror of
https://github.com/hanzoai/chat.git
synced 2026-09-30 20:51:17 +00:00
zooqueen
3c15370f7d
Chat was minting its own credentials on top of an identity IAM had already established: the browser ran the PKCE flow, posted the resulting IAM token to a bridge, and got back a Chat JWT, a refresh cookie and a Session row. Everything after login was authenticated by that second credential, and IAM's was filed away server-side for calls to cloud. The token IAM issues is now the only one. It rides every request as the bearer, is verified against IAM's JWKS on the spot, and is not stored — so there is one credential, and the principal that authenticates here is by construction the principal cloud bills. `resolveTenantBearer` loses the machinery that existed to keep a stored copy honest (principal binding, expiry checks, cookie fallback, the renewal middleware in front of the completion route); a token that IS the request cannot name a different user or outlive the request it arrived on. The audience is now checked. One issuer serves every Hanzo relying party, so a token addressed to another app would otherwise authenticate here on the strength of a shared signature. Removed, because IAM owns them: two-factor enrolment and verification, email verification, password reset, the admin panel's OAuth code exchange, and the server-initiated OpenID redirect. Sign-out now ends the session where it lives — revoking both tokens at the issuer — rather than dropping the local copy and leaving the browser recognised. A guest holds nothing at all. Anonymous chat used to mint a signed guest token, which proved nothing: minting was unauthenticated and the free-message quota keyed on the client address regardless. A request without a bearer is now the guest, identified by that same address, hashed so it stays out of job metadata and logs.
123 lines
3.8 KiB
JavaScript
123 lines
3.8 KiB
JavaScript
jest.mock('@hanzochat/api', () => ({
|
|
isEnabled: (value) => value === 'true' || value === true,
|
|
}));
|
|
|
|
jest.mock('@hanzochat/data-provider', () => ({
|
|
EModelEndpoint: { custom: 'custom' },
|
|
}));
|
|
|
|
const {
|
|
getGuestConfig,
|
|
buildGuestPrincipal,
|
|
buildGuestUser,
|
|
buildGuestEndpointsConfig,
|
|
buildGuestModelsConfig,
|
|
GUEST_ROLE,
|
|
GUEST_NAME,
|
|
DEFAULT_GUEST_MESSAGE_MAX,
|
|
DEFAULT_GUEST_ENDPOINT,
|
|
DEFAULT_GUEST_MODEL,
|
|
} = require('./guestConfig');
|
|
|
|
describe('getGuestConfig', () => {
|
|
const originalEnv = { ...process.env };
|
|
|
|
beforeEach(() => {
|
|
delete process.env.ALLOW_GUEST_CHAT;
|
|
delete process.env.GUEST_MESSAGE_MAX;
|
|
delete process.env.GUEST_TOKEN_EXPIRY;
|
|
delete process.env.GUEST_ENDPOINT;
|
|
delete process.env.GUEST_MODEL;
|
|
});
|
|
|
|
afterAll(() => {
|
|
process.env = originalEnv;
|
|
});
|
|
|
|
it('is disabled by default (fail closed)', () => {
|
|
expect(getGuestConfig().enabled).toBe(false);
|
|
});
|
|
|
|
it('is enabled only when ALLOW_GUEST_CHAT is truthy', () => {
|
|
process.env.ALLOW_GUEST_CHAT = 'true';
|
|
expect(getGuestConfig().enabled).toBe(true);
|
|
});
|
|
|
|
it('uses defaults when env is unset', () => {
|
|
const config = getGuestConfig();
|
|
expect(config.messageMax).toBe(DEFAULT_GUEST_MESSAGE_MAX);
|
|
expect(config.endpoint).toBe(DEFAULT_GUEST_ENDPOINT);
|
|
expect(config.model).toBe(DEFAULT_GUEST_MODEL);
|
|
});
|
|
|
|
it('honors GUEST_MESSAGE_MAX', () => {
|
|
process.env.GUEST_MESSAGE_MAX = '7';
|
|
expect(getGuestConfig().messageMax).toBe(7);
|
|
});
|
|
|
|
it('falls back to default for invalid or non-positive GUEST_MESSAGE_MAX', () => {
|
|
process.env.GUEST_MESSAGE_MAX = 'abc';
|
|
expect(getGuestConfig().messageMax).toBe(DEFAULT_GUEST_MESSAGE_MAX);
|
|
process.env.GUEST_MESSAGE_MAX = '0';
|
|
expect(getGuestConfig().messageMax).toBe(DEFAULT_GUEST_MESSAGE_MAX);
|
|
process.env.GUEST_MESSAGE_MAX = '-5';
|
|
expect(getGuestConfig().messageMax).toBe(DEFAULT_GUEST_MESSAGE_MAX);
|
|
});
|
|
|
|
it('honors the configurable guest endpoint and model', () => {
|
|
process.env.GUEST_ENDPOINT = 'Hanzo';
|
|
process.env.GUEST_MODEL = 'zen4-mini';
|
|
const config = getGuestConfig();
|
|
expect(config.endpoint).toBe('Hanzo');
|
|
expect(config.model).toBe('zen4-mini');
|
|
});
|
|
|
|
it('exposes GUEST_ROLE constant', () => {
|
|
expect(GUEST_ROLE).toBe('GUEST');
|
|
});
|
|
});
|
|
|
|
describe('guest principal + scoped-config builders', () => {
|
|
beforeEach(() => {
|
|
delete process.env.GUEST_ENDPOINT;
|
|
delete process.env.GUEST_MODEL;
|
|
});
|
|
|
|
const req = { headers: { 'cf-connecting-ip': '203.0.113.7' } };
|
|
|
|
it('buildGuestPrincipal returns an ephemeral GUEST principal with no DB id/email', () => {
|
|
const principal = buildGuestPrincipal(req);
|
|
expect(principal).toEqual({
|
|
id: expect.stringMatching(/^guest_[0-9a-f]{32}$/),
|
|
role: GUEST_ROLE,
|
|
name: GUEST_NAME,
|
|
guest: true,
|
|
});
|
|
expect(principal).not.toHaveProperty('email');
|
|
expect(principal).not.toHaveProperty('_id');
|
|
});
|
|
|
|
it('buildGuestUser exposes only safe, guest-scoped fields (no email)', () => {
|
|
const user = buildGuestUser(buildGuestPrincipal(req));
|
|
expect(user.id).toMatch(/^guest_[0-9a-f]{32}$/);
|
|
expect(user.role).toBe(GUEST_ROLE);
|
|
expect(user.name).toBe(GUEST_NAME);
|
|
expect(user.guest).toBe(true);
|
|
expect(user).not.toHaveProperty('email');
|
|
expect(user).not.toHaveProperty('password');
|
|
});
|
|
|
|
it('buildGuestEndpointsConfig exposes ONLY the configured guest endpoint', () => {
|
|
process.env.GUEST_ENDPOINT = 'Hanzo';
|
|
const config = buildGuestEndpointsConfig();
|
|
expect(Object.keys(config)).toEqual(['Hanzo']);
|
|
expect(config.Hanzo).toMatchObject({ type: 'custom', userProvide: false });
|
|
});
|
|
|
|
it('buildGuestModelsConfig exposes ONLY the single configured guest model', () => {
|
|
process.env.GUEST_ENDPOINT = 'Hanzo';
|
|
process.env.GUEST_MODEL = 'zen5-mini';
|
|
expect(buildGuestModelsConfig()).toEqual({ Hanzo: ['zen5-mini'] });
|
|
});
|
|
});
|