wmailhub/tests/auth.test.ts

/** 认证与会话测试:登录、错误密码、会话校验、登出、CSRF Origin */
import { describe, expect, test } from "bun:test";
import { authedFetch, loginCookie, makeTestEnv } from "./helpers.ts";

describe("用户认证(默认 admin/admin)", () => {
  test("正确账密登录并拿到会话", async () => {
    const t = await makeTestEnv();
    const cookie = await loginCookie(t);
    const me = await authedFetch(t, cookie, "http://localhost/api/auth/me");
    expect(me.status).toBe(200);
    const data = (await me.json()) as { user: { username: string } };
    expect(data.user.username).toBe("admin");
  });

  test("错误密码返回 401", async () => {
    const t = await makeTestEnv();
    const resp = await t.app.fetch(
      new Request("http://localhost/api/auth/login", {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({ username: "admin", password: "wrong" }),
      }),
      t.env,
    );
    expect(resp.status).toBe(401);
  });

  test("无会话访问受保护接口返回 401", async () => {
    const t = await makeTestEnv();
    const resp = await t.app.fetch(new Request("http://localhost/api/nodes"), t.env);
    expect(resp.status).toBe(401);
  });

  test("登出后会话失效(clients 清 cookie 后 401)", async () => {
    const t = await makeTestEnv();
    const cookie = await loginCookie(t);
    await authedFetch(t, cookie, "http://localhost/api/auth/logout", { method: "POST" });
    const me = await t.app.fetch(new Request("http://localhost/api/auth/me"), t.env);
    expect(me.status).toBe(401);
  });

  test("伪造会话 cookie 被拒(签名不匹配)", async () => {
    const t = await makeTestEnv();
    const resp = await authedFetch(t, "wmh_session=eyJhIjoxfQ.deadbeef", "http://localhost/api/auth/me");
    expect(resp.status).toBe(401);
  });

  test("跨域 Origin 写请求被拒(CSRF)", async () => {
    const t = await makeTestEnv();
    const cookie = await loginCookie(t);
    const resp = await authedFetch(t, cookie, "http://localhost/api/keys", {
      method: "POST",
      headers: { "Content-Type": "application/json", Origin: "https://evil.example.com" },
      body: JSON.stringify({ kind: "api" }),
    });
    expect(resp.status).toBe(403);
  });
});