Something went wrong. Try again.
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839import { describe, expect, it } from "vitest";import { isLoopbackHost, secureHttpBase, secureSocketFor } from "../../shared/secureAddress";import { buildWorkerManifest } from "../../extension/manifest";import { createCredentialManager } from "../../extension/worker/credentials";
describe("tokens only travel over https, or to this machine", () => { it("knows loopback hosts", () => { for (const h of ["localhost", "LOCALHOST", "127.0.0.1", "127.1.2.3", "::1", "[::1]"]) expect(isLoopbackHost(h)).toBe(true); for (const h of ["example.com", "128.0.0.1", "127.0.0.1.evil.example", "10.0.0.5"]) expect(isLoopbackHost(h)).toBe(false); }); it("accepts https and loopback http for the central address, nothing else", () => { expect(secureHttpBase("https://central.example/")).toBe("https://central.example"); expect(secureHttpBase("http://127.0.0.1:4790")).toBe("http://127.0.0.1:4790"); expect(secureHttpBase("http://central.example")).toBeUndefined(); expect(secureHttpBase("http://10.0.0.5:4790")).toBeUndefined(); expect(secureHttpBase("ftp://x")).toBeUndefined(); expect(secureHttpBase("not a url")).toBeUndefined(); }); it("the doorbell socket must be wss (or loopback ws) on the central host", () => { expect(secureSocketFor("wss://central.example/xmpp", "https://central.example")).toBe(true); expect(secureSocketFor("ws://127.0.0.1:5290/xmpp", "http://127.0.0.1:4790")).toBe(true); expect(secureSocketFor("ws://central.example/xmpp", "https://central.example")).toBe(false); expect(secureSocketFor("wss://elsewhere.example/xmpp", "https://central.example")).toBe(false); expect(secureSocketFor("garbage", "https://central.example")).toBe(false); }); it("the worker manifest refuses an unencrypted central address that is not this machine", () => { expect(() => buildWorkerManifest(["https://app.example"], "0.0.0", { central: "http://central.example" })).toThrow(/https/); expect(() => buildWorkerManifest(["https://app.example"], "0.0.0", { central: "https://central.example" })).not.toThrow(); expect(() => buildWorkerManifest(["https://app.example"], "0.0.0", { central: "http://127.0.0.1:4790" })).not.toThrow(); }); it("enrolment refuses to send its code to an unencrypted remote address", async () => { let called = false; const m = createCredentialManager({ load: async () => undefined, save: async () => undefined, fetch: (async () => ((called = true), new Response("{}"))) as never, now: () => 0, timeoutMs: 100 }); const r = await m.enrol({ central: "http://central.example", code: "ABCD-EFGH" }); expect(r.ok).toBe(false); expect(called).toBe(false); });});