Do Siki
a7b1a2cab2
CI Pipeline with Test Management / 🧪 Run Tests & Generate Reports (push) Waiting to run
CI Pipeline with Test Management / 🐳 Docker Integration Tests (push) Blocked by required conditions
CI Pipeline with Test Management / 🏗️ Build Docker Image (push) Blocked by required conditions
CI Pipeline with Test Management / 📊 Generate Test Summary (push) Blocked by required conditions
Test Reporting & Gherkin Analysis / 🧪 Run Tests & Generate Reports (push) Waiting to run
Test Reporting & Gherkin Analysis / 📊 Analyze Test Coverage (push) Blocked by required conditions
Test Reporting & Gherkin Analysis / 🔄 Sync with Linear (push) Blocked by required conditions
Test Reporting & Gherkin Analysis / ⚡ Performance Monitoring (push) Blocked by required conditions
Safari-specific deviations fixed: 1. Safari shows its native auth dialog on fetch() calls answered with a 401 + WWW-Authenticate challenge (e.g. save with an expired session). All CMS 401 responses now omit WWW-Authenticate; browsers use the styled /login page instead. 2. Safari caches Basic credentials and resends them automatically, which made logout ineffective (a navigation after logout went straight back into the editor). Browser navigations (GET + text/html) now authenticate ONLY via the session cookie; Basic Auth remains valid for non-browser clients (curl, API). 3. /login and redirects send Cache-Control: no-store so Safari does not cache the login page or the 302. Closes MITHOME-62
91 lines
3.2 KiB
JavaScript
91 lines
3.2 KiB
JavaScript
#!/usr/bin/env node
|
|
|
|
/**
|
|
* Integration test for the Content Editor /logout endpoint.
|
|
* Spawns the real server on an ephemeral port and verifies:
|
|
* 1. /logout always answers 401 + WWW-Authenticate (invalidates cached Basic Auth)
|
|
* 2. /logout is exempt from the auth rate limiter (logging out never locks the user out)
|
|
* 3. the auth rate limiter still works for real failed logins (429 after the limit)
|
|
*/
|
|
const assert = require('assert/strict');
|
|
const fs = require('fs');
|
|
const os = require('os');
|
|
const path = require('path');
|
|
const { spawn } = require('child_process');
|
|
|
|
const PORT = 4123;
|
|
const BASE = `http://127.0.0.1:${PORT}`;
|
|
const ROOT = path.join(__dirname, '..');
|
|
const AUDIT_FILE = path.join(os.tmpdir(), `content-editor-audit-test-${process.pid}.jsonl`);
|
|
|
|
const env = {
|
|
...process.env,
|
|
CONTENT_EDITOR_PORT: String(PORT),
|
|
CONTENT_EDITOR_AUDIT_FILE: AUDIT_FILE,
|
|
CMS_USER: 'logout-test-user',
|
|
CMS_PASS: 'logout-test-pass',
|
|
CMS_DEPLOY_ENV: 'staging',
|
|
};
|
|
|
|
const child = spawn('node', ['content-editor.js'], { cwd: ROOT, env, stdio: 'ignore' });
|
|
|
|
async function waitForServer(timeoutMs = 10000) {
|
|
const deadline = Date.now() + timeoutMs;
|
|
while (Date.now() < deadline) {
|
|
try {
|
|
// Poll /logout (rate-limit-free) so the readiness probe itself never
|
|
// consumes a failed-login attempt from the auth rate limiter.
|
|
await fetch(`${BASE}/logout`);
|
|
return;
|
|
} catch {
|
|
await new Promise(r => setTimeout(r, 200));
|
|
}
|
|
}
|
|
throw new Error('server did not start');
|
|
}
|
|
|
|
async function main() {
|
|
await waitForServer();
|
|
|
|
// 1. /logout answers 401 without a Basic challenge (Safari would pop its
|
|
// native auth dialog on challenged fetch calls)
|
|
const logoutRes = await fetch(`${BASE}/logout`);
|
|
assert.equal(logoutRes.status, 401);
|
|
assert.equal(logoutRes.headers.get('www-authenticate'), null);
|
|
|
|
// 2. /logout is exempt from the auth rate limiter: many logout calls must not
|
|
// consume the failed-login budget.
|
|
for (let i = 0; i < 10; i++) {
|
|
const res = await fetch(`${BASE}/logout`);
|
|
assert.equal(res.status, 401);
|
|
}
|
|
// A failed real login right after the logout flood must still be 401, not 429.
|
|
const failed = await fetch(`${BASE}/`, {
|
|
headers: { 'Authorization': 'Basic ' + Buffer.from('logout-test-user:wrong').toString('base64') },
|
|
});
|
|
assert.equal(failed.status, 401);
|
|
|
|
// 3. The limiter still engages after repeated real failures (5 allowed, 6th → 429)
|
|
for (let i = 0; i < 4; i++) {
|
|
const res = await fetch(`${BASE}/`, {
|
|
headers: { 'Authorization': 'Basic ' + Buffer.from('logout-test-user:wrong').toString('base64') },
|
|
});
|
|
assert.equal(res.status, 401);
|
|
}
|
|
const limited = await fetch(`${BASE}/`, {
|
|
headers: { 'Authorization': 'Basic ' + Buffer.from('logout-test-user:wrong').toString('base64') },
|
|
});
|
|
assert.equal(limited.status, 429);
|
|
|
|
// Valid credentials would now also be throttled — that is expected limiter behavior.
|
|
|
|
console.log('Content Editor logout endpoint test: OK');
|
|
}
|
|
|
|
main()
|
|
.catch(err => { console.error('❌', err.message); process.exitCode = 1; })
|
|
.finally(() => {
|
|
child.kill('SIGTERM');
|
|
try { fs.unlinkSync(AUDIT_FILE); } catch { /* already gone */ }
|
|
});
|