toor
1e9ea89d86
Import the client, server, skills, tests, and build scripts as the starting point for the rebuild, then trim the surfaces this project does not ship: Electron desktop packaging, the marketing website, and the ESP32 firmware tree. CI keeps the web build, e2e, lockfile, release, and Docker workflows. Rename the package and CLI entry points to hermes-ui, drop the prepare hook so npm ci no longer triggers a build, and drop the removed tsconfig and nodemon references. Rewrite AGENTS.md, ARCHITECTURE.md, DEVELOPMENT.md, and the READMEs so the documented package map and hard rules match this repository. reference_code/ is ignored: it is a read-only snapshot, not an input to the build.
75 lines
3.1 KiB
TypeScript
75 lines
3.1 KiB
TypeScript
import http from 'http'
|
|
import Koa from 'koa'
|
|
import { afterEach, describe, expect, it } from 'vitest'
|
|
import {
|
|
createCorsOriginResolver,
|
|
isOriginAllowed,
|
|
securityHeaders,
|
|
shouldRejectUpgradeOrigin,
|
|
} from '../../packages/server/src/security'
|
|
|
|
function fakeCtx(origin: string, host: string) {
|
|
return {
|
|
host,
|
|
get(name: string) {
|
|
return name.toLowerCase() === 'origin' ? origin : ''
|
|
},
|
|
} as any
|
|
}
|
|
|
|
describe('server security policy', () => {
|
|
let servers: http.Server[] = []
|
|
|
|
afterEach(async () => {
|
|
const closing = servers.map(server => new Promise<void>((resolve) => server.close(() => resolve())))
|
|
servers = []
|
|
await Promise.all(closing)
|
|
})
|
|
|
|
it('allows same-host browser origins without enabling wildcard CORS', async () => {
|
|
const resolveOrigin = createCorsOriginResolver('')
|
|
|
|
await expect(resolveOrigin(fakeCtx('http://127.0.0.1:8648', '127.0.0.1:8648'))).resolves.toBe('http://127.0.0.1:8648')
|
|
await expect(resolveOrigin(fakeCtx('https://evil.example', '127.0.0.1:8648'))).resolves.toBe('')
|
|
})
|
|
|
|
it('allows configured origins and explicit wildcard opt-in only', () => {
|
|
expect(isOriginAllowed('https://app.example', '127.0.0.1:8648', 'https://app.example')).toBe(true)
|
|
expect(isOriginAllowed('https://evil.example', '127.0.0.1:8648', 'https://app.example')).toBe(false)
|
|
expect(isOriginAllowed('null', '127.0.0.1:8648', '')).toBe(false)
|
|
expect(isOriginAllowed('null', '127.0.0.1:8648', '*')).toBe(true)
|
|
expect(isOriginAllowed('https://evil.example', '127.0.0.1:8648', '*')).toBe(true)
|
|
})
|
|
|
|
it('rejects disallowed browser websocket upgrade origins', () => {
|
|
expect(shouldRejectUpgradeOrigin({ headers: { origin: 'https://evil.example', host: '127.0.0.1:8648' } } as any, '')).toBe(true)
|
|
expect(shouldRejectUpgradeOrigin({ headers: { origin: 'null', host: '127.0.0.1:8648' } } as any, '')).toBe(true)
|
|
expect(shouldRejectUpgradeOrigin({ headers: { origin: 'http://127.0.0.1:8648', host: '127.0.0.1:8648' } } as any, '')).toBe(false)
|
|
expect(shouldRejectUpgradeOrigin({ headers: { host: '127.0.0.1:8648' } } as any, '')).toBe(false)
|
|
})
|
|
|
|
it('adds baseline browser security headers', async () => {
|
|
const app = new Koa()
|
|
app.use(securityHeaders())
|
|
app.use((ctx) => {
|
|
ctx.body = { ok: true }
|
|
})
|
|
const server = app.listen(0)
|
|
servers.push(server)
|
|
await new Promise<void>((resolve) => server.once('listening', () => resolve()))
|
|
const address = server.address()
|
|
if (!address || typeof address === 'string') throw new Error('expected tcp server')
|
|
|
|
const response = await fetch(`http://127.0.0.1:${address.port}/health`, {
|
|
headers: { 'x-forwarded-proto': 'https' },
|
|
})
|
|
|
|
expect(response.headers.get('x-content-type-options')).toBe('nosniff')
|
|
expect(response.headers.get('x-frame-options')).toBe('DENY')
|
|
expect(response.headers.get('referrer-policy')).toBe('no-referrer')
|
|
expect(response.headers.get('cross-origin-opener-policy')).toBe('same-origin-allow-popups')
|
|
expect(response.headers.get('content-security-policy')).toContain("default-src 'self'")
|
|
expect(response.headers.get('strict-transport-security')).toContain('max-age=31536000')
|
|
})
|
|
})
|