mirror of
https://github.com/saltbo/zpan.git
synced 2026-08-29 00:01:42 +08:00
Jasper Van
b92df828ab
* ci: parallelize and isolate test suites * ci: avoid unavailable Playwright video runtime * ci: shard coverage and cache docker smoke * ci: balance Playwright shards by test * ci: smoke test the CLI container * ci: enforce merged coverage thresholds * ci: ratchet canonical coverage baseline * ci: make coverage ratchet lossless * ci: organize parallel gates by responsibility * perf(ci): reduce total runner time * perf(ci): balance runner cost and latency * perf(ci): suppress passing test logs * fix(test): make coverage sorting proof deterministic * perf(docker): exclude test-only build inputs * perf(ci): scope Docker smokes to packaging changes * refactor(test): enforce fast test boundaries * test: isolate coverage ownership * perf(test): run backend projects concurrently * perf(ci): separate test layers by runtime * perf(test): separate integration boundaries * perf(ci): prioritize test runners * docs(ci): clarify package scheduling * test: restore shared Cloudflare mocks * fix(preview): isolate Cloudflare E2E build config * fix(auth): bind preview sessions to request origin * revert: remove ineffective preview auth workaround * fix(auth): stop signing JWTs on session reads
35 lines
1.2 KiB
TypeScript
35 lines
1.2 KiB
TypeScript
import { describe, expect, it } from 'vitest'
|
|
import { createTestApp } from './test/setup.js'
|
|
|
|
describe('API CORS', () => {
|
|
it('allows configured auth and trusted origins', async () => {
|
|
const { app } = await createTestApp({
|
|
BETTER_AUTH_URL: 'https://zpan.space',
|
|
TRUSTED_ORIGINS: 'https://app.example.com',
|
|
})
|
|
|
|
const authOriginRes = await app.request('/api/auth/get-session', {
|
|
headers: { Origin: 'https://zpan.space' },
|
|
})
|
|
expect(authOriginRes.headers.get('Access-Control-Allow-Origin')).toBe('https://zpan.space')
|
|
|
|
const trustedOriginRes = await app.request('/api/auth/get-session', {
|
|
headers: { Origin: 'https://app.example.com' },
|
|
})
|
|
expect(trustedOriginRes.headers.get('Access-Control-Allow-Origin')).toBe('https://app.example.com')
|
|
})
|
|
|
|
it('does not reflect untrusted origins', async () => {
|
|
const { app } = await createTestApp({
|
|
BETTER_AUTH_URL: 'https://zpan.space',
|
|
TRUSTED_ORIGINS: 'https://app.example.com',
|
|
})
|
|
|
|
const res = await app.request('/api/auth/get-session', {
|
|
headers: { Origin: 'https://evil.example' },
|
|
})
|
|
|
|
expect(res.headers.get('Access-Control-Allow-Origin')).toBeNull()
|
|
})
|
|
})
|