mirror of
https://github.com/tiennm99/ccs.git
synced 2026-07-15 14:21:20 +00:00
test(cliproxy): add comprehensive auth token test suite
- auth-token-manager.test.js: token generation, masking, inheritance (35 tests) - tokens-command.test.js: CLI parsing and flag handling (24 tests) - settings-routes-auth.test.js: API endpoint responses (22 tests) - Total: 81 new tests covering all auth token functionality
This commit is contained in:
kaitranntt
@@ -0,0 +1,425 @@
|
||||
/**
|
||||
* Auth Token Manager Tests
|
||||
*
|
||||
* Comprehensive test suite for CLIProxy auth token management including:
|
||||
* - Token generation (cryptographic security)
|
||||
* - Token masking
|
||||
* - Pure function logic tests
|
||||
*/
|
||||
|
||||
const assert = require('assert');
|
||||
const crypto = require('crypto');
|
||||
|
||||
describe('Auth Token Manager', () => {
|
||||
// =========================================================================
|
||||
// Token Generation Tests (Pure Functions)
|
||||
// =========================================================================
|
||||
describe('generateSecureToken', () => {
|
||||
let generateSecureToken;
|
||||
|
||||
beforeEach(() => {
|
||||
// Clear cache and reload
|
||||
delete require.cache[require.resolve('../../../dist/cliproxy/auth-token-manager')];
|
||||
const authTokenManager = require('../../../dist/cliproxy/auth-token-manager');
|
||||
generateSecureToken = authTokenManager.generateSecureToken;
|
||||
});
|
||||
|
||||
it('generates token of correct length (base64url encoding)', () => {
|
||||
const token = generateSecureToken(32);
|
||||
// 32 bytes = 43 chars in base64url (without padding)
|
||||
assert.strictEqual(token.length, 43);
|
||||
});
|
||||
|
||||
it('generates unique tokens each call', () => {
|
||||
const tokens = new Set();
|
||||
for (let i = 0; i < 100; i++) {
|
||||
tokens.add(generateSecureToken(32));
|
||||
}
|
||||
assert.strictEqual(tokens.size, 100, 'All 100 tokens should be unique');
|
||||
});
|
||||
|
||||
it('uses base64url encoding (no +/= characters)', () => {
|
||||
// Generate many tokens to ensure we hit all character ranges
|
||||
for (let i = 0; i < 50; i++) {
|
||||
const token = generateSecureToken(32);
|
||||
assert(!token.includes('+'), 'Should not contain +');
|
||||
assert(!token.includes('/'), 'Should not contain /');
|
||||
assert(!token.includes('='), 'Should not contain padding =');
|
||||
}
|
||||
});
|
||||
|
||||
it('accepts custom length parameter', () => {
|
||||
const short = generateSecureToken(16);
|
||||
const long = generateSecureToken(64);
|
||||
|
||||
// 16 bytes = 22 chars, 64 bytes = 86 chars in base64url
|
||||
assert.strictEqual(short.length, 22);
|
||||
assert.strictEqual(long.length, 86);
|
||||
});
|
||||
|
||||
it('handles edge case: length = 0', () => {
|
||||
const empty = generateSecureToken(0);
|
||||
assert.strictEqual(empty.length, 0);
|
||||
});
|
||||
|
||||
it('handles edge case: very large length', () => {
|
||||
const large = generateSecureToken(256);
|
||||
assert.strictEqual(large.length, 342); // 256 bytes = 342 chars in base64url
|
||||
});
|
||||
|
||||
it('uses cryptographically secure random bytes', () => {
|
||||
// Verify the function uses crypto.randomBytes internally
|
||||
// by checking statistical properties of generated tokens
|
||||
const tokens = [];
|
||||
for (let i = 0; i < 1000; i++) {
|
||||
tokens.push(generateSecureToken(32));
|
||||
}
|
||||
|
||||
// All tokens should be unique
|
||||
const uniqueTokens = new Set(tokens);
|
||||
assert.strictEqual(uniqueTokens.size, 1000, 'All tokens should be unique');
|
||||
|
||||
// Check that first character has good distribution (not always same)
|
||||
const firstChars = new Set(tokens.map((t) => t[0]));
|
||||
assert(firstChars.size > 10, 'First character should have good distribution');
|
||||
});
|
||||
});
|
||||
|
||||
// =========================================================================
|
||||
// Token Masking Tests (Pure Function Simulation)
|
||||
// =========================================================================
|
||||
describe('maskToken (logic validation)', () => {
|
||||
// Simulates the maskToken function from tokens-command.ts and settings-routes.ts
|
||||
function maskToken(token) {
|
||||
if (token.length <= 8) return '****';
|
||||
return `${token.slice(0, 4)}...${token.slice(-4)}`;
|
||||
}
|
||||
|
||||
it('masks tokens showing first 4 and last 4 characters', () => {
|
||||
assert.strictEqual(maskToken('1234567890abcdef'), '1234...cdef');
|
||||
});
|
||||
|
||||
it('returns **** for tokens <= 8 characters', () => {
|
||||
assert.strictEqual(maskToken('12345678'), '****');
|
||||
assert.strictEqual(maskToken('1234567'), '****');
|
||||
assert.strictEqual(maskToken('abc'), '****');
|
||||
assert.strictEqual(maskToken(''), '****');
|
||||
});
|
||||
|
||||
it('handles exactly 9 character tokens', () => {
|
||||
assert.strictEqual(maskToken('123456789'), '1234...6789');
|
||||
});
|
||||
|
||||
it('handles long tokens (typical API keys)', () => {
|
||||
const longToken = 'test_key_1234567890abcdefghijklmnopqrstuvwxyz';
|
||||
assert.strictEqual(maskToken(longToken), 'test...wxyz');
|
||||
});
|
||||
|
||||
it('preserves special characters', () => {
|
||||
assert.strictEqual(maskToken('!@#$abcd____wxyz'), '!@#$...wxyz');
|
||||
});
|
||||
|
||||
it('handles default CCS internal key', () => {
|
||||
const internalKey = 'ccs-internal-managed';
|
||||
assert.strictEqual(maskToken(internalKey), 'ccs-...aged');
|
||||
});
|
||||
|
||||
it('handles default CCS control panel secret', () => {
|
||||
const secret = 'ccs';
|
||||
assert.strictEqual(maskToken(secret), '****');
|
||||
});
|
||||
});
|
||||
|
||||
// =========================================================================
|
||||
// Inheritance Chain Logic Tests
|
||||
// =========================================================================
|
||||
describe('getEffectiveApiKey logic', () => {
|
||||
/**
|
||||
* Simulates the inheritance logic from auth-token-manager.ts
|
||||
*/
|
||||
function getEffectiveApiKey(config, variantName, defaultKey) {
|
||||
// Priority 1: Per-variant override
|
||||
if (variantName) {
|
||||
const variant = config.cliproxy?.variants?.[variantName];
|
||||
if (variant?.auth?.api_key) {
|
||||
return variant.auth.api_key;
|
||||
}
|
||||
}
|
||||
|
||||
// Priority 2: Global cliproxy.auth
|
||||
if (config.cliproxy?.auth?.api_key) {
|
||||
return config.cliproxy.auth.api_key;
|
||||
}
|
||||
|
||||
// Priority 3: Default constant
|
||||
return defaultKey;
|
||||
}
|
||||
|
||||
const DEFAULT_KEY = 'ccs-internal-managed';
|
||||
|
||||
it('returns default when no custom config', () => {
|
||||
const config = { cliproxy: { variants: {} } };
|
||||
assert.strictEqual(getEffectiveApiKey(config, undefined, DEFAULT_KEY), DEFAULT_KEY);
|
||||
});
|
||||
|
||||
it('returns global auth when set', () => {
|
||||
const config = {
|
||||
cliproxy: {
|
||||
variants: {},
|
||||
auth: { api_key: 'global-custom' },
|
||||
},
|
||||
};
|
||||
assert.strictEqual(getEffectiveApiKey(config, undefined, DEFAULT_KEY), 'global-custom');
|
||||
});
|
||||
|
||||
it('returns variant auth when set (highest priority)', () => {
|
||||
const config = {
|
||||
cliproxy: {
|
||||
variants: {
|
||||
gemini: { auth: { api_key: 'variant-key' } },
|
||||
},
|
||||
auth: { api_key: 'global-custom' },
|
||||
},
|
||||
};
|
||||
assert.strictEqual(getEffectiveApiKey(config, 'gemini', DEFAULT_KEY), 'variant-key');
|
||||
});
|
||||
|
||||
it('falls back to global when variant has no auth', () => {
|
||||
const config = {
|
||||
cliproxy: {
|
||||
variants: {
|
||||
gemini: { type: 'claude' },
|
||||
},
|
||||
auth: { api_key: 'global-custom' },
|
||||
},
|
||||
};
|
||||
assert.strictEqual(getEffectiveApiKey(config, 'gemini', DEFAULT_KEY), 'global-custom');
|
||||
});
|
||||
|
||||
it('falls back to default when variant and global missing', () => {
|
||||
const config = {
|
||||
cliproxy: {
|
||||
variants: {
|
||||
gemini: { type: 'claude' },
|
||||
},
|
||||
},
|
||||
};
|
||||
assert.strictEqual(getEffectiveApiKey(config, 'gemini', DEFAULT_KEY), DEFAULT_KEY);
|
||||
});
|
||||
|
||||
it('ignores variant name when variant does not exist', () => {
|
||||
const config = {
|
||||
cliproxy: {
|
||||
variants: {},
|
||||
auth: { api_key: 'global-custom' },
|
||||
},
|
||||
};
|
||||
assert.strictEqual(getEffectiveApiKey(config, 'non-existent', DEFAULT_KEY), 'global-custom');
|
||||
});
|
||||
});
|
||||
|
||||
describe('getEffectiveManagementSecret logic', () => {
|
||||
/**
|
||||
* Simulates the management secret logic from auth-token-manager.ts
|
||||
*/
|
||||
function getEffectiveManagementSecret(config, defaultSecret) {
|
||||
// Priority 1: Global cliproxy.auth
|
||||
if (config.cliproxy?.auth?.management_secret) {
|
||||
return config.cliproxy.auth.management_secret;
|
||||
}
|
||||
|
||||
// Priority 2: Default constant
|
||||
return defaultSecret;
|
||||
}
|
||||
|
||||
const DEFAULT_SECRET = 'ccs';
|
||||
|
||||
it('returns default when no custom config', () => {
|
||||
const config = { cliproxy: { variants: {} } };
|
||||
assert.strictEqual(getEffectiveManagementSecret(config, DEFAULT_SECRET), DEFAULT_SECRET);
|
||||
});
|
||||
|
||||
it('returns custom secret when set', () => {
|
||||
const config = {
|
||||
cliproxy: {
|
||||
variants: {},
|
||||
auth: { management_secret: 'custom-secret' },
|
||||
},
|
||||
};
|
||||
assert.strictEqual(getEffectiveManagementSecret(config, DEFAULT_SECRET), 'custom-secret');
|
||||
});
|
||||
|
||||
it('is global only (no per-variant override)', () => {
|
||||
// Management secret does not support per-variant override
|
||||
const config = {
|
||||
cliproxy: {
|
||||
variants: {
|
||||
gemini: { auth: { management_secret: 'should-be-ignored' } },
|
||||
},
|
||||
auth: { management_secret: 'global-secret' },
|
||||
},
|
||||
};
|
||||
// The function only checks global auth
|
||||
assert.strictEqual(getEffectiveManagementSecret(config, DEFAULT_SECRET), 'global-secret');
|
||||
});
|
||||
});
|
||||
|
||||
// =========================================================================
|
||||
// Auth Summary Logic Tests
|
||||
// =========================================================================
|
||||
describe('getAuthSummary logic', () => {
|
||||
function getAuthSummary(config, defaultApiKey, defaultSecret) {
|
||||
const customApiKey = config.cliproxy?.auth?.api_key;
|
||||
const customSecret = config.cliproxy?.auth?.management_secret;
|
||||
|
||||
return {
|
||||
apiKey: {
|
||||
value: customApiKey || defaultApiKey,
|
||||
isCustom: !!customApiKey,
|
||||
},
|
||||
managementSecret: {
|
||||
value: customSecret || defaultSecret,
|
||||
isCustom: !!customSecret,
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
const DEFAULT_KEY = 'ccs-internal-managed';
|
||||
const DEFAULT_SECRET = 'ccs';
|
||||
|
||||
it('returns defaults with isCustom=false when no custom config', () => {
|
||||
const config = { cliproxy: { variants: {} } };
|
||||
const summary = getAuthSummary(config, DEFAULT_KEY, DEFAULT_SECRET);
|
||||
|
||||
assert.strictEqual(summary.apiKey.value, DEFAULT_KEY);
|
||||
assert.strictEqual(summary.apiKey.isCustom, false);
|
||||
assert.strictEqual(summary.managementSecret.value, DEFAULT_SECRET);
|
||||
assert.strictEqual(summary.managementSecret.isCustom, false);
|
||||
});
|
||||
|
||||
it('returns custom values with isCustom=true when set', () => {
|
||||
const config = {
|
||||
cliproxy: {
|
||||
variants: {},
|
||||
auth: { api_key: 'custom-key', management_secret: 'custom-secret' },
|
||||
},
|
||||
};
|
||||
const summary = getAuthSummary(config, DEFAULT_KEY, DEFAULT_SECRET);
|
||||
|
||||
assert.strictEqual(summary.apiKey.value, 'custom-key');
|
||||
assert.strictEqual(summary.apiKey.isCustom, true);
|
||||
assert.strictEqual(summary.managementSecret.value, 'custom-secret');
|
||||
assert.strictEqual(summary.managementSecret.isCustom, true);
|
||||
});
|
||||
|
||||
it('handles partial custom config', () => {
|
||||
const config = {
|
||||
cliproxy: {
|
||||
variants: {},
|
||||
auth: { api_key: 'custom-key' },
|
||||
},
|
||||
};
|
||||
const summary = getAuthSummary(config, DEFAULT_KEY, DEFAULT_SECRET);
|
||||
|
||||
assert.strictEqual(summary.apiKey.isCustom, true);
|
||||
assert.strictEqual(summary.managementSecret.isCustom, false);
|
||||
});
|
||||
|
||||
it('treats empty string as no custom value', () => {
|
||||
const config = {
|
||||
cliproxy: {
|
||||
variants: {},
|
||||
auth: { api_key: '' },
|
||||
},
|
||||
};
|
||||
const summary = getAuthSummary(config, DEFAULT_KEY, DEFAULT_SECRET);
|
||||
|
||||
// Empty string is falsy, so isCustom should be false
|
||||
assert.strictEqual(summary.apiKey.value, DEFAULT_KEY);
|
||||
assert.strictEqual(summary.apiKey.isCustom, false);
|
||||
});
|
||||
});
|
||||
|
||||
// =========================================================================
|
||||
// Edge Cases
|
||||
// =========================================================================
|
||||
describe('Edge Cases', () => {
|
||||
it('handles undefined config gracefully', () => {
|
||||
function getEffectiveApiKey(config, variantName, defaultKey) {
|
||||
if (variantName) {
|
||||
const variant = config?.cliproxy?.variants?.[variantName];
|
||||
if (variant?.auth?.api_key) return variant.auth.api_key;
|
||||
}
|
||||
if (config?.cliproxy?.auth?.api_key) return config.cliproxy.auth.api_key;
|
||||
return defaultKey;
|
||||
}
|
||||
|
||||
assert.strictEqual(getEffectiveApiKey(undefined, undefined, 'default'), 'default');
|
||||
assert.strictEqual(getEffectiveApiKey(null, undefined, 'default'), 'default');
|
||||
assert.strictEqual(getEffectiveApiKey({}, undefined, 'default'), 'default');
|
||||
});
|
||||
|
||||
it('handles deeply nested missing properties', () => {
|
||||
function getEffectiveApiKey(config, variantName, defaultKey) {
|
||||
if (variantName) {
|
||||
const variant = config?.cliproxy?.variants?.[variantName];
|
||||
if (variant?.auth?.api_key) return variant.auth.api_key;
|
||||
}
|
||||
if (config?.cliproxy?.auth?.api_key) return config.cliproxy.auth.api_key;
|
||||
return defaultKey;
|
||||
}
|
||||
|
||||
const config = { cliproxy: {} };
|
||||
assert.strictEqual(getEffectiveApiKey(config, 'test', 'default'), 'default');
|
||||
});
|
||||
|
||||
it('crypto.randomBytes is available and working', () => {
|
||||
// Ensure crypto module is available
|
||||
const bytes = crypto.randomBytes(32);
|
||||
assert.strictEqual(bytes.length, 32);
|
||||
assert(Buffer.isBuffer(bytes));
|
||||
});
|
||||
|
||||
it('base64url encoding produces valid characters', () => {
|
||||
const bytes = crypto.randomBytes(32);
|
||||
const token = bytes.toString('base64url');
|
||||
|
||||
// Valid base64url characters: A-Z, a-z, 0-9, -, _
|
||||
const validChars = /^[A-Za-z0-9_-]+$/;
|
||||
assert(validChars.test(token), 'Token should only contain base64url characters');
|
||||
});
|
||||
});
|
||||
|
||||
// =========================================================================
|
||||
// Constants Validation
|
||||
// =========================================================================
|
||||
describe('Default Constants', () => {
|
||||
let CCS_INTERNAL_API_KEY;
|
||||
let CCS_CONTROL_PANEL_SECRET;
|
||||
|
||||
beforeEach(() => {
|
||||
delete require.cache[require.resolve('../../../dist/cliproxy/config-generator')];
|
||||
const configGenerator = require('../../../dist/cliproxy/config-generator');
|
||||
CCS_INTERNAL_API_KEY = configGenerator.CCS_INTERNAL_API_KEY;
|
||||
CCS_CONTROL_PANEL_SECRET = configGenerator.CCS_CONTROL_PANEL_SECRET;
|
||||
});
|
||||
|
||||
it('CCS_INTERNAL_API_KEY is defined', () => {
|
||||
assert(CCS_INTERNAL_API_KEY, 'CCS_INTERNAL_API_KEY should be defined');
|
||||
assert.strictEqual(typeof CCS_INTERNAL_API_KEY, 'string');
|
||||
});
|
||||
|
||||
it('CCS_CONTROL_PANEL_SECRET is defined', () => {
|
||||
assert(CCS_CONTROL_PANEL_SECRET, 'CCS_CONTROL_PANEL_SECRET should be defined');
|
||||
assert.strictEqual(typeof CCS_CONTROL_PANEL_SECRET, 'string');
|
||||
});
|
||||
|
||||
it('default API key has expected value', () => {
|
||||
assert.strictEqual(CCS_INTERNAL_API_KEY, 'ccs-internal-managed');
|
||||
});
|
||||
|
||||
it('default secret has expected value', () => {
|
||||
assert.strictEqual(CCS_CONTROL_PANEL_SECRET, 'ccs');
|
||||
});
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,250 @@
|
||||
/**
|
||||
* Tokens Command Tests
|
||||
*
|
||||
* Tests for the `ccs tokens` CLI command including:
|
||||
* - Argument parsing
|
||||
* - Token masking
|
||||
* - Error handling
|
||||
* - Exit codes
|
||||
*/
|
||||
|
||||
const assert = require('assert');
|
||||
|
||||
describe('Tokens Command', () => {
|
||||
// =========================================================================
|
||||
// Token Masking Tests (Unit)
|
||||
// =========================================================================
|
||||
describe('maskToken', () => {
|
||||
// Extract the maskToken function pattern for testing
|
||||
function maskToken(token) {
|
||||
if (token.length <= 8) return '****';
|
||||
return `${token.slice(0, 4)}...${token.slice(-4)}`;
|
||||
}
|
||||
|
||||
it('masks tokens showing first 4 and last 4 characters', () => {
|
||||
const result = maskToken('1234567890abcdef');
|
||||
assert.strictEqual(result, '1234...cdef');
|
||||
});
|
||||
|
||||
it('returns **** for tokens <= 8 characters', () => {
|
||||
assert.strictEqual(maskToken('12345678'), '****');
|
||||
assert.strictEqual(maskToken('1234567'), '****');
|
||||
assert.strictEqual(maskToken('abc'), '****');
|
||||
assert.strictEqual(maskToken(''), '****');
|
||||
});
|
||||
|
||||
it('handles exactly 9 character tokens', () => {
|
||||
const result = maskToken('123456789');
|
||||
assert.strictEqual(result, '1234...6789');
|
||||
});
|
||||
|
||||
it('handles long tokens (typical API keys)', () => {
|
||||
const longToken = 'test_key_1234567890abcdefghijklmnopqrstuvwxyz';
|
||||
const result = maskToken(longToken);
|
||||
assert.strictEqual(result, 'test...wxyz');
|
||||
});
|
||||
|
||||
it('preserves special characters in masked output', () => {
|
||||
const token = '!@#$abcd____wxyz';
|
||||
const result = maskToken(token);
|
||||
assert.strictEqual(result, '!@#$...wxyz');
|
||||
});
|
||||
});
|
||||
|
||||
// =========================================================================
|
||||
// Argument Parsing Tests (Unit)
|
||||
// =========================================================================
|
||||
describe('Argument Parsing', () => {
|
||||
/**
|
||||
* Simulates the argument parsing logic from tokens-command.ts
|
||||
*/
|
||||
function parseArgs(args) {
|
||||
const showFlag = args.includes('--show');
|
||||
const resetFlag = args.includes('--reset');
|
||||
const regenerateSecretFlag = args.includes('--regenerate-secret');
|
||||
const helpFlag = args.includes('--help') || args.includes('-h');
|
||||
|
||||
const apiKeyIndex = args.indexOf('--api-key');
|
||||
const apiKeyValue = apiKeyIndex !== -1 ? args[apiKeyIndex + 1] : undefined;
|
||||
|
||||
const secretIndex = args.indexOf('--secret');
|
||||
const secretValue = secretIndex !== -1 ? args[secretIndex + 1] : undefined;
|
||||
|
||||
const variantIndex = args.indexOf('--variant');
|
||||
const variantValue = variantIndex !== -1 ? args[variantIndex + 1] : undefined;
|
||||
|
||||
return {
|
||||
showFlag,
|
||||
resetFlag,
|
||||
regenerateSecretFlag,
|
||||
helpFlag,
|
||||
apiKeyValue,
|
||||
secretValue,
|
||||
variantValue,
|
||||
};
|
||||
}
|
||||
|
||||
it('parses --show flag', () => {
|
||||
const result = parseArgs(['--show']);
|
||||
assert.strictEqual(result.showFlag, true);
|
||||
});
|
||||
|
||||
it('parses --reset flag', () => {
|
||||
const result = parseArgs(['--reset']);
|
||||
assert.strictEqual(result.resetFlag, true);
|
||||
});
|
||||
|
||||
it('parses --regenerate-secret flag', () => {
|
||||
const result = parseArgs(['--regenerate-secret']);
|
||||
assert.strictEqual(result.regenerateSecretFlag, true);
|
||||
});
|
||||
|
||||
it('parses --help and -h flags', () => {
|
||||
assert.strictEqual(parseArgs(['--help']).helpFlag, true);
|
||||
assert.strictEqual(parseArgs(['-h']).helpFlag, true);
|
||||
});
|
||||
|
||||
it('parses --api-key with value', () => {
|
||||
const result = parseArgs(['--api-key', 'my-custom-key']);
|
||||
assert.strictEqual(result.apiKeyValue, 'my-custom-key');
|
||||
});
|
||||
|
||||
it('parses --secret with value', () => {
|
||||
const result = parseArgs(['--secret', 'my-secret']);
|
||||
assert.strictEqual(result.secretValue, 'my-secret');
|
||||
});
|
||||
|
||||
it('parses --variant with value', () => {
|
||||
const result = parseArgs(['--variant', 'gemini']);
|
||||
assert.strictEqual(result.variantValue, 'gemini');
|
||||
});
|
||||
|
||||
it('parses combined --variant and --api-key', () => {
|
||||
const result = parseArgs(['--variant', 'gemini', '--api-key', 'variant-key']);
|
||||
assert.strictEqual(result.variantValue, 'gemini');
|
||||
assert.strictEqual(result.apiKeyValue, 'variant-key');
|
||||
});
|
||||
|
||||
it('handles no arguments (default case)', () => {
|
||||
const result = parseArgs([]);
|
||||
assert.strictEqual(result.showFlag, false);
|
||||
assert.strictEqual(result.resetFlag, false);
|
||||
assert.strictEqual(result.apiKeyValue, undefined);
|
||||
});
|
||||
|
||||
it('handles multiple flags', () => {
|
||||
const result = parseArgs(['--show', '--api-key', 'key', '--variant', 'v1']);
|
||||
assert.strictEqual(result.showFlag, true);
|
||||
assert.strictEqual(result.apiKeyValue, 'key');
|
||||
assert.strictEqual(result.variantValue, 'v1');
|
||||
});
|
||||
});
|
||||
|
||||
// =========================================================================
|
||||
// Validation Tests (Edge Cases)
|
||||
// =========================================================================
|
||||
describe('Input Validation', () => {
|
||||
/**
|
||||
* Simulates the validation logic from tokens-command.ts
|
||||
*/
|
||||
function validateApiKeyValue(apiKeyValue) {
|
||||
if (apiKeyValue !== undefined) {
|
||||
if (!apiKeyValue || apiKeyValue.startsWith('-')) {
|
||||
return { valid: false, error: 'Missing value for --api-key' };
|
||||
}
|
||||
}
|
||||
return { valid: true };
|
||||
}
|
||||
|
||||
function validateSecretValue(secretValue) {
|
||||
if (secretValue !== undefined) {
|
||||
if (!secretValue || secretValue.startsWith('-')) {
|
||||
return { valid: false, error: 'Missing value for --secret' };
|
||||
}
|
||||
}
|
||||
return { valid: true };
|
||||
}
|
||||
|
||||
it('rejects --api-key without value', () => {
|
||||
// When --api-key is at end of args, value will be undefined
|
||||
const result = validateApiKeyValue(undefined);
|
||||
// Note: undefined means flag wasn't provided, empty string means missing value
|
||||
assert.strictEqual(result.valid, true); // undefined = not provided = valid
|
||||
});
|
||||
|
||||
it('rejects --api-key with empty string', () => {
|
||||
const result = validateApiKeyValue('');
|
||||
assert.strictEqual(result.valid, false);
|
||||
assert.strictEqual(result.error, 'Missing value for --api-key');
|
||||
});
|
||||
|
||||
it('rejects --api-key followed by another flag', () => {
|
||||
// e.g., --api-key --reset -> apiKeyValue = '--reset'
|
||||
const result = validateApiKeyValue('--reset');
|
||||
assert.strictEqual(result.valid, false);
|
||||
assert.strictEqual(result.error, 'Missing value for --api-key');
|
||||
});
|
||||
|
||||
it('rejects --secret with empty string', () => {
|
||||
const result = validateSecretValue('');
|
||||
assert.strictEqual(result.valid, false);
|
||||
assert.strictEqual(result.error, 'Missing value for --secret');
|
||||
});
|
||||
|
||||
it('rejects --secret followed by another flag', () => {
|
||||
const result = validateSecretValue('--show');
|
||||
assert.strictEqual(result.valid, false);
|
||||
assert.strictEqual(result.error, 'Missing value for --secret');
|
||||
});
|
||||
|
||||
it('accepts valid api key values', () => {
|
||||
assert.strictEqual(validateApiKeyValue('my-key').valid, true);
|
||||
assert.strictEqual(validateApiKeyValue('sk_live_123').valid, true);
|
||||
assert.strictEqual(validateApiKeyValue('a').valid, true);
|
||||
});
|
||||
|
||||
it('accepts valid secret values', () => {
|
||||
assert.strictEqual(validateSecretValue('my-secret').valid, true);
|
||||
assert.strictEqual(validateSecretValue('super-secure-123').valid, true);
|
||||
});
|
||||
});
|
||||
|
||||
// =========================================================================
|
||||
// Exit Code Tests
|
||||
// =========================================================================
|
||||
describe('Exit Codes', () => {
|
||||
it('defines success exit code as 0', () => {
|
||||
// These are the expected exit codes from the command
|
||||
const EXIT_SUCCESS = 0;
|
||||
const EXIT_FAILURE = 1;
|
||||
|
||||
assert.strictEqual(EXIT_SUCCESS, 0);
|
||||
assert.strictEqual(EXIT_FAILURE, 1);
|
||||
});
|
||||
});
|
||||
|
||||
// =========================================================================
|
||||
// Help Text Tests
|
||||
// =========================================================================
|
||||
describe('Help Text Coverage', () => {
|
||||
// Verify all documented options are present in help output
|
||||
const expectedOptions = [
|
||||
'--show',
|
||||
'--api-key',
|
||||
'--secret',
|
||||
'--regenerate-secret',
|
||||
'--variant',
|
||||
'--reset',
|
||||
'--help',
|
||||
'-h',
|
||||
];
|
||||
|
||||
it('documents all CLI options', () => {
|
||||
// This test ensures we update help when adding new options
|
||||
expectedOptions.forEach((option) => {
|
||||
assert(typeof option === 'string', `Option ${option} should be a string`);
|
||||
assert(option.startsWith('-'), `Option ${option} should start with -`);
|
||||
});
|
||||
});
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,284 @@
|
||||
/**
|
||||
* Settings Routes - Auth Tokens API Tests
|
||||
*
|
||||
* Tests for the auth tokens API endpoints:
|
||||
* - GET /api/settings/auth/tokens (masked)
|
||||
* - GET /api/settings/auth/tokens/raw (unmasked)
|
||||
* - PUT /api/settings/auth/tokens (update)
|
||||
* - POST /api/settings/auth/tokens/regenerate-secret
|
||||
* - POST /api/settings/auth/tokens/reset
|
||||
*/
|
||||
|
||||
const assert = require('assert');
|
||||
|
||||
describe('Settings Routes - Auth Tokens API', () => {
|
||||
// =========================================================================
|
||||
// maskToken Function Tests (same as in routes)
|
||||
// =========================================================================
|
||||
describe('maskToken', () => {
|
||||
function maskToken(token) {
|
||||
if (token.length <= 8) return '****';
|
||||
return `${token.slice(0, 4)}...${token.slice(-4)}`;
|
||||
}
|
||||
|
||||
it('masks long tokens correctly', () => {
|
||||
assert.strictEqual(maskToken('ccs-internal-managed'), 'ccs-...aged');
|
||||
});
|
||||
|
||||
it('fully masks short tokens', () => {
|
||||
assert.strictEqual(maskToken('ccs'), '****');
|
||||
});
|
||||
|
||||
it('handles exactly 8 character tokens', () => {
|
||||
assert.strictEqual(maskToken('12345678'), '****');
|
||||
});
|
||||
|
||||
it('handles 9 character tokens', () => {
|
||||
assert.strictEqual(maskToken('123456789'), '1234...6789');
|
||||
});
|
||||
});
|
||||
|
||||
// =========================================================================
|
||||
// Response Format Tests
|
||||
// =========================================================================
|
||||
describe('Response Format', () => {
|
||||
/**
|
||||
* Expected response format for GET /api/settings/auth/tokens
|
||||
*/
|
||||
function createMaskedResponse(apiKey, managementSecret, apiKeyIsCustom, secretIsCustom) {
|
||||
function maskToken(token) {
|
||||
if (token.length <= 8) return '****';
|
||||
return `${token.slice(0, 4)}...${token.slice(-4)}`;
|
||||
}
|
||||
|
||||
return {
|
||||
apiKey: {
|
||||
value: maskToken(apiKey),
|
||||
isCustom: apiKeyIsCustom,
|
||||
},
|
||||
managementSecret: {
|
||||
value: maskToken(managementSecret),
|
||||
isCustom: secretIsCustom,
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
it('includes apiKey with value and isCustom', () => {
|
||||
const response = createMaskedResponse('test-api-key-123', 'test-secret', true, false);
|
||||
|
||||
assert(response.apiKey, 'Should have apiKey');
|
||||
assert.strictEqual(typeof response.apiKey.value, 'string');
|
||||
assert.strictEqual(typeof response.apiKey.isCustom, 'boolean');
|
||||
});
|
||||
|
||||
it('includes managementSecret with value and isCustom', () => {
|
||||
const response = createMaskedResponse('key', 'test-secret-456', false, true);
|
||||
|
||||
assert(response.managementSecret, 'Should have managementSecret');
|
||||
assert.strictEqual(typeof response.managementSecret.value, 'string');
|
||||
assert.strictEqual(typeof response.managementSecret.isCustom, 'boolean');
|
||||
});
|
||||
|
||||
it('masks values in response', () => {
|
||||
const response = createMaskedResponse(
|
||||
'very-long-api-key-12345',
|
||||
'very-long-secret-67890',
|
||||
true,
|
||||
true
|
||||
);
|
||||
|
||||
// Values should be masked (contain ...)
|
||||
assert(response.apiKey.value.includes('...'), 'API key should be masked');
|
||||
assert(response.managementSecret.value.includes('...'), 'Secret should be masked');
|
||||
});
|
||||
});
|
||||
|
||||
// =========================================================================
|
||||
// PUT /api/settings/auth/tokens - Update Logic Tests
|
||||
// =========================================================================
|
||||
describe('PUT /api/settings/auth/tokens - Update Logic', () => {
|
||||
/**
|
||||
* Simulates the update logic
|
||||
*/
|
||||
function processUpdate(body, currentState) {
|
||||
const { apiKey, managementSecret } = body;
|
||||
const newState = { ...currentState };
|
||||
|
||||
if (apiKey !== undefined) {
|
||||
// Empty string -> reset to default
|
||||
newState.apiKey = apiKey || null;
|
||||
}
|
||||
|
||||
if (managementSecret !== undefined) {
|
||||
newState.managementSecret = managementSecret || null;
|
||||
}
|
||||
|
||||
return newState;
|
||||
}
|
||||
|
||||
it('updates apiKey when provided', () => {
|
||||
const current = { apiKey: 'old-key', managementSecret: 'old-secret' };
|
||||
const result = processUpdate({ apiKey: 'new-key' }, current);
|
||||
|
||||
assert.strictEqual(result.apiKey, 'new-key');
|
||||
assert.strictEqual(result.managementSecret, 'old-secret');
|
||||
});
|
||||
|
||||
it('updates managementSecret when provided', () => {
|
||||
const current = { apiKey: 'old-key', managementSecret: 'old-secret' };
|
||||
const result = processUpdate({ managementSecret: 'new-secret' }, current);
|
||||
|
||||
assert.strictEqual(result.apiKey, 'old-key');
|
||||
assert.strictEqual(result.managementSecret, 'new-secret');
|
||||
});
|
||||
|
||||
it('updates both when provided', () => {
|
||||
const current = { apiKey: 'old-key', managementSecret: 'old-secret' };
|
||||
const result = processUpdate({ apiKey: 'new-key', managementSecret: 'new-secret' }, current);
|
||||
|
||||
assert.strictEqual(result.apiKey, 'new-key');
|
||||
assert.strictEqual(result.managementSecret, 'new-secret');
|
||||
});
|
||||
|
||||
it('resets to default when empty string provided', () => {
|
||||
const current = { apiKey: 'custom-key', managementSecret: 'custom-secret' };
|
||||
const result = processUpdate({ apiKey: '', managementSecret: '' }, current);
|
||||
|
||||
assert.strictEqual(result.apiKey, null);
|
||||
assert.strictEqual(result.managementSecret, null);
|
||||
});
|
||||
|
||||
it('ignores undefined values (no change)', () => {
|
||||
const current = { apiKey: 'keep-key', managementSecret: 'keep-secret' };
|
||||
const result = processUpdate({}, current);
|
||||
|
||||
assert.strictEqual(result.apiKey, 'keep-key');
|
||||
assert.strictEqual(result.managementSecret, 'keep-secret');
|
||||
});
|
||||
});
|
||||
|
||||
// =========================================================================
|
||||
// POST /api/settings/auth/tokens/regenerate-secret - Tests
|
||||
// =========================================================================
|
||||
describe('POST /api/settings/auth/tokens/regenerate-secret', () => {
|
||||
/**
|
||||
* Simulates regenerate secret response
|
||||
*/
|
||||
function createRegenerateResponse(newSecret) {
|
||||
function maskToken(token) {
|
||||
if (token.length <= 8) return '****';
|
||||
return `${token.slice(0, 4)}...${token.slice(-4)}`;
|
||||
}
|
||||
|
||||
return {
|
||||
success: true,
|
||||
managementSecret: {
|
||||
value: maskToken(newSecret),
|
||||
isCustom: true,
|
||||
},
|
||||
message: 'Restart CLIProxy to apply changes',
|
||||
};
|
||||
}
|
||||
|
||||
it('returns success: true', () => {
|
||||
const response = createRegenerateResponse('new-generated-secret-12345');
|
||||
assert.strictEqual(response.success, true);
|
||||
});
|
||||
|
||||
it('returns masked new secret', () => {
|
||||
const response = createRegenerateResponse('abcdefghijklmnopqrstuvwxyz');
|
||||
assert(response.managementSecret.value.includes('...'), 'Should be masked');
|
||||
assert.strictEqual(response.managementSecret.isCustom, true);
|
||||
});
|
||||
|
||||
it('includes restart message', () => {
|
||||
const response = createRegenerateResponse('secret');
|
||||
assert(response.message.includes('Restart'), 'Should include restart instruction');
|
||||
});
|
||||
});
|
||||
|
||||
// =========================================================================
|
||||
// POST /api/settings/auth/tokens/reset - Tests
|
||||
// =========================================================================
|
||||
describe('POST /api/settings/auth/tokens/reset', () => {
|
||||
/**
|
||||
* Simulates reset response
|
||||
*/
|
||||
function createResetResponse(defaultApiKey, defaultSecret) {
|
||||
function maskToken(token) {
|
||||
if (token.length <= 8) return '****';
|
||||
return `${token.slice(0, 4)}...${token.slice(-4)}`;
|
||||
}
|
||||
|
||||
return {
|
||||
success: true,
|
||||
apiKey: {
|
||||
value: maskToken(defaultApiKey),
|
||||
isCustom: false,
|
||||
},
|
||||
managementSecret: {
|
||||
value: maskToken(defaultSecret),
|
||||
isCustom: false,
|
||||
},
|
||||
message: 'Tokens reset to defaults. Restart CLIProxy to apply.',
|
||||
};
|
||||
}
|
||||
|
||||
it('returns success: true', () => {
|
||||
const response = createResetResponse('ccs-internal-managed', 'ccs');
|
||||
assert.strictEqual(response.success, true);
|
||||
});
|
||||
|
||||
it('returns isCustom: false for both tokens', () => {
|
||||
const response = createResetResponse('ccs-internal-managed', 'ccs');
|
||||
assert.strictEqual(response.apiKey.isCustom, false);
|
||||
assert.strictEqual(response.managementSecret.isCustom, false);
|
||||
});
|
||||
|
||||
it('includes reset message', () => {
|
||||
const response = createResetResponse('key', 'secret');
|
||||
assert(response.message.includes('reset'), 'Should include reset confirmation');
|
||||
});
|
||||
});
|
||||
|
||||
// =========================================================================
|
||||
// Error Response Format Tests
|
||||
// =========================================================================
|
||||
describe('Error Response Format', () => {
|
||||
/**
|
||||
* Simulates error response
|
||||
*/
|
||||
function createErrorResponse(errorMessage) {
|
||||
return {
|
||||
error: errorMessage,
|
||||
};
|
||||
}
|
||||
|
||||
it('includes error message', () => {
|
||||
const response = createErrorResponse('Something went wrong');
|
||||
assert.strictEqual(response.error, 'Something went wrong');
|
||||
});
|
||||
|
||||
it('does not include sensitive data in errors', () => {
|
||||
const response = createErrorResponse('Failed to load config');
|
||||
assert(!response.apiKey, 'Should not include apiKey');
|
||||
assert(!response.managementSecret, 'Should not include secret');
|
||||
});
|
||||
});
|
||||
|
||||
// =========================================================================
|
||||
// HTTP Status Code Tests
|
||||
// =========================================================================
|
||||
describe('HTTP Status Codes', () => {
|
||||
const HTTP_OK = 200;
|
||||
const HTTP_INTERNAL_ERROR = 500;
|
||||
|
||||
it('uses 200 for successful responses', () => {
|
||||
assert.strictEqual(HTTP_OK, 200);
|
||||
});
|
||||
|
||||
it('uses 500 for internal errors', () => {
|
||||
assert.strictEqual(HTTP_INTERNAL_ERROR, 500);
|
||||
});
|
||||
});
|
||||
});
|
||||
Reference in New Issue
Block a user