28 lines
1.5 KiB
TypeScript
28 lines
1.5 KiB
TypeScript
import assert from "node:assert/strict"
|
|
import Fastify from "fastify"
|
|
import {SignJWT} from "jose"
|
|
process.env.AUTH_REQUIRED="true"
|
|
process.env.AUTH_JWT_SECRET="optimizer-test-secret"
|
|
process.env.AUTH_ISSUER="https://auth.test.local"
|
|
process.env.NODE_ENV="test"
|
|
const {default:authPlugin,requireAuth}=await import("./auth.js")
|
|
const app=Fastify()
|
|
await app.register(authPlugin)
|
|
app.addHook("preHandler",requireAuth)
|
|
let reads=0,writes=0
|
|
app.post("/api/servers/:id/ospf/optimize/preview",async()=>{reads++;return {ok:true}})
|
|
app.post("/api/servers/:id/ospf/optimize",async()=>{writes++;return {ok:true}})
|
|
const secret=new TextEncoder().encode("optimizer-test-secret")
|
|
for(const permission of ["mm:network:read","mm:network:write","mm:servers:write"]){
|
|
const token=await new SignJWT({sub:"reader",apps:["mm"],permissions:[permission]}).setProtectedHeader({alg:"HS256"}).setIssuer("https://auth.test.local").setExpirationTime("1h").sign(secret)
|
|
const headers={authorization:"Bearer "+token}
|
|
const preview=await app.inject({method:"POST",url:"/api/servers/1/ospf/optimize/preview",headers})
|
|
const apply=await app.inject({method:"POST",url:"/api/servers/1/ospf/optimize",headers})
|
|
assert.equal(preview.statusCode,permission==="mm:servers:write"?403:200)
|
|
assert.equal(apply.statusCode,permission==="mm:network:write"?200:403)
|
|
}
|
|
assert.equal(reads,2);assert.equal(writes,1)
|
|
assert.equal((await app.inject({method:"POST",url:"/api/servers/1/ospf/optimize"})).statusCode,401)
|
|
await app.close()
|
|
console.log("OSPF optimizer RBAC: signed JWT read/write/servers-only, no DB/RouterOS")
|