rootandClaude Fable 5.1
304feea141
- root deno.json workspace (nodeModulesDir auto), npm versions registered once in imports, deno.lock; remove pnpm-lock/pnpm-workspace/root package.json; members keep minimal package.json (name/type/exports) - tasks: dev, typecheck (tsc 7.0.2 per member + deno check), lint/fmt (biome, useImportExtensions), test (vitest via deno), check:tokens, build (web + deno compile), ci, db:migrate/reset, gen:types - tsconfig base moved to config/ (no root tsconfig.json); deno types -> types/deno.d.ts; web drops baseUrl - server: Deno.serve entry with graceful shutdown, --role migrate|preflight|probe, WEB_ROOT static SPA hosting; drop @hono/node-server, tsx, esbuild build.mjs - logger: redact child() bindings and serialize err by message/stack; sync stdout destination; tests - relative imports get explicit extensions (sites/mp-sync paths left for follow-up) - crash-recovery tests spawn `deno run -A`; tasks tests use unique per-file schemas - single-container Dockerfile + entrypoint (migrate -> preflight -> api+worker watchdog), docker-compose.yml - docs: README, runbook, ADR-001 superseded, plan §1 validation row Co-Authored-By: Claude Fable 5.1 <[email protected]>
50 lines
1.9 KiB
TypeScript
50 lines
1.9 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
import { hasScope } from "../src/http/auth.ts";
|
|
import { DEV_KEY, json, memoryStore, testApp } from "./helpers.ts";
|
|
|
|
const store = memoryStore({
|
|
"key-read": { id: "k1", scopes: ["read"] },
|
|
"key-org": { id: "k2", scopes: ["organize.execute"] },
|
|
"key-revoked": { id: "k3", scopes: ["admin"], revoked: true },
|
|
});
|
|
const whoami = (app: ReturnType<typeof testApp>["app"], key?: string) =>
|
|
app.request("/api/v1/auth/whoami", key ? { headers: { Authorization: `Bearer ${key}` } } : {});
|
|
|
|
describe("API Key 鉴权", () => {
|
|
it("缺少 Key → 401", async () => {
|
|
const res = await whoami(testApp({ store }).app);
|
|
expect(res.status).toBe(401);
|
|
expect((await json(res)).error.code).toBe("unauthorized");
|
|
});
|
|
|
|
it("有效 Key 通过,返回 principal", async () => {
|
|
const res = await whoami(testApp({ store }).app, "key-read");
|
|
expect(res.status).toBe(200);
|
|
expect((await json(res)).data.id).toBe("k1");
|
|
});
|
|
|
|
it("未知或已撤销 Key → 401", async () => {
|
|
const { app } = testApp({ store });
|
|
expect((await whoami(app, "bogus")).status).toBe(401);
|
|
expect((await whoami(app, "key-revoked")).status).toBe(401);
|
|
});
|
|
|
|
it("scope 不足 → 403", async () => {
|
|
const res = await whoami(testApp({ store }).app, "key-org");
|
|
expect(res.status).toBe(403);
|
|
expect((await json(res)).error.code).toBe("forbidden");
|
|
});
|
|
|
|
it("开发模式 DEV_ADMIN_KEY 可用,生产模式不可用", async () => {
|
|
expect((await whoami(testApp({ store }).app, DEV_KEY)).status).toBe(200);
|
|
expect((await whoami(testApp({ store, nodeEnv: "production" }).app, DEV_KEY)).status).toBe(401);
|
|
});
|
|
|
|
it("scope 蕴含关系", () => {
|
|
expect(hasScope(["admin"], "organize.execute")).toBe(true);
|
|
expect(hasScope(["organize.execute"], "organize.read")).toBe(true);
|
|
expect(hasScope(["organize.read"], "organize.execute")).toBe(false);
|
|
expect(hasScope(["read"], "organize.read")).toBe(false);
|
|
});
|
|
});
|