rootandClaude Opus 5.5
ff230e5da7
- Admin login gate (docs/design/auth-reference.md): admin_user/admin_session/login_attempt
(migration 0015), one-time setup token logged once + conditional UPDATE, argon2id via
hash-wasm (WASM; compiled binary has no --allow-ffi), sha256-stored sessions in HttpOnly
SameSite=Lax cookie umt_session (fixed 12h TTL, soft revoke), HMAC-derived double-submit
CSRF, IP (5) + account (15) failure limits per 15 min, password change revokes other
sessions, optional TOTP with replay counter, AuditAction enum.
- Unified auth middleware: cookie session or Bearer API key -> c.var.actor
{type: admin|api_key, id, name, scopes}; requireScope works for both; requireAdminSession.
- ctx.secrets: AES-256-GCM, per-secret HKDF-SHA256 key from SECRET_MASTER_KEY, AAD bound
to (id, purpose); ctx.settings: 30s cache invalidated by settings.changed events.
- Endpoints: /auth/*, /settings, /api-keys, /secrets, /audit-events, library-roots,
downloader/media-server instances (+test), path-mappings (+verify),
PUT /sites/{id}/credentials, /engine/runs|stats|cancel (read-only openworkflow schema).
- SSE: PgEventBus (sse_event table, migration 0016, LISTEN/NOTIFY umt_events, catch-up by
seq, pruning, resync); EventBusPort is now async.
- Tests: login/rate limit/revocation/CSRF/TOTP, secrets round trip and no log leakage,
admin APIs against mock qB/Emby, SSE across two Deno subprocesses.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
42 lines
1.4 KiB
TypeScript
42 lines
1.4 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
import { EventBus } from "../src/http/sse.ts";
|
|
import { DEV_KEY, testApp } from "./helpers.ts";
|
|
|
|
describe("EventBus", () => {
|
|
it("序号自增并按 after 补读,淘汰后标记 gap", () => {
|
|
const bus = new EventBus(3);
|
|
for (let i = 0; i < 5; i++) bus.publishSync("t", { i });
|
|
expect(bus.latestSeq).toBe(5);
|
|
expect(bus.sinceSync(3).events.map((e) => e.seq)).toEqual([4, 5]);
|
|
expect(bus.sinceSync(3).gap).toBe(false);
|
|
expect(bus.sinceSync(1).gap).toBe(true);
|
|
});
|
|
});
|
|
|
|
describe("GET /api/v1/events", () => {
|
|
it("需要鉴权", async () => {
|
|
const { app } = testApp();
|
|
expect((await app.request("/api/v1/events")).status).toBe(401);
|
|
});
|
|
|
|
it("补读 after 之后的事件", async () => {
|
|
const { app, bus } = testApp();
|
|
bus.publishSync("a", 1);
|
|
bus.publishSync("b", 2);
|
|
const ac = new AbortController();
|
|
const res = await app.request("/api/v1/events?after=1", {
|
|
headers: { Authorization: `Bearer ${DEV_KEY}` },
|
|
signal: ac.signal,
|
|
});
|
|
expect(res.headers.get("content-type")).toContain("text/event-stream");
|
|
const reader = res.body!.getReader();
|
|
const { value } = await reader.read();
|
|
const text = new TextDecoder().decode(value);
|
|
expect(text).toContain("id: 2");
|
|
expect(text).toContain("event: b");
|
|
expect(text).not.toContain("event: a");
|
|
ac.abort();
|
|
await reader.cancel();
|
|
});
|
|
});
|