CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-08-09 07:46:08 +02:00
Code Issues Packages Projects Releases Wiki Activity

merge: resolve conflicts with main (adopt chrome-extension origin gating)

Browse Source
This commit is contained in:
Garry Tan
2026-04-04 23:20:15 -07:00
parent 32abe70047 9ca8f1d7a9
commit 28b7301c6f
35 changed files with 506 additions and 71 deletions
Download Patch File Download Diff File Expand all files Collapse all files
browse/test/server-auth.test.ts
+6 -7
View File
@@ -21,14 +21,13 @@ function sliceBetween(source: string, startMarker: string, endMarker: string): s
}
describe('Server auth security', () => {
// Test 1: /health serves auth token for extension bootstrap (localhost-only, safe)
// Previously token was removed from /health, but extension needs it since
// .auth.json in the extension dir breaks read-only .app bundles and codesigning.
test('/health serves auth token with safety comment', () => {
// Test 1: /health serves auth token gated on chrome-extension:// Origin
// to prevent leaking when the server is tunneled to the internet.
test('/health serves auth token only for chrome extension origin', () => {
const healthBlock = sliceBetween(SERVER_SRC, "url.pathname === '/health'", "url.pathname === '/connect'");
expect(healthBlock).toContain('healthResponse.token = AUTH_TOKEN');
// Must have a comment explaining why this is safe — strip when tunneled
expect(healthBlock).toContain('tunnelActive');
expect(healthBlock).toContain('AUTH_TOKEN');
// Must be gated on chrome-extension Origin
expect(healthBlock).toContain('chrome-extension://');
});
// Test 2: /refs endpoint requires auth via validateAuth