675de771c7
Loopback Fastify auth-broker + esbuild SPA. Operator password login (constant-time, signed HttpOnly session cookie, per-forwarded-IP rate-limit) → session-gated proxy that mints a fresh 60s manage capability token per call to the control-plane admin API: list hosts, mint pairing codes (with QR + pair command), revoke hosts. Security headers + CSP, CP_URL pinned loopback (anti-SSRF), hostId dot-segment guard. 55 tests pass; security-reviewed. Deployed behind nginx panel.terminal.yaojia.wang.
28 lines
1.2 KiB
TypeScript
28 lines
1.2 KiB
TypeScript
import { describe, it, expect } from 'vitest'
|
|
import { buildPairCommand, buildQrDataUrl, buildPairingArtifacts } from '../src/pairing.js'
|
|
|
|
describe('pairing artifacts', () => {
|
|
it('builds the ready-to-run pair command with the code and zone', () => {
|
|
const cmd = buildPairCommand('ABCD-EFGH', 'terminal.yaojia.wang')
|
|
expect(cmd).toBe('web-terminal-agent pair ABCD-EFGH --install --zone terminal.yaojia.wang')
|
|
})
|
|
|
|
it('renders a PNG data URL for the code', async () => {
|
|
const url = await buildQrDataUrl('ABCD-EFGH')
|
|
expect(url.startsWith('data:image/png;base64,')).toBe(true)
|
|
expect(url.length).toBeGreaterThan(100)
|
|
})
|
|
|
|
it('combines an issued code into the full artifacts payload', async () => {
|
|
const artifacts = await buildPairingArtifacts(
|
|
{ code: 'WXYZ-1234', expiresAt: '2026-05-01T00:00:00.000Z' },
|
|
'z.example',
|
|
)
|
|
expect(artifacts.code).toBe('WXYZ-1234')
|
|
expect(artifacts.expiresAt).toBe('2026-05-01T00:00:00.000Z')
|
|
expect(artifacts.pairCommand).toContain('WXYZ-1234')
|
|
expect(artifacts.pairCommand).toContain('z.example')
|
|
expect(artifacts.qrDataUrl.startsWith('data:image/png;base64,')).toBe(true)
|
|
})
|
|
})
|