59 lines
2.2 KiB
JavaScript
59 lines
2.2 KiB
JavaScript
'use strict';
|
|
|
|
const test = require('node:test');
|
|
const assert = require('node:assert/strict');
|
|
const { SessionStore } = require('../src/session-store');
|
|
|
|
const SENTINEL = 'HERMES_SENTINEL_SECRET';
|
|
|
|
test('stores a canonical origin and cookie only in main-process memory', () => {
|
|
const store = new SessionStore();
|
|
store.establish('https://Tenant.AVASECURITY.com/', SENTINEL);
|
|
|
|
assert.deepEqual(store.describe(), {
|
|
connected: true,
|
|
origin: 'https://tenant.avasecurity.com',
|
|
});
|
|
assert.equal(JSON.stringify(store.describe()).includes(SENTINEL), false);
|
|
|
|
const session = store.requireSession();
|
|
assert.equal(session.origin, 'https://tenant.avasecurity.com');
|
|
assert.equal(session.cookie, SENTINEL);
|
|
assert.equal(Object.isFrozen(session), true);
|
|
});
|
|
|
|
test('rejects malformed and header-injecting cookies', () => {
|
|
const store = new SessionStore();
|
|
for (const cookie of ['', null, 12, 'secret\r\nX-Evil: yes', `x${'a'.repeat(4096)}`, 'abc\0def', 'token; injected=yes']) {
|
|
assert.throws(() => store.establish('https://tenant.avasecurity.com', cookie), {
|
|
code: 'INVALID_SESSION_COOKIE',
|
|
});
|
|
}
|
|
assert.equal(store.describe().connected, false);
|
|
});
|
|
|
|
test('does not replace a valid session when a new session is invalid', () => {
|
|
const store = new SessionStore();
|
|
store.establish('https://one.avasecurity.com', SENTINEL);
|
|
assert.throws(() => store.establish('https://evil.example', 'replacement'));
|
|
assert.equal(store.requireSession().origin, 'https://one.avasecurity.com');
|
|
assert.equal(store.requireSession().cookie, SENTINEL);
|
|
});
|
|
|
|
test('clear removes session references and dispose permanently closes the store', () => {
|
|
const store = new SessionStore();
|
|
store.establish('https://tenant.avigilon.com', SENTINEL);
|
|
store.clear();
|
|
|
|
assert.deepEqual(store.describe(), { connected: false, origin: null });
|
|
assert.throws(() => store.requireSession(), { code: 'NO_ALTA_SESSION' });
|
|
|
|
store.establish('https://tenant.avigilon.com', 'new-token');
|
|
store.dispose();
|
|
assert.deepEqual(store.describe(), { connected: false, origin: null });
|
|
assert.throws(() => store.establish('https://tenant.avigilon.com', 'again'), {
|
|
code: 'SESSION_STORE_DISPOSED',
|
|
});
|
|
assert.doesNotThrow(() => store.dispose());
|
|
});
|