* fix(security): harden auth and credential handling (HH-444) * fix(security): address HH-444 review blockers * fix(security): close remaining HH-444 review blockers --------- Co-authored-by: Rogee <rogee@ipao.vip>
147 lines
4.5 KiB
JavaScript
147 lines
4.5 KiB
JavaScript
import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
|
|
|
|
const {
|
|
createConsumer,
|
|
createSubscription,
|
|
getCookie,
|
|
post,
|
|
subscriptionState,
|
|
} = vi.hoisted(() => {
|
|
const subscriptionState = { callbacks: null };
|
|
return {
|
|
createConsumer: vi.fn(),
|
|
createSubscription: vi.fn((_identifier, callbacks) => {
|
|
subscriptionState.callbacks = callbacks;
|
|
return { updatePresence: vi.fn() };
|
|
}),
|
|
getCookie: vi.fn(),
|
|
post: vi.fn(),
|
|
subscriptionState,
|
|
};
|
|
});
|
|
|
|
vi.mock('@rails/actioncable', () => ({ createConsumer }));
|
|
vi.mock('js-cookie', () => ({ default: { get: getCookie } }));
|
|
|
|
import BaseActionCableConnector from '../BaseActionCableConnector';
|
|
|
|
const app = {
|
|
$store: {
|
|
getters: { getCurrentAccountId: 3, getCurrentUserID: 7 },
|
|
},
|
|
};
|
|
|
|
describe('BaseActionCableConnector', () => {
|
|
beforeEach(() => {
|
|
vi.useFakeTimers();
|
|
createConsumer.mockReturnValue({
|
|
connection: { isOpen: vi.fn(() => true) },
|
|
disconnect: vi.fn(),
|
|
subscriptions: { create: createSubscription },
|
|
});
|
|
window.axios = { post };
|
|
});
|
|
|
|
afterEach(() => {
|
|
vi.clearAllMocks();
|
|
vi.useRealTimers();
|
|
subscriptionState.callbacks = null;
|
|
BaseActionCableConnector.isDisconnected = false;
|
|
});
|
|
|
|
it('authenticates a widget socket and RoomChannel with its pubsub token', () => {
|
|
getCookie.mockReturnValue(undefined);
|
|
|
|
new BaseActionCableConnector(app, 'visitor token');
|
|
|
|
expect(createConsumer).toHaveBeenCalledWith(
|
|
`${window.location.origin}/cable?pubsub_token=visitor%20token`
|
|
);
|
|
expect(createSubscription).toHaveBeenCalledWith(
|
|
expect.objectContaining({
|
|
channel: 'RoomChannel',
|
|
pubsub_token: 'visitor token',
|
|
}),
|
|
expect.any(Object)
|
|
);
|
|
});
|
|
|
|
it('continues consuming widget events after ActionCable reconnects', async () => {
|
|
getCookie.mockReturnValue(undefined);
|
|
const connector = new BaseActionCableConnector(app, 'visitor-token');
|
|
const onMessage = vi.fn();
|
|
connector.events['message.created'] = onMessage;
|
|
connector.onDisconnected = vi.fn();
|
|
connector.onReconnect = vi.fn();
|
|
|
|
subscriptionState.callbacks.received({
|
|
event: 'message.created',
|
|
data: { id: 1, content: 'before reconnect' },
|
|
});
|
|
subscriptionState.callbacks.disconnected();
|
|
await vi.advanceTimersByTimeAsync(1000);
|
|
subscriptionState.callbacks.received({
|
|
event: 'message.created',
|
|
data: { id: 2, content: 'after reconnect' },
|
|
});
|
|
|
|
expect(connector.onDisconnected).toHaveBeenCalledOnce();
|
|
expect(connector.onReconnect).toHaveBeenCalledOnce();
|
|
expect(onMessage).toHaveBeenNthCalledWith(1, {
|
|
id: 1,
|
|
content: 'before reconnect',
|
|
});
|
|
expect(onMessage).toHaveBeenNthCalledWith(2, {
|
|
id: 2,
|
|
content: 'after reconnect',
|
|
});
|
|
});
|
|
|
|
it('exchanges the dashboard session for a ticket without putting JWT in the URL', async () => {
|
|
getCookie.mockReturnValue('1');
|
|
post.mockResolvedValue({ data: { data: { ticket: 'one-time' } } });
|
|
|
|
const connector = new BaseActionCableConnector(
|
|
app,
|
|
'pubsub',
|
|
'wss://chat.test'
|
|
);
|
|
await vi.waitFor(() => expect(createConsumer).toHaveBeenCalledOnce());
|
|
|
|
expect(post).toHaveBeenCalledWith('/api/v1/auth/ws_ticket');
|
|
expect(createConsumer).toHaveBeenCalledWith(
|
|
'wss://chat.test/cable?ticket=one-time'
|
|
);
|
|
expect(createConsumer.mock.calls[0][0]).not.toContain('access-token');
|
|
connector.disconnect();
|
|
});
|
|
|
|
it('gets a fresh ticket after a dashboard disconnect', async () => {
|
|
getCookie.mockReturnValue('1');
|
|
post
|
|
.mockResolvedValueOnce({ data: { data: { ticket: 'first' } } })
|
|
.mockResolvedValueOnce({ data: { data: { ticket: 'second' } } });
|
|
|
|
const connector = new BaseActionCableConnector(app, 'pubsub');
|
|
await vi.waitFor(() => expect(createConsumer).toHaveBeenCalledOnce());
|
|
subscriptionState.callbacks.disconnected();
|
|
await vi.advanceTimersByTimeAsync(1000);
|
|
await vi.waitFor(() => expect(createConsumer).toHaveBeenCalledTimes(2));
|
|
|
|
expect(createConsumer).toHaveBeenLastCalledWith(
|
|
`${window.location.origin}/cable?ticket=second`
|
|
);
|
|
connector.disconnect();
|
|
});
|
|
|
|
it('does not open a dashboard socket when ticket exchange returns 401', async () => {
|
|
getCookie.mockReturnValue('1');
|
|
post.mockRejectedValue({ response: { status: 401 } });
|
|
|
|
new BaseActionCableConnector(app, 'pubsub');
|
|
await vi.waitFor(() => expect(post).toHaveBeenCalledOnce());
|
|
|
|
expect(createConsumer).not.toHaveBeenCalled();
|
|
});
|
|
});
|