light
6ec9778d45
Laimiao agent v2 service: agent orchestration, sessions, billing, gateway client, skills catalog, auth, config, plus tests.
45 lines
2.0 KiB
TypeScript
45 lines
2.0 KiB
TypeScript
import { createHmac } from "node:crypto";
|
|
import { describe, expect, it } from "vitest";
|
|
import { AuthError, resolveIdentity, verifyJwt } from "../src/auth/jwt.js";
|
|
|
|
function sign(payload: Record<string, unknown>, secret = "secret", alg = "HS256"): string {
|
|
const header = Buffer.from(JSON.stringify({ alg, typ: "JWT" })).toString("base64url");
|
|
const body = Buffer.from(JSON.stringify(payload)).toString("base64url");
|
|
const signature = createHmac("sha256", secret).update(`${header}.${body}`).digest("base64url");
|
|
return `${header}.${body}.${signature}`;
|
|
}
|
|
|
|
describe("auth", () => {
|
|
it("verifies a valid HS256 token and resolves identity", () => {
|
|
const token = sign({ uid: 42, nickname: "小明", exp: Math.floor(Date.now() / 1000) + 60 });
|
|
const identity = resolveIdentity(
|
|
{ jwtKey: "secret", jwtAlgorithm: "HS256" },
|
|
{ headers: { authorization: `Bearer ${token}`, "x-team-id": "9" } },
|
|
);
|
|
expect(identity).toMatchObject({ uid: "42", nickname: "小明", team_id: "9" });
|
|
});
|
|
|
|
it("rejects missing, expired, tampered, and wrong-algorithm tokens", () => {
|
|
const auth = { jwtKey: "secret", jwtAlgorithm: "HS256" };
|
|
expect(() => resolveIdentity(auth, { headers: {} })).toThrow(AuthError);
|
|
|
|
const expired = sign({ uid: 1, exp: Math.floor(Date.now() / 1000) - 1 });
|
|
expect(() => verifyJwt(expired, "secret", "HS256")).toThrow(/过期/);
|
|
|
|
const valid = sign({ uid: 1, exp: Math.floor(Date.now() / 1000) + 60 });
|
|
const tampered = `${valid.split(".").slice(0, 2).join(".")}.bad`;
|
|
expect(() => verifyJwt(tampered, "secret", "HS256")).toThrow(/签名/);
|
|
|
|
const wrongAlg = sign({ uid: 1, exp: Math.floor(Date.now() / 1000) + 60 }, "secret", "HS512");
|
|
expect(() => verifyJwt(wrongAlg, "secret", "HS256")).toThrow(/算法/);
|
|
});
|
|
|
|
it("uses x-uid headers in development mode", () => {
|
|
const identity = resolveIdentity(
|
|
{ jwtAlgorithm: "HS256" },
|
|
{ headers: { "x-uid": "7", "x-team-id": "8", "x-nickname": "dev" } },
|
|
);
|
|
expect(identity).toEqual({ uid: "7", team_id: "8", nickname: "dev" });
|
|
});
|
|
});
|