asepharyana
9a48fbf227
- Apply Biome organize-import/formatting fixes across changed S3 files - Replace remaining string concatenations with template literals for lint - Make home page inline handlers explicit via window.* and add button types - Clean S3 auth lint issues with dot-property access and optional chaining - Keep GetObject proxy and production/S3 SDK tests passing Verification: - bun run lint (0 errors, 1 CSS specificity warning) - S3_SECRET_KEY=<env> bun test test/production-e2e.test.ts (29 pass) - S3_SECRET_KEY=<env> bun test test/s3-sdk.test.ts (20 pass) - bun test test/s3-auth.test.ts (5 pass)
87 lines
2.6 KiB
TypeScript
87 lines
2.6 KiB
TypeScript
import { beforeAll, describe, expect, it } from 'bun:test';
|
|
|
|
describe('S3 Auth (SigV4)', () => {
|
|
let verifySignature: typeof import('../src/utils/s3/auth').verifySignature;
|
|
let verifyPresignedUrl: typeof import('../src/utils/s3/auth').verifyPresignedUrl;
|
|
let isS3Request: typeof import('../src/utils/s3/auth').isS3Request;
|
|
|
|
beforeAll(async () => {
|
|
const auth = await import('../src/utils/s3/auth');
|
|
verifySignature = auth.verifySignature;
|
|
verifyPresignedUrl = auth.verifyPresignedUrl;
|
|
isS3Request = auth.isS3Request;
|
|
});
|
|
|
|
it('detects S3 requests by Authorization header', () => {
|
|
expect(isS3Request({ authorization: 'AWS4-HMAC-SHA256 Credential=...' })).toBe(true);
|
|
expect(isS3Request({ authorization: 'Bearer token123' })).toBe(false);
|
|
expect(isS3Request({})).toBe(false);
|
|
});
|
|
|
|
it('rejects missing Authorization header', async () => {
|
|
const result = await verifySignature(
|
|
'GET',
|
|
'http://localhost/',
|
|
{},
|
|
null,
|
|
'key',
|
|
'secret',
|
|
'us-east-1',
|
|
);
|
|
expect(result.isValid).toBe(false);
|
|
expect(result.errorCode).toBe('AccessDenied');
|
|
});
|
|
|
|
it('rejects wrong access key before signature calculation succeeds', async () => {
|
|
const headers = {
|
|
authorization:
|
|
'AWS4-HMAC-SHA256 Credential=wrongkey/20260706/us-east-1/s3/aws4_request, SignedHeaders=host, Signature=abc123',
|
|
'x-amz-date': '20260706T120000Z',
|
|
host: 'localhost',
|
|
};
|
|
const result = await verifySignature(
|
|
'GET',
|
|
'http://localhost/',
|
|
headers,
|
|
null,
|
|
'correctkey',
|
|
'secret',
|
|
'us-east-1',
|
|
);
|
|
expect(result.isValid).toBe(false);
|
|
expect(result.errorCode).toBe('SignatureDoesNotMatch');
|
|
});
|
|
|
|
it('rejects region mismatch in Authorization credential scope', async () => {
|
|
const headers = {
|
|
authorization:
|
|
'AWS4-HMAC-SHA256 Credential=testkey/20260706/eu-west-1/s3/aws4_request, SignedHeaders=host;x-amz-date, Signature=abc123',
|
|
'x-amz-date': '20260706T120000Z',
|
|
host: 'localhost',
|
|
};
|
|
const result = await verifySignature(
|
|
'GET',
|
|
'http://localhost/',
|
|
headers,
|
|
null,
|
|
'testkey',
|
|
'secret',
|
|
'us-east-1',
|
|
);
|
|
expect(result.isValid).toBe(false);
|
|
expect(result.errorCode).toBe('SignatureDoesNotMatch');
|
|
});
|
|
|
|
it('rejects malformed presigned URLs', async () => {
|
|
const result = await verifyPresignedUrl(
|
|
'http://localhost/bucket/key',
|
|
'GET',
|
|
'key',
|
|
'secret',
|
|
'us-east-1',
|
|
);
|
|
expect(result.isValid).toBe(false);
|
|
expect(result.errorCode).toBe('AccessDenied');
|
|
});
|
|
});
|