mega-plant/scripts/verify-auth-routes.mjs

// Run against a running local dev or production server. Does not modify PocketBase.
import { test } from "node:test";
import assert from "node:assert/strict";

const base = process.env.MEGA_AUTH_BASE_URL || "http://localhost:6007";
test("anonymous dashboard and app API requests are denied, including IDs ending in .json", async () => {
  for (const path of [
    "/", "/settings", "/plant", "/income/invoices", "/income/external-invoices", "/sites", "/clock", "/employees", "/attendance",
  ]) {
    const response = await fetch(`${base}${path}`, { redirect: "manual" });
    assert.equal(response.status, 307);
    assert.ok(response.headers.get("location")?.endsWith("/login"));
  }
  for (const path of ["/api/assets/missing", "/api/assets/missing.json", "/api/invoices/intake", "/api/clock/roster", "/api/clock/scan"]) {
    assert.equal((await fetch(`${base}${path}`)).status, 401);
  }
  assert.equal((await fetch(`${base}/api/health`)).status, 200);
});

test("standalone Clock manifest and sign-in are public while scanner remains protected", async () => {
  const response=await fetch(`${base}/clock.webmanifest`);
  assert.equal(response.status,200);assert.equal((await response.json()).id,"/clock");
  const login=await fetch(`${base}/clock/login`);assert.equal(login.status,200);
  const html=await login.text();assert.match(html,/clock\.webmanifest/);
  assert.match(html,/Sign in to start scanning/);
  const scanner=await fetch(`${base}/clock`,{redirect:"manual"});
  assert.equal(scanner.status,307);assert.ok(scanner.headers.get("location")?.endsWith("/clock/login"));
});

test("logout deletes local session without a valid backend user and rejects other origins", async () => {
  const response = await fetch(`${base}/api/auth/logout`, {
    method: "POST", headers: { Origin: base, Cookie: "mega_session=not-a-real-token" },
  });
  assert.equal(response.status, 200);
  assert.match(response.headers.get("set-cookie") || "", /mega_session=;/);
  assert.equal((await fetch(`${base}/api/auth/logout`, { method: "POST", headers: { Origin: "https://unrelated.example" } })).status, 403);
});