Dave
2594dead84
Add PocketBase login, first-sign-in password changes, account settings, and user activation, reactivation and deletion with self-removal guards. Protect application pages and APIs and keep private pages out of PWA caches. Resolve plant locations from site assignments and improve map controls, profit chart views, navigation and mobile table layouts. Validation: production build and TypeScript passed; 28 unit tests passed. Backend access integration tests and mobile verification are documented.
25 lines
1.3 KiB
JavaScript
25 lines
1.3 KiB
JavaScript
// Run against a running local dev or production server. Does not modify PocketBase.
|
|
import { test } from "node:test";
|
|
import assert from "node:assert/strict";
|
|
|
|
const base = process.env.MEGA_AUTH_BASE_URL || "http://localhost:6007";
|
|
test("anonymous dashboard and app API requests are denied, including IDs ending in .json", async () => {
|
|
for (const path of ["/", "/settings", "/plant", "/income/invoices", "/sites"]) {
|
|
const response = await fetch(`${base}${path}`, { redirect: "manual" });
|
|
assert.equal(response.status, 307);
|
|
assert.ok(response.headers.get("location")?.endsWith("/login"));
|
|
}
|
|
for (const path of ["/api/assets/missing", "/api/assets/missing.json", "/api/invoices/intake"]) {
|
|
assert.equal((await fetch(`${base}${path}`)).status, 401);
|
|
}
|
|
assert.equal((await fetch(`${base}/api/health`)).status, 200);
|
|
});
|
|
|
|
test("logout deletes local session without a valid backend user and rejects other origins", async () => {
|
|
const response = await fetch(`${base}/api/auth/logout`, {
|
|
method: "POST", headers: { Origin: base, Cookie: "mega_session=not-a-real-token" },
|
|
});
|
|
assert.equal(response.status, 200);
|
|
assert.match(response.headers.get("set-cookie") || "", /mega_session=;/);
|
|
assert.equal((await fetch(`${base}/api/auth/logout`, { method: "POST", headers: { Origin: "https://unrelated.example" } })).status, 403);
|
|
});
|