df53130861
- Workforce: Employees register, per-employee dashboards, Attendance table - Plant Clock: scan-only clock, bottom tab bar (Employees / Oil & Diesel / Job cards) - Oil & Diesel stock: diesel tank (650 L, opening 589 L), level overwrite dialog, QR on each card, book-out screen with searchable vehicle picker, filterable "Booked out" table (today/week/month/all/range) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
37 lines
2.1 KiB
JavaScript
37 lines
2.1 KiB
JavaScript
// Run against a running local dev or production server. Does not modify PocketBase.
|
|
import { test } from "node:test";
|
|
import assert from "node:assert/strict";
|
|
|
|
const base = process.env.MEGA_AUTH_BASE_URL || "http://localhost:6007";
|
|
test("anonymous dashboard and app API requests are denied, including IDs ending in .json", async () => {
|
|
for (const path of [
|
|
"/", "/settings", "/plant", "/income/invoices", "/income/external-invoices", "/sites", "/clock", "/employees", "/attendance",
|
|
]) {
|
|
const response = await fetch(`${base}${path}`, { redirect: "manual" });
|
|
assert.equal(response.status, 307);
|
|
assert.ok(response.headers.get("location")?.endsWith("/login"));
|
|
}
|
|
for (const path of ["/api/assets/missing", "/api/assets/missing.json", "/api/invoices/intake", "/api/clock/roster", "/api/clock/scan"]) {
|
|
assert.equal((await fetch(`${base}${path}`)).status, 401);
|
|
}
|
|
assert.equal((await fetch(`${base}/api/health`)).status, 200);
|
|
});
|
|
|
|
test("standalone Clock manifest and sign-in are public while scanner remains protected", async () => {
|
|
const response=await fetch(`${base}/clock.webmanifest`);
|
|
assert.equal(response.status,200);assert.equal((await response.json()).id,"/clock");
|
|
const login=await fetch(`${base}/clock/login`);assert.equal(login.status,200);
|
|
const html=await login.text();assert.match(html,/clock\.webmanifest/);
|
|
assert.match(html,/Sign in to start scanning/);
|
|
const scanner=await fetch(`${base}/clock`,{redirect:"manual"});
|
|
assert.equal(scanner.status,307);assert.ok(scanner.headers.get("location")?.endsWith("/clock/login"));
|
|
});
|
|
|
|
test("logout deletes local session without a valid backend user and rejects other origins", async () => {
|
|
const response = await fetch(`${base}/api/auth/logout`, {
|
|
method: "POST", headers: { Origin: base, Cookie: "mega_session=not-a-real-token" },
|
|
});
|
|
assert.equal(response.status, 200);
|
|
assert.match(response.headers.get("set-cookie") || "", /mega_session=;/);
|
|
assert.equal((await fetch(`${base}/api/auth/logout`, { method: "POST", headers: { Origin: "https://unrelated.example" } })).status, 403);
|
|
});
|