kimi-code/packages/server-v2/test/bindClassify.test.ts
haozhe.yang 4d103c5d76 feat(server-v2): add auth and request security hardening
- add persistent bearer-token auth (token store, credentials, password hashing)
- gate HTTP and WebSocket (bearer subprotocol) upgrades behind auth
- classify loopback vs non-loopback binds and validate hostnames/origin
- add rate limiting and security headers middleware
- add GUI store service and routes
- add process file locking
2026-07-01 11:44:20 +08:00

73 lines
2 KiB
TypeScript

import { describe, expect, it } from 'vitest';
import { classify } from '../src/security/bindClassify';
describe('classify', () => {
describe('loopback', () => {
it.each([['127.0.0.1'], ['127.255.255.255'], ['::1'], ['localhost']])(
'%s → loopback',
(host) => {
expect(classify(host)).toBe('loopback');
},
);
});
describe('lan', () => {
it.each([
['192.168.1.5'],
['10.0.0.1'],
['172.16.0.1'],
['172.31.255.255'],
['169.254.1.1'],
['fe80::1'],
['fe80:0000:0000:0000:0000:0000:0000:0001'],
['febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff'],
])('%s → lan', (host) => {
expect(classify(host)).toBe('lan');
});
});
describe('public', () => {
it.each([
['8.8.8.8'],
['172.32.0.1'],
['203.0.113.5'],
['2001:4860:4860::8888'],
['fec0::1'],
['example.com'],
])('%s → public', (host) => {
expect(classify(host)).toBe('public');
});
});
describe('wildcard binds default to public unless relaxed', () => {
it('0.0.0.0 → public by default', () => {
expect(classify('0.0.0.0')).toBe('public');
});
it('0.0.0.0 → lan when bindClass=lan', () => {
expect(classify('0.0.0.0', { bindClass: 'lan' })).toBe('lan');
});
it('0.0.0.0 → public when bindClass=public', () => {
expect(classify('0.0.0.0', { bindClass: 'public' })).toBe('public');
});
it(':: → public by default', () => {
expect(classify('::')).toBe('public');
});
it(':: → lan when bindClass=lan', () => {
expect(classify('::', { bindClass: 'lan' })).toBe('lan');
});
it('empty string → public by default', () => {
expect(classify('')).toBe('public');
});
});
it('bindClass override does not reclassify a concrete loopback/lan host', () => {
expect(classify('127.0.0.1', { bindClass: 'public' })).toBe('loopback');
expect(classify('192.168.1.5', { bindClass: 'public' })).toBe('lan');
});
});