mirror of
https://github.com/anomalyco/opencode.git
synced 2026-08-30 01:02:02 +00:00
24 lines
1.5 KiB
TypeScript
24 lines
1.5 KiB
TypeScript
import { expect, test } from "bun:test"
|
|
import { isAllowedCorsOrigin, isAllowedRequestOrigin } from "../src/cors"
|
|
|
|
test("custom origins extend the defaults without allowing other origins", () => {
|
|
const options = { cors: ["http://192.168.1.10:3001", "https://example.com"] }
|
|
expect(isAllowedCorsOrigin("http://192.168.1.10:3001")).toBe(false)
|
|
expect(isAllowedCorsOrigin("http://192.168.1.10:3001", options)).toBe(true)
|
|
expect(isAllowedCorsOrigin("https://example.com", options)).toBe(true)
|
|
expect(isAllowedCorsOrigin("http://localhost:3001", options)).toBe(true)
|
|
expect(isAllowedCorsOrigin("https://app.opencode.ai", options)).toBe(true)
|
|
expect(isAllowedCorsOrigin(undefined, options)).toBe(true)
|
|
expect(isAllowedCorsOrigin("http://192.168.1.10:3002", options)).toBe(false)
|
|
expect(isAllowedCorsOrigin("https://example.com.evil.test", options)).toBe(false)
|
|
expect(isAllowedCorsOrigin("http://example.com", options)).toBe(false)
|
|
expect(isAllowedCorsOrigin("null", options)).toBe(false)
|
|
})
|
|
|
|
test("PTY origin checks use the same allowlist and retain same-host access", () => {
|
|
const options = { cors: ["http://192.168.1.10:3001"] }
|
|
expect(isAllowedRequestOrigin("http://192.168.1.10:3001", "192.168.1.10:1029")).toBe(false)
|
|
expect(isAllowedRequestOrigin("http://192.168.1.10:3001", "192.168.1.10:1029", options)).toBe(true)
|
|
expect(isAllowedRequestOrigin("http://192.168.1.10:1029", "192.168.1.10:1029", options)).toBe(true)
|
|
expect(isAllowedRequestOrigin("http://192.168.1.10:3002", "192.168.1.10:1029", options)).toBe(false)
|
|
})
|