bbdfae09a0
The Playwright suite had no linter and no formatter — only tsc. Add flat-config ESLint
(typescript-eslint, type-aware) and Prettier (2-space, matching the suite's style).
Rules keep the ones that catch real TEST bugs and drop the noise:
- no-floating-promises KEPT — an un-awaited request/assertion can let a test end before it runs,
passing vacuously. It caught one: the SSE reader loop in sse-listener is now explicitly `void`.
- no-unused-vars KEPT — caught three dead bindings (an unused adminToken fixture arg, an unused
`api` arg, an unused JPEG_MAGIC import), all removed.
- no-explicit-any OFF — all test code; `any` is the honest type for an untyped res.json() body or
a page.evaluate() return.
- no-empty-pattern OFF — Playwright's dependency-free fixtures are `async ({}, use) => {}`.
Refactor: `const BASE = process.env.E2E_FRONTEND_URL ?? '...'` was redeclared verbatim in 23
files — extracted to helpers/env.ts and imported, so a port/scheme change is one edit not a sweep.
Then `prettier --write`. Verified: eslint clean, tsc clean, prettier clean, desktop suite 210
passed / 1 skipped. (One mobile spec flaked once under retries:0 — a pre-existing cross-test
reflow-timing vector from the flakiness audit, not this change: the each-key edit is stable across
16 isolated runs and a clean full mobile re-run.)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
54 lines
1.9 KiB
TypeScript
54 lines
1.9 KiB
TypeScript
/**
|
|
* Authorization checks. These overlap with Phase 2 adversarial work but
|
|
* belong here because they're foundational expectations on every endpoint:
|
|
* guest can't hit host/admin; host can't hit admin.
|
|
*/
|
|
import { test, expect } from '../../fixtures/test';
|
|
import { BASE } from '../../helpers/env';
|
|
|
|
test.describe('Authorization escalation guards', () => {
|
|
test('guest → POST /host/event/close returns 403', async ({ guest }) => {
|
|
const g = await guest('Esc1');
|
|
const res = await fetch(`${BASE}/api/v1/host/event/close`, {
|
|
method: 'POST',
|
|
headers: { Authorization: `Bearer ${g.jwt}` },
|
|
});
|
|
expect(res.status).toBe(403);
|
|
});
|
|
|
|
test('guest → GET /admin/config returns 403', async ({ guest }) => {
|
|
const g = await guest('Esc2');
|
|
const res = await fetch(`${BASE}/api/v1/admin/config`, {
|
|
headers: { Authorization: `Bearer ${g.jwt}` },
|
|
});
|
|
expect(res.status).toBe(403);
|
|
});
|
|
|
|
test('host → GET /admin/config returns 403 (host ≠ admin)', async ({ host }) => {
|
|
const res = await fetch(`${BASE}/api/v1/admin/config`, {
|
|
headers: { Authorization: `Bearer ${host.jwt}` },
|
|
});
|
|
expect(res.status).toBe(403);
|
|
});
|
|
|
|
test('tampered JWT returns 401', async ({ guest }) => {
|
|
const g = await guest('Tampered');
|
|
const parts = g.jwt.split('.');
|
|
// Flip a character in the signature.
|
|
const tampered = `${parts[0]}.${parts[1]}.${parts[2].slice(0, -1)}${parts[2].endsWith('A') ? 'B' : 'A'}`;
|
|
const res = await fetch(`${BASE}/api/v1/me/context`, {
|
|
headers: { Authorization: `Bearer ${tampered}` },
|
|
});
|
|
expect(res.status).toBe(401);
|
|
});
|
|
|
|
test('expired session JWT returns 401', async ({ guest, db }) => {
|
|
const g = await guest('Expired');
|
|
await db.expireSession(g.userId);
|
|
const res = await fetch(`${BASE}/api/v1/me/context`, {
|
|
headers: { Authorization: `Bearer ${g.jwt}` },
|
|
});
|
|
expect(res.status).toBe(401);
|
|
});
|
|
});
|