danvics/zerobyte
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

test: controllers security tests

Browse source
This commit is contained in:
Nicolas Meienberger 2025-12-19 19:05:28 +01:00
parent 9e1dfcc669
commit 8d4efa86d8
6 changed files with 462 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
app/server/modules/backups/__tests__/backups.controller.test.ts
View file

@ -37,7 +37,7 @@ describe("backups security", () => {
expect(res.status).toBe(200);
});
describe("unauthenticated access to all endpoints", () => {
describe("unauthenticated access", () => {
const endpoints: { method: string; path: string }[] = [
{ method: "GET", path: "/api/v1/backups" },
{ method: "GET", path: "/api/v1/backups/1" },

53
app/server/modules/events/__tests__/events.controller.test.ts Normal file
View file

@ -0,0 +1,53 @@
import { test, describe, expect } from "bun:test";
import { createApp } from "~/server/app";
import { createTestSession } from "~/test/helpers/auth";
const app = createApp();
describe("events security", () => {
test("should return 401 if no session cookie is provided", async () => {
const res = await app.request("/api/v1/events");
expect(res.status).toBe(401);
const body = await res.json();
expect(body.message).toBe("Authentication required");
});
test("should return 401 if session is invalid", async () => {
const res = await app.request("/api/v1/events", {
headers: {
Cookie: "session_id=invalid-session",
},
});
expect(res.status).toBe(401);
const body = await res.json();
expect(body.message).toBe("Invalid or expired session");
expect(res.headers.get("Set-Cookie")).toContain("session_id=;");
});
test("should return 200 if session is valid", async () => {
const { sessionId } = await createTestSession();
const res = await app.request("/api/v1/events", {
headers: {
Cookie: `session_id=${sessionId}`,
},
});
expect(res.status).toBe(200);
expect(res.headers.get("Content-Type")).toBe("text/event-stream");
});
describe("unauthenticated access", () => {
const endpoints: { method: string; path: string }[] = [{ method: "GET", path: "/api/v1/events" }];
for (const { method, path } of endpoints) {
test(`${method} ${path} should return 401`, async () => {
const res = await app.request(path, { method });
expect(res.status).toBe(401);
const body = await res.json();
expect(body.message).toBe("Authentication required");
});
}
});
});

110
app/server/modules/notifications/__tests__/notifications.controller.test.ts Normal file
View file

@ -0,0 +1,110 @@
import { test, describe, expect } from "bun:test";
import { createApp } from "~/server/app";
import { createTestSession } from "~/test/helpers/auth";
const app = createApp();
describe("notifications security", () => {
test("should return 401 if no session cookie is provided", async () => {
const res = await app.request("/api/v1/notifications/destinations");
expect(res.status).toBe(401);
const body = await res.json();
expect(body.message).toBe("Authentication required");
});
test("should return 401 if session is invalid", async () => {
const res = await app.request("/api/v1/notifications/destinations", {
headers: {
Cookie: "session_id=invalid-session",
},
});
expect(res.status).toBe(401);
const body = await res.json();
expect(body.message).toBe("Invalid or expired session");
expect(res.headers.get("Set-Cookie")).toContain("session_id=;");
});
test("should return 200 if session is valid", async () => {
const { sessionId } = await createTestSession();
const res = await app.request("/api/v1/notifications/destinations", {
headers: {
Cookie: `session_id=${sessionId}`,
},
});
expect(res.status).toBe(200);
});
describe("unauthenticated access", () => {
const endpoints: { method: string; path: string }[] = [
{ method: "GET", path: "/api/v1/notifications/destinations" },
{ method: "POST", path: "/api/v1/notifications/destinations" },
{ method: "GET", path: "/api/v1/notifications/destinations/1" },
{ method: "PATCH", path: "/api/v1/notifications/destinations/1" },
{ method: "DELETE", path: "/api/v1/notifications/destinations/1" },
{ method: "POST", path: "/api/v1/notifications/destinations/1/test" },
];
for (const { method, path } of endpoints) {
test(`${method} ${path} should return 401`, async () => {
const res = await app.request(path, { method });
expect(res.status).toBe(401);
const body = await res.json();
expect(body.message).toBe("Authentication required");
});
}
});
describe("information disclosure", () => {
test("should not disclose if a destination exists when unauthenticated", async () => {
const res = await app.request("/api/v1/notifications/destinations/999999");
expect(res.status).toBe(401);
const body = await res.json();
expect(body.message).toBe("Authentication required");
});
});
describe("input validation", () => {
test("should return 404 for malformed destination ID", async () => {
const { sessionId } = await createTestSession();
const res = await app.request("/api/v1/notifications/destinations/not-a-number", {
headers: {
Cookie: `session_id=${sessionId}`,
},
});
expect(res.status).toBe(404);
});
test("should return 404 for non-existent destination ID", async () => {
const { sessionId } = await createTestSession();
const res = await app.request("/api/v1/notifications/destinations/999999", {
headers: {
Cookie: `session_id=${sessionId}`,
},
});
expect(res.status).toBe(404);
const body = await res.json();
expect(body.message).toBe("Notification destination not found");
});
test("should return 400 for invalid payload on create", async () => {
const { sessionId } = await createTestSession();
const res = await app.request("/api/v1/notifications/destinations", {
method: "POST",
headers: {
Cookie: `session_id=${sessionId}`,
"Content-Type": "application/json",
},
body: JSON.stringify({
name: "Test",
}),
});
expect(res.status).toBe(400);
});
});
});

105
app/server/modules/repositories/__tests__/repositories.controller.test.ts Normal file
View file

@ -0,0 +1,105 @@
import { test, describe, expect } from "bun:test";
import { createApp } from "~/server/app";
import { createTestSession } from "~/test/helpers/auth";
const app = createApp();
describe("repositories security", () => {
test("should return 401 if no session cookie is provided", async () => {
const res = await app.request("/api/v1/repositories");
expect(res.status).toBe(401);
const body = await res.json();
expect(body.message).toBe("Authentication required");
});
test("should return 401 if session is invalid", async () => {
const res = await app.request("/api/v1/repositories", {
headers: {
Cookie: "session_id=invalid-session",
},
});
expect(res.status).toBe(401);
const body = await res.json();
expect(body.message).toBe("Invalid or expired session");
expect(res.headers.get("Set-Cookie")).toContain("session_id=;");
});
test("should return 200 if session is valid", async () => {
const { sessionId } = await createTestSession();
const res = await app.request("/api/v1/repositories", {
headers: {
Cookie: `session_id=${sessionId}`,
},
});
expect(res.status).toBe(200);
});
describe("unauthenticated access", () => {
const endpoints: { method: string; path: string }[] = [
{ method: "GET", path: "/api/v1/repositories" },
{ method: "POST", path: "/api/v1/repositories" },
{ method: "GET", path: "/api/v1/repositories/rclone-remotes" },
{ method: "GET", path: "/api/v1/repositories/test-repo" },
{ method: "DELETE", path: "/api/v1/repositories/test-repo" },
{ method: "GET", path: "/api/v1/repositories/test-repo/snapshots" },
{ method: "GET", path: "/api/v1/repositories/test-repo/snapshots/test-snapshot" },
{ method: "GET", path: "/api/v1/repositories/test-repo/snapshots/test-snapshot/files" },
{ method: "POST", path: "/api/v1/repositories/test-repo/restore" },
{ method: "POST", path: "/api/v1/repositories/test-repo/doctor" },
{ method: "DELETE", path: "/api/v1/repositories/test-repo/snapshots/test-snapshot" },
{ method: "PATCH", path: "/api/v1/repositories/test-repo" },
];
for (const { method, path } of endpoints) {
test(`${method} ${path} should return 401`, async () => {
const res = await app.request(path, { method });
expect(res.status).toBe(401);
const body = await res.json();
expect(body.message).toBe("Authentication required");
});
}
});
describe("information disclosure", () => {
test("should not disclose if a repository exists when unauthenticated", async () => {
const res = await app.request("/api/v1/repositories/non-existent-repo");
expect(res.status).toBe(401);
const body = await res.json();
expect(body.message).toBe("Authentication required");
});
});
describe("input validation", () => {
test("should return 404 for non-existent repository", async () => {
const { sessionId } = await createTestSession();
const res = await app.request("/api/v1/repositories/non-existent-repo", {
headers: {
Cookie: `session_id=${sessionId}`,
},
});
expect(res.status).toBe(404);
const body = await res.json();
expect(body.message).toBe("Repository not found");
});
test("should return 400 for invalid payload on create", async () => {
const { sessionId } = await createTestSession();
const res = await app.request("/api/v1/repositories", {
method: "POST",
headers: {
Cookie: `session_id=${sessionId}`,
"Content-Type": "application/json",
},
body: JSON.stringify({
name: "Test",
}),
});
expect(res.status).toBe(400);
});
});
});

89
app/server/modules/system/__tests__/system.controller.test.ts Normal file
View file

@ -0,0 +1,89 @@
import { test, describe, expect } from "bun:test";
import { createApp } from "~/server/app";
import { createTestSession } from "~/test/helpers/auth";
const app = createApp();
describe("system security", () => {
test("should return 401 if no session cookie is provided", async () => {
const res = await app.request("/api/v1/system/info");
expect(res.status).toBe(401);
const body = await res.json();
expect(body.message).toBe("Authentication required");
});
test("should return 401 if session is invalid", async () => {
const res = await app.request("/api/v1/system/info", {
headers: {
Cookie: "session_id=invalid-session",
},
});
expect(res.status).toBe(401);
const body = await res.json();
expect(body.message).toBe("Invalid or expired session");
expect(res.headers.get("Set-Cookie")).toContain("session_id=;");
});
test("should return 200 if session is valid", async () => {
const { sessionId } = await createTestSession();
const res = await app.request("/api/v1/system/info", {
headers: {
Cookie: `session_id=${sessionId}`,
},
});
expect(res.status).toBe(200);
});
describe("unauthenticated access", () => {
const endpoints: { method: string; path: string }[] = [
{ method: "GET", path: "/api/v1/system/info" },
{ method: "POST", path: "/api/v1/system/restic-password" },
];
for (const { method, path } of endpoints) {
test(`${method} ${path} should return 401`, async () => {
const res = await app.request(path, { method });
expect(res.status).toBe(401);
const body = await res.json();
expect(body.message).toBe("Authentication required");
});
}
});
describe("input validation", () => {
test("should return 400 for invalid payload on restic-password", async () => {
const { sessionId } = await createTestSession();
const res = await app.request("/api/v1/system/restic-password", {
method: "POST",
headers: {
Cookie: `session_id=${sessionId}`,
"Content-Type": "application/json",
},
body: JSON.stringify({}),
});
expect(res.status).toBe(400);
});
test("should return 401 for incorrect password on restic-password", async () => {
const { sessionId } = await createTestSession();
const res = await app.request("/api/v1/system/restic-password", {
method: "POST",
headers: {
Cookie: `session_id=${sessionId}`,
"Content-Type": "application/json",
},
body: JSON.stringify({
password: "wrong-password",
}),
});
expect(res.status).toBe(401);
const body = await res.json();
expect(body.message).toBe("Incorrect password");
});
});
});

104
app/server/modules/volumes/__tests__/volumes.controller.test.ts Normal file
View file

@ -0,0 +1,104 @@
import { test, describe, expect } from "bun:test";
import { createApp } from "~/server/app";
import { createTestSession } from "~/test/helpers/auth";
const app = createApp();
describe("volumes security", () => {
test("should return 401 if no session cookie is provided", async () => {
const res = await app.request("/api/v1/volumes");
expect(res.status).toBe(401);
const body = await res.json();
expect(body.message).toBe("Authentication required");
});
test("should return 401 if session is invalid", async () => {
const res = await app.request("/api/v1/volumes", {
headers: {
Cookie: "session_id=invalid-session",
},
});
expect(res.status).toBe(401);
const body = await res.json();
expect(body.message).toBe("Invalid or expired session");
expect(res.headers.get("Set-Cookie")).toContain("session_id=;");
});
test("should return 200 if session is valid", async () => {
const { sessionId } = await createTestSession();
const res = await app.request("/api/v1/volumes", {
headers: {
Cookie: `session_id=${sessionId}`,
},
});
expect(res.status).toBe(200);
});
describe("unauthenticated access", () => {
const endpoints: { method: string; path: string }[] = [
{ method: "GET", path: "/api/v1/volumes" },
{ method: "POST", path: "/api/v1/volumes" },
{ method: "POST", path: "/api/v1/volumes/test-connection" },
{ method: "DELETE", path: "/api/v1/volumes/test-volume" },
{ method: "GET", path: "/api/v1/volumes/test-volume" },
{ method: "PUT", path: "/api/v1/volumes/test-volume" },
{ method: "POST", path: "/api/v1/volumes/test-volume/mount" },
{ method: "POST", path: "/api/v1/volumes/test-volume/unmount" },
{ method: "POST", path: "/api/v1/volumes/test-volume/health-check" },
{ method: "GET", path: "/api/v1/volumes/test-volume/files" },
{ method: "GET", path: "/api/v1/volumes/filesystem/browse" },
];
for (const { method, path } of endpoints) {
test(`${method} ${path} should return 401`, async () => {
const res = await app.request(path, { method });
expect(res.status).toBe(401);
const body = await res.json();
expect(body.message).toBe("Authentication required");
});
}
});
describe("information disclosure", () => {
test("should not disclose if a volume exists when unauthenticated", async () => {
const res = await app.request("/api/v1/volumes/non-existent-volume");
expect(res.status).toBe(401);
const body = await res.json();
expect(body.message).toBe("Authentication required");
});
});
describe("input validation", () => {
test("should return 404 for non-existent volume", async () => {
const { sessionId } = await createTestSession();
const res = await app.request("/api/v1/volumes/non-existent-volume", {
headers: {
Cookie: `session_id=${sessionId}`,
},
});
expect(res.status).toBe(404);
const body = await res.json();
expect(body.message).toBe("Volume not found");
});
test("should return 400 for invalid payload on create", async () => {
const { sessionId } = await createTestSession();
const res = await app.request("/api/v1/volumes", {
method: "POST",
headers: {
Cookie: `session_id=${sessionId}`,
"Content-Type": "application/json",
},
body: JSON.stringify({
name: "Test",
}),
});
expect(res.status).toBe(400);
});
});
});