mirror of
https://github.com/gethomepage/homepage.git
synced 2026-10-17 07:51:44 -07:00
Fix api page tests creating routes
Docker CI / Docker Build & Push (push) Canceled after 0s
Lint / Linting Checks (push) Canceled after 0s
Release Drafter / Update Release Draft (push) Canceled after 0s
Release Drafter / Auto Label PR (push) Canceled after 0s
Tests / vitest (1) (push) Canceled after 0s
Tests / vitest (2) (push) Canceled after 0s
Tests / vitest (3) (push) Canceled after 0s
Tests / vitest (4) (push) Canceled after 0s
Docker CI / Docker Build & Push (push) Canceled after 0s
Lint / Linting Checks (push) Canceled after 0s
Release Drafter / Update Release Draft (push) Canceled after 0s
Release Drafter / Auto Label PR (push) Canceled after 0s
Tests / vitest (1) (push) Canceled after 0s
Tests / vitest (2) (push) Canceled after 0s
Tests / vitest (3) (push) Canceled after 0s
Tests / vitest (4) (push) Canceled after 0s
This commit is contained in:
shamoon
@@ -1,251 +0,0 @@
|
||||
import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
|
||||
|
||||
const { getServerSession, errorMock } = vi.hoisted(() => ({
|
||||
getServerSession: vi.fn(),
|
||||
errorMock: vi.fn(),
|
||||
}));
|
||||
|
||||
vi.mock("next-auth/next", () => ({ getServerSession }));
|
||||
vi.mock("utils/logger", () => ({ default: () => ({ error: errorMock, warn: vi.fn(), debug: vi.fn() }) }));
|
||||
|
||||
function mockResponse() {
|
||||
const res = {
|
||||
statusCode: 200,
|
||||
headers: {},
|
||||
body: undefined,
|
||||
setHeader: vi.fn((key, value) => {
|
||||
res.headers[key] = value;
|
||||
}),
|
||||
status: vi.fn((code) => {
|
||||
res.statusCode = code;
|
||||
return res;
|
||||
}),
|
||||
json: vi.fn((body) => {
|
||||
res.body = body;
|
||||
return res;
|
||||
}),
|
||||
end: vi.fn((body) => {
|
||||
res.body = body;
|
||||
return res;
|
||||
}),
|
||||
};
|
||||
return res;
|
||||
}
|
||||
|
||||
async function loadHandler() {
|
||||
vi.resetModules();
|
||||
return (await import("./index")).default;
|
||||
}
|
||||
|
||||
describe("pages/api/mcp", () => {
|
||||
const originalEnv = process.env;
|
||||
|
||||
beforeEach(() => {
|
||||
vi.resetModules();
|
||||
getServerSession.mockReset();
|
||||
errorMock.mockReset();
|
||||
process.env = { ...originalEnv };
|
||||
});
|
||||
|
||||
afterEach(() => {
|
||||
process.env = originalEnv;
|
||||
});
|
||||
|
||||
it("returns 404 while disabled", async () => {
|
||||
delete process.env.HOMEPAGE_MCP_ENABLED;
|
||||
const handler = await loadHandler();
|
||||
const res = mockResponse();
|
||||
|
||||
await handler({ method: "POST", headers: {}, body: { jsonrpc: "2.0", id: 1, method: "tools/list" } }, res);
|
||||
|
||||
expect(res.status).toHaveBeenCalledWith(404);
|
||||
});
|
||||
|
||||
it("requires bearer token when configured", async () => {
|
||||
process.env.HOMEPAGE_MCP_ENABLED = "true";
|
||||
process.env.HOMEPAGE_MCP_TOKEN = "mcp-tok-0123456789abcdefghijklmnopqrstuv";
|
||||
const handler = await loadHandler();
|
||||
const res = mockResponse();
|
||||
|
||||
await handler({ method: "POST", headers: {}, body: { jsonrpc: "2.0", id: 1, method: "tools/list" } }, res);
|
||||
|
||||
expect(res.status).toHaveBeenCalledWith(401);
|
||||
});
|
||||
|
||||
it("fails closed with 500 when the configured MCP token is too short", async () => {
|
||||
process.env.HOMEPAGE_MCP_ENABLED = "true";
|
||||
process.env.HOMEPAGE_MCP_TOKEN = "change-me";
|
||||
const handler = await loadHandler();
|
||||
const res = mockResponse();
|
||||
|
||||
// even presenting the weak token verbatim must not authorize
|
||||
await handler(
|
||||
{
|
||||
method: "POST",
|
||||
headers: { authorization: "Bearer change-me" },
|
||||
body: { jsonrpc: "2.0", id: 1, method: "tools/list" },
|
||||
},
|
||||
res,
|
||||
);
|
||||
|
||||
expect(res.status).toHaveBeenCalledWith(500);
|
||||
expect(getServerSession).not.toHaveBeenCalled();
|
||||
expect(errorMock).toHaveBeenCalledWith(expect.stringContaining("at least 32 characters"));
|
||||
});
|
||||
|
||||
it("rejects requests when neither Homepage auth nor an MCP token is configured", async () => {
|
||||
process.env.HOMEPAGE_MCP_ENABLED = "true";
|
||||
delete process.env.HOMEPAGE_AUTH_ENABLED;
|
||||
delete process.env.HOMEPAGE_MCP_TOKEN;
|
||||
const handler = await loadHandler();
|
||||
const res = mockResponse();
|
||||
|
||||
await handler({ method: "POST", headers: {}, body: { jsonrpc: "2.0", id: 1, method: "tools/list" } }, res);
|
||||
|
||||
expect(getServerSession).not.toHaveBeenCalled();
|
||||
expect(res.status).toHaveBeenCalledWith(401);
|
||||
});
|
||||
|
||||
it("handles JSON-RPC requests when enabled and authorized", async () => {
|
||||
process.env.HOMEPAGE_MCP_ENABLED = "true";
|
||||
process.env.HOMEPAGE_MCP_TOKEN = "mcp-tok-0123456789abcdefghijklmnopqrstuv";
|
||||
const handler = await loadHandler();
|
||||
const res = mockResponse();
|
||||
|
||||
await handler(
|
||||
{
|
||||
method: "POST",
|
||||
headers: { authorization: "Bearer mcp-tok-0123456789abcdefghijklmnopqrstuv" },
|
||||
body: { jsonrpc: "2.0", id: 1, method: "tools/list" },
|
||||
},
|
||||
res,
|
||||
);
|
||||
|
||||
expect(res.status).toHaveBeenCalledWith(200);
|
||||
expect(res.body.result.tools.length).toBeGreaterThan(0);
|
||||
});
|
||||
|
||||
it("allows requests with a NextAuth session when Homepage auth is enabled", async () => {
|
||||
process.env.HOMEPAGE_MCP_ENABLED = "true";
|
||||
process.env.HOMEPAGE_AUTH_ENABLED = "true";
|
||||
process.env.HOMEPAGE_AUTH_PASSWORD = "password";
|
||||
process.env.HOMEPAGE_AUTH_SECRET = "rk3Xk9wQ0mVJt7cZbN2yLpA8sHdF4gRuEwTiOaSvBnM=";
|
||||
process.env.HOMEPAGE_EXTERNAL_URL = "https://homepage.example";
|
||||
getServerSession.mockResolvedValueOnce({ user: { name: "Homepage" } });
|
||||
const handler = await loadHandler();
|
||||
const res = mockResponse();
|
||||
|
||||
await handler({ method: "POST", headers: {}, body: { jsonrpc: "2.0", id: 1, method: "tools/list" } }, res);
|
||||
|
||||
expect(getServerSession).toHaveBeenCalled();
|
||||
expect(res.status).toHaveBeenCalledWith(200);
|
||||
expect(res.body.result.tools.length).toBeGreaterThan(0);
|
||||
});
|
||||
|
||||
it("rejects requests without a token or session when Homepage auth is enabled", async () => {
|
||||
process.env.HOMEPAGE_MCP_ENABLED = "true";
|
||||
process.env.HOMEPAGE_AUTH_ENABLED = "true";
|
||||
process.env.HOMEPAGE_AUTH_PASSWORD = "password";
|
||||
process.env.HOMEPAGE_AUTH_SECRET = "rk3Xk9wQ0mVJt7cZbN2yLpA8sHdF4gRuEwTiOaSvBnM=";
|
||||
process.env.HOMEPAGE_EXTERNAL_URL = "https://homepage.example";
|
||||
getServerSession.mockResolvedValueOnce(null);
|
||||
const handler = await loadHandler();
|
||||
const res = mockResponse();
|
||||
|
||||
await handler({ method: "POST", headers: {}, body: { jsonrpc: "2.0", id: 1, method: "tools/list" } }, res);
|
||||
|
||||
expect(getServerSession).toHaveBeenCalled();
|
||||
expect(res.status).toHaveBeenCalledWith(401);
|
||||
});
|
||||
|
||||
it("allows bearer token requests when Homepage auth is enabled", async () => {
|
||||
process.env.HOMEPAGE_MCP_ENABLED = "true";
|
||||
process.env.HOMEPAGE_AUTH_ENABLED = "true";
|
||||
process.env.HOMEPAGE_AUTH_PASSWORD = "password";
|
||||
process.env.HOMEPAGE_AUTH_SECRET = "rk3Xk9wQ0mVJt7cZbN2yLpA8sHdF4gRuEwTiOaSvBnM=";
|
||||
process.env.HOMEPAGE_EXTERNAL_URL = "https://homepage.example";
|
||||
process.env.HOMEPAGE_MCP_TOKEN = "mcp-tok-0123456789abcdefghijklmnopqrstuv";
|
||||
const handler = await loadHandler();
|
||||
const res = mockResponse();
|
||||
|
||||
await handler(
|
||||
{
|
||||
method: "POST",
|
||||
headers: { authorization: "Bearer mcp-tok-0123456789abcdefghijklmnopqrstuv" },
|
||||
body: { jsonrpc: "2.0", id: 1, method: "tools/list" },
|
||||
},
|
||||
res,
|
||||
);
|
||||
|
||||
expect(getServerSession).not.toHaveBeenCalled();
|
||||
expect(res.status).toHaveBeenCalledWith(200);
|
||||
});
|
||||
|
||||
it("returns 202 for JSON-RPC notifications", async () => {
|
||||
process.env.HOMEPAGE_MCP_ENABLED = "true";
|
||||
process.env.HOMEPAGE_MCP_TOKEN = "mcp-tok-0123456789abcdefghijklmnopqrstuv";
|
||||
const handler = await loadHandler();
|
||||
const res = mockResponse();
|
||||
|
||||
await handler(
|
||||
{
|
||||
method: "POST",
|
||||
headers: { authorization: "Bearer mcp-tok-0123456789abcdefghijklmnopqrstuv" },
|
||||
body: { jsonrpc: "2.0", method: "notifications/initialized" },
|
||||
},
|
||||
res,
|
||||
);
|
||||
|
||||
expect(res.status).toHaveBeenCalledWith(202);
|
||||
expect(res.end).toHaveBeenCalledWith();
|
||||
});
|
||||
|
||||
it("rejects non-POST requests", async () => {
|
||||
process.env.HOMEPAGE_MCP_ENABLED = "true";
|
||||
process.env.HOMEPAGE_MCP_TOKEN = "mcp-tok-0123456789abcdefghijklmnopqrstuv";
|
||||
const handler = await loadHandler();
|
||||
const res = mockResponse();
|
||||
|
||||
await handler(
|
||||
{ method: "GET", headers: { authorization: "Bearer mcp-tok-0123456789abcdefghijklmnopqrstuv" }, body: {} },
|
||||
res,
|
||||
);
|
||||
|
||||
expect(res.status).toHaveBeenCalledWith(405);
|
||||
expect(res.setHeader).toHaveBeenCalledWith("Allow", "POST");
|
||||
});
|
||||
|
||||
it("answers unauthenticated CORS preflights with 405 rather than 401", async () => {
|
||||
process.env.HOMEPAGE_MCP_ENABLED = "true";
|
||||
process.env.HOMEPAGE_MCP_TOKEN = "mcp-tok-0123456789abcdefghijklmnopqrstuv";
|
||||
const handler = await loadHandler();
|
||||
const res = mockResponse();
|
||||
|
||||
// a preflight never carries the Authorization header the browser strips
|
||||
await handler(
|
||||
{
|
||||
method: "OPTIONS",
|
||||
headers: {
|
||||
origin: "https://claude.ai",
|
||||
"access-control-request-method": "POST",
|
||||
"access-control-request-headers": "authorization,content-type",
|
||||
},
|
||||
},
|
||||
res,
|
||||
);
|
||||
|
||||
expect(res.status).toHaveBeenCalledWith(405);
|
||||
expect(res.setHeader).toHaveBeenCalledWith("Allow", "POST");
|
||||
expect(getServerSession).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it("still returns 404 for non-POST requests while disabled", async () => {
|
||||
delete process.env.HOMEPAGE_MCP_ENABLED;
|
||||
const handler = await loadHandler();
|
||||
const res = mockResponse();
|
||||
|
||||
await handler({ method: "OPTIONS", headers: {} }, res);
|
||||
|
||||
expect(res.status).toHaveBeenCalledWith(404);
|
||||
});
|
||||
});
|
||||
@@ -1,229 +0,0 @@
|
||||
import { beforeEach, describe, expect, it, vi } from "vitest";
|
||||
|
||||
import createMockRes from "test-utils/create-mock-res";
|
||||
|
||||
const { getServiceWidget, logger, genericHandler, allowedHandler, mappedHandler, calendarHandler } = vi.hoisted(() => ({
|
||||
getServiceWidget: vi.fn(),
|
||||
logger: { debug: vi.fn(), error: vi.fn() },
|
||||
genericHandler: vi.fn(),
|
||||
allowedHandler: vi.fn(),
|
||||
mappedHandler: vi.fn(),
|
||||
calendarHandler: vi.fn(),
|
||||
}));
|
||||
|
||||
vi.mock("utils/logger", () => ({
|
||||
default: () => logger,
|
||||
}));
|
||||
vi.mock("utils/config/service-helpers", () => ({
|
||||
default: getServiceWidget,
|
||||
}));
|
||||
vi.mock("widgets/calendar/proxy", () => ({
|
||||
default: calendarHandler,
|
||||
}));
|
||||
|
||||
vi.mock("widgets/widgets", () => ({
|
||||
default: {
|
||||
noendpoint: {
|
||||
api: "{url}",
|
||||
proxyHandler: genericHandler,
|
||||
},
|
||||
allowed: {
|
||||
api: "{url}/api/{endpoint}",
|
||||
proxyHandler: allowedHandler,
|
||||
allowedEndpoints: /^status$/,
|
||||
},
|
||||
mapped: {
|
||||
api: "{url}/{endpoint}",
|
||||
proxyHandler: mappedHandler,
|
||||
mappings: {
|
||||
Sessions: {
|
||||
endpoint: "Sessions",
|
||||
},
|
||||
Pause: {
|
||||
method: "POST",
|
||||
endpoint: "Sessions/Playing/Pause",
|
||||
body: "mapping-body",
|
||||
},
|
||||
Refresh: {
|
||||
method: "POST",
|
||||
endpoint: "Sessions/Refresh",
|
||||
},
|
||||
},
|
||||
},
|
||||
ical: {
|
||||
api: "{url}",
|
||||
proxyHandler: calendarHandler,
|
||||
},
|
||||
},
|
||||
}));
|
||||
|
||||
import handler from "./proxy";
|
||||
|
||||
function createReq({ method = "GET", body, query = {} } = {}) {
|
||||
return { method, body, query };
|
||||
}
|
||||
|
||||
describe("pages/api/services/proxy", () => {
|
||||
beforeEach(() => {
|
||||
vi.clearAllMocks();
|
||||
});
|
||||
|
||||
describe("client request shaping", () => {
|
||||
it("forces GET and drops the body on the no-endpoint quick return", async () => {
|
||||
getServiceWidget.mockResolvedValue({ type: "noendpoint", url: "http://example" });
|
||||
|
||||
const req = createReq({
|
||||
method: "POST",
|
||||
body: '{"cmd":"delete_all"}',
|
||||
query: { group: "g", service: "svc", index: "0" },
|
||||
});
|
||||
|
||||
await handler(req, createMockRes());
|
||||
|
||||
expect(genericHandler).toHaveBeenCalledTimes(1);
|
||||
const forwarded = genericHandler.mock.calls[0][0];
|
||||
expect(forwarded.method).toBe("GET");
|
||||
expect(forwarded.body).toBeUndefined();
|
||||
});
|
||||
|
||||
it.each(["PUT", "DELETE", "PATCH"])("forces GET for a %s on the no-endpoint quick return", async (method) => {
|
||||
getServiceWidget.mockResolvedValue({ type: "noendpoint", url: "http://example" });
|
||||
|
||||
const req = createReq({ method, body: "payload", query: { group: "g", service: "svc", index: "0" } });
|
||||
|
||||
await handler(req, createMockRes());
|
||||
|
||||
const forwarded = genericHandler.mock.calls[0][0];
|
||||
expect(forwarded.method).toBe("GET");
|
||||
expect(forwarded.body).toBeUndefined();
|
||||
});
|
||||
|
||||
it("forces GET and drops the body on the allowedEndpoints path", async () => {
|
||||
getServiceWidget.mockResolvedValue({ type: "allowed", url: "http://example" });
|
||||
|
||||
const req = createReq({
|
||||
method: "DELETE",
|
||||
body: "payload",
|
||||
query: { group: "g", service: "svc", endpoint: "status", index: "0" },
|
||||
});
|
||||
|
||||
await handler(req, createMockRes());
|
||||
|
||||
expect(allowedHandler).toHaveBeenCalledTimes(1);
|
||||
const forwarded = allowedHandler.mock.calls[0][0];
|
||||
expect(forwarded.method).toBe("GET");
|
||||
expect(forwarded.body).toBeUndefined();
|
||||
});
|
||||
|
||||
it("forces GET and drops the body on the calendar exception path", async () => {
|
||||
getServiceWidget.mockResolvedValue({ type: "calendar", url: "http://example" });
|
||||
|
||||
const req = createReq({
|
||||
method: "POST",
|
||||
body: "payload",
|
||||
query: { group: "g", service: "svc", endpoint: "events", index: "0" },
|
||||
});
|
||||
|
||||
await handler(req, createMockRes());
|
||||
|
||||
expect(calendarHandler).toHaveBeenCalledTimes(1);
|
||||
const forwarded = calendarHandler.mock.calls[0][0];
|
||||
expect(forwarded.method).toBe("GET");
|
||||
expect(forwarded.body).toBeUndefined();
|
||||
});
|
||||
|
||||
it("forces GET for a mapping that does not declare a method", async () => {
|
||||
getServiceWidget.mockResolvedValue({ type: "mapped", url: "http://example" });
|
||||
|
||||
const req = createReq({
|
||||
method: "POST",
|
||||
body: "payload",
|
||||
query: { group: "g", service: "svc", endpoint: "Sessions", index: "0" },
|
||||
});
|
||||
|
||||
await handler(req, createMockRes());
|
||||
|
||||
const forwarded = mappedHandler.mock.calls[0][0];
|
||||
expect(forwarded.method).toBe("GET");
|
||||
expect(forwarded.body).toBeUndefined();
|
||||
});
|
||||
|
||||
it("drops a client body when a non-GET mapping does not declare one", async () => {
|
||||
getServiceWidget.mockResolvedValue({ type: "mapped", url: "http://example" });
|
||||
|
||||
const req = createReq({
|
||||
method: "POST",
|
||||
body: "attacker-controlled",
|
||||
query: { group: "g", service: "svc", endpoint: "Refresh", index: "0" },
|
||||
});
|
||||
|
||||
await handler(req, createMockRes());
|
||||
|
||||
const forwarded = mappedHandler.mock.calls[0][0];
|
||||
expect(forwarded.method).toBe("POST");
|
||||
expect(forwarded.body).toBeUndefined();
|
||||
});
|
||||
});
|
||||
|
||||
describe("mapping opt-in", () => {
|
||||
it("still allows a mapping to declare a non-GET method and body", async () => {
|
||||
getServiceWidget.mockResolvedValue({ type: "mapped", url: "http://example" });
|
||||
|
||||
const req = createReq({
|
||||
method: "POST",
|
||||
query: { group: "g", service: "svc", endpoint: "Pause", index: "0" },
|
||||
});
|
||||
|
||||
await handler(req, createMockRes());
|
||||
|
||||
expect(mappedHandler).toHaveBeenCalledTimes(1);
|
||||
const forwarded = mappedHandler.mock.calls[0][0];
|
||||
expect(forwarded.method).toBe("POST");
|
||||
expect(forwarded.body).toBe("mapping-body");
|
||||
expect(forwarded.query.endpoint).toBe("Sessions/Playing/Pause");
|
||||
});
|
||||
|
||||
it("rejects a method that does not match the mapping", async () => {
|
||||
getServiceWidget.mockResolvedValue({ type: "mapped", url: "http://example" });
|
||||
|
||||
const req = createReq({
|
||||
method: "GET",
|
||||
query: { group: "g", service: "svc", endpoint: "Pause", index: "0" },
|
||||
});
|
||||
const res = createMockRes();
|
||||
|
||||
await handler(req, res);
|
||||
|
||||
expect(mappedHandler).not.toHaveBeenCalled();
|
||||
expect(res.statusCode).toBe(403);
|
||||
expect(res.body).toEqual({ error: "Unsupported method" });
|
||||
});
|
||||
});
|
||||
|
||||
describe("dispatch guards", () => {
|
||||
it("rejects an endpoint that fails the allowedEndpoints test", async () => {
|
||||
getServiceWidget.mockResolvedValue({ type: "allowed", url: "http://example" });
|
||||
|
||||
const req = createReq({ query: { group: "g", service: "svc", endpoint: "shutdown", index: "0" } });
|
||||
const res = createMockRes();
|
||||
|
||||
await handler(req, res);
|
||||
|
||||
expect(allowedHandler).not.toHaveBeenCalled();
|
||||
expect(res.statusCode).toBe(403);
|
||||
expect(res.body).toEqual({ error: "Unmapped proxy request." });
|
||||
});
|
||||
|
||||
it("rejects an unknown widget type", async () => {
|
||||
getServiceWidget.mockResolvedValue({ type: "nope", url: "http://example" });
|
||||
|
||||
const req = createReq({ query: { group: "g", service: "svc", index: "0" } });
|
||||
const res = createMockRes();
|
||||
|
||||
await handler(req, res);
|
||||
|
||||
expect(res.statusCode).toBe(403);
|
||||
expect(res.body).toEqual({ error: "Unknown proxy service type" });
|
||||
});
|
||||
});
|
||||
});
|
||||
Reference in New Issue
Block a user