Quintine
903c7731e2
Serve built Workers directly through pinned Miniflare with persistent D1-compatible storage and startup migrations. Build and verify Docker images in CI; publish main checkpoints to GHCR for manual TrueNAS updates on port 33046. Preserve explicit public-origin checks and LAN-compatible cryptographic operation IDs. Validation: 5,153 offline tests, typecheck, lint and build; 49 HTTP integration cases; HTTPS-origin create/join/chat/seat protection, foreign-origin rejection, exact saved-seat restart and browser asset serving. Independent persistence/proxy review completed. Clean Docker CI and actual NAS installation follow this source checkpoint.
15 lines
835 B
TypeScript
15 lines
835 B
TypeScript
import test from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { requestOrigin } from '../lib/request-origin';
|
|
|
|
void test('HTTP upstream can explicitly use its HTTPS public origin without trusting forwarded headers', () => {
|
|
const request = new Request('http://192.168.2.251:33046/api/rooms', {
|
|
headers: { 'x-forwarded-host': 'attacker.invalid', 'x-forwarded-proto': 'https' },
|
|
});
|
|
assert.equal(requestOrigin(request), 'http://192.168.2.251:33046');
|
|
assert.equal(requestOrigin(request, 'https://dune.example.test/'), 'https://dune.example.test');
|
|
for (const invalid of ['https://dune.example.test/path', 'https://user:secret@dune.example.test', 'https://dune.example.test/?x=1', 'https://dune.example.test/#x', 'file:///tmp', 'invalid']) {
|
|
assert.throws(() => requestOrigin(request, invalid));
|
|
}
|
|
});
|