Danijel Martinek
49241845b5
The tRPC createContext was () => ({}) — the mounted dsr/consent routers
401'd every call and the dsr singleton stub threw (audit finding A11).
createTrpcContext now accepts an app resolveUser hook; web-next resolves
the session cookie through the auth feature's validateSession (denylist
included) plus a role snapshot, and threads bindProductionDsr/Consent
(or dev-seed) bindings into every request. The dsr router resolves its
binding from ctx.dsrBinding per request instead of a throwing proxy.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
91 lines
3.2 KiB
TypeScript
91 lines
3.2 KiB
TypeScript
import { describe, it, expect, vi, beforeEach } from "vitest";
|
|
|
|
const findByID = vi.fn();
|
|
vi.mock("payload", () => ({
|
|
getPayload: vi.fn(async () => ({ findByID })),
|
|
}));
|
|
vi.mock("@repo/core-cms", () => ({ default: Promise.resolve({}) }));
|
|
|
|
const validateSession = vi.fn();
|
|
vi.mock("@repo/auth/di/container", () => ({
|
|
authContainer: { get: () => ({ validateSession }) },
|
|
}));
|
|
|
|
const consentFactory = vi.fn(async () => ({}));
|
|
const dsrBinding = { marker: "dsr-binding" };
|
|
const resolveBindingMode = vi.fn<() => "production" | "dev-seed">(
|
|
() => "production",
|
|
);
|
|
vi.mock("./bind-production", () => ({
|
|
bindAll: vi.fn(async () => {}),
|
|
getComplianceBindings: vi.fn(async () => ({ consentFactory, dsrBinding })),
|
|
resolveBindingMode: () => resolveBindingMode(),
|
|
}));
|
|
|
|
import { createWebNextTrpcContext } from "./trpc-context";
|
|
|
|
function makeRequest(headers: Record<string, string> = {}): Request {
|
|
return new Request("https://example.test/api/trpc", { headers });
|
|
}
|
|
|
|
describe("createWebNextTrpcContext (A11)", () => {
|
|
beforeEach(() => {
|
|
vi.clearAllMocks();
|
|
resolveBindingMode.mockReturnValue("production");
|
|
findByID.mockResolvedValue({ id: "user-1", role: "admin" });
|
|
validateSession.mockResolvedValue({ user: { id: "user-1" } });
|
|
});
|
|
|
|
it("threads compliance bindings for anonymous requests", async () => {
|
|
const ctx = await createWebNextTrpcContext(makeRequest());
|
|
expect(ctx.user).toBeUndefined();
|
|
expect(ctx.userId).toBeUndefined();
|
|
expect(ctx.consentFactory).toBe(consentFactory);
|
|
expect(ctx.dsrBinding).toBe(dsrBinding);
|
|
expect(validateSession).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it("derives clientIp from proxy headers (B2)", async () => {
|
|
const ctx = await createWebNextTrpcContext(
|
|
makeRequest({ "x-forwarded-for": "203.0.113.9" }),
|
|
);
|
|
expect(ctx.clientIp).toBe("203.0.113.9");
|
|
});
|
|
|
|
it("resolves the user + role snapshot from the payload-token cookie", async () => {
|
|
const ctx = await createWebNextTrpcContext(
|
|
makeRequest({ cookie: "payload-token=jwt-abc; other=1" }),
|
|
);
|
|
expect(validateSession).toHaveBeenCalledWith("jwt-abc");
|
|
expect(ctx.user).toEqual({ id: "user-1", roles: ["admin"] });
|
|
expect(ctx.userId).toBe("user-1");
|
|
});
|
|
|
|
it("resolves the dev-seed session cookie name too", async () => {
|
|
resolveBindingMode.mockReturnValue("dev-seed");
|
|
const ctx = await createWebNextTrpcContext(
|
|
makeRequest({ cookie: "session=session_user-1" }),
|
|
);
|
|
expect(validateSession).toHaveBeenCalledWith("session_user-1");
|
|
// dev-seed has no Payload — role snapshot is empty
|
|
expect(ctx.user).toEqual({ id: "user-1", roles: [] });
|
|
expect(findByID).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it("treats an invalid/expired session as anonymous", async () => {
|
|
validateSession.mockRejectedValue(new Error("Invalid or expired"));
|
|
const ctx = await createWebNextTrpcContext(
|
|
makeRequest({ cookie: "payload-token=tampered" }),
|
|
);
|
|
expect(ctx.user).toBeUndefined();
|
|
});
|
|
|
|
it("yields no roles when the users doc has none", async () => {
|
|
findByID.mockResolvedValue({ id: "user-1" });
|
|
const ctx = await createWebNextTrpcContext(
|
|
makeRequest({ cookie: "payload-token=jwt-abc" }),
|
|
);
|
|
expect(ctx.user).toEqual({ id: "user-1", roles: [] });
|
|
});
|
|
});
|