65 lines
3.9 KiB
JavaScript
65 lines
3.9 KiB
JavaScript
// Public HTTPS preflight. Uses only deliberately invalid OAuth codes; creates no
|
|
// user/report, makes no paid Face++ call, and never simulates a production OpenID.
|
|
// H5_BASE_URL=https://1me.xajuzi.com/state/ node h5/test/wechat-production.mjs
|
|
import assert from 'node:assert/strict';
|
|
import { randomUUID } from 'node:crypto';
|
|
|
|
assert(process.env.H5_BASE_URL, 'Set H5_BASE_URL explicitly for the production preflight');
|
|
const base = new URL(process.env.H5_BASE_URL);
|
|
assert.equal(base.protocol, 'https:');
|
|
assert(base.pathname.endsWith('/'), 'H5_BASE_URL must have a trailing slash');
|
|
const expectedAppId = process.env.WECHAT_EXPECTED_APP_ID || 'wx645d9a7573f1fe9a';
|
|
async function api(route, options = {}) {
|
|
return fetch(new URL('api/' + route, base), { ...options, redirect: 'manual', signal: AbortSignal.timeout(20000) });
|
|
}
|
|
const config = await api('auth/config');
|
|
assert.equal(config.status, 200);
|
|
assert.equal((await config.json()).wechat, true);
|
|
for (const [data, origin, status] of [
|
|
[{ consent: false }, base.origin, 400],
|
|
[{ consent: true }, 'https://invalid.example', 403]
|
|
]) {
|
|
const r = await api('auth/wechat', { method: 'POST', headers: { 'Content-Type': 'application/json', Origin: origin }, body: JSON.stringify(data) });
|
|
assert.equal(r.status, status);
|
|
}
|
|
async function start() {
|
|
const r = await api('auth/wechat', { method: 'POST', headers: { 'Content-Type': 'application/json', Origin: base.origin }, body: JSON.stringify({ consent: true }) });
|
|
assert.equal(r.status, 200);
|
|
const cookies = r.headers.getSetCookie();
|
|
const binding = cookies.find(c => c.startsWith('juzi_oauth='));
|
|
assert(binding && binding.includes('Secure') && binding.includes('HttpOnly') && binding.includes('SameSite=Lax'));
|
|
assert(binding.includes('Path=' + base.pathname + ';'));
|
|
assert(!cookies.some(c => c.startsWith('juzi_session=')));
|
|
const auth = new URL((await r.json()).url);
|
|
assert.equal(auth.origin + auth.pathname, 'https://open.weixin.qq.com/connect/oauth2/authorize');
|
|
assert.equal(auth.searchParams.get('appid'), expectedAppId);
|
|
assert.equal(auth.searchParams.get('scope'), 'snsapi_base');
|
|
assert.equal(auth.searchParams.get('response_type'), 'code');
|
|
assert.equal(auth.searchParams.get('redirect_uri'), new URL('api/auth/wechat/callback', base).href);
|
|
assert.equal(auth.hash, '#wechat_redirect');
|
|
assert(!auth.searchParams.has('secret'));
|
|
const state = auth.searchParams.get('state');
|
|
assert(/^[a-f0-9]{64}$/.test(state));
|
|
return { cookie: binding.split(';')[0], state };
|
|
}
|
|
async function callback(row, cookie, expectedError) {
|
|
const query = new URLSearchParams({ code: 'codex-invalid-' + randomUUID(), state: row.state });
|
|
const r = await api('auth/wechat/callback?' + query, { headers: cookie ? { Cookie: cookie } : {} });
|
|
assert.equal(r.status, 302);
|
|
assert.equal(r.headers.get('location'), base.pathname + '?login_error=' + expectedError);
|
|
assert(!r.headers.getSetCookie().some(c => c.startsWith('juzi_session=')), 'invalid callback must not issue a session');
|
|
}
|
|
const missingBinding = await start();
|
|
await callback(missingBinding, '', 'state');
|
|
const invalidCode = await start();
|
|
await callback(invalidCode, invalidCode.cookie, 'wechat');
|
|
await callback(invalidCode, invalidCode.cookie, 'state');
|
|
assert.equal((await api('auth/session')).status, 200);
|
|
assert.equal((await (await api('auth/session')).json()).user, null);
|
|
assert.equal((await api('reports')).status, 401);
|
|
assert.equal((await api('admin/records')).status, 401);
|
|
assert.equal((await fetch(new URL('admin.html', base))).status, 401);
|
|
assert.equal((await api('health')).status, 200);
|
|
assert.equal((await fetch(new URL('/MP_verify_kpx234XimQGtFPo6.txt', base))).status, 200);
|
|
console.log('PASS: public HTTPS WeChat config, consent/CSRF, correct authorization URL, Secure scoped cookies, missing binding, real invalid-code rejection, state replay rejection, anonymous report denial, admin protection and domain file; REAL client authorization remains untested');
|