twitter-lite/src/features/access/policy.test.ts

// @vitest-environment node
import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
import { checkAccess, readAccessConfig } from "./policy.server";

const config = {
  mode: "tailscale" as const,
  origin: "https://deck.invalid",
  allowedLogin: "[email protected]",
};

beforeEach(() => vi.stubEnv("TWITTER_LITE_AUTH_MODE", undefined));
afterEach(() => vi.unstubAllEnvs());

describe("access boundary", () => {
  it.each([undefined, "tailscale"])("requires an owner in identity mode: %s", (mode) => {
    vi.stubEnv("TWITTER_LITE_AUTH_MODE", mode);
    vi.stubEnv("TWITTER_LITE_ORIGIN", config.origin);
    vi.stubEnv("TWITTER_LITE_ALLOWED_LOGIN", "");
    expect(readAccessConfig()).toBeNull();
  });

  it.each(["", "off", "NONE"])("fails closed for an unknown auth mode: %s", (mode) => {
    vi.stubEnv("TWITTER_LITE_AUTH_MODE", mode);
    vi.stubEnv("TWITTER_LITE_ORIGIN", config.origin);
    vi.stubEnv("TWITTER_LITE_ALLOWED_LOGIN", config.allowedLogin);
    expect(checkAccess(new Request(config.origin), readAccessConfig())?.status).toBe(503);
  });

  it("allows private-proxy navigation without an identity only when explicitly configured", () => {
    vi.stubEnv("TWITTER_LITE_AUTH_MODE", "none");
    vi.stubEnv("TWITTER_LITE_ORIGIN", config.origin);
    vi.stubEnv("TWITTER_LITE_ALLOWED_LOGIN", "");
    const access = readAccessConfig();
    expect(access).toEqual({ origin: config.origin, mode: "none" });
    expect(checkAccess(new Request(config.origin), access)).toBeNull();
  });

  it("still requires a configured origin without identity authentication", () => {
    vi.stubEnv("TWITTER_LITE_AUTH_MODE", "none");
    vi.stubEnv("TWITTER_LITE_ORIGIN", "");
    expect(readAccessConfig()).toBeNull();
  });

  it.each(["POST", "PUT", "PATCH", "DELETE"])(
    "requires exact Origin without identity authentication for %s",
    (method) => {
      const access = { origin: config.origin, mode: "none" as const };
      expect(checkAccess(new Request(config.origin, { method }), access)?.status).toBe(403);
      expect(
        checkAccess(
          new Request(config.origin, {
            method,
            headers: {
              Origin: "https://other.invalid",
              "Sec-Fetch-Site": "same-origin",
            },
          }),
          access,
        )?.status,
      ).toBe(403);
      expect(
        checkAccess(
          new Request(config.origin, {
            method,
            headers: { Origin: config.origin },
          }),
          access,
        ),
      ).toBeNull();
    },
  );

  it("fails closed when the deployment is not configured", () => {
    vi.stubEnv("TWITTER_LITE_ORIGIN", "");
    vi.stubEnv("TWITTER_LITE_ALLOWED_LOGIN", "");
    expect(readAccessConfig()).toBeNull();
    expect(checkAccess(new Request(config.origin), null)?.status).toBe(503);
  });

  it.each(["", "https://deck.invalid/path", "http://deck.invalid", "not a URL"])(
    "rejects an invalid configured origin: %s",
    (origin) => {
      vi.stubEnv("TWITTER_LITE_ORIGIN", origin);
      vi.stubEnv("TWITTER_LITE_ALLOWED_LOGIN", config.allowedLogin);
      expect(readAccessConfig()).toBeNull();
    },
  );

  it.each(["https://deck.invalid", "http://127.0.0.1:4173"])(
    "accepts an explicit deployment origin: %s",
    (origin) => {
      vi.stubEnv("TWITTER_LITE_ORIGIN", origin);
      vi.stubEnv("TWITTER_LITE_ALLOWED_LOGIN", config.allowedLogin);
      expect(readAccessConfig()).toEqual({ ...config, origin });
    },
  );

  it.each([undefined, "[email protected]", "[email protected], [email protected]"])(
    "rejects absent, foreign, or ambiguous identities: %s",
    (login) => {
      const headers = new Headers();
      if (login) headers.set("Tailscale-User-Login", login);
      expect(checkAccess(new Request(config.origin, { headers }), config)?.status).toBe(403);
    },
  );

  it("permits owner navigation back from an OAuth provider without Origin", () => {
    const request = new Request(`${config.origin}/oauth/mastodon/callback?code=code`, {
      headers: {
        "Tailscale-User-Login": config.allowedLogin,
        "Sec-Fetch-Site": "cross-site",
      },
    });
    expect(checkAccess(request, config)).toBeNull();
  });

  it.each(["POST", "PUT", "PATCH", "DELETE"])(
    "requires exact Origin for %s even with same-origin Fetch Metadata",
    (method) => {
      const headers = {
        "Tailscale-User-Login": config.allowedLogin,
        "Sec-Fetch-Site": "same-origin",
      };
      expect(checkAccess(new Request(config.origin, { method, headers }), config)?.status).toBe(
        403,
      );
      expect(
        checkAccess(
          new Request(config.origin, {
            method,
            headers: { ...headers, Origin: "https://other.invalid" },
          }),
          config,
        )?.status,
      ).toBe(403);
      expect(
        checkAccess(
          new Request(config.origin, {
            method,
            headers: { ...headers, Origin: config.origin },
          }),
          config,
        ),
      ).toBeNull();
    },
  );
});