35 lines
1.9 KiB
TypeScript
35 lines
1.9 KiB
TypeScript
import { afterEach, describe, expect, it, vi } from "vitest";
|
|
import { createAgentApiClient } from "./client";
|
|
|
|
afterEach(() => { vi.restoreAllMocks(); vi.unstubAllGlobals(); });
|
|
|
|
describe("authenticated session exports", () => {
|
|
it("fetches only Agent session files with identity and project headers", async () => {
|
|
const fetchMock = vi.fn(async () => new Response("ZIP", { headers: { "Content-Type": "application/zip" } }));
|
|
vi.stubGlobal("fetch", fetchMock);
|
|
vi.stubGlobal("URL", class extends URL {
|
|
static createObjectURL = vi.fn(() => "blob:fixture");
|
|
static revokeObjectURL = vi.fn();
|
|
});
|
|
const click = vi.spyOn(HTMLAnchorElement.prototype, "click").mockImplementation(() => {});
|
|
const client = createAgentApiClient("https://agent.test", { getAccessToken: async () => "FIXTURE", getProjectId: async () => "project-a" });
|
|
const path = "/api/v1/session/session-a/files/mcp-11111111-1111-1111-1111-111111111111.zip";
|
|
await client.downloadFile(path);
|
|
const [url, init] = fetchMock.mock.calls[0] as unknown as [string, RequestInit];
|
|
expect(url).toBe(`https://agent.test${path}`);
|
|
expect(new Headers(init.headers).get("Authorization")).toBe("Bearer FIXTURE");
|
|
expect(new Headers(init.headers).get("X-Project-Id")).toBe("project-a");
|
|
expect(init.redirect).toBe("error");
|
|
expect(click).toHaveBeenCalledOnce();
|
|
});
|
|
|
|
it("rejects arbitrary URLs and paths before requesting any credential", async () => {
|
|
const getAccessToken = vi.fn();
|
|
const client = createAgentApiClient("https://agent.test", { getAccessToken });
|
|
for (const path of ["https://foreign.test/file.zip", "/api/v1/admin/files/a.zip", "/api/v1/session/s/files/secret.env", "/api/v1/session/s/files/../owner.json"]) {
|
|
await expect(client.downloadFile(path)).rejects.toThrow("无效");
|
|
}
|
|
expect(getAccessToken).not.toHaveBeenCalled();
|
|
});
|
|
});
|