bckelley/cgm-remote-monitor
1
0
Fork 0
mirror of https://github.com/bckelley/cgm-remote-monitor.git synced 2026-08-24 03:14:12 -05:00
Code Issues Packages Projects Releases Wiki Activity

migrate to API-SECRET header

Browse Source 
@jasoncalabrese pointed out that some agents do odd things with
underscores and that using a hyphen is more common.
This also adds tests to ensure that the API_SECRET handling works as
expected.
This commit is contained in:
Ben West
2014-07-27 15:12:40 -07:00
parent c7def83762
commit ff84000773
2 changed files with 49 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/security.test.js
+47 -3
View File
@@ -40,11 +40,35 @@ describe('API_SECRET', function ( ) {
should.not.exist(env.api_secret);
var ctx = setup_app(env, function ( ) {
ctx.app.enabled('api').should.be.false;
ping_status(ctx.app, done);
ping_status(ctx.app, again);
function again ( ) {
ping_authorized_endpoint(ctx.app, 404, done);
}
});
});
it('should work fail set unauthorized', function (done) {
var known = 'b723e97aa97846eb92d5264f084b2823f57c4aa1';
delete process.env.API_SECRET;
process.env.API_SECRET = 'this is my long pass phrase';
var env = require('../env')( );
env.api_secret.should.equal(known);
var ctx = setup_app(env, function ( ) {
// console.log(this.app.enabled('api'));
ctx.app.enabled('api').should.be.true;
// ping_status(ctx.app, done);
// ping_authorized_endpoint(ctx.app, 200, done);
ping_status(ctx.app, again);
function again ( ) {
ctx.app.api_secret = '';
ping_authorized_endpoint(ctx.app, 401, done);
}
});
});
it('should work fine set', function (done) {
var known = 'b723e97aa97846eb92d5264f084b2823f57c4aa1';
delete process.env.API_SECRET;
@@ -54,7 +78,13 @@ describe('API_SECRET', function ( ) {
var ctx = setup_app(env, function ( ) {
// console.log(this.app.enabled('api'));
ctx.app.enabled('api').should.be.true;
ping_status(ctx.app, done);
// ping_status(ctx.app, done);
// ping_authorized_endpoint(ctx.app, 200, done);
ping_status(ctx.app, again);
function again ( ) {
ctx.app.api_secret = env.api_secret;
ping_authorized_endpoint(ctx.app, 200, done);
}
});
});
@@ -72,7 +102,7 @@ describe('API_SECRET', function ( ) {
function ping_status (app, fn) {
request(app)
.get('/status/.json')
.get('/status.json')
.expect(200)
.end(function (err, res) {
// console.log(res.body);
@@ -82,5 +112,19 @@ describe('API_SECRET', function ( ) {
})
}
function ping_authorized_endpoint (app, fails, fn) {
request(app)
.get('/experiments/test')
.set('API-SECRET', app.api_secret || '')
.expect(fails)
.end(function (err, res) {
if (fails < 400) {
res.body.status.should.equal('ok');
}
fn( );
// console.log('err', err, 'res', res);
})
}
});