From 4305eb117a65fe0a5516cdbe2ec055566f2950b4 Mon Sep 17 00:00:00 2001
From: legonzaur <legonzaur@live.fr>
Date: Thu, 20 Apr 2023 11:48:29 +0200
Subject: [PATCH] v2 auths tests

---
 src/server/server.ts |  8 +++++---
 tests/server.test.ts | 38 +++++++++++++++++++++++++++++++++++++-
 2 files changed, 42 insertions(+), 4 deletions(-)

diff --git a/src/server/server.ts b/src/server/server.ts
index 6bbaa71..3a05183 100644
--- a/src/server/server.ts
+++ b/src/server/server.ts
@@ -12,7 +12,7 @@ router.post(
     .exists({ checkFalsy: true })
     .withMessage('Missing Authorization Header')
     .bail()
-    .contains('Bearer')
+    .custom(e => e.split(' ')[0].toLowerCase() == 'bearer')
     .withMessage('Authorization Token is not Bearer'),
   validateErrors,
   async (req, res, next) => {
@@ -129,8 +129,10 @@ router.post(
   validateErrors,
   async (req, res) => {
     if (!req.headers.authorization) return res.sendStatus(403)
-    const query = (await CheckServerToken(req.headers.authorization.split(' ')[1]))
-    if (!query) return
+    const headers = req.headers.authorization.split(' ')
+    if (headers[0].toLowerCase() != "bearer") return res.status(403).send("authorization must be token bearer")
+    const query = (await CheckServerToken(headers[1]))
+    if (!query) return res.sendStatus(403)
     const host = query.id
     const {
       servername,
diff --git a/tests/server.test.ts b/tests/server.test.ts
index 7c534f6..75f4d18 100644
--- a/tests/server.test.ts
+++ b/tests/server.test.ts
@@ -11,7 +11,43 @@ beforeAll(async () => {
 })
 
 describe('server', () => {
-  test('server auth prefetch', async () => {
+
+  test('bad auth prefetch', async () => {
+    const response = await fetch(`http://127.0.0.1:3001/`, {
+      method: "POST", // *GET, POST, PUT, DELETE, etc.
+      credentials: "same-origin", // include, *same-origin, omit
+      headers: {
+        "Content-Type": "application/json",
+        'Authorization': `Bearere ${Buffer.from('' + process.env.SERVERAUTH_TOKEN).toString('base64')}`
+      }
+    });
+    expect(response.status).toBe(400)
+
+    const response2 = await fetch(`http://127.0.0.1:3001/`, {
+      method: "POST", // *GET, POST, PUT, DELETE, etc.
+      credentials: "same-origin", // include, *same-origin, omit
+      headers: {
+        "Content-Type": "application/json",
+        'Authorization': `Bearer ${Buffer.from('badtoken').toString('base64')}`
+      }
+    });
+    expect(response2.status).toBe(403)
+  })
+
+  test('bad kill token', async () => {
+    const response2 = await fetch(`http://127.0.0.1:3001/kill`, {
+      method: "POST", // *GET, POST, PUT, DELETE, etc.
+      credentials: "same-origin", // include, *same-origin, omit
+      headers: {
+        "Content-Type": "application/json",
+        'Authorization': `Bearer ${Buffer.from('badtoken').toString('base64')}`
+      }
+    });
+    expect(response2.status).toBe(403)
+  })
+
+
+  test('good auth prefetch', async () => {
     const response = await fetch(`http://127.0.0.1:3001/`, {
       method: "POST", // *GET, POST, PUT, DELETE, etc.
       credentials: "same-origin", // include, *same-origin, omit