v2 auths tests

src/server/server.ts

@@ -12,7 +12,7 @@ router.post(
     .exists({ checkFalsy: true })
     .withMessage('Missing Authorization Header')
     .bail()
-    .contains('Bearer')
+    .custom(e => e.split(' ')[0].toLowerCase() == 'bearer')
     .withMessage('Authorization Token is not Bearer'),
   validateErrors,
   async (req, res, next) => {
@@ -129,8 +129,10 @@ router.post(
   validateErrors,
   async (req, res) => {
     if (!req.headers.authorization) return res.sendStatus(403)
-    const query = (await CheckServerToken(req.headers.authorization.split(' ')[1]))
+    const headers = req.headers.authorization.split(' ')
-    if (!query) return
+    if (headers[0].toLowerCase() != "bearer") return res.status(403).send("authorization must be token bearer")
+    const query = (await CheckServerToken(headers[1]))
+    if (!query) return res.sendStatus(403)
     const host = query.id
     const {
       servername,

tests/server.test.ts

@@ -11,7 +11,43 @@ beforeAll(async () => {
 })
 
 describe('server', () => {
-  test('server auth prefetch', async () => {
+
+  test('bad auth prefetch', async () => {
+    const response = await fetch(`http://127.0.0.1:3001/`, {
+      method: "POST", // *GET, POST, PUT, DELETE, etc.
+      credentials: "same-origin", // include, *same-origin, omit
+      headers: {
+        "Content-Type": "application/json",
+        'Authorization': `Bearere ${Buffer.from('' + process.env.SERVERAUTH_TOKEN).toString('base64')}`
+      }
+    });
+    expect(response.status).toBe(400)
+
+    const response2 = await fetch(`http://127.0.0.1:3001/`, {
+      method: "POST", // *GET, POST, PUT, DELETE, etc.
+      credentials: "same-origin", // include, *same-origin, omit
+      headers: {
+        "Content-Type": "application/json",
+        'Authorization': `Bearer ${Buffer.from('badtoken').toString('base64')}`
+      }
+    });
+    expect(response2.status).toBe(403)
+  })
+
+  test('bad kill token', async () => {
+    const response2 = await fetch(`http://127.0.0.1:3001/kill`, {
+      method: "POST", // *GET, POST, PUT, DELETE, etc.
+      credentials: "same-origin", // include, *same-origin, omit
+      headers: {
+        "Content-Type": "application/json",
+        'Authorization': `Bearer ${Buffer.from('badtoken').toString('base64')}`
+      }
+    });
+    expect(response2.status).toBe(403)
+  })
+
+
+  test('good auth prefetch', async () => {
     const response = await fetch(`http://127.0.0.1:3001/`, {
       method: "POST", // *GET, POST, PUT, DELETE, etc.
       credentials: "same-origin", // include, *same-origin, omit