Flea Flicker
8f5a069e77
/api/readyz was returning 401 Unauthorized in UAT (GRO-2692 Shedward regression). The authMiddleware for /api/* did not whitelist /api/readyz, causing every unauthenticated probe request to be rejected. Add /api/readyz to the bypass condition alongside /api/auth/* and /api/health. Add readyz-auth-bypass.test.ts confirming the route passes through the middleware without auth and that non-whitelisted paths still block (503 when auth not configured). Closes GRO-2692 regression (UAT fail).
45 lines
1.5 KiB
TypeScript
45 lines
1.5 KiB
TypeScript
import { describe, it, expect, vi } from "vitest";
|
|
import { Hono } from "hono";
|
|
|
|
// Mock auth lib so getAuth() throws — non-bypass paths hit the 503 "not configured" guard.
|
|
vi.mock("../lib/auth.js", () => ({
|
|
getAuth: () => {
|
|
throw new Error("auth not configured");
|
|
},
|
|
initAuth: vi.fn(),
|
|
getActiveProviders: vi.fn(() => []),
|
|
}));
|
|
|
|
describe("authMiddleware bypass: /api/readyz", () => {
|
|
it("serves /api/readyz without auth (bypass before auth check)", async () => {
|
|
// Ensure AUTH_DISABLED is not set so the bypass is exercised, not AUTH_DISABLED shortcut.
|
|
const prev = process.env.AUTH_DISABLED;
|
|
delete process.env.AUTH_DISABLED;
|
|
|
|
const { authMiddleware } = await import("../middleware/auth.js");
|
|
const app = new Hono();
|
|
app.use("/api/*", authMiddleware);
|
|
app.get("/api/readyz", (c) => c.json({ status: "ok" }, 200));
|
|
|
|
const res = await app.request("/api/readyz", { method: "GET" });
|
|
expect(res.status).toBe(200);
|
|
|
|
if (prev !== undefined) process.env.AUTH_DISABLED = prev;
|
|
});
|
|
|
|
it("blocks non-whitelisted /api/* paths when auth is not configured", async () => {
|
|
const prev = process.env.AUTH_DISABLED;
|
|
delete process.env.AUTH_DISABLED;
|
|
|
|
const { authMiddleware } = await import("../middleware/auth.js");
|
|
const app = new Hono();
|
|
app.use("/api/*", authMiddleware);
|
|
app.get("/api/staff", (c) => c.json({ ok: true }, 200));
|
|
|
|
const res = await app.request("/api/staff", { method: "GET" });
|
|
expect(res.status).toBe(503);
|
|
|
|
if (prev !== undefined) process.env.AUTH_DISABLED = prev;
|
|
});
|
|
});
|