@7365admin1/core 3.67.0 → 3.68.1

package/test/socket-session.test.mjs

@@ -0,0 +1,119 @@
+/*
+ * Proving who is on the other end of a socket.
+ *
+ * `/manpower` streams every client site's live staffing level — how many guards
+ * are actually on shift against how many were promised — to anyone who connects,
+ * with no credential of any kind. The authenticated twin `/manpower-live` uses
+ * this check; the old namespace is deliberately left open, because the guard app
+ * installed on phones today connects to it.
+ *
+ * Every refusal must look identical. A socket refused because its session
+ * expired must not be distinguishable from one refused for sending nothing, or
+ * the difference becomes an oracle.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  MANPOWER_LIVE_NAMESPACE,
+  authoriseSocketSession,
+  sidFromHandshake,
+  userIdOfSession,
+} from "./.build/utils/socket-session.util.mjs";
+
+const SID = "a-live-session-id";
+const USER = "64b7f0000000000000000007";
+
+/** A session store holding exactly one live session. */
+const store = async (sid) => (sid === SID ? { user: USER } : null);
+
+test("the authenticated namespace is a NEW one, not the open feed", () => {
+  // If this ever became "/manpower", the guard handsets in the field would be
+  // cut off the moment it deployed.
+  assert.equal(MANPOWER_LIVE_NAMESPACE, "/manpower-live");
+  assert.notEqual(MANPOWER_LIVE_NAMESPACE, "/manpower");
+});
+
+test("the session id is read from every shape the clients send", () => {
+  assert.equal(sidFromHandshake({ headers: { cookie: `a=1; sid=${SID}; b=2` } }), SID);
+  assert.equal(sidFromHandshake({ auth: { sid: SID } }), SID);
+  assert.equal(sidFromHandshake({ auth: { token: SID } }), SID);
+  assert.equal(sidFromHandshake({ headers: { authorization: `Bearer ${SID}` } }), SID);
+  assert.equal(sidFromHandshake({ headers: { authorization: SID } }), SID);
+});
+
+test("the cookie wins, and an empty one does not mask the auth payload", () => {
+  assert.equal(
+    sidFromHandshake({ headers: { cookie: `sid=${SID}` }, auth: { sid: "other" } }),
+    SID,
+  );
+  assert.equal(sidFromHandshake({ headers: { cookie: "sid=" }, auth: { sid: SID } }), SID);
+});
+
+test("an empty handshake presents nothing", () => {
+  assert.equal(sidFromHandshake({}), "");
+  assert.equal(sidFromHandshake({ headers: {}, auth: {} }), "");
+  assert.equal(sidFromHandshake({ auth: { sid: "   " } }), "");
+});
+
+test("a session's user id is read under either spelling", () => {
+  assert.equal(userIdOfSession({ user: USER }), USER);
+  assert.equal(userIdOfSession({ _id: USER }), USER);
+  assert.equal(userIdOfSession(null), "");
+  assert.equal(userIdOfSession({}), "");
+});
+
+test("a live session is admitted", async () => {
+  assert.equal(await authoriseSocketSession({ auth: { sid: SID } }, store), USER);
+});
+
+test("an anonymous socket is refused - the whole point of the new namespace", async () => {
+  await assert.rejects(() => authoriseSocketSession({}, store), /Unauthorized/);
+});
+
+test("an expired or invented session id is refused", async () => {
+  await assert.rejects(
+    () => authoriseSocketSession({ auth: { sid: "not-real" } }, store),
+    /Unauthorized/,
+  );
+});
+
+test("a session that resolves to nobody is refused", async () => {
+  await assert.rejects(
+    () => authoriseSocketSession({ auth: { sid: SID } }, async () => ({})),
+    /Unauthorized/,
+  );
+});
+
+test("a session store that is DOWN refuses, it does not let everyone in", async () => {
+  // Fail closed here: this is an authentication decision, not a feature flag.
+  await assert.rejects(
+    () =>
+      authoriseSocketSession({ auth: { sid: SID } }, async () => {
+        throw new Error("redis is unreachable");
+      }),
+    /Unauthorized/,
+  );
+});
+
+test("every refusal carries the SAME message", async () => {
+  const messages = [];
+  for (const [handshake, read] of [
+    [{}, store],
+    [{ auth: { sid: "not-real" } }, store],
+    [{ auth: { sid: SID } }, async () => ({})],
+    [
+      { auth: { sid: SID } },
+      async () => {
+        throw new Error("redis is unreachable");
+      },
+    ],
+  ]) {
+    await authoriseSocketSession(handshake, read).catch((error) =>
+      messages.push(error.message),
+    );
+  }
+
+  assert.equal(messages.length, 4);
+  assert.deepEqual([...new Set(messages)], ["Unauthorized"]);
+});