@memberjunction/server 6.2.0-edge.3 → 6.2.0-edge.5

package/src/__tests__/RealtimeProxyServer.test.ts

@@ -1,4 +1,4 @@
-import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
 import type { IncomingMessage } from 'node:http';
 import type { Duplex } from 'node:stream';
 import { RealtimeProxyRegistry, REALTIME_PROXY_PATH } from '@memberjunction/ai';
@@ -105,6 +105,21 @@ describe('C3: Origin allowlist (MJ_REALTIME_PROXY_ALLOWED_ORIGINS)', () => {
         expect(RealtimeProxyRegistry.Instance.Consume(ticket.ID)).not.toBeNull();
     });
 
+    it('logs the refusal once with the origin, never the ticket or the query', () => {
+        process.env[ENV_KEY] = 'https://app.example.com';
+        const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+        try {
+            const ticket = RealtimeProxyRegistry.Instance.Issue({ UpstreamUrl: 'ws://internal:8000/v1/realtime', TTLSeconds: 60 });
+            proxy.TryHandleUpgrade(reqWithOrigin(`${REALTIME_PROXY_PATH}?ticket=${ticket.ID}`, 'https://evil.example'), sock(new FakeSocket()), HEAD);
+            const lines = warn.mock.calls.map((call) => call.map(String).join(' '));
+            expect(lines).toEqual(['[RealtimeProxy] upgrade refused (403): origin "https://evil.example" is not in MJ_REALTIME_PROXY_ALLOWED_ORIGINS']);
+            expect(lines[0]).not.toContain(ticket.ID);
+            expect(lines[0]).not.toContain('ticket=');
+        } finally {
+            warn.mockRestore();
+        }
+    });
+
     it('accepts an allowlisted origin (normalization: case + trailing slash)', () => {
         process.env[ENV_KEY] = 'https://App.Example.com/';
         const fake = new FakeSocket();