gooneyryan/hermes-web-ui
1
0
Fork 0
mirror of https://github.com/EKKOLearnAI/hermes-web-ui.git synced 2026-07-18 22:42:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

test server token loopback guard

Browse Source
This commit is contained in:
ekko
2026-06-06 09:03:58 +08:00
committed by ekko
parent 794cac7d72
commit 3df4ee87ce
1 changed files with 19 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/server/user-auth.test.ts
+19 -2
View File
@@ -143,11 +143,28 @@ describe('user auth tables and middleware', () => {
expect(ctx.state.serverTokenAuth).toBe(true)
})
it('rejects server token for MCP device endpoints from non-loopback clients', async () => {
it.each([
'/api/hermes/media/apikey-image-generate',
'/api/hermes/media/grok-image-to-video',
'/api/devices',
'/api/devices/scan',
'/api/devices/device-1/connect',
'/api/devices/peer-connections',
'/api/devices/peer-connections/conn-1/disconnect',
'/api/devices/peer-connections/conn-1/terminal',
'/api/devices/peer-connections/conn-1/terminals',
'/api/devices/peer-connections/conn-1/terminal/term-1/read',
'/api/devices/peer-connections/conn-1/terminal/term-1/input',
'/api/devices/peer-connections/conn-1/terminal/term-1/resize',
'/api/devices/peer-connections/conn-1/terminal/term-1/close',
'/api/devices/peer-connections/conn-1/exec',
'/api/devices/peer-connections/conn-1/download',
'/api/devices/peer-connections/conn-1/upload',
])('rejects server token for local-only endpoint %s from non-loopback clients', async (path) => {
vi.stubEnv('AUTH_TOKEN', 'server-token')
const { auth } = await initUsers()
const ctx = {
path: '/api/devices/peer-connections/conn-1/exec',
path,
headers: { authorization: 'Bearer server-token' },
query: {},
ip: '192.168.1.50',