alisaza
e1eaf5eff5
Extract admin dashboard from ghabilee-frontend2 into a dedicated Next.js app for backoffice.ghabilee.ir (no SEO indexing / Clarity).
49 lines
1.7 KiB
TypeScript
49 lines
1.7 KiB
TypeScript
import { describe, expect, it } from 'vitest'
|
|
|
|
import { isRequestHostAllowed } from '@/lib/security/requestHost'
|
|
|
|
describe('isRequestHostAllowed', () => {
|
|
it.each([
|
|
'backoffice.ghabilee.ir',
|
|
'backoffice.ghabilee.ir:443',
|
|
'BACKOFFICE.GHABILEE.IR',
|
|
])('allows a canonical production host: %s', (host) => {
|
|
expect(isRequestHostAllowed(host, 'production')).toBe(true)
|
|
})
|
|
|
|
it.each([
|
|
null,
|
|
'',
|
|
'ghabilee.ir',
|
|
'www.ghabilee.ir',
|
|
'dev.ghabilee.ir',
|
|
'arashmohammadi.com',
|
|
'backoffice.ghabilee.ir.attacker.example',
|
|
'backoffice.ghabilee.ir@attacker.example',
|
|
'backoffice.ghabilee.ir/path',
|
|
'backoffice.ghabilee.ir, attacker.example',
|
|
'backoffice.ghabilee.ir:65536',
|
|
])('rejects an untrusted or malformed production host: %s', (host) => {
|
|
expect(isRequestHostAllowed(host, 'production')).toBe(false)
|
|
})
|
|
|
|
it('does not block local development hosts', () => {
|
|
expect(isRequestHostAllowed('127.0.0.1:3008', 'development')).toBe(true)
|
|
expect(isRequestHostAllowed('localhost:3008', 'test')).toBe(true)
|
|
})
|
|
|
|
it('allows loopback hosts in production only when ALLOW_LOCAL_REQUEST_HOSTS is set', () => {
|
|
const previous = process.env.ALLOW_LOCAL_REQUEST_HOSTS
|
|
|
|
delete process.env.ALLOW_LOCAL_REQUEST_HOSTS
|
|
expect(isRequestHostAllowed('127.0.0.1:3102', 'production')).toBe(false)
|
|
|
|
process.env.ALLOW_LOCAL_REQUEST_HOSTS = '1'
|
|
expect(isRequestHostAllowed('127.0.0.1:3102', 'production')).toBe(true)
|
|
expect(isRequestHostAllowed('localhost:3102', 'production')).toBe(true)
|
|
|
|
if (previous === undefined) delete process.env.ALLOW_LOCAL_REQUEST_HOSTS
|
|
else process.env.ALLOW_LOCAL_REQUEST_HOSTS = previous
|
|
})
|
|
})
|