11 lines
1.7 KiB
JavaScript
11 lines
1.7 KiB
JavaScript
import fs from 'node:fs';import path from 'node:path';import assert from 'node:assert/strict';
|
|
const read=p=>JSON.parse(fs.readFileSync(p,'utf8')),state=read('C:/laragon/data/sgf-tempo/run/modular-regression-current.json'),tag=process.argv[2];if(state.port!==55439||!/^[a-f0-9]{12}$/.test(tag??''))throw Error('Owned QA tag required');
|
|
const root=path.join(state.root,'private/ledger-'+tag),demo=read(path.join(root,'ledger-demo.json')),base=new URL(demo.url).origin,output=path.join(root,'ledger-demo-cookie.json');if(fs.existsSync(output))throw Error('Completed cookie proof preserved');
|
|
const jar=new Map(),r=await fetch(base+'/qa/ledger-enter/read',{headers:{Accept:'application/json'}}),auth=await r.json();
|
|
for(const cookie of r.headers.getSetCookie()){const p=cookie.split(';')[0],at=p.indexOf('=');jar.set(p.slice(0,at),p.slice(at+1));}
|
|
assert(jar.has(demo.cookie)&&!jar.has('XSRF-TOKEN'));
|
|
const body={proposal_id:1,revision:'0'.repeat(64),reason:'Cookie isolation must retain CSRF validation.'};
|
|
const send=async token=>fetch(base+'/api/general-ledger/post',{method:'POST',headers:{Accept:'application/json','Content-Type':'application/json',Cookie:[...jar].map(([k,v])=>k+'='+v).join('; '),'X-SGF-Context':auth.context,'X-CSRF-TOKEN':token,'Idempotency-Key':'00000000-0000-4000-8000-000000000001'},body:JSON.stringify(body)});
|
|
assert.equal((await send('')).status,419);assert.equal((await send(auth.csrf)).status,403);
|
|
fs.writeFileSync(output,JSON.stringify({passed:true,own_session_cookie:true,shared_xsrf_cookie_not_replaced:true,csrf_validation_retained:true,unauthorised_action_refused:true,no_business_effect:true},null,2)+'\n');console.log('Demo cookie isolation, real CSRF and read-only role refusal passed.');
|