invoke-auth.test.ts50 lines · main

1	import { describe, expect, it } from 'bun:test';
2
3	/**
4	* Regression guard for the fail-OPEN /invoke bug: the bearer check used to be
5	* gated inside `if (expected)`, so an unset BRIVEN_RUNTIME_SHARED_SECRET
6	* skipped auth entirely and left the endpoint open. The route must now fail
7	* CLOSED — a missing OR mismatched token is always 401, regardless of whether
8	* the secret is configured. Both assertions below hold either way, so the
9	* test doesn't depend on the secret being unset in the test env.
10	*/
11	describe('runtime /invoke auth (fail-closed)', () => {
12	it('rejects an unauthenticated request with 401', async () => {
13	const app = (await import('./index.js')).default;
14	const res = await app.fetch(
15	new Request('http://localhost/invoke', {
16	method: 'POST',
17	headers: { 'content-type': 'application/json' },
18	body: JSON.stringify({
19	projectId: 'p',
20	functionName: 'f',
21	deploymentId: 'd',
22	requestId: 'r',
23	args: {},
24	}),
25	}),
26	);
27	expect(res.status).toBe(401);
28	});
29
30	it('rejects a request with a bogus bearer token with 401', async () => {
31	const app = (await import('./index.js')).default;
32	const res = await app.fetch(
33	new Request('http://localhost/invoke', {
34	method: 'POST',
35	headers: {
36	'content-type': 'application/json',
37	authorization: 'Bearer this-is-not-the-secret',
38	},
39	body: JSON.stringify({
40	projectId: 'p',
41	functionName: 'f',
42	deploymentId: 'd',
43	requestId: 'r',
44	args: {},
45	}),
46	}),
47	);
48	expect(res.status).toBe(401);
49	});
50	});