nezumi/9router
1
0
Fork 0
mirror of https://github.com/Nezumi-2711/9router.git synced 2026-09-22 20:00:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

Enhance security

Browse Source
This commit is contained in:
decolua
2026-05-21 11:33:18 +07:00
parent e3cab135ef
commit 026a7c9b85
6 changed files with 173 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/unit/dashboard-guard.test.js
+43 -2
View File
@@ -129,13 +129,22 @@ describe("dashboard guard public LLM API access", () => {
describe("dashboard guard local-only access", () => {
beforeEach(() => {
vi.clearAllMocks();
mocks.getSettings.mockResolvedValue({ requireLogin: false });
mocks.getSettings.mockResolvedValue({ requireLogin: true });
mocks.validateApiKey.mockResolvedValue(false);
mocks.getConsistentMachineId.mockResolvedValue("cli-token");
mocks.verifyDashboardAuthToken.mockResolvedValue(false);
});
it("rejects local-only route with spoofed loopback headers but no CLI token", async () => {
it("rejects local-only route from non-loopback host without CLI token", async () => {
const response = await proxy(request("/api/mcp/filesystem/sse", {
host: "router.example.com",
}));
expect(response.status).toBe(403);
expect(response.body.error).toBe("Local only: CLI token required");
});
it("rejects local-only route on loopback when requireLogin=true and no JWT", async () => {
const response = await proxy(request("/api/mcp/filesystem/sse", {
host: "localhost:20128",
origin: "http://localhost:20128",
@@ -145,6 +154,38 @@ describe("dashboard guard local-only access", () => {
expect(response.body.error).toBe("Local only: CLI token required");
});
it("allows local-only route on loopback when requireLogin=false", async () => {
mocks.getSettings.mockResolvedValue({ requireLogin: false });
const response = await proxy(request("/api/cli-tools/antigravity-mitm", {
host: "localhost:20128",
origin: "http://localhost:20128",
}));
expect(response).toBe(mocks.nextResponse);
});
it("rejects local-only route from tunnel host even when requireLogin=false", async () => {
mocks.getSettings.mockResolvedValue({ requireLogin: false });
const response = await proxy(request("/api/cli-tools/antigravity-mitm", {
host: "router.example.com",
}));
expect(response.status).toBe(403);
});
it("rejects local-only route when Origin is non-loopback (CSRF block)", async () => {
mocks.getSettings.mockResolvedValue({ requireLogin: false });
const response = await proxy(request("/api/cli-tools/antigravity-mitm", {
host: "localhost:20128",
origin: "http://evil.example.com",
}));
expect(response.status).toBe(403);
});
it("allows local-only route with valid CLI token", async () => {
const response = await proxy(request("/api/mcp/filesystem/sse", {
host: "router.example.com",