nezumi/9router
1
0
Fork 0
mirror of https://github.com/Nezumi-2711/9router.git synced 2026-09-22 13:38:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: update the permission for token saver page

Browse Source
This commit is contained in:
nezumi
2026-07-12 17:24:33 +07:00
parent 2427852593
commit be7c210161
5 changed files with 65 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/unit/dashboard-guard.test.js
+35
View File
@@ -301,6 +301,41 @@ describe("dashboard guard combo administration access", () => {
});
});
describe("dashboard guard token saver administration access", () => {
beforeEach(() => {
vi.clearAllMocks();
mocks.getSettings.mockResolvedValue({ requireLogin: true });
mocks.getUserById.mockResolvedValue({ id: "user-1", isActive: true, role: "user" });
mocks.getConsistentMachineId.mockResolvedValue("cli-token");
mocks.getDashboardAuthSession.mockResolvedValue({ userId: "user-1" });
mocks.verifyDashboardAuthToken.mockResolvedValue(true);
});
it("rejects normal users from Token Saver pages and APIs", async () => {
for (const pathname of [
"/api/headroom/status",
"/api/pxpipe/status",
]) {
const response = await proxy(request(pathname, { host: "localhost:20128" }, "user-token"));
expect(response.status).toBe(403);
expect(response.body.error).toBe("Administrator access required");
}
const response = await proxy(request("/dashboard/token-saver", { host: "localhost:20128" }, "user-token"));
expect(response.status).toBe(307);
expect(response.url.href).toBe("http://localhost/dashboard");
});
it("allows administrators to access Token Saver pages and APIs", async () => {
mocks.getUserById.mockResolvedValue({ id: "user-1", isActive: true, role: "admin" });
expect(await proxy(request("/dashboard/token-saver", { host: "localhost:20128" }, "admin-token"))).toBe(mocks.nextResponse);
expect(await proxy(request("/api/headroom/status", { host: "localhost:20128" }, "admin-token"))).toBe(mocks.nextResponse);
expect(await proxy(request("/api/pxpipe/status", { host: "localhost:20128" }, "admin-token"))).toBe(mocks.nextResponse);
});
});
describe("dashboard guard helpers", () => {
it("extracts bearer API keys before x-api-key", () => {
const apiRequest = request("/v1/chat/completions", {