mirror of
https://github.com/DayuanJiang/next-ai-draw-io.git
synced 2026-10-12 20:49:53 +08:00
dayuan.jiang
1333ed68c6
- tests/e2e/lib: openApp(page, { path, config }), MODEL_CONFIGS_KEY,
savedModelConfigs, settingsDialog, chunkedReplies, sse() and
toolCallEvents() replace about 70 copies of goto + wait for iframe,
three local openApp functions, 14 window.fetch overrides and the
Node-side SSE serialisers; unused fixtures removed
- delete theme, save, history, model-config, upload and copy-paste
specs (the copy-button test moves to chat.spec.ts); trim
iframe-interaction, history-restore, keyboard and smoke to tests that
can fail; file-upload asserts on the preview image
- settings-review-fixes.spec.ts split by topic into settings-bedrock,
settings-tabs-sync and settings-providers
- unit tests use vi.stubEnv with unstubEnvs: true instead of
hand-written process.env save and restore loops
92 lines
3.1 KiB
TypeScript
92 lines
3.1 KiB
TypeScript
// @vitest-environment node
|
|
import { afterEach, beforeEach, describe, expect, it, vi } from "vitest"
|
|
import { POST as chat } from "@/app/api/chat/route"
|
|
import { POST as parseUrl } from "@/app/api/parse-url/route"
|
|
import { POST as providerModels } from "@/app/api/provider-models/route"
|
|
import { POST as validateDiagram } from "@/app/api/validate-diagram/route"
|
|
import { POST as validateModel } from "@/app/api/validate-model/route"
|
|
|
|
// The routes that run models or fetch URLs, which a page on another site
|
|
// could otherwise make the user's own server do
|
|
const ROUTES = {
|
|
chat,
|
|
"parse-url": parseUrl,
|
|
"provider-models": providerModels,
|
|
"validate-diagram": validateDiagram,
|
|
"validate-model": validateModel,
|
|
}
|
|
|
|
const body = JSON.stringify({
|
|
messages: [
|
|
{ id: "u1", role: "user", parts: [{ type: "text", text: "hi" }] },
|
|
],
|
|
url: "https://example.com",
|
|
provider: "openai",
|
|
apiKey: "k",
|
|
modelId: "gpt-5.5",
|
|
imageData: "data:image/png;base64,AAAA",
|
|
})
|
|
|
|
beforeEach(() => {
|
|
vi.stubGlobal(
|
|
"fetch",
|
|
vi.fn(async () => {
|
|
throw new Error("no network in tests")
|
|
}),
|
|
)
|
|
})
|
|
|
|
afterEach(() => {
|
|
vi.unstubAllGlobals()
|
|
})
|
|
|
|
describe("requests another website could send", () => {
|
|
for (const [name, post] of Object.entries(ROUTES)) {
|
|
it(`${name}: refuses a text body, which needs no CORS preflight`, async () => {
|
|
// fetch(..., { mode: "no-cors", body: JSON.stringify(...) })
|
|
// from another site arrives as text/plain
|
|
const res = await post(
|
|
new Request(`http://127.0.0.1:61337/api/${name}`, {
|
|
method: "POST",
|
|
body,
|
|
}),
|
|
)
|
|
expect(res.status).toBe(415)
|
|
expect(fetch).not.toHaveBeenCalled()
|
|
})
|
|
|
|
it(`${name}: desktop app refuses a foreign Host (DNS rebinding)`, async () => {
|
|
vi.stubEnv("NEXT_AI_DRAWIO_DESKTOP", "1")
|
|
const res = await post(
|
|
new Request(`http://127.0.0.1:61337/api/${name}`, {
|
|
method: "POST",
|
|
headers: {
|
|
"Content-Type": "application/json",
|
|
host: "rebind.attacker.example:61337",
|
|
},
|
|
body,
|
|
}),
|
|
)
|
|
expect(res.status).toBe(403)
|
|
expect(fetch).not.toHaveBeenCalled()
|
|
})
|
|
}
|
|
|
|
it("lets the desktop window's own requests through", async () => {
|
|
vi.stubEnv("NEXT_AI_DRAWIO_DESKTOP", "1")
|
|
const res = await validateModel(
|
|
new Request("http://127.0.0.1:61337/api/validate-model", {
|
|
method: "POST",
|
|
headers: {
|
|
"Content-Type": "application/json; charset=utf-8",
|
|
host: "127.0.0.1:61337",
|
|
},
|
|
body: JSON.stringify({ provider: "openai" }),
|
|
}),
|
|
)
|
|
// Past the check: the route's own validation answers
|
|
expect(res.status).toBe(400)
|
|
expect(await res.text()).toMatch(/required/)
|
|
})
|
|
})
|