Paul Nothaft
d1c582396a
Apply shared session, permission, ownership and lifecycle checks across gallery access, media grants and session restoration. Validate mutation origins, pin webhook DNS resolution and redact token-bearing request URLs. Consolidate gallery creation and queries, extract frontend state hooks, fix hook ordering and resource cleanup, and repair the fresh event schema. Update affected dependencies and restore excluded CI suites with regression and cross-database coverage.
28 lines
1.3 KiB
JavaScript
28 lines
1.3 KiB
JavaScript
const EventEmitter = require('events');
|
|
jest.mock('../../src/utils/logger', () => ({ info: jest.fn() }));
|
|
const logger = require('../../src/utils/logger');
|
|
const middleware = require('../../src/middleware/apiRequestLogger');
|
|
const { requestLogPath } = require('../../src/utils/requestLogPath');
|
|
const marker = 'SECRET_TEST_CAPABILITY';
|
|
it.each([
|
|
`/api/gallery/g/photos?token=${marker}&password=${marker}`,
|
|
`/api/gallery/g/verify-token/${marker}`,
|
|
`/api/gallery/g/show/${marker}/state`,
|
|
`/api/images/g/photo/1/signed/${marker}`,
|
|
`/api/secure-images/g/secure/1/${marker}`,
|
|
`/api/secure-images/g/secure-download/1/${marker}`,
|
|
`/api/public/contracts/${marker}/sign`,
|
|
`/api/customer/auth/password-reset/${marker}`,
|
|
])('does not log capabilities on request or response: %s', (originalUrl) => {
|
|
logger.info.mockClear();
|
|
const res = new EventEmitter(); res.statusCode = 200;
|
|
middleware({ originalUrl, method: 'GET' }, res, jest.fn());
|
|
res.emit('finish');
|
|
expect(logger.info).toHaveBeenCalledTimes(2);
|
|
expect(JSON.stringify(logger.info.mock.calls)).not.toContain(marker);
|
|
});
|
|
it('retains useful non-secret routes and removes control characters', () => {
|
|
expect(requestLogPath('/api/admin/events/12?search=private')).toBe('/api/admin/events/12');
|
|
expect(requestLogPath('/api/admin/events\nforged')).not.toContain('\n');
|
|
});
|