DorianandClaude Fable 5
2a343ac746
CI / check (push) Failing after 6m11s
Client: useNostr.ts's auto-restore now calls GET /api/auth/me (a plain
authFetch, no body) instead of POSTing {pubkey} to /api/auth/login —
identity is derived server-side from the JWT alone, never claimed by
the client.
Server: POST /login is reduced to a pure, documented-deprecated read.
Removed the creator auto-create branch and the creator auto-upgrade
db.update block — an unauthenticated request can no longer mutate the
database via this endpoint. The identical creator auto-create/upgrade
logic already exists, correctly gated behind NIP-98 verification, in
POST /nostr/session, so a creator signing in with a real signer still
gets the same row created/upgraded. Added a handler doc comment plus a
new auth.test.ts case asserting an unregistered creator pubkey now
returns exists:false and leaves the bots table row count unchanged.
e2e/helpers/auth.ts: doc comments updated to describe loginWithPubkey
as a read-only test lookup helper, not a login; request/signature
unchanged so existing e2e specs keep working.
Verification: auth.test.ts + auth-edge.test.ts + auth-audit.test.ts +
auth-me.test.ts = 56/56 pass. Full server suite (bypassing pnpm's
install-gate via ./node_modules/.bin/vitest, since this environment's
pnpm needs an interactive build-approval step unrelated to this task)
= 810/817 pass, remaining 7 are pre-existing timing/perf flakes under
CPU load (lifecycle/speed-meta/tier-balance/bot-auth constant-time),
none touching auth. tsc (server) and vue-tsc (frontend) both exit 0.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
42 lines
1.3 KiB
TypeScript
42 lines
1.3 KiB
TypeScript
/**
|
|
* E2E authentication helpers.
|
|
* Provides a programmatic bot lookup for tests without browser extension interaction.
|
|
*/
|
|
|
|
import { randomPubkey } from './setup.js'
|
|
|
|
/**
|
|
* Create a test identity (pubkey + nsec equivalent).
|
|
* For E2E tests, we use the read-only lookup helper below (loginWithPubkey)
|
|
* since we can't interact with NIP-07 browser extensions.
|
|
*/
|
|
export function createTestIdentity() {
|
|
return {
|
|
pubkey: randomPubkey(),
|
|
// In a real NIP-98 flow, this would be a signed event
|
|
// For testing, we use the deprecated read-only lookup endpoint
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Look up a bot by pubkey via the deprecated, read-only POST /api/auth/login
|
|
* endpoint. This is NOT a login — it establishes no session and issues no
|
|
* token (D-01/BOT-01). It's kept only as a test helper: real session
|
|
* establishment goes through POST /api/auth/nostr/session (NIP-98) and
|
|
* session restoration through GET /api/auth/me (JWT). Returns bot info if
|
|
* the pubkey has a registered bot, `{}` otherwise.
|
|
*/
|
|
export async function loginWithPubkey(baseURL: string, pubkey: string): Promise<{ bot?: { id: string; name: string } }> {
|
|
const res = await fetch(`${baseURL}/api/auth/login`, {
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'application/json' },
|
|
body: JSON.stringify({ pubkey }),
|
|
})
|
|
|
|
if (!res.ok) {
|
|
return {}
|
|
}
|
|
|
|
return res.json()
|
|
}
|