@@ -1,10 +1,13 @@
1-import { describe, expect, it } from "vitest";
1+import { describe, expect, it, vi } from "vitest";
2+import type { BrowserRouteContext, ProfileContext } from "../server-context.js";
23import {
34readBody,
45resolveSafeRouteTabUrl,
56resolveTargetIdFromBody,
67resolveTargetIdFromQuery,
8+withRouteTabContext,
79} from "./agent.shared.js";
10+import { createBrowserRouteResponse } from "./test-helpers.js";
811import type { BrowserRequest } from "./types.js";
9121013function requestWithBody(body: unknown): BrowserRequest {
@@ -36,6 +39,31 @@ function profileContext(tabs: Array<{ targetId: string; url: string }>) {
3639};
3740}
384142+function routeContextForTab(url: string): BrowserRouteContext {
43+const profileCtx = {
44+profile: {
45+cdpUrl: "http://127.0.0.1:9222",
46+name: "default",
47+},
48+ensureTabAvailable: vi.fn(async () => ({
49+targetId: "tab-1",
50+title: "Tab",
51+ url,
52+type: "page",
53+})),
54+} as unknown as ProfileContext;
55+56+return {
57+forProfile: () => profileCtx,
58+state: () => ({
59+resolved: {
60+ssrfPolicy: {},
61+},
62+}),
63+mapTabError: () => null,
64+} as unknown as BrowserRouteContext;
65+}
66+3967describe("browser route shared helpers", () => {
4068describe("readBody", () => {
4169it("returns object bodies", () => {
@@ -100,4 +128,44 @@ describe("browser route shared helpers", () => {
100128).resolves.toBeUndefined();
101129});
102130});
131+132+describe("withRouteTabContext", () => {
133+it("does not enforce current-tab URL policy unless requested", async () => {
134+const response = createBrowserRouteResponse();
135+const run = vi.fn(async () => {
136+response.res.json({ ok: true });
137+});
138+139+await withRouteTabContext({
140+req: requestWithBody({}),
141+res: response.res,
142+ctx: routeContextForTab("http://127.0.0.1:8080/admin"),
143+ run,
144+});
145+146+expect(run).toHaveBeenCalledOnce();
147+expect(response.body).toEqual({ ok: true });
148+});
149+150+it("blocks guarded routes before running on a disallowed current tab", async () => {
151+const response = createBrowserRouteResponse();
152+const run = vi.fn(async () => {
153+response.res.json({ ok: true });
154+});
155+156+await withRouteTabContext({
157+req: requestWithBody({}),
158+res: response.res,
159+ctx: routeContextForTab("http://127.0.0.1:8080/admin"),
160+enforceCurrentUrlAllowed: true,
161+ run,
162+});
163+164+expect(run).not.toHaveBeenCalled();
165+expect(response.statusCode).toBe(400);
166+expect(response.body).toMatchObject({ error: expect.any(String) });
167+const body = response.body as { error?: unknown };
168+expect(body.error).not.toBe("");
169+});
170+});
103171});
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。