@@ -888,7 +888,7 @@ describe("deviceHandlers", () => {
888888);
889889});
890890891-it("allows non-device operator sessions to approve operator roles within caller scopes", async () => {
891+it("allows shared-auth operator sessions to approve operator roles within caller scopes", async () => {
892892getPendingDevicePairingMock.mockResolvedValue({
893893requestId: "req-1",
894894deviceId: "device-2",
@@ -914,7 +914,7 @@ describe("deviceHandlers", () => {
914914const opts = createOptions(
915915"device.pair.approve",
916916{ requestId: "req-1" },
917-{ client: createClient(["operator.pairing"]) },
917+{ client: createClient(["operator.pairing"], "device-1", { isDeviceTokenAuth: false }) },
918918);
919919920920await deviceHandlers["device.pair.approve"](opts);
@@ -941,19 +941,40 @@ describe("deviceHandlers", () => {
941941);
942942});
943943944+it("rejects approving node roles for the caller device without admin scope", async () => {
945+getPendingDevicePairingMock.mockResolvedValue({
946+requestId: "req-1",
947+deviceId: " device-1 ",
948+publicKey: "pk-1",
949+role: "node",
950+roles: ["node"],
951+ts: 100,
952+});
953+const opts = createOptions(
954+"device.pair.approve",
955+{ requestId: "req-1" },
956+{ client: createClient(["operator.pairing"], "device-1", { isDeviceTokenAuth: true }) },
957+);
958+959+await deviceHandlers["device.pair.approve"](opts);
960+961+expect(approveDevicePairingMock).not.toHaveBeenCalled();
962+expectRespondedErrorMessage(opts, "device pairing approval denied");
963+});
964+944965it("rejects approving node roles from non-admin shared-auth sessions", async () => {
945966getPendingDevicePairingMock.mockResolvedValue({
946967requestId: "req-1",
947-deviceId: "device-2",
948-publicKey: "pk-2",
968+deviceId: "device-1",
969+publicKey: "pk-1",
949970role: "node",
950971roles: ["node"],
951972ts: 100,
952973});
953974const opts = createOptions(
954975"device.pair.approve",
955976{ requestId: "req-1" },
956-{ client: createClient(["operator.pairing"]) },
977+{ client: createClient(["operator.pairing"], "device-1", { isDeviceTokenAuth: false }) },
957978);
958979959980await deviceHandlers["device.pair.approve"](opts);
@@ -998,27 +1019,6 @@ describe("deviceHandlers", () => {
9981019expectRespondedErrorMessage(opts, "device pairing approval denied");
9991020});
100010211001-it("rejects approving node roles for the caller device without admin scope", async () => {
1002-getPendingDevicePairingMock.mockResolvedValue({
1003-requestId: "req-1",
1004-deviceId: " device-1 ",
1005-publicKey: "pk-1",
1006-role: "node",
1007-roles: ["node"],
1008-ts: 100,
1009-});
1010-const opts = createOptions(
1011-"device.pair.approve",
1012-{ requestId: "req-1" },
1013-{ client: createClient(["operator.pairing"], "device-1", { isDeviceTokenAuth: true }) },
1014-);
1015-1016-await deviceHandlers["device.pair.approve"](opts);
1017-1018-expect(approveDevicePairingMock).not.toHaveBeenCalled();
1019-expectRespondedErrorMessage(opts, "device pairing approval denied");
1020-});
1021-10221022it("rejects rejecting another device from a non-admin device session", async () => {
10231023getPendingDevicePairingMock.mockResolvedValue({
10241024requestId: "req-2",
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。