118 lines
4.3 KiB
JavaScript
118 lines
4.3 KiB
JavaScript
import assert from "node:assert/strict";
|
|
import { once } from "node:events";
|
|
import { mkdtemp, mkdir, rm, writeFile } from "node:fs/promises";
|
|
import { createServer } from "node:net";
|
|
import { tmpdir } from "node:os";
|
|
import { join } from "node:path";
|
|
import { spawn } from "node:child_process";
|
|
|
|
const root = await mkdtemp(join(tmpdir(), "nodedc-map-gateway-credential-smoke-"));
|
|
const cacheDir = join(root, "cache");
|
|
const port = await freePort();
|
|
let child;
|
|
|
|
try {
|
|
await mkdir(join(cacheDir, "ion-endpoints"), { recursive: true });
|
|
await writeFile(join(cacheDir, "index.json"), `${JSON.stringify({ version: 1, entries: {} })}\n`);
|
|
await writeFile(join(cacheDir, "ion-endpoints", "1.json"), `${JSON.stringify({
|
|
assetId: "1",
|
|
type: "TERRAIN",
|
|
url: "https://assets.ion.cesium.com/asset/1/",
|
|
accessToken: "terrain-private-token",
|
|
attributions: [],
|
|
savedAt: Date.now(),
|
|
})}\n`);
|
|
await writeFile(join(cacheDir, "ion-endpoints", "2.json"), `${JSON.stringify({
|
|
assetId: "2",
|
|
type: "IMAGERY",
|
|
externalType: "BING",
|
|
options: {
|
|
url: "https://dev.virtualearth.net/",
|
|
key: "bing-private-key",
|
|
mapStyle: "Aerial",
|
|
},
|
|
attributions: [],
|
|
savedAt: Date.now(),
|
|
})}\n`);
|
|
const expiredBuildingsToken = fakeJwt("expired-buildings", Math.floor(Date.now() / 1000) - 60);
|
|
await writeFile(join(cacheDir, "ion-endpoints", "96188.json"), `${JSON.stringify({
|
|
assetId: "96188",
|
|
type: "3DTILES",
|
|
url: "https://assets.ion.cesium.com/us-east-1/asset_depot/96188/OpenStreetMap/CWT/2025-04-01/tileset.json?v=expired",
|
|
accessToken: expiredBuildingsToken,
|
|
attributions: [],
|
|
savedAt: Date.now(),
|
|
})}\n`);
|
|
|
|
child = spawn(process.execPath, ["src/server.mjs"], {
|
|
cwd: new URL("..", import.meta.url),
|
|
env: {
|
|
...process.env,
|
|
PORT: String(port),
|
|
MAP_CACHE_DIR: cacheDir,
|
|
MAP_GATEWAY_ALLOW_ANONYMOUS: "true",
|
|
MAP_CACHE_MODE: "readwrite",
|
|
CESIUM_ION_TOKEN: "",
|
|
CESIUM_ION_ASSET_ALLOWLIST: "1,2,96188",
|
|
MAP_GATEWAY_UPSTREAM_ALLOWLIST: "assets.ion.cesium.com,dev.virtualearth.net",
|
|
},
|
|
stdio: ["ignore", "pipe", "pipe"],
|
|
});
|
|
|
|
await waitForGateway(port, child);
|
|
for (const assetId of ["1", "2"]) {
|
|
const response = await fetch(`http://127.0.0.1:${port}/api/map/ion/assets/${assetId}/endpoint`);
|
|
assert.equal(response.status, 200);
|
|
const body = await response.text();
|
|
assert.equal(body.includes("terrain-private-token"), false);
|
|
assert.equal(body.includes("bing-private-key"), false);
|
|
assert.equal(body.includes("accessToken"), false);
|
|
assert.equal(body.includes('"key"'), false);
|
|
const endpoint = JSON.parse(body);
|
|
assert.equal(endpoint.credentialMode, "gateway");
|
|
}
|
|
const expired = await fetch(`http://127.0.0.1:${port}/api/map/ion/assets/96188/endpoint`);
|
|
const expiredRaw = await expired.text();
|
|
assert.equal(expired.status, 503);
|
|
assert.equal(expiredRaw.includes(expiredBuildingsToken), false);
|
|
assert.equal(expiredRaw.includes("accessToken"), false);
|
|
console.log("ok: endpoint responses contain no credentials and a known-expired Ion JWT is never served");
|
|
} finally {
|
|
if (child && !child.killed) {
|
|
child.kill("SIGTERM");
|
|
await once(child, "exit").catch(() => undefined);
|
|
}
|
|
await rm(root, { recursive: true, force: true });
|
|
}
|
|
|
|
async function freePort() {
|
|
const server = createServer();
|
|
server.listen(0, "127.0.0.1");
|
|
await once(server, "listening");
|
|
const address = server.address();
|
|
assert(address && typeof address === "object");
|
|
const port = address.port;
|
|
server.close();
|
|
await once(server, "close");
|
|
return port;
|
|
}
|
|
|
|
async function waitForGateway(port, child) {
|
|
let output = "";
|
|
child.stderr.on("data", (chunk) => { output += String(chunk); });
|
|
for (let attempt = 0; attempt < 60; attempt += 1) {
|
|
if (child.exitCode !== null) throw new Error(`gateway_exited:${child.exitCode}:${output}`);
|
|
try {
|
|
const response = await fetch(`http://127.0.0.1:${port}/healthz`);
|
|
if (response.ok) return;
|
|
} catch { /* service is still starting */ }
|
|
await new Promise((resolve) => setTimeout(resolve, 50));
|
|
}
|
|
throw new Error(`gateway_start_timeout:${output}`);
|
|
}
|
|
|
|
function fakeJwt(subject, exp) {
|
|
const encode = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
|
|
return `${encode({ alg: "HS256", typ: "JWT" })}.${encode({ sub: subject, exp })}.test-signature`;
|
|
}
|