import { describe, expect, test } from 'bun:test'
import { csrfProtection, verifyRequestOrigin } from './csrf'
describe('verifyRequestOrigin', () => {
test('should accept matching origin and host', () => {
expect(verifyRequestOrigin('https://example.com', ['example.com'])).toBe(true)
expect(verifyRequestOrigin('http://localhost:8000', ['localhost:8000'])).toBe(true)
expect(verifyRequestOrigin('https://app.example.com', ['app.example.com'])).toBe(true)
})
test('should accept origin matching one of multiple allowed hosts', () => {
const allowedHosts = ['example.com', 'app.example.com', 'localhost:8000']
expect(verifyRequestOrigin('https://example.com', allowedHosts)).toBe(true)
expect(verifyRequestOrigin('https://app.example.com', allowedHosts)).toBe(true)
expect(verifyRequestOrigin('http://localhost:8000', allowedHosts)).toBe(true)
})
test('should reject non-matching origin', () => {
expect(verifyRequestOrigin('https://evil.com', ['example.com'])).toBe(false)
expect(verifyRequestOrigin('https://fake-example.com', ['example.com'])).toBe(false)
expect(verifyRequestOrigin('https://example.com.evil.com', ['example.com'])).toBe(false)
})
test('should reject empty origin', () => {
expect(verifyRequestOrigin('', ['example.com'])).toBe(false)
})
test('should reject invalid URL format', () => {
expect(verifyRequestOrigin('not-a-url', ['example.com'])).toBe(false)
expect(verifyRequestOrigin('javascript:alert(1)', ['example.com'])).toBe(false)
expect(verifyRequestOrigin('file:///etc/passwd', ['example.com'])).toBe(false)
})
test('should handle different protocols correctly', () => {
// Same host, different protocols should match (we only check host)
expect(verifyRequestOrigin('http://example.com', ['example.com'])).toBe(true)
expect(verifyRequestOrigin('https://example.com', ['example.com'])).toBe(true)
})
test('should handle port numbers correctly', () => {
expect(verifyRequestOrigin('http://localhost:3000', ['localhost:3000'])).toBe(true)
expect(verifyRequestOrigin('http://localhost:3000', ['localhost:8000'])).toBe(false)
expect(verifyRequestOrigin('http://localhost', ['localhost'])).toBe(true)
})
test('should handle subdomains correctly', () => {
expect(verifyRequestOrigin('https://sub.example.com', ['sub.example.com'])).toBe(true)
expect(verifyRequestOrigin('https://sub.example.com', ['example.com'])).toBe(false)
})
test('should handle case sensitivity (exact match required)', () => {
// URL host is automatically lowercased by URL parser
expect(verifyRequestOrigin('https://EXAMPLE.COM', ['example.com'])).toBe(true)
expect(verifyRequestOrigin('https://example.com', ['example.com'])).toBe(true)
// But allowed hosts are case-sensitive
expect(verifyRequestOrigin('https://example.com', ['EXAMPLE.COM'])).toBe(false)
})
test('should handle trailing slashes in origin', () => {
expect(verifyRequestOrigin('https://example.com/', ['example.com'])).toBe(true)
})
test('should handle paths in origin (host extraction)', () => {
expect(verifyRequestOrigin('https://example.com/path/to/page', ['example.com'])).toBe(true)
expect(verifyRequestOrigin('https://evil.com/example.com', ['example.com'])).toBe(false)
})
test('should reject when allowed hosts is empty', () => {
expect(verifyRequestOrigin('https://example.com', [])).toBe(false)
})
test('should allow private-site subdomain origins via dot-suffix allowlist', () => {
// <siteId>.priv.wisp.place legitimately POSTs /private/redeem
const allowed = ['.priv.wisp.place']
expect(verifyRequestOrigin('https://amber-anchor-fox-1234.priv.wisp.place', allowed)).toBe(true)
expect(verifyRequestOrigin('https://priv.wisp.place', allowed)).toBe(false)
expect(verifyRequestOrigin('https://evilpriv.wisp.place', allowed)).toBe(false)
expect(verifyRequestOrigin('https://amber-anchor-fox-1234.priv.evil.com', allowed)).toBe(false)
})
test('should handle IPv4 addresses', () => {
expect(verifyRequestOrigin('http://127.0.0.1:8000', ['127.0.0.1:8000'])).toBe(true)
expect(verifyRequestOrigin('http://192.168.1.1', ['192.168.1.1'])).toBe(true)
})
test('should handle IPv6 addresses', () => {
expect(verifyRequestOrigin('http://[::1]:8000', ['[::1]:8000'])).toBe(true)
expect(verifyRequestOrigin('http://[2001:db8::1]', ['[2001:db8::1]'])).toBe(true)
})
})
describe('csrfProtection', () => {
const privateOrigin = 'https://amber-anchor-fox-1234.priv.wisp.place'
const protect = csrfProtection(['.priv.wisp.place'])
const run = (path: string, origin: string = privateOrigin) => {
const set: { status?: number | string } = {}
const result = protect({
request: new Request(`https://wisp.place${path}`, {
method: 'POST',
headers: { Host: 'wisp.place', Origin: origin },
}),
set,
})
return { result, set }
}
test('allows private-site origins for scoped share redemption', () => {
const { result, set } = run('/private/redeem')
expect(result).toBeUndefined()
expect(set.status).toBeUndefined()
})
// Browsers serialize the origin of a non-CORS POST as `null` when the posting
// document sends `Referrer-Policy: no-referrer`, so the private sign-in page
// must not use that policy — see privateFormResponseHeaders().
test('rejects opaque null origins on scoped share redemption', () => {
const { result, set } = run('/private/redeem', 'null')
expect(set.status).toBe(403)
expect(result).toEqual({
error: 'CSRF validation failed',
message: 'Request origin does not match host',
})
})
// A PDS relays `agent.call(...)` to /xrpc server-to-server, so those requests carry
// no Origin header. XRPC is bearer-authenticated and never reads the session cookie,
// so requiring an origin there only breaks the CLI.
test('allows originless XRPC procedures', () => {
for (const path of ['/xrpc/place.wisp.v2.privateSite.create', '/xrpc/place.wisp.v2.domain.claim', '/xrpc']) {
const set: { status?: number | string } = {}
const result = protect({
request: new Request(`https://wisp.place${path}`, {
method: 'POST',
headers: { Host: 'wisp.place', Authorization: 'Bearer service-jwt' },
}),
set,
})
expect(result).toBeUndefined()
expect(set.status).toBeUndefined()
}
})
test('still rejects originless cookie-authenticated routes', () => {
const set: { status?: number | string } = {}
const result = protect({
request: new Request('https://wisp.place/wisp/upload-files', {
method: 'POST',
headers: { Host: 'wisp.place' },
}),
set,
})
expect(set.status).toBe(403)
expect(result).toEqual({
error: 'CSRF validation failed',
message: 'Request origin does not match host',
})
})
test('rejects private-site origins for other unsafe routes', () => {
for (const path of ['/wisp/upload-files', '/api/auth/logout', '/api/domain/claim']) {
const { result, set } = run(path)
expect(set.status).toBe(403)
expect(result).toEqual({
error: 'CSRF validation failed',
message: 'Request origin does not match host',
})
}
})
})