Breaking wire-format change: dual-read (V1+V2) / single-write (V2) so existing user secrets, stored messages, and inter-tenant key keep working. Old clients and relays lose cross-version chat until both sides are upgraded. Relay - Switch clientEncrypt/masterEncrypt to AES-256-GCM with HKDF-derived per-ciphertext salts; keep CBC-V1 fallback on decrypt only. - On-bootstrap migration re-envelopes tenant secret_encrypted and the inter-tenant key to GCM-V2 (idempotent). - CORS: stop reflecting arbitrary Origin; allow own origin + optional RELAY_CORS_ORIGINS env allowlist; drop Access-Control-Allow-Credentials. - Generic error messages replace "no such user: <name>" enumeration. - Exception messages no longer echoed back; logged server-side. - Collab-lock max hold capped at 10min so a member can't grief-refresh forever. - Attachment filenames validated against hex.<ext> pattern. - Passwords min length 10; /api/account/password rate-limited. App / Electron client - Shared hyprcrdRelayEncrypt/Decrypt helpers (GCM-V2 write, V1 read). - Chat + collab-buckets plugins delegate to the shared helpers. - Poll + push + attachments migrated to the dual-format path. - /api/relay/settings GET returns has_key boolean; secret never echoed. - Setup endpoint now CSRF-checked. - SSRF: CURLOPT_PROTOCOLS restricted to HTTP(S) everywhere; bookmarks favicon fetch also blocks private/loopback/link-local. - Login / password-change rate limiter moved to DB-backed IP keying. - Passwords min length 10 throughout. - Zip import enforces per-file (25MB) and total (500MB) caps, extension allowlist, no-overwrite. - Verbose relay-push debug gated behind APP_DEBUG env. Version bumped to 2.0.0 (protocol-breaking). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
42 lines
1.8 KiB
JavaScript
42 lines
1.8 KiB
JavaScript
import { describe, it, expect, csrf } from './runner.js?v=4';
|
|
|
|
describe('Relay: Push API', () => {
|
|
it('push without config returns error', async () => {
|
|
const settings = await fetch('api/relay/settings').then(r => r.json());
|
|
// GET only reports `has_key` (boolean) — the secret itself is never
|
|
// echoed. If a relay is configured the real push may succeed or fail
|
|
// for other reasons, so skip in that case.
|
|
if (settings.url && settings.has_key) return; // skip if configured
|
|
|
|
const res = await fetch('api/relay/push', {
|
|
method: 'POST', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf() },
|
|
body: JSON.stringify({ card_id: 1 }),
|
|
}).then(r => r.json());
|
|
expect(res.ok).toBe(false);
|
|
expect(res.error).toContain('not configured');
|
|
});
|
|
|
|
it('push without card_id returns error', async () => {
|
|
const settings = await fetch('api/relay/settings').then(r => r.json());
|
|
if (!settings.url || !settings.has_key) return; // card_id check is after config check
|
|
const res = await fetch('api/relay/push', {
|
|
method: 'POST', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf() },
|
|
body: JSON.stringify({}),
|
|
});
|
|
expect(res.status).toBe(400);
|
|
});
|
|
});
|
|
|
|
describe('Relay: Poll API', () => {
|
|
it('poll without config returns 0 pulled', async () => {
|
|
const settings = await fetch('api/relay/settings').then(r => r.json());
|
|
if (settings.url && settings.has_key) return;
|
|
|
|
const res = await fetch('api/relay/poll', {
|
|
method: 'POST', headers: { 'X-CSRF-Token': csrf() },
|
|
}).then(r => r.json());
|
|
expect(res.ok).toBe(true);
|
|
expect(res.pulled).toBe(0);
|
|
});
|
|
});
|