homeio

1import { describe, expect, it, vi } from "vitest";
2
3vi.mock("server-only", () => ({}));
4vi.mock("@/lib/server/logging/logger", () => ({ logServerAction: vi.fn() }));
5
6import {
7  decodeConnectorToken,
8  normalizeConnectorToken,
9} from "@/lib/server/modules/integrations/cloudflare-api";
10
11describe("decodeConnectorToken", () => {
12  it("reads the account and tunnel ids out of a connector token", () => {
13    // Cloudflare hands out base64 of {"a": account, "t": tunnel, "s": secret},
14    // so the operator only has to supply the one token.
15    const token = Buffer.from(
16      JSON.stringify({ a: "acct-123", t: "tunnel-456", s: "secret" }),
17    ).toString("base64");
18
19    expect(decodeConnectorToken(token)).toEqual({
20      accountId: "acct-123",
21      tunnelId: "tunnel-456",
22    });
23  });
24
25  it("returns null rather than throwing on anything else", () => {
26    expect(decodeConnectorToken("not-base64-json")).toBeNull();
27    expect(decodeConnectorToken(Buffer.from('{"a":1}').toString("base64"))).toBeNull();
28    expect(decodeConnectorToken("")).toBeNull();
29  });
30});
31
32describe("normalizeConnectorToken", () => {
33  const token = Buffer.from(
34    JSON.stringify({ a: "acct-123", t: "tunnel-456", s: "secret" }),
35  ).toString("base64");
36
37  it("accepts the install command Cloudflare actually shows you", () => {
38    // The dashboard gives a command, not a bare token, and that is what people
39    // copy. Rejecting it sent one operator round in circles.
40    expect(normalizeConnectorToken(`sudo cloudflared service install ${token}`)).toBe(token);
41  });
42
43  it("accepts the docker form too", () => {
44    expect(
45      normalizeConnectorToken(
46        `docker run cloudflare/cloudflared:latest tunnel --no-autoupdate run --token ${token}`,
47      ),
48    ).toBe(token);
49  });
50
51  it("accepts a bare token, and trims it", () => {
52    expect(normalizeConnectorToken(`  ${token}  `)).toBe(token);
53  });
54
55  it("hands anything unusable back for validation to reject", () => {
56    expect(normalizeConnectorToken("  not a token  ")).toBe("not a token");
57    // Looks like a token, is not one: must not be mistaken for valid.
58    expect(decodeConnectorToken(normalizeConnectorToken("eyJub3BlIjoxfQ=="))).toBeNull();
59  });
60});
61