0
Fork 0
mirror of https://github.com/TryGhost/Ghost.git synced 2025-01-27 22:49:56 -05:00
ghost/test/unit/web/parent-app_spec.js

114 lines
3.6 KiB
JavaScript
Raw Normal View History

const should = require('should');
const sinon = require('sinon');
Implemented externally verifiable identity tokens no-issue This adds two new endpoints, one at /ghost/.well-known/jwks.json for exposing a public key, and one on the canary api /identities, which allows the Owner user to fetch a JWT. This token can then be used by external services to verify the domain * Added ghost_{public,private}_key settings This key can be used for generating tokens for communicating with external services on behalf of Ghost * Added .well-known directory to /ghost/.well-known We add a jwks.json file to the .well-known directory which exposes a public JWK which can be used to verify the signatures of JWT's created by Ghost This is added to the /ghost/ path so that it can live on the admin domain, rather than the frontend. This is because most of its uses/functions will be in relation to the admin domain. * Improved settings model tests This removes hardcoded positions in favour of testing that a particular event wasn't emitted which is less brittle and more precise about what's being tested * Fixed parent app unit tests for well-known This updates the parent app unit tests to check that the well-known route is mounted. We all change proxyquire to use `noCallThru` which ensures that the ubderlying modules are not required. This stops the initialisation logic in ./well-known erroring in tests https://github.com/thlorenz/proxyquire/issues/215 * Moved jwt signature to a separate 'token' propery This structure corresponds to other resources and allows to exptend with additional properties in future if needed
2020-01-20 13:45:58 +02:00
const proxyquire = require('proxyquire').noCallThru();
const configUtils = require('../../utils/configUtils');
describe('parent app', function () {
let expressStub;
let vhostSpy;
let use;
let apiSpy;
let parentApp;
let adminSpy;
Implemented externally verifiable identity tokens no-issue This adds two new endpoints, one at /ghost/.well-known/jwks.json for exposing a public key, and one on the canary api /identities, which allows the Owner user to fetch a JWT. This token can then be used by external services to verify the domain * Added ghost_{public,private}_key settings This key can be used for generating tokens for communicating with external services on behalf of Ghost * Added .well-known directory to /ghost/.well-known We add a jwks.json file to the .well-known directory which exposes a public JWK which can be used to verify the signatures of JWT's created by Ghost This is added to the /ghost/ path so that it can live on the admin domain, rather than the frontend. This is because most of its uses/functions will be in relation to the admin domain. * Improved settings model tests This removes hardcoded positions in favour of testing that a particular event wasn't emitted which is less brittle and more precise about what's being tested * Fixed parent app unit tests for well-known This updates the parent app unit tests to check that the well-known route is mounted. We all change proxyquire to use `noCallThru` which ensures that the ubderlying modules are not required. This stops the initialisation logic in ./well-known erroring in tests https://github.com/thlorenz/proxyquire/issues/215 * Moved jwt signature to a separate 'token' propery This structure corresponds to other resources and allows to exptend with additional properties in future if needed
2020-01-20 13:45:58 +02:00
let wellKnownSpy;
let siteSpy;
let gatewaySpy;
let authPagesSpy;
beforeEach(function () {
use = sinon.spy();
expressStub = () => ({
use,
enable: () => {}
});
vhostSpy = sinon.spy();
apiSpy = sinon.spy();
adminSpy = sinon.spy();
Implemented externally verifiable identity tokens no-issue This adds two new endpoints, one at /ghost/.well-known/jwks.json for exposing a public key, and one on the canary api /identities, which allows the Owner user to fetch a JWT. This token can then be used by external services to verify the domain * Added ghost_{public,private}_key settings This key can be used for generating tokens for communicating with external services on behalf of Ghost * Added .well-known directory to /ghost/.well-known We add a jwks.json file to the .well-known directory which exposes a public JWK which can be used to verify the signatures of JWT's created by Ghost This is added to the /ghost/ path so that it can live on the admin domain, rather than the frontend. This is because most of its uses/functions will be in relation to the admin domain. * Improved settings model tests This removes hardcoded positions in favour of testing that a particular event wasn't emitted which is less brittle and more precise about what's being tested * Fixed parent app unit tests for well-known This updates the parent app unit tests to check that the well-known route is mounted. We all change proxyquire to use `noCallThru` which ensures that the ubderlying modules are not required. This stops the initialisation logic in ./well-known erroring in tests https://github.com/thlorenz/proxyquire/issues/215 * Moved jwt signature to a separate 'token' propery This structure corresponds to other resources and allows to exptend with additional properties in future if needed
2020-01-20 13:45:58 +02:00
wellKnownSpy = sinon.spy();
siteSpy = sinon.spy();
gatewaySpy = sinon.spy();
authPagesSpy = sinon.spy();
parentApp = proxyquire('../../../core/server/web/parent-app', {
express: expressStub,
'@tryghost/vhost-middleware': vhostSpy,
'./api': apiSpy,
'./admin': adminSpy,
Implemented externally verifiable identity tokens no-issue This adds two new endpoints, one at /ghost/.well-known/jwks.json for exposing a public key, and one on the canary api /identities, which allows the Owner user to fetch a JWT. This token can then be used by external services to verify the domain * Added ghost_{public,private}_key settings This key can be used for generating tokens for communicating with external services on behalf of Ghost * Added .well-known directory to /ghost/.well-known We add a jwks.json file to the .well-known directory which exposes a public JWK which can be used to verify the signatures of JWT's created by Ghost This is added to the /ghost/ path so that it can live on the admin domain, rather than the frontend. This is because most of its uses/functions will be in relation to the admin domain. * Improved settings model tests This removes hardcoded positions in favour of testing that a particular event wasn't emitted which is less brittle and more precise about what's being tested * Fixed parent app unit tests for well-known This updates the parent app unit tests to check that the well-known route is mounted. We all change proxyquire to use `noCallThru` which ensures that the ubderlying modules are not required. This stops the initialisation logic in ./well-known erroring in tests https://github.com/thlorenz/proxyquire/issues/215 * Moved jwt signature to a separate 'token' propery This structure corresponds to other resources and allows to exptend with additional properties in future if needed
2020-01-20 13:45:58 +02:00
'./well-known': wellKnownSpy,
'./site': siteSpy,
'../services/members': {
gateway: gatewaySpy,
authPages: authPagesSpy
}
});
configUtils.set('url', 'http://ghost.blog');
});
afterEach(function () {
sinon.restore();
configUtils.restore();
});
// url = 'https://ghost.blog'
describe('without separate admin url', function () {
it('should mount and assign correct routes', function () {
parentApp();
use.calledWith('/ghost/api').should.be.true();
Implemented externally verifiable identity tokens no-issue This adds two new endpoints, one at /ghost/.well-known/jwks.json for exposing a public key, and one on the canary api /identities, which allows the Owner user to fetch a JWT. This token can then be used by external services to verify the domain * Added ghost_{public,private}_key settings This key can be used for generating tokens for communicating with external services on behalf of Ghost * Added .well-known directory to /ghost/.well-known We add a jwks.json file to the .well-known directory which exposes a public JWK which can be used to verify the signatures of JWT's created by Ghost This is added to the /ghost/ path so that it can live on the admin domain, rather than the frontend. This is because most of its uses/functions will be in relation to the admin domain. * Improved settings model tests This removes hardcoded positions in favour of testing that a particular event wasn't emitted which is less brittle and more precise about what's being tested * Fixed parent app unit tests for well-known This updates the parent app unit tests to check that the well-known route is mounted. We all change proxyquire to use `noCallThru` which ensures that the ubderlying modules are not required. This stops the initialisation logic in ./well-known erroring in tests https://github.com/thlorenz/proxyquire/issues/215 * Moved jwt signature to a separate 'token' propery This structure corresponds to other resources and allows to exptend with additional properties in future if needed
2020-01-20 13:45:58 +02:00
use.calledWith('/ghost/.well-known').should.be.true();
use.calledWith('/ghost').should.be.true();
use.calledWith('/content/images').should.be.false();
apiSpy.called.should.be.true();
Implemented externally verifiable identity tokens no-issue This adds two new endpoints, one at /ghost/.well-known/jwks.json for exposing a public key, and one on the canary api /identities, which allows the Owner user to fetch a JWT. This token can then be used by external services to verify the domain * Added ghost_{public,private}_key settings This key can be used for generating tokens for communicating with external services on behalf of Ghost * Added .well-known directory to /ghost/.well-known We add a jwks.json file to the .well-known directory which exposes a public JWK which can be used to verify the signatures of JWT's created by Ghost This is added to the /ghost/ path so that it can live on the admin domain, rather than the frontend. This is because most of its uses/functions will be in relation to the admin domain. * Improved settings model tests This removes hardcoded positions in favour of testing that a particular event wasn't emitted which is less brittle and more precise about what's being tested * Fixed parent app unit tests for well-known This updates the parent app unit tests to check that the well-known route is mounted. We all change proxyquire to use `noCallThru` which ensures that the ubderlying modules are not required. This stops the initialisation logic in ./well-known erroring in tests https://github.com/thlorenz/proxyquire/issues/215 * Moved jwt signature to a separate 'token' propery This structure corresponds to other resources and allows to exptend with additional properties in future if needed
2020-01-20 13:45:58 +02:00
wellKnownSpy.called.should.be.true();
adminSpy.called.should.be.true();
siteSpy.called.should.be.true();
vhostSpy.calledTwice.should.be.true();
vhostSpy.firstCall.calledWith(/.*/).should.be.true();
vhostSpy.secondCall.calledWith(/.*/).should.be.true();
});
});
// url = 'https://ghost.blog'
// admin.url = 'https://admin.ghost.blog'
describe('with separate admin url', function () {
beforeEach(function () {
configUtils.set('admin:url', 'https://admin.ghost.blog');
});
it('should mount and assign correct routes', function () {
parentApp();
vhostSpy.calledTwice.should.be.true();
vhostSpy.firstCall.calledWith('admin.ghost.blog').should.be.true();
vhostSpy.secondCall.calledWith(/^(?!admin\.ghost\.blog).*/).should.be.true();
});
it('should have regex that excludes admin traffic on front-end', function () {
parentApp();
const frontendRegex = vhostSpy.secondCall.args[0];
frontendRegex.test('localhost').should.be.true();
frontendRegex.test('ghost.blog').should.be.true();
frontendRegex.test('admin.ghost.blog').should.be.false();
});
});
// url = 'http://ghost.blog'
// admin.url = 'https://ghost.blog'
describe('with separate admin protocol', function () {
it('should mount and assign correct routes', function () {
configUtils.set('admin:url', 'https://ghost.blog');
parentApp();
vhostSpy.calledTwice.should.be.true();
vhostSpy.firstCall.calledWith(/.*/).should.be.true();
vhostSpy.secondCall.calledWith(/.*/).should.be.true();
});
});
});