From bbb25f3b585081282979fad7d99032a2dd31238c Mon Sep 17 00:00:00 2001 From: Dotta Date: Sat, 15 Aug 2026 19:20:40 +0000 Subject: [PATCH] test(security): align board key checks with current master Co-Authored-By: Paperclip --- .../src/security/board-key-route-inventory.ts | 3 +++ server/src/services/board-auth.test.ts | 19 +++++++++++++------ 2 files changed, 16 insertions(+), 6 deletions(-) diff --git a/server/src/security/board-key-route-inventory.ts b/server/src/security/board-key-route-inventory.ts index 43abfbe075..2e6c45e905 100644 --- a/server/src/security/board-key-route-inventory.ts +++ b/server/src/security/board-key-route-inventory.ts @@ -208,6 +208,9 @@ export const BOARD_KEY_ROUTE_INVENTORY: readonly string[] = [ "board_key_denied | deny | /api/cli-auth/{*path}", "board_key_denied | deny | /api/cloud/{*path}", "board_key_denied | deny | /api/companies/{id}/adapters/{id}/detect-model", + "board_key_denied | deny | /api/companies/{id}/adapters/{id}/login-sessions", + "board_key_denied | deny | /api/companies/{id}/adapters/{id}/login-sessions/{id}", + "board_key_denied | deny | /api/companies/{id}/adapters/{id}/login-sessions/{id}/cancel", "board_key_denied | deny | /api/companies/{id}/adapters/{id}/model-profiles", "board_key_denied | deny | /api/companies/{id}/adapters/{id}/models", "board_key_denied | deny | /api/companies/{id}/adapters/{id}/test-environment", diff --git a/server/src/services/board-auth.test.ts b/server/src/services/board-auth.test.ts index f5849e57bb..7a51a6f86c 100644 --- a/server/src/services/board-auth.test.ts +++ b/server/src/services/board-auth.test.ts @@ -4,28 +4,35 @@ import { boardAuthService } from "./board-auth.js"; describe("boardAuthService touchBoardApiKey", () => { it("retries the audit write after a transient failure", async () => { - const writes = [Promise.reject(new Error("transient")), Promise.resolve([])]; + const writes = [ + Promise.reject(new Error("transient")), + Promise.resolve([{ id: "key-1" }]), + ]; const update = vi.fn(() => ({ set: () => ({ - where: () => writes.shift(), + where: () => ({ + returning: () => writes.shift(), + }), }), })); const service = boardAuthService({ update } as unknown as Db); await expect(service.touchBoardApiKey("key-1")).rejects.toThrow("transient"); - await expect(service.touchBoardApiKey("key-1")).resolves.toBeUndefined(); + await expect(service.touchBoardApiKey("key-1")).resolves.toEqual({ id: "key-1" }); expect(update).toHaveBeenCalledTimes(2); }); it("shares one in-flight audit write across concurrent touches", async () => { let releaseWrite: (() => void) | undefined; - const write = new Promise((resolve) => { - releaseWrite = resolve; + const write = new Promise>((resolve) => { + releaseWrite = () => resolve([{ id: "key-1" }]); }); const update = vi.fn(() => ({ set: () => ({ - where: () => write, + where: () => ({ + returning: () => write, + }), }), })); const service = boardAuthService({ update } as unknown as Db);