bf98d44a45
- Replace hardcoded DB_PASSWORD 'dwroller2025' with process.env.DB_PASSWORD - Replace hardcoded GM_SECRET 'bongo' with process.env.GM_SECRET - Replace hardcoded GM_PASSWORD with process.env.GM_PASSWORD - Replace hardcoded PLAYER_PASSWORD '1234' with process.env.PLAYER_PASSWORD - Update .env.example to document required environment variables - Apply changes to all backend routes, database modules, and React components - Update test files to use environment variables for credentials - Ensure .env remains in .gitignore for production safety This fix addresses critical security vulnerabilities where database credentials and authentication secrets were exposed in source code.
43 lines
1.8 KiB
JavaScript
43 lines
1.8 KiB
JavaScript
jest.setTimeout(20000);
|
|
const { execSync } = require('child_process');
|
|
|
|
describe('Shop endpoints (public and protected)', () => {
|
|
const baseURL = process.env.API_BASE || 'http://localhost:5000';
|
|
const gmHeaders = `-H "x-gm-secret: ${process.env.GM_SECRET || 'defaultsecret'}"`;
|
|
const mockPlayer = 'shoptestplayer';
|
|
|
|
const curl = (method, url, data = null, headers = '') => {
|
|
const command = `curl -s -X ${method} ${headers} -H "Content-Type: application/json" ${data ? `-d '${JSON.stringify(data)}'` : ''} ${url}`;
|
|
try {
|
|
const result = execSync(command, { encoding: 'utf-8' });
|
|
return JSON.parse(result || '{}');
|
|
} catch (error) {
|
|
if (error.stdout) {
|
|
try { return JSON.parse(error.stdout); } catch (e) { /* ignore */ }
|
|
}
|
|
throw error;
|
|
}
|
|
};
|
|
|
|
test('public items endpoints work and protected inventory requires auth', () => {
|
|
const items = curl('GET', `${baseURL}/api/shop/items`);
|
|
expect(Array.isArray(items)).toBe(true);
|
|
|
|
const category = curl('GET', `${baseURL}/api/shop/items/category/Gear`);
|
|
expect(Array.isArray(category)).toBe(true);
|
|
|
|
// create player to ensure inventory exists
|
|
try { curl('DELETE', `${baseURL}/api/players/${mockPlayer}`, null, gmHeaders); } catch (e) {}
|
|
const created = curl('POST', `${baseURL}/api/players`, { name: mockPlayer, rp: 20, pw: 'pw' }, gmHeaders);
|
|
expect(created.name).toBe(mockPlayer);
|
|
|
|
// Inventory without session should be protected (requireSession returns 403 or similar)
|
|
const invNoAuth = curl('GET', `${baseURL}/api/shop/inventory/${mockPlayer}`);
|
|
// invNoAuth should be an error object or not an array
|
|
expect(Array.isArray(invNoAuth)).toBe(false);
|
|
|
|
// cleanup
|
|
curl('DELETE', `${baseURL}/api/players/${mockPlayer}`, null, gmHeaders);
|
|
});
|
|
});
|