ute2e/tests/content-control-plane-security.spec.ts

import http from 'node:http'
import type { AddressInfo } from 'node:net'

import { expect, test } from '@playwright/test'

import { openContentControlPlane, resolveContentControlPlaneBaseUrl } from './content-control-plane'

const listen = (server: http.Server): Promise<number> => new Promise((resolve, reject) => {
  server.once('error', reject)
  server.listen(0, '127.0.0.1', () => resolve((server.address() as AddressInfo).port))
})

const close = (server: http.Server): Promise<void> => new Promise((resolve, reject) => {
  server.close((error) => (error ? reject(error) : resolve()))
})

test('content control plane never forwards login bodies across redirects', async () => {
  let redirectedRequests = 0
  const redirectTarget = http.createServer((_request, response) => {
    redirectedRequests += 1
    response.writeHead(204).end()
  })
  const targetPort = await listen(redirectTarget)
  const gateway = http.createServer((_request, response) => {
    response.writeHead(307, { Location: `http://127.0.0.1:${targetPort}/captured` }).end()
  })
  const gatewayPort = await listen(gateway)
  const request = await openContentControlPlane(`http://127.0.0.1:${gatewayPort}`)

  try {
    const response = await request.post('/login', {
      data: { username: 'redirect-sentinel', password: 'must-not-be-forwarded' },
    })
    expect(response.status()).toBe(307)
    expect(redirectedRequests).toBe(0)
  } finally {
    await request.dispose()
    await close(gateway)
    await close(redirectTarget)
  }
})

test('content control plane rejects local/remote drift and cleartext remote UI', () => {
  expect(() => resolveContentControlPlaneBaseUrl({
    BASE_URL: 'https://ui.example.test',
    E2E_API_BASE_URL: 'http://127.0.0.1:6100',
  })).toThrow(/cross the local\/remote boundary/)

  expect(() => resolveContentControlPlaneBaseUrl({
    BASE_URL: 'http://ui.example.test',
    E2E_API_BASE_URL: 'https://api.example.test',
  })).toThrow(/Remote BASE_URL must use HTTPS/)
})