← back to Govarbitrage
TK-11476 test: regression guard for TK-11466 FIX 2 (presentedAdminBasicAuth)
037818cbfe6de3f35f263b620f39018c4f3482c5 · 2026-09-12 23:56:17 -0700 · Steve Abrams
Adds src/middleware.test.ts (8 cases) exercising the wall-OFF scenario that
caused the anonymous-ADMIN bypass: with BASIC_AUTH="" an anon caller on a
protected page must redirect to /login (307) / 401 JSON on APIs, and must
never be minted an ADMIN ga_session cookie -- including regression guards
for a bogus Authorization header and for presenting the exact default
BASIC_AUTH credential while the wall is off (the precise TK-11466 shape).
Wall-ON behavior is asserted unchanged (401 with no creds, ADMIN mint on
the correct shared credential, 401 on a wrong one). All 8 pass against the
current working-tree middleware.ts (which already carries FIX 2, committed
0442a97 and verified live on Kamatera prod per TK-11466's action log).
Full suite: 196/196 pass; tsc --noEmit clean.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SF5S5cw5NwnFQwg5iSbj6T
Files touched
Diff
commit 037818cbfe6de3f35f263b620f39018c4f3482c5
Author: Steve Abrams <steve@designerwallcoverings.com>
Date: Sat Sep 12 23:56:17 2026 -0700
TK-11476 test: regression guard for TK-11466 FIX 2 (presentedAdminBasicAuth)
Adds src/middleware.test.ts (8 cases) exercising the wall-OFF scenario that
caused the anonymous-ADMIN bypass: with BASIC_AUTH="" an anon caller on a
protected page must redirect to /login (307) / 401 JSON on APIs, and must
never be minted an ADMIN ga_session cookie -- including regression guards
for a bogus Authorization header and for presenting the exact default
BASIC_AUTH credential while the wall is off (the precise TK-11466 shape).
Wall-ON behavior is asserted unchanged (401 with no creds, ADMIN mint on
the correct shared credential, 401 on a wrong one). All 8 pass against the
current working-tree middleware.ts (which already carries FIX 2, committed
0442a97 and verified live on Kamatera prod per TK-11466's action log).
Full suite: 196/196 pass; tsc --noEmit clean.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SF5S5cw5NwnFQwg5iSbj6T
---
src/middleware.test.ts | 98 ++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 98 insertions(+)
diff --git a/src/middleware.test.ts b/src/middleware.test.ts
new file mode 100644
index 0000000..fb63baf
--- /dev/null
+++ b/src/middleware.test.ts
@@ -0,0 +1,98 @@
+import { describe, expect, it, beforeEach, vi } from "vitest";
+import { NextRequest } from "next/server";
+
+// TK-11476 — verify TK-11466 FIX 2 (presentedAdminBasicAuth) actually holds:
+// with the shared-password wall OFF (BASIC_AUTH=""), an anonymous caller on a
+// protected path must fall through to /login (pages) / 401 JSON (APIs) and
+// must NEVER be minted an ADMIN session. BASIC_AUTH is read as a top-level
+// module constant, so each case resets modules and re-imports after setting
+// the env var it needs to exercise.
+async function loadMiddleware() {
+ const mod = await import("./middleware");
+ return mod.middleware;
+}
+
+function req(path: string, headers: Record<string, string> = {}) {
+ return new NextRequest(new Request(`https://auctions.agentabrams.com${path}`, { headers }));
+}
+
+const basicHeader = (creds: string) => "Basic " + Buffer.from(creds).toString("base64");
+
+beforeEach(() => {
+ vi.resetModules();
+ process.env.AUTH_SECRET = "test-secret-please-change";
+ delete process.env.FLEET_SSO_SECRET;
+ delete process.env.IMPORT_TOKEN;
+});
+
+describe("middleware — wall OFF (BASIC_AUTH empty)", () => {
+ beforeEach(() => {
+ process.env.BASIC_AUTH = "";
+ });
+
+ it("anon GET / redirects to /login and mints no session cookie", async () => {
+ const middleware = await loadMiddleware();
+ const res = await middleware(req("/"));
+ expect(res.status).toBe(307);
+ expect(res.headers.get("location")).toContain("/login");
+ expect(res.cookies.get("ga_session")).toBeUndefined();
+ });
+
+ it("anon GET /api/credentials returns 401 JSON and mints no session cookie", async () => {
+ const middleware = await loadMiddleware();
+ const res = await middleware(req("/api/credentials"));
+ expect(res.status).toBe(401);
+ expect(res.cookies.get("ga_session")).toBeUndefined();
+ });
+
+ it("regression guard: a bogus Authorization header still does not mint ADMIN", async () => {
+ const middleware = await loadMiddleware();
+ const res = await middleware(req("/", { Authorization: basicHeader("anyone:anything") }));
+ expect(res.status).toBe(307);
+ expect(res.headers.get("location")).toContain("/login");
+ expect(res.cookies.get("ga_session")).toBeUndefined();
+ });
+
+ it("regression guard: even the correct default creds do not mint ADMIN once the wall is off", async () => {
+ // The exact TK-11466 bypass shape: basicAuthOk() would have been true
+ // unconditionally with the wall off. presentedAdminBasicAuth() must stay
+ // false regardless of what's presented when BASIC_AUTH itself is empty.
+ const middleware = await loadMiddleware();
+ const res = await middleware(req("/", { Authorization: basicHeader("admin:DW2024!") }));
+ expect(res.status).toBe(307);
+ expect(res.headers.get("location")).toContain("/login");
+ expect(res.cookies.get("ga_session")).toBeUndefined();
+ });
+
+ it("public paths (e.g. /pricing) stay reachable anonymously", async () => {
+ const middleware = await loadMiddleware();
+ const res = await middleware(req("/pricing"));
+ expect(res.status).toBe(200);
+ });
+});
+
+describe("middleware — wall ON (BASIC_AUTH set, unchanged behavior)", () => {
+ beforeEach(() => {
+ process.env.BASIC_AUTH = "admin:DW2024!";
+ });
+
+ it("anon GET / (no credentials) is 401'd by the wall", async () => {
+ const middleware = await loadMiddleware();
+ const res = await middleware(req("/"));
+ expect(res.status).toBe(401);
+ expect(res.headers.get("www-authenticate")).toContain("Basic");
+ });
+
+ it("the real shared credential still auto-mints an ADMIN session", async () => {
+ const middleware = await loadMiddleware();
+ const res = await middleware(req("/", { Authorization: basicHeader("admin:DW2024!") }));
+ expect(res.status).toBe(200);
+ expect(res.cookies.get("ga_session")?.value).toBeTruthy();
+ });
+
+ it("a wrong credential is 401'd, not redirected", async () => {
+ const middleware = await loadMiddleware();
+ const res = await middleware(req("/", { Authorization: basicHeader("admin:wrong") }));
+ expect(res.status).toBe(401);
+ });
+});
← 91c4705 auto-data-snapshot: 2026-09-12T13:27:22 (1 data files) — tsc
·
back to Govarbitrage
·
auto-data-snapshot: 2026-09-13T00:21:19 (1 data files) — tsc f407576 →