Skip to content

Commit

Permalink
Support console session auth in /workspaces/list endpoint
Browse files Browse the repository at this point in the history
  • Loading branch information
andrii-balitskyi committed Nov 20, 2024
1 parent b16386a commit d2d16ec
Show file tree
Hide file tree
Showing 2 changed files with 23 additions and 0 deletions.
1 change: 1 addition & 0 deletions src/pages/api/workspaces/list.ts
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ export default withRouteSpec({
"pat_without_workspace",
"api_key",
"client_session",
"console_session",
],
jsonResponse: z.object({
workspaces: z.array(workspace),
Expand Down
22 changes: 22 additions & 0 deletions test/api/workspaces/list.test.ts
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
import test, { type ExecutionContext } from "ava"
import jwt from "jsonwebtoken"

import { getTestServer } from "fixtures/get-test-server.ts"

Expand Down Expand Up @@ -31,3 +32,24 @@ test("GET /workspaces/list with access token auth", async (t: ExecutionContext)
t.is(workspaces.length, 1)
t.is(workspaces[0]?.workspace_id, seed.ws2.workspace_id)
})

test("GET /workspaces/list with console session auth", async (t: ExecutionContext) => {
const { axios, seed } = await getTestServer(t)
const session_token = jwt.sign(
{
user_id: seed.ws2.user1_id,
key: seed.ws2.user1_key,
},
"secret",

Check failure

Code scanning / CodeQL

Hard-coded credentials Critical test

The hard-coded value "secret" is used as
jwt key
.
)
const {
data: { workspaces },
} = await axios.get("/workspaces/list", {
headers: {
Authorization: `Bearer ${session_token}`,
"Seam-Workspace": seed.ws2.workspace_id,
},
})
t.is(workspaces.length, 1)
t.is(workspaces[0]?.workspace_id, seed.ws2.workspace_id)
})

0 comments on commit d2d16ec

Please sign in to comment.