gnezim
60e2149072
Tasks 16-20: Online Board Tests (Search/Filter, Tabs, Flight List, Details Modal, Time/Date) - Task 16: Search & Filter tests (37 tests) - departure/arrival cities, passenger count, cabin class - Task 17: Arrival/Departure Tabs tests (45 tests) - tab switching, flight display, sorting - Task 18: Flight List View tests (50 tests) - display, sorting, filtering, pagination, loading states - Task 19: Flight Details Modal tests (40 tests) - opening/closing, content display, actions - Task 20: Time & Date Filter tests (43 tests) - date selection, time ranges, calendar navigation Tasks 21-25: Flight Details Tests (Flight Info, Passengers, Seats, Services, Fares) - Task 21: Flight Info Display tests (40 tests) - basic info, airports, route visualization, timeline - Task 22: Passenger Info tests (50 tests) - passenger list, details, services, special requirements - Task 23: Seat Selection tests (50 tests) - seat map, selection, categories, recommendations - Task 24: Service Selection tests (25 tests) - baggage, meals, seats, summary - Task 25: Fare Display tests (55 tests) - fare breakdown, comparisons, discounts, refunds All tests follow AAA pattern and use data-testid selectors matching Angular version. Total: 245 tests across 10 feature suites.
56 lines
2.1 KiB
JavaScript
56 lines
2.1 KiB
JavaScript
// src/middleware/csrf/index.ts
|
|
import { HTTPException } from "../../http-exception.js";
|
|
var secFetchSiteValues = ["same-origin", "same-site", "none", "cross-site"];
|
|
var isSecFetchSite = (value) => secFetchSiteValues.includes(value);
|
|
var isSafeMethodRe = /^(GET|HEAD)$/;
|
|
var isRequestedByFormElementRe = /^\b(application\/x-www-form-urlencoded|multipart\/form-data|text\/plain)\b/i;
|
|
var csrf = (options) => {
|
|
const originHandler = ((optsOrigin) => {
|
|
if (!optsOrigin) {
|
|
return (origin, c) => origin === new URL(c.req.url).origin;
|
|
} else if (typeof optsOrigin === "string") {
|
|
return (origin) => origin === optsOrigin;
|
|
} else if (typeof optsOrigin === "function") {
|
|
return optsOrigin;
|
|
} else {
|
|
return (origin) => optsOrigin.includes(origin);
|
|
}
|
|
})(options?.origin);
|
|
const isAllowedOrigin = async (origin, c) => {
|
|
if (origin === void 0) {
|
|
return false;
|
|
}
|
|
return await originHandler(origin, c);
|
|
};
|
|
const secFetchSiteHandler = ((optsSecFetchSite) => {
|
|
if (!optsSecFetchSite) {
|
|
return (secFetchSite) => secFetchSite === "same-origin";
|
|
} else if (typeof optsSecFetchSite === "string") {
|
|
return (secFetchSite) => secFetchSite === optsSecFetchSite;
|
|
} else if (typeof optsSecFetchSite === "function") {
|
|
return optsSecFetchSite;
|
|
} else {
|
|
return (secFetchSite) => optsSecFetchSite.includes(secFetchSite);
|
|
}
|
|
})(options?.secFetchSite);
|
|
const isAllowedSecFetchSite = async (secFetchSite, c) => {
|
|
if (secFetchSite === void 0) {
|
|
return false;
|
|
}
|
|
if (!isSecFetchSite(secFetchSite)) {
|
|
return false;
|
|
}
|
|
return await secFetchSiteHandler(secFetchSite, c);
|
|
};
|
|
return async function csrf2(c, next) {
|
|
if (!isSafeMethodRe.test(c.req.method) && isRequestedByFormElementRe.test(c.req.header("content-type") || "text/plain") && !await isAllowedSecFetchSite(c.req.header("sec-fetch-site"), c) && !await isAllowedOrigin(c.req.header("origin"), c)) {
|
|
const res = new Response("Forbidden", { status: 403 });
|
|
throw new HTTPException(403, { res });
|
|
}
|
|
await next();
|
|
};
|
|
};
|
|
export {
|
|
csrf
|
|
};
|