popagent

Latest change 62f685314a2172a23c717ce4fe12027a662a406c - Make tests clean up persistent state by AkurAI Build

import { describe, expect, test } from "bun:test";
import { isAllowedDestination, validateBrowserDestination } from "./browser-policy";

describe("browser destination policy", () => {
  test.each(["10.0.0.1", "172.16.0.1", "172.31.255.255", "192.168.1.1", "127.0.0.1", "169.254.1.1", "2130706433"]) ("denies private IPv4 %s", (host) => {
    expect(isAllowedDestination(`http://${host}`).allowed).toBe(false);
  });
  test("denies localhost and IPv6 local addresses", () => {
    expect(isAllowedDestination("http://localhost").allowed).toBe(false);
    expect(isAllowedDestination("http://[::1]").allowed).toBe(false);
    expect(isAllowedDestination("http://[fc00::1]").allowed).toBe(false);
  });
  test("allows public hosts", () => expect(isAllowedDestination("https://example.com").allowed).toBe(true));
  test("allows configured private host", () => {
    const previous = process.env.POPAGENT_BROWSER_ALLOW;
    try {
      process.env.POPAGENT_BROWSER_ALLOW = "localhost:3000";
      expect(isAllowedDestination("http://localhost:3000").allowed).toBe(true);
    } finally {
      if (previous === undefined) delete process.env.POPAGENT_BROWSER_ALLOW;
      else process.env.POPAGENT_BROWSER_ALLOW = previous;
    }
  });
  test("denies non-http schemes", () => expect(isAllowedDestination("file:///etc/passwd").allowed).toBe(false));
  test("applies persisted allow and deny hosts", () => {
    expect(isAllowedDestination("https://blocked.example", { denyHosts: ["blocked.example"] }).allowed).toBe(false);
    expect(isAllowedDestination("http://localhost:3000", { allowHosts: ["localhost:3000"] }).allowed).toBe(true);
  });
  test("denies public hostnames that resolve to private addresses", async () => {
    const result = await validateBrowserDestination("https://public-looking.example", {}, async () => ["127.0.0.1"]);
    expect(result).toEqual({ allowed: false, reason: "hostname resolves to a private or local address" });
  });
  test("permits a public DNS result and rejects redirect destinations independently", async () => {
    const resolve = async () => ["93.184.216.34"];
    expect((await validateBrowserDestination("https://example.com", {}, resolve)).allowed).toBe(true);
    expect((await validateBrowserDestination("http://192.168.1.2/redirect", {}, resolve)).allowed).toBe(false);
  });
});