testPublicRemotesAreOnlyPublicAddresses

tcmts.cli.sync.test.testPublicRemotesAreOnlyPublicAddresses · #rlioo5tn · term

What a registry opens on someone else's say-so is an http(s) address at a public server, alone: never a directory, a remote's name (with its token), an internal address, or one with credentials in it.

import { publicRemote } from "#codebase/tcmts/cli/sync";
import assert from "node:assert/strict";

export const testPublicRemotesAreOnlyPublicAddresses = async () => {
  const local = process.env.TCM_ATPROTO_LOCAL;
  delete process.env.TCM_ATPROTO_LOCAL;
  try {
    for (const [spec, why] of [
      ["../another-codebase", /must be an http\(s\) address/],
      ["/srv/codebase", /must be an http\(s\) address/],
      ["origin", /must be an http\(s\) address/],
      ["http://127.0.0.1:7400", /private or local address/],
      ["http://10.0.0.5", /private or local address/],
      ["https://169.254.169.254/latest", /private or local address/],
      ["https://user:secret@8.8.8.8", /credentials/],
    ] as const)
      await assert.rejects(publicRemote(spec, "a visitor's codebase"), why, spec);
    assert.equal((await publicRemote("https://8.8.8.8/", "a source")).label, "https://8.8.8.8/");
  } finally {
    if (local !== undefined) process.env.TCM_ATPROTO_LOCAL = local;
  }
}

uses