feat：移除了弹窗，服务器添加sls

apps/telemetry-dashboard/test/server/auth.test.ts

@@ -0,0 +1,65 @@
+import { generateKeyPair, SignJWT } from 'jose'
+import { afterEach, describe, expect, it } from 'vitest'
+
+import { authenticateAccessToken, mockAuthEnabled, verifyAccessJwt } from '../../server/utils/auth'
+
+const settings = { teamDomain: 'fixture-team', audience: 'fixture-audience' }
+const issuer = 'https://fixture-team.cloudflareaccess.com'
+
+async function token(
+	privateKey: CryptoKey,
+	overrides: { audience?: string; expiresAt?: number } = {},
+): Promise<string> {
+	const now = Math.floor(Date.now() / 1_000)
+	return new SignJWT({ email: 'fixture@example.invalid', name: 'Fixture Operator' })
+		.setProtectedHeader({ alg: 'RS256' })
+		.setIssuer(issuer)
+		.setAudience(overrides.audience ?? settings.audience)
+		.setIssuedAt(now)
+		.setExpirationTime(overrides.expiresAt ?? now + 600)
+		.sign(privateKey)
+}
+
+describe('Cloudflare Access authentication', () => {
+	const previousNodeEnv = process.env.NODE_ENV
+
+	afterEach(() => {
+		process.env.NODE_ENV = previousNodeEnv
+		delete process.env.TELEMETRY_ADMIN_MOCK_AUTH
+	})
+
+	it('rejects a missing Access assertion', async () => {
+		await expect(authenticateAccessToken(null, settings)).rejects.toMatchObject({
+			statusCode: 401,
+			code: 'unauthenticated',
+		})
+	})
+
+	it('rejects the wrong audience and expired tokens, then accepts a valid token', async () => {
+		const { privateKey, publicKey } = (await generateKeyPair('RS256')) as CryptoKeyPair
+		await expect(
+			verifyAccessJwt(await token(privateKey, { audience: 'wrong-audience' }), settings, publicKey),
+		).rejects.toMatchObject({ statusCode: 401 })
+		await expect(
+			verifyAccessJwt(
+				await token(privateKey, { expiresAt: Math.floor(Date.now() / 1_000) - 10 }),
+				settings,
+				publicKey,
+			),
+		).rejects.toMatchObject({ statusCode: 401 })
+
+		const session = await verifyAccessJwt(await token(privateKey), settings, publicKey)
+		expect(session).toMatchObject({
+			identity: { name: 'Fixture Operator', email: 'fixture@example.invalid' },
+			organization: 'Axolotl-Launcher',
+			mock: false,
+			dataSource: 'production',
+		})
+	})
+
+	it('cannot enable MockAuthProvider in production', () => {
+		process.env.NODE_ENV = 'production'
+		process.env.TELEMETRY_ADMIN_MOCK_AUTH = 'true'
+		expect(mockAuthEnabled({ mockAuth: true } as ReturnType<typeof useRuntimeConfig>)).toBe(false)
+	})
+})