refactor: strengthen client boundaries and quality gates

2026-08-28 14:26:58 +08:00
parent 3af145abe5
commit ad27acad7e
51 changed files with 7703 additions and 697 deletions
@@ -0,0 +1,28 @@
+import { BadRequestException } from '@nestjs/common';
+import { strictValidationPipe } from '../common/strict-validation.pipe';
+import { ClientHttpCredentialDto, ClientWebhookDto } from './client-open-api.dto';
+
+function validate<T>(metatype: new () => T, value: unknown) {
+  return strictValidationPipe.transform(value, { type: 'body', metatype, data: undefined });
+}
+
+describe('client HTTP API DTOs', () => {
+  it('rejects client-supplied operator identity and malformed expiry dates', async () => {
+    await expect(validate(ClientHttpCredentialDto, { name: '凭据', createdById: 'spoofed' })).rejects.toBeInstanceOf(
+      BadRequestException,
+    );
+    await expect(validate(ClientHttpCredentialDto, { expiresAt: 'tomorrow' })).rejects.toBeInstanceOf(
+      BadRequestException,
+    );
+  });
+
+  it('accepts a blank webhook URL for deletion and rejects unsafe fields', async () => {
+    await expect(validate(ClientWebhookDto, { url: '   ' })).resolves.toEqual(expect.objectContaining({ url: '' }));
+    await expect(validate(ClientWebhookDto, { url: 'javascript:alert(1)' })).rejects.toBeInstanceOf(
+      BadRequestException,
+    );
+    await expect(
+      validate(ClientWebhookDto, { url: 'https://example.com/hook', status: 'approved' }),
+    ).rejects.toBeInstanceOf(BadRequestException);
+  });
+});