29 lines
1.3 KiB
TypeScript
29 lines
1.3 KiB
TypeScript
import { BadRequestException } from '@nestjs/common';
|
|
import { strictValidationPipe } from '../common/strict-validation.pipe';
|
|
import { ClientHttpCredentialDto, ClientWebhookDto } from './client-open-api.dto';
|
|
|
|
function validate<T>(metatype: new () => T, value: unknown) {
|
|
return strictValidationPipe.transform(value, { type: 'body', metatype, data: undefined });
|
|
}
|
|
|
|
describe('client HTTP API DTOs', () => {
|
|
it('rejects client-supplied operator identity and malformed expiry dates', async () => {
|
|
await expect(validate(ClientHttpCredentialDto, { name: '凭据', createdById: 'spoofed' })).rejects.toBeInstanceOf(
|
|
BadRequestException,
|
|
);
|
|
await expect(validate(ClientHttpCredentialDto, { expiresAt: 'tomorrow' })).rejects.toBeInstanceOf(
|
|
BadRequestException,
|
|
);
|
|
});
|
|
|
|
it('accepts a blank webhook URL for deletion and rejects unsafe fields', async () => {
|
|
await expect(validate(ClientWebhookDto, { url: ' ' })).resolves.toEqual(expect.objectContaining({ url: '' }));
|
|
await expect(validate(ClientWebhookDto, { url: 'javascript:alert(1)' })).rejects.toBeInstanceOf(
|
|
BadRequestException,
|
|
);
|
|
await expect(
|
|
validate(ClientWebhookDto, { url: 'https://example.com/hook', status: 'approved' }),
|
|
).rejects.toBeInstanceOf(BadRequestException);
|
|
});
|
|
});
|