Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
it('should return 401 with expiration message if macaroon is expired', async () => {
const expirationCaveat = getExpirationCaveat(-100)
macaroon = builder
.add_first_party_caveat(expirationCaveat.encode())
.getMacaroon()
.serialize()
lsat = Lsat.fromMacaroon(macaroon, invoiceResponse.request)
const response: request.Response = await request
.agent(app)
.get(protectedRoute)
.set('Authorization', lsat.toToken())
expect(response.status).to.equal(401)
expect(response).to.have.nested.property('body.error.message')
// confirm it gives an error message about an expired macaroon
expect(response.body.error.message).to.match(/expired/g)
})
it('should return 401 if macaroon is expired', async () => {
const expirationCaveat = getExpirationCaveat(-100)
const macaroon = builder
.add_first_party_caveat(expirationCaveat.encode())
.getMacaroon()
.serialize()
const lsat = Lsat.fromMacaroon(macaroon)
const response: request.Response = await request
.agent(app)
.get('/invoice')
.set('Authorization', lsat.toToken())
expect(response.status).to.equal(401)
expect(response).to.have.nested.property('body.error.message')
// confirm it gives an error message about an expired macaroon
expect(response.body.error.message).to.match(/expired/g)
})
it('should return 401 for invalid macaroon', async () => {
macaroon = getTestBuilder('another secret')
.getMacaroon()
.serialize()
lsat = Lsat.fromMacaroon(macaroon, invoiceResponse.request)
const response: request.Response = await request
.agent(app)
.get(protectedRoute)
.set('Authorization', lsat.toToken())
expect(response.status).to.equal(401)
expect(response).to.have.nested.property('body.error.message')
})
it('should block access and return 401 for a hodl invoice that is settled', async () => {
getInvStub.restore()
getInvStub = getLnStub('getInvoice', {
...invoiceResponse,
is_confirmed: true,
is_held: false,
})
const macaroon = builder.getMacaroon().serialize()
const lsat = Lsat.fromMacaroon(macaroon, invoiceResponse.request)
lsat.setPreimage(invoiceResponse.secret)
await request
.agent(app)
.get(protectedRoute)
.set('Authorization', lsat.toToken())
.expect(401)
.expect(res => {
if (!res.error || !res.body.error.message)
throw new Error('Expected error message')
if (!/(expired)|(unauthorized)/gi.test(res.body.error.message))
throw new Error('Expected error message to mention expired lsat')
})
expect(getInvStub.called).to.be.true
})