test: harden package boundaries and audit budgets

2026-08-24 12:05:20 +05:30
parent 613ff7ae5b
commit b3c93e9b18
12 changed files with 115 additions and 17 deletions
@@ -43,4 +43,13 @@ describe("upload policy hardening", () => {
    ).rejects.toThrow("store");
    expect(await verifySignedFileToken("not-a-token", "long-enough-secret")).toBeNull();
  });
+
+  test("signed file tokens reject expiry, tampering, and the wrong signing key", async () => {
+    const value = { store: "uploads", key: "safe/report.pdf", expiresAt: 2_000 };
+    const token = await createSignedFileToken(value, "long-enough-secret");
+    expect(await verifySignedFileToken(token, "long-enough-secret", 1_999)).toEqual(value);
+    expect(await verifySignedFileToken(token, "long-enough-secret", 2_000)).toBeNull();
+    expect(await verifySignedFileToken(`${token}x`, "long-enough-secret", 1_999)).toBeNull();
+    expect(await verifySignedFileToken(token, "different-long-secret", 1_999)).toBeNull();
+  });
 });