pear-git / test / test-auth-headers.js

#!/usr/bin/env node

/**
 * Test authentication headers
 */

const BASE_URL = 'http://10.22.0.1:5005/git';

async function test() {
  console.log('🧪 Testing authentication headers...\n');

  // Step 1: Check if profile page loads
  console.log('1. Loading profile page...');
  const profileResponse = await fetch(`${BASE_URL}/profile`);
  const profileHtml = await profileResponse.text();

  // Check if identity script is included
  const hasIdentityScript = profileHtml.includes('Identity] Base path');
  console.log('✓ Profile page loaded');
  console.log('  - Identity script included:', hasIdentityScript);
  console.log('  - HTML size:', profileHtml.length, 'bytes');

  // Step 2: Generate identity
  console.log('\n2. Generating identity...');
  const genResponse = await fetch(`${BASE_URL}/api/identity/generate`, {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' }
  });

  if (!genResponse.ok) {
    console.error('❌ Failed to generate identity:', genResponse.status);
    process.exit(1);
  }

  const identity = await genResponse.json();
  const publicKey = identity.publicKey;
  console.log('✓ Identity generated:', publicKey.substring(0, 8) + '...');

  // Step 3: Test authentication WITHOUT header
  console.log('\n3. Testing without header...');
  const noAuthResponse = await fetch(`${BASE_URL}/api/user/identities`);
  console.log('  Status:', noAuthResponse.status, noAuthResponse.statusText);

  // Step 4: Test authentication WITH header
  console.log('\n4. Testing with header...');
  const authResponse = await fetch(`${BASE_URL}/api/user/identities`, {
    headers: {
      'X-Wirecore-PublicKey': publicKey
    }
  });
  console.log('  Status:', authResponse.status, authResponse.statusText);

  if (authResponse.ok) {
    const data = await authResponse.json();
    console.log('✓ Authenticated! Identities:', data.identities.length);
  } else {
    console.error('❌ Authentication failed even with header!');
    const errorText = await authResponse.text();
    console.error('  Error:', errorText);
  }

  // Step 5: Check server logs
  console.log('\n5. Checking server logs...');
  console.log('  (Check tmux session for server output)');

  console.log('\n📊 Summary:');
  console.log('  - Profile includes identity script:', hasIdentityScript);
  console.log('  - Auth without header:', noAuthResponse.status);
  console.log('  - Auth with header:', authResponse.status);

  if (authResponse.ok) {
    console.log('\n✅ Headers work when sent correctly!');
    console.log('   Problem: Browser is NOT sending the header');
    console.log('   Solution: Fix client-side header injection');
  } else {
    console.log('\n❌ Headers DON\'T work even when sent!');
    console.log('   Problem: Server is rejecting the header');
    console.log('   Solution: Fix server-side authentication');
  }
}

test().catch(err => {
  console.error('\n❌ Test failed:', err.message);
  process.exit(1);
});