PWA: Service Worker ohne Session erreichbar, nie HTTP-gecacht; authentifizierter Smoke

- proxy: /sw.js vom Session-Gate ausgenommen (Update-Prüfung auch bei abgelaufener Sitzung; enthält keine Mandantendaten) – gemeldet von L7 - next.config: /sw.js mit Cache-Control no-cache/no-store, Service-Worker-Allowed / - scripts/smoke-auth.ts: Session-Cookie über finalizeIdentityLogin + next-auth/jwt encode (ohne Passworteingabe), prüft Backoffice- und Monteur-Seiten Nachweis: /sw.js anonym 200 + no-cache; Smoke 19/19 Seiten grün. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-14 17:43:29 +02:00
parent 2a30ee1919
commit 1796869e05
3 changed files with 106 additions and 1 deletions
@@ -0,0 +1,94 @@
+/**
+ * Authenticated HTTP smoke against a running dev server — WITHOUT typing passwords:
+ * builds the session user via finalizeIdentityLogin (same code path as a real login after
+ * password/MFA checks) and encodes the Auth.js session cookie with AUTH_SECRET.
+ *
+ * Usage (from repo root, dev server running):
+ *   BASE=http://localhost:3099 npx tsx scripts/smoke-auth.ts
+ */
+import "dotenv/config";
+import { encode } from "next-auth/jwt";
+import { prisma } from "../src/server/db";
+import { finalizeIdentityLogin } from "../src/server/auth";
+
+const BASE = process.env.BASE ?? "http://localhost:3099";
+const COOKIE = BASE.startsWith("https") ? "__Secure-authjs.session-token" : "authjs.session-token";
+
+type Check = { path: string; expect?: number[]; mustContain?: string };
+
+const PLAN: Record<string, Check[]> = {
+  "backoffice@demo.example": [
+    { path: "/dashboard", expect: [200] },
+    { path: "/work-orders", expect: [200] },
+    { path: "/imports", expect: [200] },
+    { path: "/customers", expect: [200] },
+    { path: "/sites", expect: [200] },
+    { path: "/teams", expect: [200] },
+    { path: "/reports", expect: [200] },
+    { path: "/documents", expect: [200] },
+    { path: "/notifications", expect: [200] },
+    { path: "/search?q=a", expect: [200] },
+    { path: "/work-orders/emergency-review", expect: [200] },
+    { path: "/settings/order-types", expect: [200] },
+    { path: "/settings/audit", expect: [200, 403, 307] },
+  ],
+  "monteur@demo.example": [
+    { path: "/", expect: [307, 308] },
+    { path: "/m", expect: [200] },
+    { path: "/m/orders", expect: [200] },
+    { path: "/m/emergency", expect: [200] },
+    { path: "/m/sync", expect: [200] },
+    { path: "/m/profile", expect: [200] },
+  ],
+};
+
+async function cookieFor(email: string): Promise<string> {
+  const identity = await prisma.identity.findUnique({ where: { email } });
+  if (!identity) throw new Error(`identity ${email} not found (seed?)`);
+  const user = await finalizeIdentityLogin(identity.id, "demo");
+  if (!user) throw new Error(`no active membership for ${email}`);
+  const token = {
+    sub: user.id,
+    name: user.name,
+    email: user.email,
+    userId: user.id,
+    identityId: user.identityId,
+    tenantId: user.tenantId,
+    tenantSlug: user.tenantSlug,
+    activeMembershipId: user.activeMembershipId,
+    memberships: user.memberships,
+    roles: user.roles,
+    permissions: user.permissions,
+    isPlatformAdmin: user.isPlatformAdmin,
+    mfaEnrolled: user.mfaEnrolled,
+  };
+  const value = await encode({ token, secret: process.env.AUTH_SECRET!, salt: COOKIE, maxAge: 60 * 30 });
+  return `${COOKIE}=${value}`;
+}
+
+async function main() {
+  let failures = 0;
+  for (const [email, checks] of Object.entries(PLAN)) {
+    const cookie = await cookieFor(email);
+    console.log(`\n== ${email}`);
+    for (const c of checks) {
+      const res = await fetch(BASE + c.path, { headers: { cookie }, redirect: "manual" });
+      const body = res.status === 200 ? await res.text() : "";
+      const errorPage = /Application error|Internal Server Error|NEXT_REDIRECT|Unhandled Runtime Error/i.test(body);
+      const okStatus = !c.expect || c.expect.includes(res.status);
+      const okText = !c.mustContain || body.includes(c.mustContain);
+      const ok = okStatus && okText && !errorPage;
+      if (!ok) failures++;
+      const loc = res.headers.get("location");
+      console.log(`${ok ? "✓" : "✗"} ${String(res.status).padEnd(3)} ${c.path}${loc ? ` → ${loc}` : ""}${errorPage ? " [error page]" : ""}`);
+    }
+  }
+  await prisma.$disconnect();
+  console.log(failures ? `\n${failures} Fehler` : "\nOK");
+  process.exit(failures ? 1 : 0);
+}
+
+main().catch((err) => {
+  console.error(err);
+  process.exit(1);
+});