tylerg/auth-yes
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(merge): clean up merge conflicts in auth-session.ts and main.test.ts

Browse Source
This commit is contained in:
Tyler Gillispie 2026-08-24 15:15:15 -07:00
parent 09ed9de178
commit 3c57dfbc78
2 changed files with 7 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
server/auth-session.ts
View File

@ -286,7 +286,9 @@ export function isIpAllowed(
if (subnetNum !== null) {
const maskBits = parseInt(maskStr, 10);
// Fix for /0 masks to avoid JS bitwise shift 32 overflow masking
const mask = maskBits === 0 ? 0 : ((0xffffffff << (32 - maskBits)) >>> 0);
const mask = maskBits === 0
? 0
: ((0xffffffff << (32 - maskBits)) >>> 0);
if ((ipNum & mask) === (subnetNum & mask)) {
return true;
}
@ -299,6 +301,10 @@ export function isIpAllowed(
}
}
return false;
}
/**
* Validates a given URL to ensure it is safe to redirect to.
* Allows relative paths, localhost, and *.atyg.org (or custom RP_ID)
*/

14
server/main.test.ts
View File

@ -520,20 +520,6 @@ Deno.test("Tier 1 & 2: POST /api/guests/sandbox - Creates guest session", async
assertEquals(data.success, true);
assertEquals(true, !!data.sessionId);
assertEquals(true, !!data.guestUuid);
const origRpId = Deno.env.get("RP_ID");
Deno.env.delete("RP_ID");
try {
assertEquals(getCookieDomain("auth.atyg.org"), ".atyg.org");
assertEquals(getCookieDomain("ed-droid.atyg.org"), ".atyg.org");
assertEquals(getCookieDomain("atyg.org"), ".atyg.org");
assertEquals(getCookieDomain("localhost"), undefined);
assertEquals(getCookieDomain(""), undefined);
} finally {
if (origRpId !== undefined) {
Deno.env.set("RP_ID", origRpId);
}
}
});
Deno.test("Logout Return-Path Validation", async (t) => {