|
| 1 | +import test from 'node:test'; |
| 2 | +import assert from 'node:assert/strict'; |
| 3 | + |
| 4 | +import { mintPass } from '@profullstack/x402-gateway'; |
| 5 | + |
| 6 | +import { TIERS } from '../src/lib/tiers.js'; |
| 7 | + |
| 8 | +/** |
| 9 | + * The pass rung, and the thing it fixes. |
| 10 | + * |
| 11 | + * Until now /crawl sold a pass that bought a training crawler past the 402 and |
| 12 | + * then met the same 600-an-hour throttle as an anonymous curl. The pass is now |
| 13 | + * a rung on the ladder, so the thing we sell buys something a caller can feel. |
| 14 | + * |
| 15 | + * `hasValidPass` is imported lazily inside each test: lib/crawl-gateway.js |
| 16 | + * reads COINPAY_X402_KEY at module scope through `env`, and these set it first. |
| 17 | + */ |
| 18 | +const SECRET = 'cp_live_test_secret_0123456789'; |
| 19 | + |
| 20 | +async function passModule() { |
| 21 | + process.env.COINPAY_X402_KEY = SECRET; |
| 22 | + return import('../src/lib/crawl-gateway.js'); |
| 23 | +} |
| 24 | + |
| 25 | +const withHeaders = (headers) => |
| 26 | + new Request('https://rssamplifier.com/topics/anything', { headers: new Headers(headers) }); |
| 27 | + |
| 28 | +async function livePass() { |
| 29 | + const now = Math.floor(Date.now() / 1000); |
| 30 | + const { token } = await mintPass({ secret: SECRET, ref: 'test', expiresAt: now + 3600, now }); |
| 31 | + return token; |
| 32 | +} |
| 33 | + |
| 34 | +test('a pass sits at the sponsor ceiling, not above it', () => { |
| 35 | + // A sponsored key is a relationship and a pass is a dollar. There is no |
| 36 | + // honest reason the dollar should out-rank the relationship. |
| 37 | + assert.equal(TIERS.pass.hourly, TIERS.sponsor.hourly); |
| 38 | + assert.equal(TIERS.pass.burst, TIERS.sponsor.burst); |
| 39 | +}); |
| 40 | + |
| 41 | +test('a pass is worth far more than signing in, or nobody would buy one', () => { |
| 42 | + assert.ok( |
| 43 | + TIERS.pass.hourly > TIERS.session.hourly, |
| 44 | + 'a bought pass must beat the free account tier', |
| 45 | + ); |
| 46 | + assert.ok(TIERS.pass.hourly > TIERS.anon.hourly * 100); |
| 47 | +}); |
| 48 | + |
| 49 | +test('a live pass in the header is recognised', async () => { |
| 50 | + const { hasValidPass } = await passModule(); |
| 51 | + const token = await livePass(); |
| 52 | + assert.equal(await hasValidPass(withHeaders({ 'x-crawl-pass': token })), true); |
| 53 | +}); |
| 54 | + |
| 55 | +test('a live pass presented as a bearer token is recognised', async () => { |
| 56 | + // The gateway accepts both spellings, so the throttle must agree with it or |
| 57 | + // a caller doing exactly what the sales page said gets throttled anyway. |
| 58 | + const { hasValidPass } = await passModule(); |
| 59 | + const token = await livePass(); |
| 60 | + assert.equal(await hasValidPass(withHeaders({ authorization: `Bearer ${token}` })), true); |
| 61 | +}); |
| 62 | + |
| 63 | +test('no pass is not a pass', async () => { |
| 64 | + const { hasValidPass } = await passModule(); |
| 65 | + assert.equal(await hasValidPass(withHeaders({})), false); |
| 66 | +}); |
| 67 | + |
| 68 | +test('a forged pass is refused, which is the whole point of signing them', async () => { |
| 69 | + const { hasValidPass } = await passModule(); |
| 70 | + const token = await livePass(); |
| 71 | + const tampered = `${token.slice(0, -1)}${token.endsWith('A') ? 'B' : 'A'}`; |
| 72 | + assert.equal(await hasValidPass(withHeaders({ 'x-crawl-pass': tampered })), false); |
| 73 | +}); |
| 74 | + |
| 75 | +test('a pass from a different secret is refused', async () => { |
| 76 | + const { hasValidPass } = await passModule(); |
| 77 | + const now = Math.floor(Date.now() / 1000); |
| 78 | + const { token } = await mintPass({ |
| 79 | + secret: 'someone-elses-key', |
| 80 | + ref: null, |
| 81 | + expiresAt: now + 3600, |
| 82 | + now, |
| 83 | + }); |
| 84 | + assert.equal(await hasValidPass(withHeaders({ 'x-crawl-pass': token })), false); |
| 85 | +}); |
| 86 | + |
| 87 | +test('an expired pass is refused', async () => { |
| 88 | + const { hasValidPass } = await passModule(); |
| 89 | + const now = Math.floor(Date.now() / 1000); |
| 90 | + // Minted live, then judged from a moment after it lapsed. |
| 91 | + const { token } = await mintPass({ secret: SECRET, ref: null, expiresAt: now + 1, now }); |
| 92 | + await new Promise((resolve) => setTimeout(resolve, 1100)); |
| 93 | + assert.equal(await hasValidPass(withHeaders({ 'x-crawl-pass': token })), false); |
| 94 | +}); |
| 95 | + |
| 96 | +test('garbage in the header is not an error, just not a pass', async () => { |
| 97 | + const { hasValidPass } = await passModule(); |
| 98 | + for (const value of ['', ' ', 'cp_', 'cp_nodot', 'not-a-pass', 'Bearer nonsense']) { |
| 99 | + assert.equal( |
| 100 | + await hasValidPass(withHeaders({ 'x-crawl-pass': value })), |
| 101 | + false, |
| 102 | + JSON.stringify(value), |
| 103 | + ); |
| 104 | + } |
| 105 | +}); |
| 106 | + |
| 107 | +test('the sales page lists what a pass buys, and every line of it is rate', async () => { |
| 108 | + // The directory's position is that data is open and money buys speed. A |
| 109 | + // benefits list promising fields or endpoints the free tier cannot have would |
| 110 | + // sell the opposite of what this site is for. |
| 111 | + const { gateway } = await passModule(); |
| 112 | + const benefits = gateway.options.benefits; |
| 113 | + assert.ok(Array.isArray(benefits) && benefits.length > 0, 'a pass has to say what it buys'); |
| 114 | + assert.ok( |
| 115 | + benefits.some((line) => /120,000 requests an hour/.test(line)), |
| 116 | + 'the headline number belongs in the list', |
| 117 | + ); |
| 118 | + assert.ok( |
| 119 | + benefits.some((line) => /rate, never access/.test(line)), |
| 120 | + 'and so does the promise that nothing is withheld', |
| 121 | + ); |
| 122 | +}); |
0 commit comments