Harden bot, storage and web API

test/auth.test.js

@@ -0,0 +1,49 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+Object.assign(process.env, {
+  NODE_ENV: "test",
+  DISCORD_GUILD_ID: "1",
+  SHINUWA_USER_ID: "1",
+  WEB_SERVER_PORT: "3000",
+  WEB_API_KEY: "test-key",
+  DISCORD_APPLICATION_ID: "1",
+  DISCORD_TOKEN: "test-token",
+  VOICE_CHANNEL_ID: "1",
+  TEXT_CHANNEL_ID: "1",
+  GAME_SERVERS_MESSAGE_ID: "1",
+});
+
+const { authMiddleware } = await import("../src/web/middlewares/auth.js");
+
+function runAuth(authorization) {
+  let nextCalled = false;
+  let statusCode;
+  let payload;
+  const request = { headers: { authorization } };
+  const response = {
+    status(code) {
+      statusCode = code;
+      return this;
+    },
+    json(value) {
+      payload = value;
+      return this;
+    },
+  };
+
+  authMiddleware(request, response, () => {
+    nextCalled = true;
+  });
+  return { nextCalled, statusCode, payload };
+}
+
+test("API authentication accepts only an exact Bearer token", () => {
+  assert.equal(runAuth("Bearer test-key").nextCalled, true);
+  assert.deepEqual(runAuth("test-key"), {
+    nextCalled: false,
+    statusCode: 401,
+    payload: { error: "Unauthorized" },
+  });
+  assert.equal(runAuth("Bearer wrong-key").statusCode, 401);
+});