80 lines
3.3 KiB
TypeScript
80 lines
3.3 KiB
TypeScript
import { test, expect } from '@playwright/test'
|
|
import { API_KEY_HEADER } from './helpers'
|
|
|
|
test.describe('Security Audit API', () => {
|
|
test('GET /api/security-audit returns 401 without auth', async ({ request }) => {
|
|
const res = await request.get('/api/security-audit')
|
|
expect(res.status()).toBe(401)
|
|
})
|
|
|
|
test('GET /api/security-audit returns 403 for non-admin (viewer)', async ({ request }) => {
|
|
// API key grants admin, so without it and without session, we get 401
|
|
// This test verifies that auth is required
|
|
const res = await request.get('/api/security-audit', {
|
|
headers: { 'Content-Type': 'application/json' },
|
|
})
|
|
expect([401, 403]).toContain(res.status())
|
|
})
|
|
|
|
test('GET /api/security-audit returns 200 with admin auth', async ({ request }) => {
|
|
const res = await request.get('/api/security-audit', { headers: API_KEY_HEADER })
|
|
expect(res.status()).toBe(200)
|
|
})
|
|
|
|
test('response has expected top-level fields', async ({ request }) => {
|
|
const res = await request.get('/api/security-audit', { headers: API_KEY_HEADER })
|
|
const body = await res.json()
|
|
expect(body).toHaveProperty('posture')
|
|
expect(body).toHaveProperty('authEvents')
|
|
expect(body).toHaveProperty('agentTrust')
|
|
expect(body).toHaveProperty('secretExposures')
|
|
expect(body).toHaveProperty('mcpAudit')
|
|
expect(body).toHaveProperty('rateLimits')
|
|
expect(body).toHaveProperty('injectionAttempts')
|
|
expect(body).toHaveProperty('timeline')
|
|
})
|
|
|
|
test('posture has score and level', async ({ request }) => {
|
|
const res = await request.get('/api/security-audit', { headers: API_KEY_HEADER })
|
|
const body = await res.json()
|
|
expect(body.posture).toHaveProperty('score')
|
|
expect(body.posture).toHaveProperty('level')
|
|
expect(typeof body.posture.score).toBe('number')
|
|
expect(body.posture.score).toBeGreaterThanOrEqual(0)
|
|
expect(body.posture.score).toBeLessThanOrEqual(100)
|
|
expect(['hardened', 'secure', 'needs-attention', 'at-risk']).toContain(body.posture.level)
|
|
})
|
|
|
|
test('timeframe filtering works with day', async ({ request }) => {
|
|
const res = await request.get('/api/security-audit?timeframe=day', { headers: API_KEY_HEADER })
|
|
expect(res.status()).toBe(200)
|
|
const body = await res.json()
|
|
expect(body).toHaveProperty('posture')
|
|
})
|
|
|
|
test('timeframe filtering works with week', async ({ request }) => {
|
|
const res = await request.get('/api/security-audit?timeframe=week', { headers: API_KEY_HEADER })
|
|
expect(res.status()).toBe(200)
|
|
})
|
|
|
|
test('timeframe filtering works with hour', async ({ request }) => {
|
|
const res = await request.get('/api/security-audit?timeframe=hour', { headers: API_KEY_HEADER })
|
|
expect(res.status()).toBe(200)
|
|
})
|
|
|
|
test('timeline is an array', async ({ request }) => {
|
|
const res = await request.get('/api/security-audit', { headers: API_KEY_HEADER })
|
|
const body = await res.json()
|
|
expect(Array.isArray(body.timeline)).toBe(true)
|
|
})
|
|
|
|
test('mcpAudit has expected fields', async ({ request }) => {
|
|
const res = await request.get('/api/security-audit', { headers: API_KEY_HEADER })
|
|
const body = await res.json()
|
|
expect(body.mcpAudit).toHaveProperty('totalCalls')
|
|
expect(body.mcpAudit).toHaveProperty('uniqueTools')
|
|
expect(body.mcpAudit).toHaveProperty('failureRate')
|
|
expect(body.mcpAudit).toHaveProperty('topTools')
|
|
})
|
|
})
|