Adversarial auth enforcement test runners and the standard attack surface suite.
The combinatorial test runner (describe_adversarial_auth) generates test suites for routes x auth levels. The standard suite (describe_standard_attack_surface_tests) composes all attack surface test groups into a single call.
Stubs, app factories, and assertion helpers live in focused submodules:
- test_auth_stubs — stub factories and pre-built dep bundles
- test_auth_apps — auth-level test app factories
- test_auth_assertions — snapshot, public route, and middleware assertions
4 declarations
testing/attack_surface.ts view source
AdversarialTestOptions Options for adversarial test runners (auth enforcement and input validation).
buildBuild the app surface bundle (surface + route specs + middleware specs).
() => AppSurfaceSpecrolesAll roles in the app (e.g. ['admin', 'keeper']).
Array<string>testing/attack_surface.ts view source
(options: AdversarialTestOptions): void Generate adversarial HTTP auth enforcement test suites.
Describe blocks: - unauthenticated → 401 — every protected route - wrong role → 403 — every role route, tested with all non-matching roles - authenticated without role → 403 — every role route, no-role context - correct auth passes guard — every protected route, assert not 401/403
optionsthe test configuration
void testing/attack_surface.ts view source
(options: StandardAttackSurfaceOptions): void Run the standard attack surface test suite.
Generates 10 test groups: 1. Snapshot — live surface matches committed JSON 2. Determinism — building twice yields identical results 3. Public routes — bidirectional check (no unexpected, no missing) 4. Middleware stack — every API route has the full middleware chain 5. Surface invariants — structural assertions (error schemas, descriptions, duplicates, consistency) 6. Security policy — rate limiting on sensitive routes, no unexpected public mutations, method conventions 7. Error schema tightness audit — informational log of generic vs specific error schemas 8. Adversarial auth — unauthenticated/wrong-role/correct-auth enforcement 9. Adversarial input — input body and params validation 10. Adversarial 404 — stub 404 handlers, validate response bodies against declared schemas
Consumer test files call this with project-specific options, then add
any project-specific assertions in additional describe blocks.
optionsthe test configuration
void testing/attack_surface.ts view source
StandardAttackSurfaceOptions Options for the standard attack surface test suite.
buildBuild the app surface bundle (surface + route specs + middleware specs).
() => AppSurfaceSpecsnapshot_pathAbsolute path to the committed snapshot JSON file.
stringexpected_public_routesExpected public routes, e.g. ['GET /health', 'POST /api/account/login'].
Array<string>expected_api_middlewareExpected middleware names for API routes, e.g. ['origin', 'session', 'request_context', 'bearer_auth'].
Array<string>rolesAll roles in the app (e.g. ['admin', 'keeper']).
Array<string>api_path_prefixPath prefix for middleware stack assertion. Default '/api/'.
stringsecurity_policySecurity policy configuration. Omit for sensible defaults.
error_schema_tightnessError schema tightness assertion. Omit for informational-only behavior.