feat: Initial clean release of CHM

packages/lib/ClipperServer.test.ts

@@ -0,0 +1,41 @@
+import { isAllowedPairingOrigin, isPairingPath } from './ClipperServer';
+
+describe('ClipperServer', () => {
+
+	test.each([
+		// The router strips all leading slashes, so the gate must too, otherwise
+		// e.g. //auth would skip the check but still reach the auth handler.
+		['/auth', true],
+		['/auth/check', true],
+		['//auth', true],
+		['///auth/check', true],
+		['auth', true],
+		['/notes', false],
+		['/auth_other', false],
+		['', false],
+	])('should identify pairing path %s -> %s', (pathname, expected) => {
+		expect(isPairingPath(pathname)).toBe(expected);
+	});
+
+	test.each([
+		// Web origins must be rejected: these are the CSRF vector.
+		['http://attacker.example', false],
+		['https://attacker.example', false],
+		['http://127.0.0.1:41184', false],
+		['https://localhost', false],
+
+		// Extension origins are the legitimate caller.
+		['chrome-extension://some-extension-id', true],
+		['moz-extension://11111111-2222-3333-4444-555555555555', true],
+		['safari-web-extension://ABCDEF', true],
+
+		// No Origin (native clients, curl) is not a browser CSRF vector.
+		['', true],
+		[undefined as unknown as string, true],
+
+		// Malformed origins are rejected.
+		['not a url', false],
+	])('should decide pairing origin %s -> %s', (origin, expected) => {
+		expect(isAllowedPairingOrigin(origin)).toBe(expected);
+	});
+});