aeca9eae99
This Edge Function grants platform-admin power (list every user across every workspace, ban/unban accounts, trigger password resets for any user_id) but answered with Access-Control-Allow-Origin: '*', unlike the sibling caterium-create-employee function which already uses an origin allowlist. Authorization itself was never bypassable this way (the function still requires the caller's own Bearer token and re-checks sun_is_platform_admin() server-side), but a wildcard CORS response removes a real layer of defense-in-depth if a platform-admin token were ever exposed to another origin. Applies the same allowedOrigin()/corsHeaders() pattern already proven in caterium-create-employee, and extends edge-security-v1774.mjs (which already asserted the wildcard was gone from create-employee, but never checked this function) to cover both. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
25 lines
2.1 KiB
JavaScript
25 lines
2.1 KiB
JavaScript
import fs from 'node:fs';
|
|
const src=fs.readFileSync('supabase/functions/caterium-create-employee/index.ts','utf8');
|
|
const importMap=fs.readFileSync('supabase/functions/caterium-create-employee/deno.json','utf8');
|
|
let bad=0;const check=(v,m)=>{console.log(`${v?'OK':'FAIL'}: ${m}`);if(!v)bad++};
|
|
check(src.includes('npm:@supabase/supabase-js@2.116.0'),'Supabase JS direct import is pinned');
|
|
check(importMap.includes('npm:@supabase/supabase-js@2.116.0'),'Supabase JS import map is pinned');
|
|
check(!importMap.includes('npm:@supabase/supabase-js@2"'),'broad Supabase JS import map is removed');
|
|
check(!src.includes('"Access-Control-Allow-Origin": "*"'),'wildcard CORS is removed');
|
|
check(src.includes('https://app.caterium.ru')&&src.includes('WORKERS_DEV_ORIGIN'),'production and backup origins are allowlisted');
|
|
check(src.includes('origin_not_allowed'),'unknown browser origins fail closed');
|
|
check(src.includes('UUID_RE')&&src.includes('EMAIL_RE')&&src.includes('ALLOWED_ROLES'),'employee inputs are validated');
|
|
check(src.includes('["admin", "manager", "kitchen", "courier", "viewer"]'),'edge roles match database roles');
|
|
check(!src.includes('"operator"')&&!src.includes('"owner", "admin"'),'invented employee roles are not accepted');
|
|
check(src.includes('console.error("[caterium-create-employee]"'),'internal errors remain server-side');
|
|
check(src.includes('employee_create_failed'),'unexpected failures return a safe public code');
|
|
check(!src.includes('return reply({ error: e instanceof Error ? e.message'),'raw exception messages are not returned');
|
|
|
|
const adminSrc=fs.readFileSync('supabase/functions/caterium-platform-auth-admin/index.ts','utf8');
|
|
check(!adminSrc.includes("'Access-Control-Allow-Origin': '*'"),'platform-auth-admin: wildcard CORS is removed');
|
|
check(adminSrc.includes('https://app.caterium.ru')&&adminSrc.includes('WORKERS_DEV_ORIGIN'),'platform-auth-admin: production and backup origins are allowlisted');
|
|
check(adminSrc.includes('origin_not_allowed'),'platform-auth-admin: unknown browser origins fail closed');
|
|
check(adminSrc.includes("sun_is_platform_admin"),'platform-auth-admin: caller platform-admin check remains in place');
|
|
|
|
if(bad)process.exit(1);
|