mirror of
https://github.com/discourse/discourse.git
synced 2026-03-03 23:54:20 +08:00
12811524fe
Discourse message-bus traffic is not considered a 'public api' for general consumption. However, it does make sense to have consistency with the CORS behavior of the rest of the app, so that people can use it at their own risk.
43 lines
1.4 KiB
Ruby
43 lines
1.4 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
RSpec.describe "message bus integration" do
|
|
it "allows anonymous requests to the messagebus" do
|
|
post "/message-bus/poll"
|
|
expect(response.status).to eq(200)
|
|
end
|
|
|
|
it "allows authenticated requests to the messagebus" do
|
|
sign_in Fabricate(:user)
|
|
post "/message-bus/poll"
|
|
expect(response.status).to eq(200)
|
|
end
|
|
|
|
it "allows custom cors origins" do
|
|
global_setting :enable_cors, true
|
|
SiteSetting.cors_origins = "https://allowed.example.com"
|
|
|
|
post "/message-bus/poll"
|
|
expect(response.headers["Access-Control-Allow-Origin"]).to eq(Discourse.base_url_no_prefix)
|
|
|
|
post "/message-bus/poll", headers: { origin: "https://allowed.example.com" }
|
|
expect(response.headers["Access-Control-Allow-Origin"]).to eq("https://allowed.example.com")
|
|
|
|
post "/message-bus/poll", headers: { origin: "https://not-allowed.example.com" }
|
|
expect(response.headers["Access-Control-Allow-Origin"]).to eq(Discourse.base_url_no_prefix)
|
|
end
|
|
|
|
context "with login_required" do
|
|
before { SiteSetting.login_required = true }
|
|
|
|
it "blocks anonymous requests to the messagebus" do
|
|
post "/message-bus/poll"
|
|
expect(response.status).to eq(403)
|
|
end
|
|
|
|
it "allows authenticated requests to the messagebus" do
|
|
sign_in Fabricate(:user)
|
|
post "/message-bus/poll"
|
|
expect(response.status).to eq(200)
|
|
end
|
|
end
|
|
end
|
