+ {/* eslint-disable-next-line jsx-a11y/no-noninteractive-element-interactions */}
{
).not.toThrow();
});
+ it('verifies a freshly generated CSRF token against the same browser session', () => {
+ const { sessionId, csrfToken } = createBrowserSession();
+ expect(() =>
+ assertMutationCsrf(
+ req('POST', {
+ cookie: `${SESSION_COOKIE_NAME}=${sessionId}`,
+ origin: BASE,
+ csrf: csrfToken,
+ }),
+ ),
+ ).not.toThrow();
+ });
+
+ it('throws when CSRF header is present but empty', () => {
+ const { sessionId } = createBrowserSession();
+ expect(() =>
+ assertMutationCsrf(
+ req('POST', {
+ cookie: `${SESSION_COOKIE_NAME}=${sessionId}`,
+ origin: BASE,
+ csrf: '',
+ }),
+ ),
+ ).toThrow(CsrfValidationError);
+ });
+
+ it('throws when the CSRF token belongs to a different session cookie', () => {
+ const { sessionId: sessionA, csrfToken: tokenA } = createBrowserSession();
+ const { sessionId: sessionB } = createBrowserSession();
+
+ expect(() =>
+ assertMutationCsrf(
+ req('POST', {
+ cookie: `${SESSION_COOKIE_NAME}=${sessionB}`,
+ origin: BASE,
+ csrf: tokenA,
+ }),
+ ),
+ ).toThrow(CsrfValidationError);
+ });
+
+ it('rejects the old token after CSRF rotation and accepts the new token', () => {
+ const { sessionId, csrfToken: oldToken } = createBrowserSession();
+ const newToken = rotateCsrfToken(sessionId);
+
+ expect(newToken).toBeTruthy();
+ expect(newToken).not.toEqual(oldToken);
+
+ expect(() =>
+ assertMutationCsrf(
+ req('POST', {
+ cookie: `${SESSION_COOKIE_NAME}=${sessionId}`,
+ origin: BASE,
+ csrf: oldToken,
+ }),
+ ),
+ ).toThrow(CsrfValidationError);
+
+ expect(() =>
+ assertMutationCsrf(
+ req('POST', {
+ cookie: `${SESSION_COOKIE_NAME}=${sessionId}`,
+ origin: BASE,
+ csrf: newToken!,
+ }),
+ ),
+ ).not.toThrow();
+ });
+
it('throws when session cookie does not map to a server session', () => {
expect(() =>
assertMutationCsrf(
@@ -160,4 +229,8 @@ describe('assertSameOriginForCookieSession', () => {
it('rejects when Origin and Referer are both missing', () => {
expect(() => assertSameOriginForCookieSession(req('POST', {}))).toThrow(CsrfValidationError);
});
+
+ it('allows when Origin matches the request origin', () => {
+ expect(() => assertSameOriginForCookieSession(req('POST', { origin: BASE }))).not.toThrow();
+ });
});
diff --git a/src/lib/backend/services/marketplace.ts b/src/lib/backend/services/marketplace.ts
index 8c76ac62..f449b7c6 100644
--- a/src/lib/backend/services/marketplace.ts
+++ b/src/lib/backend/services/marketplace.ts
@@ -481,6 +481,12 @@ class MarketplaceService {
};
}
+ async getPublicListing(
+ listingId: string,
+ ): Promise {
+ return MOCK_LISTINGS.find((listing) => listing.listingId === listingId) ?? null;
+ }
+
async getPurchasePreflight(
listingId: string,
buyerAddress: string,
diff --git a/tsconfig.json b/tsconfig.json
index 5d3d3ac9..b25051f2 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -1,8 +1,14 @@
{
"compilerOptions": {
"target": "ES2020",
- "lib": ["dom", "dom.iterable", "esnext"],
- "types": ["node"],
+ "lib": [
+ "dom",
+ "dom.iterable",
+ "esnext"
+ ],
+ "types": [
+ "node"
+ ],
"allowJs": true,
"skipLibCheck": true,
"strict": true,
@@ -13,7 +19,7 @@
"moduleResolution": "bundler",
"resolveJsonModule": true,
"isolatedModules": true,
- "jsx": "react-jsx",
+ "jsx": "preserve",
"incremental": true,
"plugins": [
{
@@ -21,10 +27,18 @@
}
],
"paths": {
- "@/*": ["./src/*"]
+ "@/*": [
+ "./src/*"
+ ]
}
},
- "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
- "exclude": ["node_modules"]
+ "include": [
+ "next-env.d.ts",
+ "**/*.ts",
+ "**/*.tsx",
+ ".next/types/**/*.ts"
+ ],
+ "exclude": [
+ "node_modules"
+ ]
}
-