feat(casan): establish assurance kernel and harden control plane

2026-08-02 23:24:51 +07:00
parent 8b477f3800
commit 5745519126
51 changed files with 4076 additions and 180 deletions
@@ -29,3 +29,17 @@ test('auth context fails closed to viewer for unknown role claim', () => {
  });
  assert.equal(actor.role, 'viewer');
 });
+
+test('JWT mode rejects direct spoofed identity headers without middleware verification', () => {
+  const prior = process.env.CASAN_CP_AUTH_MODE;
+  process.env.CASAN_CP_AUTH_MODE = 'jwt';
+  try {
+    assert.throws(() => actorFromHeaders({
+      'x-casan-actor': 'attacker',
+      'x-casan-role': 'org-admin',
+    }), /AUTH_VERIFIED_IDENTITY_REQUIRED/);
+  } finally {
+    if (prior === undefined) delete process.env.CASAN_CP_AUTH_MODE;
+    else process.env.CASAN_CP_AUTH_MODE = prior;
+  }
+});