add more econ stuff

apps/econ/src/test/integration/api.test.ts

@@ -5,6 +5,32 @@ import '../../econ.app'
 
 const ORIGIN = 'https://econ.rec.djdevin.net'
 
+// Mint a token the way the `auth` worker does, using the same dev secret.
+const DEV_SECRET = 'dev-insecure-signing-key-change-me'
+
+function b64url(input: ArrayBuffer | string): string {
+	const bytes = typeof input === 'string' ? new TextEncoder().encode(input) : new Uint8Array(input)
+	let binary = ''
+	for (const byte of bytes) binary += String.fromCharCode(byte)
+	return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '')
+}
+
+async function bearer(sub = '42'): Promise<Record<string, string>> {
+	const now = Math.floor(Date.now() / 1000)
+	const signingInput = `${b64url(JSON.stringify({ alg: 'HS256', typ: 'JWT' }))}.${b64url(
+		JSON.stringify({ sub, exp: now + 3600 })
+	)}`
+	const key = await crypto.subtle.importKey(
+		'raw',
+		new TextEncoder().encode(DEV_SECRET),
+		{ name: 'HMAC', hash: 'SHA-256' },
+		false,
+		['sign']
+	)
+	const sig = await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(signingInput))
+	return { Authorization: `Bearer ${signingInput}.${b64url(sig)}` }
+}
+
 describe('econ endpoints', () => {
 	test('GET /api/avatar/v1/defaultunlocked returns the default avatar items', async () => {
 		const res = await exports.default.fetch(`${ORIGIN}/api/avatar/v1/defaultunlocked`)
@@ -15,6 +41,39 @@ describe('econ endpoints', () => {
 		expect(body[0]).toHaveProperty('AvatarItemDesc')
 	})
 
+	test('GET /api/avatar/v4/items 401s without a token', async () => {
+		const res = await exports.default.fetch(`${ORIGIN}/api/avatar/v4/items`)
+		expect(res.status).toBe(401)
+	})
+
+	test('GET /api/avatar/v4/items returns the item catalog with a valid token', async () => {
+		const res = await exports.default.fetch(`${ORIGIN}/api/avatar/v4/items`, {
+			headers: await bearer(),
+		})
+		expect(res.status).toBe(200)
+		const body = (await res.json()) as unknown[]
+		expect(Array.isArray(body)).toBe(true)
+		expect(body.length).toBeGreaterThan(0)
+		expect(body[0]).toHaveProperty('AvatarItemDesc')
+		expect(body[0]).toHaveProperty('FriendlyName')
+	})
+
+	test('GET /api/avatar/v2 401s without a token', async () => {
+		const res = await exports.default.fetch(`${ORIGIN}/api/avatar/v2`)
+		expect(res.status).toBe(401)
+	})
+
+	test('GET /api/avatar/v2 returns the default avatar with a valid token', async () => {
+		const res = await exports.default.fetch(`${ORIGIN}/api/avatar/v2`, { headers: await bearer() })
+		expect(res.status).toBe(200)
+		expect(await res.json()).toEqual({
+			OutfitSelections: '',
+			FaceFeatures: '{}',
+			SkinColor: '',
+			HairColor: '',
+		})
+	})
+
 	test('unknown path returns 404', async () => {
 		const res = await exports.default.fetch(`${ORIGIN}/nope`)
 		expect(res.status).toBe(404)