Function testSiteOrgMatchLogic

server/middlewares/verifySiteAccess.test.ts:47–100

()

// --- Tests ---

function testSiteOrgMatchLogic() {
    console.log("Running verifySiteAccess org-match logic tests...");

    // Test 1: Same org — should match
    {
        const result = siteOrgMatchesExpectedOrg(
            "org-attacker",
            "org-attacker"
        );
        assertEquals(result, true, "Same org should match");
    }

    // Test 2: Different org — should NOT match (cross-org bypass scenario)
    {
        const result = siteOrgMatchesExpectedOrg("org-victim", "org-attacker");
        assertEquals(
            result,
            false,
            "Cross-org site should NOT match expected org"
        );
    }

    // Test 3: Site orgId is null — should NOT match
    {
        const result = siteOrgMatchesExpectedOrg(null, "org-attacker");
        assertEquals(result, false, "Null site orgId should NOT match");
    }

    // Test 4: Expected orgId is null — should NOT match
    {
        const result = siteOrgMatchesExpectedOrg("org-attacker", null);
        assertEquals(result, false, "Null expected orgId should NOT match");
    }

    // Test 5: Both null — should NOT match
    {
        const result = siteOrgMatchesExpectedOrg(null, null);
        assertEquals(result, false, "Both null should NOT match");
    }

    // Test 6: Empty string orgIds — should NOT match (empty string is falsy)
    {
        const result = siteOrgMatchesExpectedOrg("", "org-attacker");
        assertEquals(result, false, "Empty site orgId should NOT match");
    }

    // Test 7: Undefined orgIds — should NOT match
    {
        const result = siteOrgMatchesExpectedOrg(undefined, "org-attacker");
        assertEquals(result, false, "Undefined site orgId should NOT match");
    }

    console.log("All verifySiteAccess org-match logic tests passed.");
}

function testShouldRejectCrossOrgSite() {
    console.log(