Function signedFetch

packages/cli/test/proxy.test.ts:644–664

(baseUrl: string, path: string, init: RequestInit = {})

        `;

        async function signedFetch(baseUrl: string, path: string, init: RequestInit = {}): Promise<Response> {
            const method = (init.method ?? 'GET').toUpperCase();
            const body = init.body ? JSON.parse(init.body as string) : undefined;
            const authHeader = (init.headers as Record<string, string> | undefined)?.['Authorization'];
            const authorizationToken = authHeader?.startsWith('Bearer ') ? authHeader.substring(7) : undefined;

            const sig = buildSignatureHeader({
                privateKey: TEST_PRIVATE_KEY,
                method,
                pathWithQuery: path,
                body,
                authorizationToken,
            });
            return fetch(`${baseUrl}${path}`, {
                ...init,
                headers: {
                    ...(init.headers as Record<string, string>),
                    'x-zenstack-signature': sig,
                },
            });
        }

        it('anonymous request should not bypass access policy', async () => {
            const { client, app } = await createPolicyApp(zmodel);