fix: authenticate terminal WebSockets synchronously on Bun

packages/web/server/lib/security/request-security.test.js

@@ -9,55 +9,55 @@ describe('request security runtime', () => {
   test('allows packaged client origins for remote client transports', async () => {
     const runtime = createRuntime();
 
-    await expect(runtime.isRequestOriginAllowed({
+    expect(await runtime.isRequestOriginAllowed({
       headers: {
         origin: 'openchamber-ui://app',
         host: '192.168.1.130:1202',
       },
       socket: {},
-    })).resolves.toBe(true);
+    })).toBe(true);
 
-    await expect(runtime.isRequestOriginAllowed({
+    expect(await runtime.isRequestOriginAllowed({
       headers: {
         origin: 'capacitor://localhost',
         host: '192.168.1.130:1202',
       },
       socket: {},
-    })).resolves.toBe(true);
+    })).toBe(true);
 
     // Android Capacitor WebView (androidScheme 'https') reports this origin.
-    await expect(runtime.isRequestOriginAllowed({
+    expect(await runtime.isRequestOriginAllowed({
       headers: {
         origin: 'https://localhost',
         host: '192.168.1.130:1202',
       },
       socket: {},
-    })).resolves.toBe(true);
+    })).toBe(true);
   });
 
   test('rejects unknown origins', async () => {
     const runtime = createRuntime();
 
-    await expect(runtime.isRequestOriginAllowed({
+    expect(await runtime.isRequestOriginAllowed({
       headers: {
         origin: 'https://evil.example.com',
         host: '192.168.1.130:1202',
       },
       socket: {},
-    })).resolves.toBe(false);
+    })).toBe(false);
   });
 
   test('allows the external host when TLS terminates before an HTTP proxy hop', async () => {
     const runtime = createRuntime();
 
-    await expect(runtime.isRequestOriginAllowed({
+    expect(await runtime.isRequestOriginAllowed({
       headers: {
         origin: 'https://devchamber.example.com',
         host: 'devchamber.example.com',
         'x-forwarded-proto': 'http',
       },
       socket: {},
-    })).resolves.toBe(true);
+    })).toBe(true);
   });
 
   test('uses the forwarded external host without trusting a different origin', async () => {
@@ -71,13 +71,13 @@ describe('request security runtime', () => {
       socket: {},
     };
 
-    await expect(runtime.isRequestOriginAllowed({
+    expect(await runtime.isRequestOriginAllowed({
       ...request,
       headers: { ...request.headers, origin: 'https://devchamber.example.com' },
-    })).resolves.toBe(true);
-    await expect(runtime.isRequestOriginAllowed({
+    })).toBe(true);
+    expect(await runtime.isRequestOriginAllowed({
       ...request,
       headers: { ...request.headers, origin: 'https://evil.example.com' },
-    })).resolves.toBe(false);
+    })).toBe(false);
   });
 });