Move browser authentication behind a generated-contract BFF

web/server.test.mjs

@@ -0,0 +1,105 @@
+import assert from 'node:assert/strict'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { after, before, test } from 'node:test'
+
+import { createWebServer } from './server.mjs'
+
+let base
+let root
+let server
+
+before(async () => {
+  root = await mkdtemp(join(tmpdir(), 'remora-web-server-'))
+  await writeFile(join(root, 'index.html'), '<main>Remora</main>')
+  await writeFile(join(root, 'application.js'), 'application()')
+  await writeFile(join(root, 'application.js.br'), 'compressed')
+  const config = {
+    root,
+    publicOrigin: 'http://127.0.0.1',
+  }
+  const created = createWebServer(config, {
+    store: { ready: true },
+    oauth: { route: async () => false },
+    proxy: {
+      route: async () => false,
+      upgrade: async () => false,
+    },
+  })
+  server = created.server
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve))
+  const address = server.address()
+  if (typeof address !== 'object' || address === null)
+    throw new Error('server address unavailable')
+  base = `http://127.0.0.1:${address.port}`
+})
+
+after(async () => {
+  server.closeIdleConnections()
+  server.closeAllConnections()
+  await new Promise((resolve, reject) =>
+    server.close((error) => (error ? reject(error) : resolve())),
+  )
+  await rm(root, { recursive: true })
+})
+
+test('serves health, metrics, runtime configuration, and security headers', async () => {
+  const ready = await fetch(`${base}/health/ready`)
+  assert.equal(ready.status, 200)
+  assert.deepEqual(await ready.json(), { status: 'ready' })
+  assert.equal(ready.headers.get('x-content-type-options'), 'nosniff')
+  assert.equal(ready.headers.get('x-frame-options'), 'DENY')
+  assert.match(
+    ready.headers.get('content-security-policy'),
+    /connect-src 'self'/,
+  )
+
+  const metrics = await fetch(`${base}/metrics`)
+  assert.match(await metrics.text(), /remora_web_requests_total/)
+
+  const runtime = await fetch(`${base}/runtime-config.js`)
+  const script = await runtime.text()
+  assert.match(script, /"apiUrl":"\/bff\/api\/"/)
+  assert.doesNotMatch(script, /oidc|client|secret/i)
+  assert.equal(runtime.headers.get('cache-control'), 'no-store')
+})
+
+test('serves immutable precompressed assets and correct HEAD responses', async () => {
+  const asset = await fetch(`${base}/application.js`, {
+    headers: { 'Accept-Encoding': 'br' },
+  })
+  assert.equal(asset.status, 200)
+  assert.equal(asset.headers.get('content-encoding'), 'br')
+  assert.equal(asset.headers.get('vary'), 'Accept-Encoding')
+  assert.match(asset.headers.get('cache-control'), /immutable/)
+
+  const head = await fetch(`${base}/application.js`, { method: 'HEAD' })
+  assert.equal(head.status, 200)
+  assert.equal(await head.text(), '')
+  assert.equal(
+    head.headers.get('content-type'),
+    'text/javascript; charset=utf-8',
+  )
+})
+
+test('limits the SPA fallback to extensionless HTML navigation', async () => {
+  const navigation = await fetch(`${base}/jobs/current`, {
+    headers: { Accept: 'text/html' },
+  })
+  assert.equal(navigation.status, 200)
+  assert.equal(await navigation.text(), '<main>Remora</main>')
+
+  const data = await fetch(`${base}/jobs/current`, {
+    headers: { Accept: 'application/json' },
+  })
+  assert.equal(data.status, 404)
+  const missingAsset = await fetch(`${base}/missing.js`, {
+    headers: { Accept: 'text/html' },
+  })
+  assert.equal(missingAsset.status, 404)
+  const traversal = await fetch(`${base}/%2e%2e/package.json`, {
+    headers: { Accept: 'text/html' },
+  })
+  assert.equal(traversal.status, 404)
+})