105 lines
3.5 KiB
JavaScript
105 lines
3.5 KiB
JavaScript
import assert from 'node:assert/strict'
|
|
import { mkdtemp, rm, writeFile } from 'node:fs/promises'
|
|
import { tmpdir } from 'node:os'
|
|
import { join } from 'node:path'
|
|
import { after, before, test } from 'node:test'
|
|
|
|
import { createWebServer } from './server.mjs'
|
|
|
|
let base
|
|
let root
|
|
let server
|
|
|
|
before(async () => {
|
|
root = await mkdtemp(join(tmpdir(), 'remora-web-server-'))
|
|
await writeFile(join(root, 'index.html'), '<main>Remora</main>')
|
|
await writeFile(join(root, 'application.js'), 'application()')
|
|
await writeFile(join(root, 'application.js.br'), 'compressed')
|
|
const config = {
|
|
root,
|
|
publicOrigin: 'http://127.0.0.1',
|
|
}
|
|
const created = createWebServer(config, {
|
|
store: { ready: true },
|
|
oauth: { route: async () => false },
|
|
proxy: {
|
|
route: async () => false,
|
|
upgrade: async () => false,
|
|
},
|
|
})
|
|
server = created.server
|
|
await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve))
|
|
const address = server.address()
|
|
if (typeof address !== 'object' || address === null)
|
|
throw new Error('server address unavailable')
|
|
base = `http://127.0.0.1:${address.port}`
|
|
})
|
|
|
|
after(async () => {
|
|
server.closeIdleConnections()
|
|
server.closeAllConnections()
|
|
await new Promise((resolve, reject) =>
|
|
server.close((error) => (error ? reject(error) : resolve())),
|
|
)
|
|
await rm(root, { recursive: true })
|
|
})
|
|
|
|
test('serves health, metrics, runtime configuration, and security headers', async () => {
|
|
const ready = await fetch(`${base}/health/ready`)
|
|
assert.equal(ready.status, 200)
|
|
assert.deepEqual(await ready.json(), { status: 'ready' })
|
|
assert.equal(ready.headers.get('x-content-type-options'), 'nosniff')
|
|
assert.equal(ready.headers.get('x-frame-options'), 'DENY')
|
|
assert.match(
|
|
ready.headers.get('content-security-policy'),
|
|
/connect-src 'self'/,
|
|
)
|
|
|
|
const metrics = await fetch(`${base}/metrics`)
|
|
assert.match(await metrics.text(), /remora_web_requests_total/)
|
|
|
|
const runtime = await fetch(`${base}/runtime-config.js`)
|
|
const script = await runtime.text()
|
|
assert.match(script, /"apiUrl":"\/bff\/api\/"/)
|
|
assert.doesNotMatch(script, /oidc|client|secret/i)
|
|
assert.equal(runtime.headers.get('cache-control'), 'no-store')
|
|
})
|
|
|
|
test('serves immutable precompressed assets and correct HEAD responses', async () => {
|
|
const asset = await fetch(`${base}/application.js`, {
|
|
headers: { 'Accept-Encoding': 'br' },
|
|
})
|
|
assert.equal(asset.status, 200)
|
|
assert.equal(asset.headers.get('content-encoding'), 'br')
|
|
assert.equal(asset.headers.get('vary'), 'Accept-Encoding')
|
|
assert.match(asset.headers.get('cache-control'), /immutable/)
|
|
|
|
const head = await fetch(`${base}/application.js`, { method: 'HEAD' })
|
|
assert.equal(head.status, 200)
|
|
assert.equal(await head.text(), '')
|
|
assert.equal(
|
|
head.headers.get('content-type'),
|
|
'text/javascript; charset=utf-8',
|
|
)
|
|
})
|
|
|
|
test('limits the SPA fallback to extensionless HTML navigation', async () => {
|
|
const navigation = await fetch(`${base}/jobs/current`, {
|
|
headers: { Accept: 'text/html' },
|
|
})
|
|
assert.equal(navigation.status, 200)
|
|
assert.equal(await navigation.text(), '<main>Remora</main>')
|
|
|
|
const data = await fetch(`${base}/jobs/current`, {
|
|
headers: { Accept: 'application/json' },
|
|
})
|
|
assert.equal(data.status, 404)
|
|
const missingAsset = await fetch(`${base}/missing.js`, {
|
|
headers: { Accept: 'text/html' },
|
|
})
|
|
assert.equal(missingAsset.status, 404)
|
|
const traversal = await fetch(`${base}/%2e%2e/package.json`, {
|
|
headers: { Accept: 'text/html' },
|
|
})
|
|
assert.equal(traversal.status, 404)
|
|
})
|