itsi 0.1.19 → 0.2.2

data/gems/server/test/middleware/compression.rb

@@ -0,0 +1,89 @@
+require_relative "../helpers/test_helper"
+class TestCompression < Minitest::Test
+
+  def test_supports_compression
+    require 'zlib'
+    require 'stringio'
+
+    payload = "I will be gzip compressed"
+    server(
+      itsi_rb: lambda do
+        compress min_size: 0
+        get("/foo"){|r| r.ok payload}
+      end) do
+        string_io = StringIO.new(get("/foo", {"Accept-Encoding" => "gzip"}))
+        gzip_reader = Zlib::GzipReader.new(string_io)
+        decompressed = gzip_reader.read
+        gzip_reader.close
+        assert_equal payload, decompressed
+    end
+  end
+
+  def test_supports_compression_size_limit
+    require 'zlib'
+    require 'stringio'
+
+    server(
+      itsi_rb: lambda do
+        compress min_size: 100
+        get("/foo") do |r|
+          r.ok "data" * r.query_params["repeat"].to_i
+        end
+      end) do
+
+        string_io = StringIO.new(get("/foo?repeat=100", {"Accept-Encoding" => "gzip"}))
+        gzip_reader = Zlib::GzipReader.new(string_io)
+        decompressed = gzip_reader.read
+        gzip_reader.close
+        assert_equal "data" * 100, decompressed
+
+        assert_equal get("/foo?repeat=1"), "data"
+    end
+  end
+
+  def test_supports_compression_mime_type_conditions
+    require 'zlib'
+    require 'stringio'
+
+    server(
+      itsi_rb: lambda do
+        compress mime_types: %w[image], min_size: 0
+        get("/foo") do |r|
+          r.respond("data", 200,  {"Content-Type" => r.query_params["type"]})
+        end
+      end) do
+
+        string_io = StringIO.new(get("/foo?type=image/png", {"Accept-Encoding" => "gzip"}))
+        gzip_reader = Zlib::GzipReader.new(string_io)
+        decompressed = gzip_reader.read
+        gzip_reader.close
+        assert_equal "data", decompressed
+        assert_equal get("/foo?type=application/octet-stream"), "data"
+    end
+  end
+
+  def test_supports_compression_streaming_compression
+    require 'zlib'
+    require 'stringio'
+
+    server(
+      itsi_rb: lambda do
+        compress mime_types: %w[all], min_size: 0, compress_streams: true
+        get("/foo") do |req|
+          r = req.response
+          r << "one\n"
+          r << "two\n"
+          r << "three\n"
+          r.close
+        end
+      end) do
+
+        string_io = StringIO.new(get("/foo", {"Accept-Encoding" => "gzip"}))
+        gzip_reader = Zlib::GzipReader.new(string_io)
+        decompressed = gzip_reader.read
+        gzip_reader.close
+        assert_equal "one\ntwo\nthree\n", decompressed
+    end
+  end
+
+end

data/gems/server/test/middleware/cors.rb

@@ -0,0 +1,113 @@
+require_relative "../helpers/test_helper"
+
+class TestCORS < Minitest::Test
+
+  def test_cors_supports_origin_and_methods
+    server(
+      itsi_rb: lambda do
+        cors \
+          allow_origins: ["https://itsi.fyi"],
+          allow_methods: %w[GET POST],
+          allow_headers: %w[Content-Type Authorization],
+          allow_credentials: true,
+          expose_headers: ["X-Special-Header"],
+          max_age: 3600
+
+        get("/foo") { |r| r.ok "ok" }
+      end
+    ) do
+      res = options("/foo", {
+        "Origin" => "https://itsi.fyi",
+        "Access-Control-Request-Method" => "POST",
+        "Access-Control-Request-Headers" => "Content-Type"
+      })
+
+      assert_includes res["Access-Control-Allow-Origin"], "https://itsi.fyi"
+      assert_includes res["Access-Control-Allow-Methods"], "POST"
+      assert_includes res["Access-Control-Allow-Headers"], "Content-Type"
+      assert_equal "true", res["Access-Control-Allow-Credentials"]
+      assert_equal "3600", res["Access-Control-Max-Age"]
+    end
+  end
+
+  def test_cors_exposes_headers_and_allows_credentials
+    server(
+      itsi_rb: lambda do
+        cors \
+          allow_origins: ["https://itsi.fyi"],
+          allow_methods: %w[GET],
+          allow_headers: %w[Content-Type],
+          allow_credentials: true,
+          expose_headers: ["X-Special-Header"],
+          max_age: 1000
+
+        get("/foo") do |r|
+          r.respond("ok", 200, {
+            "X-Special-Header" => "42"
+          })
+        end
+      end
+    ) do
+      res = get("/foo", {
+        "Origin" => "https://itsi.fyi"
+      })
+
+      assert_equal "https://itsi.fyi", res["Access-Control-Allow-Origin"]
+      assert_equal "true", res["Access-Control-Allow-Credentials"]
+      assert_equal "X-Special-Header", res["Access-Control-Expose-Headers"]
+    end
+  end
+
+  def test_cors_blocks_unauthorized_origin
+    server(
+      itsi_rb: lambda do
+        cors \
+          allow_origins: ["https://itsi.fyi"],
+          allow_methods: %w[GET],
+          allow_headers: %w[Content-Type],
+          allow_credentials: false,
+          expose_headers: [],
+          max_age: 600
+
+        get("/foo") { |r| r.ok "ok" }
+      end
+    ) do
+      res = options("/foo", {
+        "Origin" => "https://evil.com",
+        "Access-Control-Request-Method" => "GET"
+      })
+
+      refute res.key?("Access-Control-Allow-Origin")
+      refute res.key?("Access-Control-Allow-Headers")
+      refute res.key?("Access-Control-Allow-Credentials")
+    end
+  end
+
+  def test_cors_exposes_headers_and_allows_credentials
+    server(
+      itsi_rb: lambda do
+        cors \
+          allow_origins: ["https://itsi.fyi"],
+          allow_methods: %w[GET],
+          allow_headers: %w[Content-Type],
+          allow_credentials: true,
+          expose_headers: ["X-Special-Header"],
+          max_age: 1000
+
+        get("/foo") do |r|
+          r.respond("ok", 200, {
+            "X-Special-Header" => "42"
+          })
+        end
+      end
+    ) do
+      res = get_resp("/foo", {
+        "Origin" => "https://itsi.fyi"
+      })
+      assert_equal "https://itsi.fyi", res["Access-Control-Allow-Origin"]
+      assert_equal "true", res["Access-Control-Allow-Credentials"]
+      assert_equal "X-Special-Header", res["Access-Control-Expose-Headers"]
+    end
+  end
+
+end

data/gems/server/test/middleware/csp.rb

@@ -0,0 +1,62 @@
+require_relative "../helpers/test_helper"
+require "json"
+
+class TestCsp < Minitest::Test
+  def test_header_is_added
+    server(
+      itsi_rb: lambda do
+        csp \
+          policy: {
+            default_src: ["'self'"],
+            script_src: ["example.com"]
+          }
+        get("/") { |r| r.ok "hello" }
+      end
+    ) do
+      res = get_resp("/")
+      header = res["Content-Security-Policy"]
+      assert header.include?("default-src 'self'")
+      assert header.include?("script-src example.com")
+    end
+  end
+
+  def test_reports_get_logged
+    Tempfile.create("csp-log") do |f|
+      server(
+        itsi_rb: lambda do
+          csp \
+            policy: {
+              default_src: ["'none'"],
+              report_uri: ["/csp-report"]
+            },
+            reporting_enabled: true,
+            report_file: f.path,
+            report_endpoint: "/csp-report",
+            flush_interval: 0.1
+
+          get("/") { |r| r.ok "ok" }
+        end
+      ) do
+        report = {
+          "csp-report" => {
+            "document-uri" => "http://example.com/",
+            "referrer" => "",
+            "violated-directive" => "script-src",
+            "original-policy" => "default-src 'none';",
+            "blocked-uri" => "inline"
+          }
+        }
+
+        post("/csp-report", JSON.dump(report), {
+          "Content-Type" => "application/csp-report"
+        })
+
+        sleep 0.15
+
+        content = File.read(f.path)
+        assert_includes content, "violated-directive"
+        assert_includes content, "blocked-uri"
+      end
+    end
+  end
+end

data/gems/server/test/middleware/deny_list.rb

@@ -0,0 +1,131 @@
+# test_deny_list.rb
+require_relative "../helpers/test_helper"
+
+class TestDenyList < Minitest::Test
+  # 1. Single‐pattern: localhost is denied
+  def test_single_pattern_denies_and_allows
+    server(
+      itsi_rb: lambda do
+        deny_list denied_patterns: ["^127\\.0\\.0\\.1$"]
+        get("/foo") { |r| r.ok "ok" }
+      end
+    ) do
+      # Client from 127.0.0.1 is denied
+      res1 = get_resp("/foo")
+      assert_equal "403", res1.code
+
+      # If we change the pattern to something else, localhost is allowed
+      server(
+        itsi_rb: lambda do
+          deny_list denied_patterns: ["^10\\."]
+          get("/foo") { |r| r.ok "allowed" }
+        end
+      ) do
+        res2 = get_resp("/foo")
+        assert_equal "200", res2.code
+        assert_equal "allowed", res2.body
+      end
+    end
+  end
+
+  # 2. Multiple‐pattern: deny localhost or 172.16.x.x
+  def test_multiple_patterns
+    server(
+      itsi_rb: lambda do
+        deny_list denied_patterns: ["^127\\.0\\.0\\.1$", "^172\\.16\\."]
+        get("/h") { |r| r.ok "h" }
+      end
+    ) do
+      # localhost matches first pattern → denied
+      res1 = get_resp("/h")
+      assert_equal "403", res1.code
+
+      # If we restrict only to 172.16.*, localhost becomes allowed
+      server(
+        itsi_rb: lambda do
+          deny_list denied_patterns: ["^172\\.16\\."]
+          get("/h") { |r| r.ok "ok" }
+        end
+      ) do
+        res2 = get_resp("/h")
+        assert_equal "200", res2.code
+        assert_equal "ok",   res2.body
+      end
+    end
+  end
+
+  # 3. Custom error_response
+  def test_custom_error_response
+    server(
+      itsi_rb: lambda do
+        deny_list \
+          denied_patterns: ["^127\\.0\\.0\\.1$"],
+          error_response: {
+            code: 403,
+            plaintext: { inline: "Blocked by IP" },
+            default: "plaintext"
+          }
+        get("/z") { |r| r.ok "never" }
+      end
+    ) do
+      res = get_resp("/z")
+      assert_equal "403", res.code
+      assert_equal "Blocked by IP", res.body
+    end
+  end
+
+  # 4. Trusted proxies: extract client IP from header if proxy is trusted
+  def test_trusted_proxy_denies_based_on_header
+    server(
+      itsi_rb: lambda do
+        deny_list \
+          denied_patterns: ["^198\\.51\\.100\\.9$"],
+          trusted_proxies: {
+            "127.0.0.1" => { header: { name: "X-Forwarded-For" } }
+          }
+        get("/deny") { |r| r.ok "shouldn't see" }
+      end
+    ) do
+      # Header says user is 198.51.100.9, which is denied
+      res = get_resp("/deny", { "X-Forwarded-For" => "198.51.100.9" })
+      assert_equal "403", res.code
+    end
+  end
+
+  def test_trusted_proxy_allows_if_forwarded_ip_not_denied
+    server(
+      itsi_rb: lambda do
+        deny_list \
+          denied_patterns: ["^198\\.51\\.100\\.9$"],  # deny this IP
+          trusted_proxies: {
+            "127.0.0.1" => { header: { name: "X-Forwarded-For" } }
+          }
+        get("/deny") { |r| r.ok "welcome" }
+      end
+    ) do
+      # Header says user is 198.51.100.10, which is not denied
+      res = get_resp("/deny", { "X-Forwarded-For" => "198.51.100.10" })
+      assert_equal "200", res.code
+      assert_equal "welcome", res.body
+    end
+  end
+
+  def test_untrusted_proxy_ignores_forwarded_ip
+    server(
+      itsi_rb: lambda do
+        deny_list \
+          denied_patterns: ["^198\\.51\\.100\\.9$"],
+          trusted_proxies: {
+            "10.0.0.1" => { header: { name: "X-Forwarded-For" } } # current sender not trusted
+          }
+        get("/deny") { |r| r.ok "should be denied by socket IP" }
+      end
+    ) do
+      # Because 127.0.0.1 is not trusted, header is ignored and socket IP (which matches ^127) is not denied
+      # But 127.0.0.1 isn't in the denied_patterns, so it's allowed
+      res = get_resp("/deny", { "X-Forwarded-For" => "198.51.100.9" })
+      assert_equal "200", res.code
+      assert_equal "should be denied by socket IP", res.body
+    end
+  end
+end

data/gems/server/test/middleware/endpoint.rb

@@ -0,0 +1,300 @@
+require_relative "../helpers/test_helper"
+require "json"
+
+MySchema = { _required: %i[name], name: String }
+PingSchema = { _required: %i[status], status: String }
+
+
+class TestEndpoint < Minitest::Test
+  # 1. Basic inline GET endpoint
+  def test_basic_get
+    server(itsi_rb: lambda do
+      endpoint "/hello" do |req|
+        req.ok "world"
+      end
+    end) do
+      res = get_resp("/hello")
+      assert_equal "200", res.code
+      assert_equal "world", res.body
+    end
+  end
+
+  # 2. GET-only wrapper rejects POST
+  def test_get_wrapper_rejects_post
+    server(itsi_rb: lambda do
+      get "/onlyget" do |req|
+        req.ok "got"
+      end
+    end) do
+      assert_equal "got", get("/onlyget")
+      post_res = post("/onlyget", "")
+      refute_equal post_res.body, "got"
+    end
+  end
+
+  # 3. Trailing slash handling: both /path and /path/ map
+  def test_trailing_slash_equivalence
+    server(itsi_rb: lambda do
+      endpoint "/users" do |req|
+        req.ok req.path
+      end
+    end) do
+      res1 = get_resp("/users")
+      assert_equal "200", res1.code
+      assert_equal "/users", res1.body
+
+      res2 = get_resp("/users/")
+      assert_equal "200", res2.code
+      assert_equal "/users/", res2.body
+    end
+  end
+
+  # 4. Empty‑path endpoint: wildcard match all paths
+  def test_empty_path_wildcard
+    server(itsi_rb: lambda do
+      endpoint do |req|
+        req.ok req.path
+      end
+    end) do
+      %w[/ /foo /foo/bar].each do |path|
+        res = get_resp(path)
+        assert_equal "200", res.code
+        assert_equal path, res.body
+      end
+    end
+  end
+
+  # 5. JSON body parsing into params
+  def test_json_body_parsing
+    server(itsi_rb: lambda do
+      endpoint "/echo_json" do |req, params|
+        req.ok JSON.generate(params)
+      end
+    end) do
+      payload = { "a" => 1, "b" => 2 }
+      res = post(
+        "/echo_json",
+        JSON.generate(payload),
+        "Content-Type" => "application/json"
+      )
+      assert_equal "200", res.code
+      assert_equal payload, JSON.parse(res.body)
+    end
+  end
+
+  # 6. Form‑encoded body parsing
+  def test_form_urlencoded_parsing
+    server(itsi_rb: lambda do
+      endpoint "/echo_form" do |req, params|
+        req.ok "#{params['x']}-#{params['y']}"
+      end
+    end) do
+      res = post(
+        "/echo_form",
+        "x=foo&y=bar",
+        "Content-Type" => "application/x-www-form-urlencoded"
+      )
+      assert_equal "200", res.code
+      assert_equal "foo-bar", res.body
+    end
+  end
+
+  # 7. Streaming via low‑level response object
+  def test_streaming_response
+    server(itsi_rb: lambda do
+      endpoint "/stream" do |req|
+        stream = req.response
+        stream << "A"
+        stream << "B"
+        stream << "C"
+        stream.close
+      end
+    end) do
+      res = get_resp("/stream")
+      assert_equal "200", res.code
+      assert_equal "ABC", res.body
+    end
+  end
+
+  # 8. Exceptions inside handler produce 500
+  def test_internal_error_returns_500
+    server(itsi_rb: lambda do
+      endpoint "/boom" do |_req|
+        raise "test crash"
+      end
+    end) do
+      res = get_resp("/boom")
+      assert_equal "500", res.code
+    end
+  end
+
+  # 9. Controller method dispatch via symbol
+  def test_controller_symbol_dispatch
+    server(itsi_rb: lambda do
+      # define handler method in top‑level scope
+      def foo_handler(req)
+        req.ok "from_symbol"
+      end
+      endpoint "/sym", :foo_handler
+    end) do
+      res = get_resp("/sym")
+      assert_equal "200", res.code
+      assert_equal "from_symbol", res.body
+    end
+  end
+
+  # 10. Schema enforcement rejects bad JSON
+  def test_schema_validation_failure
+    server(itsi_rb: lambda do
+      # declare a schema and use typed params
+      endpoint "/typed" do |req, params: MySchema|
+        req.ok params["name"]
+      end
+    end) do
+      # missing "name"
+      res = post(
+        "/typed",
+        "{}",
+        "Content-Type" => "application/json"
+      )
+      assert_equal "400", res.code
+      assert_match /Validation failed/, res.body
+    end
+  end
+
+  # 11. Response‑format schema enforcement
+  def test_response_schema_enforcement
+    server(itsi_rb: lambda do
+      endpoint "/ping" do |req, _params, response_format: PingSchema|
+        req.ok json: { "wrong" => 123 }, as: response_format
+      end
+    end) do
+      res = get_resp("/ping")
+      assert_equal "400", res.code
+      assert_match /Validation failed/, res.body
+    end
+  end
+
+  # 12. Unrestricted HTTP method on endpoint (no wrapper)
+  def test_unrestricted_endpoint_all_methods
+    server(itsi_rb: lambda do
+      endpoint "/all" do |req|
+        req.ok req.request_method
+      end
+    end) do
+      %w[POST PUT PATCH DELETE].each do |m|
+        resp = send(m.downcase, "/all")
+        assert_equal "200", resp.code
+        assert_equal m, resp.body
+      end
+      resp = get_resp("/all")
+      assert_equal "200", resp.code
+      assert_equal "GET", resp.body
+    end
+  end
+
+  def test_head_on_get_wrapper
+    server(itsi_rb: lambda do
+      get "/resource" do |req|
+        req.respond body: "payload", status: 200, headers: { "X-Foo" => "bar" }
+      end
+    end) do
+      res = head("/resource")
+      assert_equal "200", res.code
+      assert_equal "bar", res["X-Foo"]
+      assert_empty res.body.to_s
+    end
+  end
+
+  # 14. POST wrapper accepts POST only
+  def test_post_wrapper
+    server(itsi_rb: lambda do
+      post "/submit" do |req|
+        req.ok "posted"
+      end
+      endpoint do |req|
+        req.not_found ""
+      end
+    end) do
+      assert_equal "posted", post("/submit", "").body
+      assert_equal "404", get_resp("/submit").code
+      assert_equal "404", head("/submit").code
+      assert_equal "404", options("/submit").code
+    end
+  end
+
+  # 15. PUT, PATCH, DELETE wrappers
+  %w[put patch delete].each do |verb|
+    define_method("test_#{verb}_wrapper") do
+      server(itsi_rb: lambda do
+        send(verb, "/thing") do |req|
+          req.ok req.request_method
+        end
+        endpoint do |req|
+          req.not_found ""
+        end
+      end) do
+        # correct method
+        send("#{verb}", "/thing")
+        # mismatched methods
+        %w[POST OPTIONS HEAD].each do |bad|
+          res = send("#{bad.downcase}", "/thing")
+          assert_equal "404", res.code, "#{verb.upcase} wrapper should 404 on #{bad}"
+        end
+      end
+    end
+  end
+
+  # 16. OPTIONS on unrestricted endpoint yields 200
+  def test_options_on_unrestricted
+    server(itsi_rb: lambda do
+      endpoint "/open" do |req|
+        req.ok "ok"
+      end
+    end) do
+      res = options("/open")
+      assert_equal "200", res.code
+      assert_equal "ok", res.body
+    end
+  end
+
+  # 17. HEAD on streaming endpoint
+  def test_head_on_streaming_endpoint
+    server(itsi_rb: lambda do
+      endpoint "/stream" do |req|
+        s = req.response
+        s << "XYZ"
+        s.close
+      end
+    end) do
+      res = head("/stream")
+      assert_equal "200", res.code
+      assert_empty res.body.to_s
+    end
+  end
+
+  # 18. Wildcard segment matching
+  def test_wildcard_endpoint
+    server(itsi_rb: lambda do
+      endpoint "/api/*" do |req|
+        req.ok req.path
+      end
+    end) do
+      ["/api/foo", "/api/foo/bar", "/api/"].each do |path|
+        res = get_resp(path)
+        assert_equal path, res.body
+      end
+    end
+  end
+
+  # 19. Multiple endpoints same path, different verbs
+  def test_same_path_different_verb
+    server(itsi_rb: lambda do
+      get "/duo" do |req| req.ok "g" end
+      post "/duo" do |req| req.ok "p" end
+    end) do
+      assert_equal "g", get("/duo")
+      assert_equal "p", post("/duo", "").body
+    end
+  end
+end