wsv 0.8.0 → 0.10.0

data/lib/wsv/tls_context/resolver.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+require "openssl"
+
+module Wsv
+  class TlsContext
+    class Resolver
+      XDG_DIR = "wsv"
+      CERT_FILE = "cert.pem"
+      KEY_FILE = "key.pem"
+
+      def self.resolve(cert_path: nil, key_path: nil)
+        new(cert_path: cert_path, key_path: key_path).resolve
+      end
+
+      def initialize(cert_path: nil, key_path: nil)
+        @cert_path = cert_path
+        @key_path = key_path
+      end
+
+      def resolve
+        return from_files(@cert_path, @key_path) if @cert_path && @key_path
+
+        raise ArgumentError, "--cert and --key must be provided together" if @cert_path || @key_path
+
+        xdg = xdg_pair
+        return from_files(*xdg) if xdg
+
+        ephemeral
+      end
+
+      private
+
+      def from_files(cert_path, key_path)
+        cert = OpenSSL::X509::Certificate.new(File.read(cert_path))
+        key = OpenSSL::PKey.read(File.read(key_path))
+        raise ArgumentError, "key file at #{key_path} does not contain a private key" unless key.private?
+        unless cert.check_private_key(key)
+          raise ArgumentError,
+                "TLS certificate at #{cert_path} does not match the key at #{key_path}"
+        end
+
+        TlsContext.new(cert: cert, key: key)
+      end
+
+      def ephemeral
+        key = OpenSSL::PKey::RSA.new(2048)
+        cert = SelfSignedCert.build(key)
+        TlsContext.new(cert: cert, key: key, ephemeral: true)
+      end
+
+      def xdg_pair
+        cert = File.join(xdg_base, XDG_DIR, CERT_FILE)
+        key  = File.join(xdg_base, XDG_DIR, KEY_FILE)
+        cert_exists = File.exist?(cert)
+        key_exists  = File.exist?(key)
+        return [cert, key] if cert_exists && key_exists
+
+        if cert_exists ^ key_exists
+          raise ArgumentError, "found only one of #{cert} / #{key} -- both must exist or neither"
+        end
+
+        nil
+      end
+
+      def xdg_base
+        ENV["XDG_CONFIG_HOME"] || File.join(Dir.home, ".config")
+      end
+    end
+  end
+end

data/lib/wsv/tls_context/self_signed_cert.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+require "openssl"
+require "securerandom"
+
+module Wsv
+  class TlsContext
+    class SelfSignedCert
+      SUBJECT = "/CN=localhost"
+      SAN = "DNS:localhost,IP:127.0.0.1,IP:::1"
+      VALIDITY_SECONDS = 365 * 24 * 60 * 60
+
+      def self.build(key)
+        new(key).build
+      end
+
+      def initialize(key)
+        @key = key
+      end
+
+      def build
+        cert = OpenSSL::X509::Certificate.new
+        cert.version = 2
+        cert.serial = SecureRandom.random_number((2**63) - 1) + 1
+        cert.subject = OpenSSL::X509::Name.parse(SUBJECT)
+        cert.issuer = cert.subject
+        cert.public_key = @key.public_key
+        cert.not_before = Time.now - 60
+        cert.not_after = Time.now + VALIDITY_SECONDS
+        ef = OpenSSL::X509::ExtensionFactory.new(cert, cert)
+        cert.add_extension(ef.create_extension("subjectAltName", SAN))
+        cert.add_extension(ef.create_extension("basicConstraints", "CA:FALSE", true))
+        cert.sign(@key, OpenSSL::Digest.new("SHA256"))
+        cert
+      end
+    end
+  end
+end

data/lib/wsv/tls_context.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+require "openssl"
+require_relative "tls_context/self_signed_cert"
+require_relative "tls_context/resolver"
+
+module Wsv
+  class TlsContext
+    attr_reader :cert, :key
+
+    def initialize(cert:, key:, ephemeral: false)
+      @cert = cert
+      @key = key
+      @ephemeral = ephemeral
+    end
+
+    def ephemeral?
+      @ephemeral
+    end
+
+    def to_ssl_context
+      ctx = OpenSSL::SSL::SSLContext.new
+      ctx.cert = @cert
+      ctx.key = @key
+      ctx.min_version = OpenSSL::SSL::TLS1_2_VERSION
+      ctx
+    end
+  end
+end

data/lib/wsv/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Wsv
-  VERSION = "0.8.0"
+  VERSION = "0.10.0"
 end

data/lib/wsv.rb

@@ -6,7 +6,9 @@ require_relative "wsv/mime_types"
 require_relative "wsv/path_resolver"
 require_relative "wsv/request"
 require_relative "wsv/response"
+require_relative "wsv/cors"
 require_relative "wsv/app"
+require_relative "wsv/tls_context"
 require_relative "wsv/server"
 require_relative "wsv/cli"
 

data/test/app_test.rb

@@ -60,6 +60,16 @@ class AppTest < Minitest::Test
     assert_equal "/docs/?q=1", response.headers["Location"]
   end
 
+  def test_redirect_normalizes_absolute_form_target_to_origin_form
+    FileUtils.mkdir_p(File.join(@dir, "docs"))
+    File.write(File.join(@dir, "docs", "index.html"), "x")
+
+    response = @app.call(req("GET", "http://example.test/docs"))
+
+    assert_equal 301, response.status
+    assert_equal "/docs/", response.headers["Location"]
+  end
+
   def test_head_omits_body_but_keeps_content_length
     File.write(File.join(@dir, "x.txt"), "hi")
 
@@ -69,9 +79,353 @@ class AppTest < Minitest::Test
     assert_equal "2", response.headers["Content-Length"]
   end
 
+  def test_advertises_accept_ranges_on_200
+    File.write(File.join(@dir, "x.txt"), "hi")
+
+    response = @app.call(req("GET", "/x.txt"))
+
+    assert_equal "bytes", response.headers["Accept-Ranges"]
+  end
+
+  def test_returns_304_when_if_modified_since_matches
+    path = File.join(@dir, "x.txt")
+    File.write(path, "hi")
+
+    response = @app.call(req("GET", "/x.txt", "if-modified-since" => File.mtime(path).httpdate))
+
+    assert_equal 304, response.status
+    assert_equal "", response.body
+    refute response.headers.key?("Content-Length")
+  end
+
+  def test_returns_200_when_if_modified_since_is_older
+    path = File.join(@dir, "x.txt")
+    File.write(path, "hi")
+    older = (File.mtime(path) - 3600).httpdate
+
+    response = @app.call(req("GET", "/x.txt", "if-modified-since" => older))
+
+    assert_equal 200, response.status
+    assert_equal "hi", response.body
+  end
+
+  def test_invalid_if_modified_since_is_ignored
+    File.write(File.join(@dir, "x.txt"), "hi")
+
+    response = @app.call(req("GET", "/x.txt", "if-modified-since" => "not a date"))
+
+    assert_equal 200, response.status
+  end
+
+  def test_serves_byte_range
+    File.write(File.join(@dir, "data.bin"), "abcdefghij")
+
+    response = @app.call(req("GET", "/data.bin", "range" => "bytes=2-5"))
+
+    assert_equal 206, response.status
+    assert_equal "cdef", response.body
+    assert_equal "4", response.headers["Content-Length"]
+    assert_equal "bytes 2-5/10", response.headers["Content-Range"]
+  end
+
+  def test_serves_open_ended_range
+    File.write(File.join(@dir, "data.bin"), "abcdefghij")
+
+    response = @app.call(req("GET", "/data.bin", "range" => "bytes=7-"))
+
+    assert_equal 206, response.status
+    assert_equal "hij", response.body
+    assert_equal "bytes 7-9/10", response.headers["Content-Range"]
+  end
+
+  def test_serves_suffix_range
+    File.write(File.join(@dir, "data.bin"), "abcdefghij")
+
+    response = @app.call(req("GET", "/data.bin", "range" => "bytes=-3"))
+
+    assert_equal 206, response.status
+    assert_equal "hij", response.body
+    assert_equal "bytes 7-9/10", response.headers["Content-Range"]
+  end
+
+  def test_clamps_range_end_to_file_size
+    File.write(File.join(@dir, "data.bin"), "abcdefghij")
+
+    response = @app.call(req("GET", "/data.bin", "range" => "bytes=5-99"))
+
+    assert_equal 206, response.status
+    assert_equal "fghij", response.body
+    assert_equal "bytes 5-9/10", response.headers["Content-Range"]
+  end
+
+  def test_unsatisfiable_range_returns_416
+    File.write(File.join(@dir, "data.bin"), "abc")
+
+    response = @app.call(req("GET", "/data.bin", "range" => "bytes=10-20"))
+
+    assert_equal 416, response.status
+    assert_equal "bytes */3", response.headers["Content-Range"]
+  end
+
+  def test_invalid_range_syntax_serves_full_content
+    File.write(File.join(@dir, "data.bin"), "abc")
+
+    response = @app.call(req("GET", "/data.bin", "range" => "bytes=garbage"))
+
+    assert_equal 200, response.status
+    assert_equal "abc", response.body
+  end
+
+  def test_head_with_range_omits_body_but_keeps_headers
+    File.write(File.join(@dir, "data.bin"), "abcdefghij")
+
+    response = @app.call(req("HEAD", "/data.bin", "range" => "bytes=0-2"))
+
+    assert_equal 206, response.status
+    assert_equal "", response.body
+    assert_equal "3", response.headers["Content-Length"]
+  end
+
+  def test_spa_fallback_serves_index_for_missing_path
+    File.write(File.join(@dir, "index.html"), "<h1>SPA</h1>")
+    spa_app = Wsv::App.new(File.realpath(@dir), spa: true)
+
+    response = spa_app.call(req("GET", "/users/123"))
+
+    assert_equal 200, response.status
+    assert_equal "<h1>SPA</h1>", response.body
+    assert_equal "text/html; charset=utf-8", response.headers["Content-Type"]
+  end
+
+  def test_spa_fallback_head_serves_index_headers_without_body
+    File.write(File.join(@dir, "index.html"), "<h1>SPA</h1>")
+    spa_app = Wsv::App.new(File.realpath(@dir), spa: true)
+
+    response = spa_app.call(req("HEAD", "/users/123"))
+
+    assert_equal 200, response.status
+    assert_equal "", response.body
+    assert_equal "text/html; charset=utf-8", response.headers["Content-Type"]
+    assert_equal "12", response.headers["Content-Length"]
+  end
+
+  def test_spa_disabled_returns_404_for_missing_path
+    File.write(File.join(@dir, "index.html"), "<h1>SPA</h1>")
+
+    response = @app.call(req("GET", "/users/123"))
+
+    assert_equal 404, response.status
+  end
+
+  def test_spa_keeps_403_for_dotfile
+    File.write(File.join(@dir, "index.html"), "<h1>SPA</h1>")
+    File.write(File.join(@dir, ".env"), "secret")
+    spa_app = Wsv::App.new(File.realpath(@dir), spa: true)
+
+    response = spa_app.call(req("GET", "/.env"))
+
+    assert_equal 403, response.status
+  end
+
+  def test_spa_keeps_403_for_path_traversal
+    File.write(File.join(@dir, "index.html"), "<h1>SPA</h1>")
+    spa_app = Wsv::App.new(File.realpath(@dir), spa: true)
+
+    response = spa_app.call(req("GET", "/../etc/passwd"))
+
+    assert_equal 403, response.status
+  end
+
+  def test_spa_returns_404_when_no_index_html
+    spa_app = Wsv::App.new(File.realpath(@dir), spa: true)
+
+    response = spa_app.call(req("GET", "/users/123"))
+
+    assert_equal 404, response.status
+  end
+
+  def test_spa_serves_real_file_when_path_matches
+    File.write(File.join(@dir, "index.html"), "<h1>SPA</h1>")
+    File.write(File.join(@dir, "robots.txt"), "User-agent: *")
+    spa_app = Wsv::App.new(File.realpath(@dir), spa: true)
+
+    response = spa_app.call(req("GET", "/robots.txt"))
+
+    assert_equal 200, response.status
+    assert_equal "User-agent: *", response.body
+  end
+
+  def test_custom_404_page_when_404_html_exists
+    File.write(File.join(@dir, "404.html"), "<h1>not found</h1>")
+
+    response = @app.call(req("GET", "/missing.txt"))
+
+    assert_equal 404, response.status
+    assert_equal "<h1>not found</h1>", response.body
+    assert_equal "text/html; charset=utf-8", response.headers["Content-Type"]
+  end
+
+  def test_no_custom_404_falls_back_to_plain_text
+    response = @app.call(req("GET", "/missing.txt"))
+
+    assert_equal 404, response.status
+    assert_includes response.body, "404 Not Found"
+    assert_equal "text/plain; charset=utf-8", response.headers["Content-Type"]
+  end
+
+  def test_custom_404_does_not_apply_to_403
+    File.write(File.join(@dir, "404.html"), "<h1>not found</h1>")
+    File.write(File.join(@dir, ".env"), "secret")
+
+    response = @app.call(req("GET", "/.env"))
+
+    assert_equal 403, response.status
+    refute_includes response.body, "<h1>not found</h1>"
+  end
+
+  def test_spa_mode_takes_precedence_over_custom_404
+    File.write(File.join(@dir, "index.html"), "<h1>SPA</h1>")
+    File.write(File.join(@dir, "404.html"), "<h1>not found</h1>")
+    spa_app = Wsv::App.new(File.realpath(@dir), spa: true)
+
+    response = spa_app.call(req("GET", "/users/123"))
+
+    assert_equal 200, response.status
+    assert_equal "<h1>SPA</h1>", response.body
+  end
+
+  def test_custom_404_works_with_head
+    File.write(File.join(@dir, "404.html"), "<h1>not found</h1>")
+
+    response = @app.call(req("HEAD", "/missing.txt"))
+
+    assert_equal 404, response.status
+    assert_equal "", response.body
+    assert_equal "text/html; charset=utf-8", response.headers["Content-Type"]
+  end
+
+  def test_serves_single_byte_range
+    File.write(File.join(@dir, "data.bin"), "abcdefghij")
+
+    response = @app.call(req("GET", "/data.bin", "range" => "bytes=0-0"))
+
+    assert_equal 206, response.status
+    assert_equal "a", response.body
+    assert_equal "1", response.headers["Content-Length"]
+    assert_equal "bytes 0-0/10", response.headers["Content-Range"]
+  end
+
+  def test_inverted_range_returns_416
+    File.write(File.join(@dir, "data.bin"), "abcdefghij")
+
+    response = @app.call(req("GET", "/data.bin", "range" => "bytes=5-3"))
+
+    assert_equal 416, response.status
+    assert_equal "bytes */10", response.headers["Content-Range"]
+  end
+
+  def test_206_preserves_caching_headers
+    path = File.join(@dir, "data.bin")
+    File.write(path, "abcdefghij")
+
+    response = @app.call(req("GET", "/data.bin", "range" => "bytes=2-5"))
+
+    assert_equal 206, response.status
+    assert_equal Wsv::MimeTypes.for_file("data.bin"), response.headers["Content-Type"]
+    assert_equal File.mtime(path).httpdate, response.headers["Last-Modified"]
+    assert_equal "no-cache", response.headers["Cache-Control"]
+    assert_equal "bytes", response.headers["Accept-Ranges"]
+  end
+
+  def test_cors_disabled_omits_acao_header
+    File.write(File.join(@dir, "x.txt"), "hi")
+
+    response = @app.call(req("GET", "/x.txt"))
+
+    refute response.headers.key?("Access-Control-Allow-Origin")
+  end
+
+  def test_cors_adds_acao_to_successful_response
+    File.write(File.join(@dir, "x.txt"), "hi")
+    cors_app = Wsv::App.new(File.realpath(@dir), cors: true)
+
+    response = cors_app.call(req("GET", "/x.txt"))
+
+    assert_equal 200, response.status
+    assert_equal "hi", response.body
+    assert_equal "*", response.headers["Access-Control-Allow-Origin"]
+    assert_equal "Origin", response.headers["Vary"]
+  end
+
+  def test_cors_adds_acao_to_error_response
+    cors_app = Wsv::App.new(File.realpath(@dir), cors: true)
+
+    response = cors_app.call(req("GET", "/missing.txt"))
+
+    assert_equal 404, response.status
+    assert_equal "*", response.headers["Access-Control-Allow-Origin"]
+  end
+
+  def test_cors_preflight_returns_204_with_methods_and_max_age
+    cors_app = Wsv::App.new(File.realpath(@dir), cors: true)
+
+    response = cors_app.call(req("OPTIONS", "/x.txt"))
+
+    assert_equal 204, response.status
+    assert_equal "*", response.headers["Access-Control-Allow-Origin"]
+    assert_equal "GET, HEAD, OPTIONS", response.headers["Access-Control-Allow-Methods"]
+    assert_equal "86400", response.headers["Access-Control-Max-Age"]
+    assert_equal "Origin", response.headers["Vary"]
+    assert_equal "", response.body
+  end
+
+  def test_cors_preflight_echoes_requested_headers
+    cors_app = Wsv::App.new(File.realpath(@dir), cors: true)
+
+    response = cors_app.call(req("OPTIONS", "/x.txt", "access-control-request-headers" => "X-Custom, Authorization"))
+
+    assert_equal 204, response.status
+    assert_equal "X-Custom, Authorization", response.headers["Access-Control-Allow-Headers"]
+  end
+
+  def test_cors_preflight_omits_allow_headers_when_not_requested
+    cors_app = Wsv::App.new(File.realpath(@dir), cors: true)
+
+    response = cors_app.call(req("OPTIONS", "/x.txt"))
+
+    refute response.headers.key?("Access-Control-Allow-Headers")
+  end
+
+  def test_options_without_cors_returns_405
+    response = @app.call(req("OPTIONS", "/x.txt"))
+
+    assert_equal 405, response.status
+    assert_equal "GET, HEAD", response.headers["Allow"]
+  end
+
+  def test_cors_405_advertises_options_in_allow
+    cors_app = Wsv::App.new(File.realpath(@dir), cors: true)
+
+    response = cors_app.call(req("POST", "/x.txt"))
+
+    assert_equal 405, response.status
+    assert_equal "GET, HEAD, OPTIONS", response.headers["Allow"]
+    assert_equal "*", response.headers["Access-Control-Allow-Origin"]
+  end
+
+  def test_multipart_range_falls_through_to_200
+    File.write(File.join(@dir, "data.bin"), "abcdefghij")
+
+    response = @app.call(req("GET", "/data.bin", "range" => "bytes=0-2,5-7"))
+
+    assert_equal 200, response.status
+    assert_equal "abcdefghij", response.body
+    refute response.headers.key?("Content-Range")
+  end
+
   private
 
-  def req(method, target)
-    Wsv::Request.new(method: method, target: target, version: "HTTP/1.1", headers: {})
+  def req(method, target, headers = {})
+    Wsv::Request.new(method: method, target: target, version: "HTTP/1.1", headers: headers)
   end
 end

data/test/browser_launcher_test.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+require_relative "test_helper"
+
+class BrowserLauncherTest < Minitest::Test
+  def test_loopback_host_used_directly
+    launcher = build(host: "127.0.0.1")
+
+    assert_equal "http://127.0.0.1:8000/", launcher.send(:url)
+  end
+
+  def test_wildcard_v4_translated_to_loopback
+    launcher = build(host: "0.0.0.0")
+
+    assert_equal "http://127.0.0.1:8000/", launcher.send(:url)
+  end
+
+  def test_wildcard_v6_translated_to_loopback
+    launcher = build(host: "::")
+
+    assert_equal "http://[::1]:8000/", launcher.send(:url)
+  end
+
+  def test_ipv6_literal_host_is_bracketed
+    launcher = build(host: "::1")
+
+    assert_equal "http://[::1]:8000/", launcher.send(:url)
+  end
+
+  def test_specific_host_passes_through
+    launcher = build(host: "192.168.1.5")
+
+    assert_equal "http://192.168.1.5:8000/", launcher.send(:url)
+  end
+
+  def test_https_scheme_when_tls_present
+    launcher = build(host: "127.0.0.1", tls: Object.new)
+
+    assert_equal "https://127.0.0.1:8000/", launcher.send(:url)
+  end
+
+  def test_logs_when_platform_unsupported
+    err = StringIO.new
+    launcher = build(host: "127.0.0.1", err: err)
+    launcher.define_singleton_method(:platform_command) { nil }
+
+    launcher.launch
+
+    assert_includes err.string, "not supported on this platform"
+  end
+
+  private
+
+  def build(host:, tls: nil, err: StringIO.new)
+    Wsv::Server::BrowserLauncher.new(host: host, port: 8000, tls: tls, err: err)
+  end
+end

data/test/cli_test.rb

@@ -42,6 +42,8 @@ class CLITest < Minitest::Test
     assert_equal 0, code
     assert_includes out.string, "Usage: wsv"
     assert_includes out.string, "--host HOST"
+    assert_includes out.string, "Examples:"
+    assert_includes out.string, "wsv _site"
   end
 
   def test_version
@@ -68,4 +70,66 @@ class CLITest < Minitest::Test
     assert_equal 1, code
     assert_includes err.string, "directory does not exist"
   end
+
+  def test_tls_flag_parses
+    Dir.mktmpdir do |dir|
+      options = Wsv::CLI.new([]).parse_options(["--tls", dir])
+
+      assert options[:tls]
+    end
+  end
+
+  def test_cert_without_key_errors
+    err = StringIO.new
+    Dir.mktmpdir do |dir|
+      code = Wsv::CLI.new(["--cert", "/nonexistent/cert.pem", dir], err: err).run
+
+      assert_equal 1, code
+      assert_includes err.string, "must be provided together"
+    end
+  end
+
+  def test_cert_and_key_parses
+    Dir.mktmpdir do |dir|
+      options = Wsv::CLI.new([]).parse_options(["--cert", "a.pem", "--key", "b.pem", dir])
+
+      assert_equal "a.pem", options[:cert]
+      assert_equal "b.pem", options[:key]
+    end
+  end
+
+  def test_spa_flag_parses
+    Dir.mktmpdir do |dir|
+      options = Wsv::CLI.new([]).parse_options(["--spa", dir])
+
+      assert options[:spa]
+      assert_equal dir, options[:directory]
+    end
+  end
+
+  def test_cors_flag_parses
+    Dir.mktmpdir do |dir|
+      options = Wsv::CLI.new([]).parse_options(["--cors", dir])
+
+      assert options[:cors]
+      assert_equal dir, options[:directory]
+    end
+  end
+
+  def test_cors_default_off
+    Dir.mktmpdir do |dir|
+      options = Wsv::CLI.new([]).parse_options([dir])
+
+      refute options[:cors]
+    end
+  end
+
+  def test_open_flag_parses
+    Dir.mktmpdir do |dir|
+      options = Wsv::CLI.new([]).parse_options(["--open", dir])
+
+      assert options[:open]
+      assert_equal dir, options[:directory]
+    end
+  end
 end