@bleedingdev/modern-js-runtime-extensions 3.9.0-ultramodern.4 → 3.9.0-ultramodern.6

package/tests/request-policy/client-isolation.test.ts

@@ -0,0 +1,149 @@
+import { createClient as createNativeClient } from '@modern-js/create-request/server';
+import * as context from '@modern-js/runtime-extensions/request-context';
+import * as canonical from '@modern-js/runtime-extensions/request-policy';
+import * as server from '@modern-js/runtime-extensions/request-policy/server';
+
+const options = {
+  path: '/api',
+  method: 'GET',
+  port: 8080,
+  requestId: 'shared-producer',
+};
+
+describe('isolated producer policy clients', () => {
+  test('does not share producer initialization or request configuration between instances', async () => {
+    const first = server.createClient();
+    const second = server.createClient();
+    const firstRequest = rs.fn(async () => new Response('first'));
+    const secondRequest = rs.fn(async () => new Response('second'));
+    first.configure({
+      requestId: options.requestId,
+      request: firstRequest,
+      setDomain: () => 'https://first.example',
+      operationContract: { enabled: false },
+    });
+    expect(() => second.createRequest(options)()).toThrow(
+      server.ProducerClientNotInitializedError,
+    );
+    second.configure({
+      requestId: options.requestId,
+      request: secondRequest,
+      setDomain: () => 'https://second.example',
+      operationContract: { enabled: false },
+    });
+    expect(await (await first.createRequest(options)()).text()).toBe('first');
+    expect(await (await second.createRequest(options)()).text()).toBe('second');
+    expect(firstRequest).toHaveBeenCalledWith(
+      'https://first.example/api',
+      expect.any(Object),
+    );
+    expect(secondRequest).toHaveBeenCalledWith(
+      'https://second.example/api',
+      expect.any(Object),
+    );
+  });
+
+  test('does not initialize producer policy by configuring a separate native client', () => {
+    createNativeClient().configure({
+      requestId: options.requestId,
+      request: rs.fn(),
+    });
+    const producer = server.createClient();
+    expect(() => producer.createRequest(options)()).toThrow(
+      server.ProducerClientNotInitializedError,
+    );
+  });
+
+  test('retains secured behavior for an explicitly empty requestId', () => {
+    const client = server.createClient();
+    const request = rs.fn();
+    client.configure({
+      requestId: '',
+      request,
+      setDomain: () => 'https://producer.example',
+    });
+    expect(() => client.createRequest({ ...options, requestId: '' })()).toThrow(
+      server.OperationContractViolationError,
+    );
+    expect(request).not.toHaveBeenCalled();
+  });
+
+  test('calls setDomain once after interceptor and keeps native and policy state on rejection', async () => {
+    const client = server.createClient();
+    const order: string[] = [];
+    const request = rs.fn(async () => new Response('original'));
+    const setDomain = rs.fn(() => {
+      order.push('domain');
+      return 'https://original.example';
+    });
+    client.configure({
+      requestId: options.requestId,
+      interceptor: () => {
+        order.push('interceptor');
+        return request;
+      },
+      setDomain,
+      requireEnvelope: false,
+      operationContract: { enabled: false },
+    });
+    const replacement = rs.fn();
+    expect(() =>
+      client.configure({
+        requestId: options.requestId,
+        request: replacement,
+        setDomain: () => '',
+      }),
+    ).toThrow(server.ProducerDomainNotConfiguredError);
+    const response = await client.createRequest(options)();
+    expect(await response.text()).toBe('original');
+    expect(order).toEqual(['interceptor', 'domain']);
+    expect(setDomain).toHaveBeenCalledTimes(1);
+    expect(request).toHaveBeenCalledWith(
+      'https://original.example/api',
+      expect.objectContaining({
+        headers: expect.not.objectContaining({
+          'x-modernjs-bff-envelope': expect.anything(),
+        }),
+      }),
+    );
+    expect(replacement).not.toHaveBeenCalled();
+  });
+
+  test('shares source configure across canonical require/import and explicit server', async () => {
+    const required: typeof canonical = require('@modern-js/runtime-extensions/request-policy');
+    expect(required.configure).toBe(canonical.configure);
+    expect(server.configure).toBe(canonical.configure);
+    const request = rs.fn(async () => new Response('shared'));
+    required.configure({
+      requestId: options.requestId,
+      request,
+      setDomain: () => 'https://shared.example',
+      operationContract: { enabled: false },
+    });
+    expect(await (await canonical.createRequest(options)()).text()).toBe(
+      'shared',
+    );
+    canonical.configure({
+      requestId: options.requestId,
+      request,
+      setDomain: () => 'https://updated.example',
+      operationContract: { enabled: false },
+    });
+    await required.createRequest(options)();
+    expect(request).toHaveBeenLastCalledWith(
+      'https://updated.example/api',
+      expect.any(Object),
+    );
+  });
+
+  test('exports universal context helpers without a request client', () => {
+    expect(context.createRequestContextHeaders).toBe(
+      canonical.createRequestContextHeaders,
+    );
+    expect(context.parseTraceparent).toBe(canonical.parseTraceparent);
+    expect(context).not.toHaveProperty('configure');
+    expect(context).not.toHaveProperty('createClient');
+    expect(context).not.toHaveProperty('createRequest');
+    expect(context).not.toHaveProperty('createUploader');
+  });
+});

package/tests/request-policy/identityBinding.test.ts

@@ -0,0 +1,75 @@
+import {
+  configure,
+  createRequest,
+} from '@modern-js/runtime-extensions/request-policy/server';
+import { storage } from '@modern-js/runtime-utils/node';
+import nock from 'nock';
+
+describe('identity binding headers', () => {
+  const path = '/api';
+  const method = 'GET';
+  const response = {
+    code: 200,
+    data: {
+      message: 'hello Modernjs',
+    },
+  };
+
+  const run = (
+    headers: Record<string, string>,
+    callback: () => Promise<void> | void,
+  ) =>
+    storage.run(
+      {
+        headers,
+        monitors: {} as any,
+      },
+      callback,
+    );
+
+  test('should not forward case-variant protected identity headers beside server-derived binding', async () => {
+    const producer = 'producer-identity-case-collision';
+    const producerUrl = 'http://127.0.0.1:9088';
+
+    await run({}, async () => {
+      nock(producerUrl).get(path).reply(200, response);
+      const customRequest = rs.fn((requestPath: any, init: any) =>
+        fetch(requestPath, init),
+      );
+
+      configure({
+        request: customRequest as unknown as typeof fetch,
+        requestId: producer,
+        allowedHeaders: ['X-Tenant-Id'],
+        resolveHeaders: () => ({
+          'X-Tenant-Id': 'tenant-resolved',
+        }),
+        operationContract: {
+          enabled: false,
+        },
+        identityBinding: {
+          deriveHeaders: () => ({
+            'x-tenant-id': 'tenant-bound',
+          }),
+          strict: false,
+        },
+        setDomain: () => producerUrl,
+      });
+
+      const request = createRequest(
+        path,
+        method,
+        8080,
+        undefined,
+        undefined,
+        producer,
+      );
+
+      await request();
+      const headers = customRequest.mock.calls[0]?.[1]?.headers;
+
+      expect(headers['X-Tenant-Id']).toBeUndefined();
+      expect(headers['x-tenant-id']).toBe('tenant-resolved');
+    });
+  });
+});