@contrast/route-coverage 1.20.7 → 1.22.0

package/lib/install/koa.test.js

@@ -0,0 +1,152 @@
+'use strict';
+
+const { expect } = require('chai');
+const sinon = require('sinon');
+const scopes = require('@contrast/scopes');
+const patcher = require('@contrast/patcher');
+const mocks = require('@contrast/test/mocks');
+const { METHODS } = require('../utils/methods');
+
+describe('route-coverage koa', function () {
+  let core, Router, framework, Koa, app, handlerFn;
+
+  beforeEach(function () {
+    core = mocks.core();
+    core.logger = mocks.logger();
+    core.routeCoverage = mocks.routeCoverage();
+    core.scopes = scopes(core);
+    core.depHooks = mocks.depHooks();
+    core.patcher = patcher(core);
+
+    framework = 'koa';
+    Router = function Router() { };
+    Router.router = {
+      stack: []
+    };
+
+    handlerFn = sinon.stub();
+    Router.prototype.use = (path, fn) => Router.router.stack.push({ methods: [], path, stack: [fn] });
+    Router.prototype.get = (path, fn) => Router.router.stack.push({ methods: ['GET'], path, stack: [fn] });
+    Router.prototype.all = (path, fn) => Router.router.stack.push({ methods: METHODS, path, stack: [fn] });
+    Router.prototype.routes = () => Router;
+
+    Koa = function() {};
+    Koa.prototype.use = sinon.stub();
+    core.depHooks.resolve.withArgs({ name: 'koa', version: '>=2.3.0' }).yields(Koa);
+    require('./koa')(core).install();
+  });
+
+  it('does not report when called with nothing', function () {
+    app = new Koa();
+    app.use();
+    expect(core.routeCoverage.discover).not.to.have.been.called;
+  });
+
+  it('does not report when called with non-router', function () {
+    app = new Koa();
+    app.use({ not: 'a router' });
+    expect(core.routeCoverage.discover).not.to.have.been.called;
+  });
+
+  it('does not report unmounted routes', function () {
+    const router = new Router();
+    router.get('/test/route', handlerFn);
+
+    expect(core.routeCoverage.discover).not.to.have.been.called;
+  });
+
+  it('does not report a non-existent route', function () {
+    const router = new Router();
+    router.get();
+
+    app = new Koa();
+    app.use(router.routes());
+    expect(core.routeCoverage.discover).not.to.have.been.called;
+  });
+
+  it('does not report when path is an array', function () {
+    const router = new Router();
+    router.get(['/test/route'], handlerFn);
+
+    app = new Koa();
+    app.use(router.routes());
+    expect(core.routeCoverage.discover).not.to.have.been.called;
+  });
+
+  it('discovers a route', function () {
+    const router = new Router();
+    router.get('/test/route', handlerFn);
+
+    app = new Koa();
+    app.use(router.routes());
+    expect(core.routeCoverage.discover).to.have.been.calledWith({
+      signature: "Router.get('/test/route', [Function])",
+      url: '/test/route',
+      normalizedUrl: '/test/route',
+      method: 'get',
+      framework
+    });
+  });
+
+  it('discovers a .use route', function () {
+    const router = new Router();
+    router.use('/test/route', handlerFn);
+
+    app = new Koa();
+    app.use(router.routes());
+    expect(core.routeCoverage.discover).to.have.been.calledWith({
+      signature: "Router.use('/test/route', [Function])",
+      url: '/test/route',
+      normalizedUrl: '/test/route',
+      method: 'use',
+      framework
+    });
+  });
+
+  it('discovers a .all route', function () {
+    const router = new Router();
+    router.all('/test/route', handlerFn);
+
+    app = new Koa();
+    app.use(router.routes());
+    expect(core.routeCoverage.discover).to.have.been.calledWith({
+      signature: "Router.all('/test/route', [Function])",
+      url: '/test/route',
+      normalizedUrl: '/test/route',
+      method: 'all',
+      framework
+    });
+  });
+
+  it('does not observe a route without a valid request', async function () {
+    const router = new Router();
+    router.get('/test/route', handlerFn);
+
+    app = new Koa();
+    app.use(router.routes());
+
+    Router.router.stack[0].stack[0]({});
+    expect(core.routeCoverage.observe).to.not.have.been.called;
+  });
+
+  it('observes a route when a route handler is exercised', async function () {
+    const router = new Router();
+    router.get('/test/route', handlerFn);
+
+    app = new Koa();
+    app.use(router.routes());
+
+    const request = {
+      url: '/test/route',
+      method: 'get'
+    };
+    Router.router.stack[0].stack[0]({ request });
+    expect(core.routeCoverage.observe).to.have.been.calledWith({
+      signature: "Router.get('/test/route', [Function])",
+      url: '/test/route',
+      normalizedUrl: '/test/route',
+      method: 'get',
+      framework: 'koa'
+    });
+  });
+});

package/lib/install/restify.js

@@ -17,6 +17,7 @@
 const { StringPrototypeToLowerCase, isString } = require('@contrast/common');
 const { createSignature, patchType } = require('../utils/route-info');
 
+// Spec: https://contrast.atlassian.net/wiki/spaces/NOD/pages/3454861621/Node.js+Agent+Route+Signatures#Restify
 module.exports = function init(core) {
   const { patcher, depHooks, routeCoverage } = core;
   const discover = (route) => routeCoverage.discover(route);
@@ -25,7 +26,7 @@ module.exports = function init(core) {
   function createRoute(url, method) {
     method = StringPrototypeToLowerCase.call(method);
     return {
-      signature: createSignature(url, method, 'Server'),
+      signature: createSignature(url, method, 'server'),
       method,
       url,
       normalizedUrl: url,

package/lib/install/restify.test.js

@@ -0,0 +1,92 @@
+'use strict';
+
+const { expect } = require('chai');
+const sinon = require('sinon');
+const scopes = require('@contrast/scopes');
+const patcher = require('@contrast/patcher');
+const mocks = require('@contrast/test/mocks');
+
+describe('route-coverage restify', function () {
+  let core, restify, serverMock, handler, framework;
+
+  beforeEach(function () {
+    core = mocks.core();
+    core.logger = mocks.logger();
+    core.routeCoverage = mocks.routeCoverage();
+    core.scopes = scopes(core);
+    core.depHooks = mocks.depHooks();
+    core.patcher = patcher(core);
+
+    handler = sinon.stub();
+    serverMock = {
+      router: {
+        mount (path, method) {
+          return {
+            path,
+            method,
+            chain: {
+              _stack: [
+                handler
+              ]
+            }
+          };
+        }
+      }
+    };
+
+    framework = 'restify';
+    restify = {
+      createServer: () => serverMock
+    };
+    core.depHooks.resolve.withArgs({ name: 'restify', version: '>= 8.0.0' }).yields(restify);
+    require('./restify')(core).install();
+  });
+
+  it('does not report a non-existent route', function () {
+    const { router } = restify.createServer();
+    router.mount();
+    expect(core.routeCoverage.discover).not.to.have.been.called;
+  });
+
+  it('does not report an incomplete route', function () {
+    const { router } = restify.createServer();
+    router.mount('/foo');
+    expect(core.routeCoverage.discover).not.to.have.been.called;
+  });
+
+  it('does not report an invalid route', function () {
+    const { router } = restify.createServer();
+    router.mount(42, 'GET');
+    expect(core.routeCoverage.discover).not.to.have.been.called;
+  });
+
+  it('discovers a route', function () {
+    const { router } = restify.createServer();
+    router.mount('/foo', 'GET');
+
+    expect(core.routeCoverage.discover).to.have.been.calledWith({
+      signature: "server.get('/foo', [Function])",
+      url: '/foo',
+      normalizedUrl: '/foo',
+      method: 'get',
+      framework
+    });
+  });
+
+  it('observes a route', async function () {
+    const { router } = restify.createServer();
+    const route = router.mount('/foo', 'GET');
+    const handler = route.chain._stack[0];
+    handler({
+      url: '/foo?input=bar',
+      method: 'GET'
+    });
+    expect(core.routeCoverage.observe).to.have.been.calledWith({
+      signature: "server.get('/foo', [Function])",
+      url: '/foo',
+      normalizedUrl: '/foo',
+      method: 'get',
+      framework
+    });
+  });
+});

package/lib/utils/methods.js

@@ -0,0 +1,45 @@
+/*
+ * Copyright: 2024 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+'use strict';
+
+// eslint-disable-next-line node/no-extraneous-require
+const semver = require('semver');
+const { METHODS } = require('http');
+
+function getFastifyMethods(version) {
+  return [
+    'DELETE',
+    'GET',
+    'HEAD',
+    'PATCH',
+    'POST',
+    'PUT',
+    'OPTIONS',
+    ...semver.gte(version, '4.4.0') ?
+        [
+          'PROPFIND',
+          'PROPPATCH',
+          'MKCOL',
+          'COPY',
+          'MOVE',
+          'LOCK',
+          'UNLOCK',
+          'TRACE',
+          'SEARCH'
+        ] : []
+  ];
+}
+
+module.exports = { getFastifyMethods, METHODS };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/route-coverage",
-  "version": "1.20.7",
+  "version": "1.22.0",
   "description": "Handles route discovery and observation",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -17,7 +17,7 @@
     "test": "../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/common": "1.21.3",
+    "@contrast/common": "1.23.0",
     "@contrast/fn-inspect": "^4.0.0"
   }
 }