@contrast/route-coverage 1.21.0 → 1.22.0

package/lib/index.test.js

@@ -0,0 +1,129 @@
+'use strict';
+
+const { expect } = require('chai');
+const sinon = require('sinon');
+const proxyquire = require('proxyquire');
+const { Event } = require('@contrast/common');
+const mocks = require('@contrast/test/mocks');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+const { installsComponents } = require('@contrast/test/utils');
+
+const MODULES = ['express', 'fastify', 'hapi', 'koa'];
+
+describe('route coverage', function () {
+  let core, simulateRequestScope, routeCoverage;
+
+  beforeEach(function () {
+    ({ core, simulateRequestScope } = initAssessFixture());
+
+    sinon.spy(core.messages, 'emit');
+
+    const moduleMock = (moduleName) => (deps) => {
+      deps.routeCoverage[moduleName] = mocks.installable();
+    };
+
+    routeCoverage = proxyquire('.', {
+      './install/express': moduleMock('express'),
+      './install/fastify': moduleMock('fastify'),
+      './install/hapi': moduleMock('hapi'),
+      './install/koa': moduleMock('koa'),
+    });
+  });
+
+  it('installs its components', function () {
+    routeCoverage(core).install();
+    installsComponents(core.routeCoverage, MODULES);
+  });
+
+  it('does not install when not enabled', function () {
+    core.config.agent.route_coverage.enable = false;
+    routeCoverage(core);
+    expect(core).not.to.have.property('routeCoverage');
+  });
+
+  describe('.discoveryFinished()', function () {
+    beforeEach(function () {
+      routeCoverage(core).install();
+    });
+
+    it('emits an event when discovery is finished', function () {
+      const eventA = { signature: 'hello', url: 'url', method: 'get' };
+      const eventB = { signature: 'hello', url: 'url', method: 'post' };
+      core.routeCoverage.discover(eventA);
+      core.routeCoverage.discover(eventA); // check that we dedupe discovery.
+      core.routeCoverage.discover(eventB);
+      core.routeCoverage.discoveryFinished();
+
+      expect(core.messages.emit).to.have.been.calledWith(
+        Event.ROUTE_COVERAGE_DISCOVERY_FINISHED,
+        [eventA, eventB],
+      );
+    });
+  });
+
+  describe('.observe()', function () {
+    beforeEach(function () {
+      routeCoverage(core).install();
+    });
+
+    it('logs debug messages when a route is missing on observation', function () {
+      const info = { url: 'url', method: 'get' };
+      core.routeCoverage.observe(info);
+      expect(core.logger.debug).to.have.been.calledOnceWithExactly(
+        info,
+        'unable to observe undiscovered route',
+      );
+    });
+
+    it('emits an event on route observation', function () {
+      const event = {
+        signature: 'hello',
+        url: 'url',
+        method: 'get',
+        sourceInfo: undefined
+      };
+      core.routeCoverage.discover(event);
+      core.routeCoverage.observe({ url: 'url', method: 'get' });
+
+      expect(core.messages.emit).to.have.been.calledWith(
+        Event.ROUTE_COVERAGE_OBSERVATION,
+        event,
+      );
+    });
+
+    it('emits an event on route observation and appends sourceInfo when in request scope', function () {
+      const event = {
+        signature: 'hello',
+        url: 'url',
+        method: 'get',
+      };
+      core.routeCoverage.discover(event);
+
+      simulateRequestScope(() => {
+        core.routeCoverage.observe({ url: 'url', method: 'get' });
+        const { sourceInfo, route } = core.scopes.sources.getStore();
+        expect(sourceInfo).to.be.ok;
+        expect(route).to.eql({ method: 'get', signature: 'hello', url: 'url' });
+        expect(core.messages.emit).to.have.been.calledWith(
+          Event.ROUTE_COVERAGE_OBSERVATION,
+          sinon.match({ ...event, sourceInfo })
+        );
+      });
+    });
+
+    it('skip adding normalizedUrl if assess store does not exist', function () {
+      const event = {
+        signature: 'hello',
+        url: 'url',
+        method: 'get',
+      };
+      core.routeCoverage.discover(event);
+
+      simulateRequestScope(() => {
+        core.routeCoverage.observe({ url: 'url', method: 'get' });
+        const store = core.scopes.sources.getStore();
+        expect(store.assess).to.be.undefined;
+      }, {});
+    });
+  });
+});

package/lib/install/express.test.js

@@ -0,0 +1,418 @@
+'use strict';
+
+const { expect } = require('chai');
+const sinon = require('sinon');
+const scopes = require('@contrast/scopes');
+const patcher = require('@contrast/patcher');
+const mocks = require('@contrast/test/mocks');
+
+const METHODS = [
+  'all',
+  'get',
+  'post',
+  'put',
+  'delete',
+  'patch',
+  'options',
+  'head',
+];
+
+describe('route-coverage express', function () {
+  let core, http, Server, application, Router, Layer, express, fn, framework;
+
+  beforeEach(function () {
+    core = mocks.core();
+    core.logger = mocks.logger();
+    core.routeCoverage = mocks.routeCoverage();
+    core.scopes = scopes(core);
+    core.depHooks = mocks.depHooks();
+    core.patcher = patcher(core);
+
+    application = () => application;
+    Router = () => Router;
+    Layer = () => Layer;
+    Layer.handle = sinon.stub();
+
+    express = () => application;
+    framework = 'express';
+
+    Router.stack = [];
+    Router.handle = sinon.stub();
+    Router.use = (prefix, router) => {
+      Router.stack.push({ handle: router, name: 'router', regexp: { source: `\\${prefix}` } });
+    };
+
+    express.application = application;
+    express.application.use = (prefix, router) => {
+      if (router?.use) router.use(prefix, router);
+      return { _router: Router };
+    };
+    express.application._router = Router;
+    express.Router = Router;
+
+    METHODS.forEach((method) => {
+      application[method] = () => {
+        Router.stack.push(Layer);
+        return { _router: Router };
+      };
+      Router[method] = (path, fn) => {
+        Layer.regexp = { source: `\\${path}` };
+        Layer.route = {
+          path,
+          stack: [
+            {
+              method
+            }
+          ],
+          methods: {
+            _all: false
+          }
+        };
+        if (fn) Router.stack.push(Layer);
+        return Router;
+      };
+    });
+    Server = function () { };
+    Server.prototype.listen = sinon.stub();
+    http = {
+      Server,
+      createServer() {
+        return new Server();
+      }
+    };
+
+    fn = sinon.stub();
+
+    core.depHooks.resolve.withArgs({ name: 'express' }).yields(express);
+    core.depHooks.resolve.withArgs({ name: 'http' }).yields(http);
+
+    require('./express')(core).install();
+  });
+
+  describe('app', function () {
+    METHODS.forEach((method) => {
+      describe(`${method}`, function () {
+        it('does not report a non-existent route', function () {
+          const app = express();
+          app[method]();
+          expect(core.routeCoverage.discover).not.to.have.been.called;
+        });
+
+        it('does not report an invalid route', function () {
+          const app = express();
+          app[method](42);
+          expect(core.routeCoverage.discover).not.to.have.been.called;
+        });
+
+        it('does not report a route missing a method', function () {
+          const app = express();
+          app[method]('/test/route');
+          expect(core.routeCoverage.discover).not.to.have.been.called;
+        });
+
+        it('discovers a route', function () {
+          const app = express();
+          app[method]('/test/route', fn);
+
+          expect(core.routeCoverage.discover).to.have.been.calledWith({
+            signature: `App.${method}('/test/route', [Function])`,
+            url: '/test/route',
+            normalizedUrl: '/test/route',
+            method,
+            framework
+          });
+        });
+
+        it('discovers an array route', function () {
+          const app = express();
+          app[method](['/test/foo', '/test/bar'], fn);
+
+          expect(core.routeCoverage.discover).to.have.been.calledWith({
+            signature: `App.${method}('/[/test/foo,/test/bar]', [Function])`,
+            url: '/[/test/foo,/test/bar]',
+            normalizedUrl: '/[/test/foo,/test/bar]',
+            method,
+            framework
+          });
+        });
+
+        it('discovers a regEx route', function () {
+          const app = express();
+          app[method](/f*o/, fn);
+
+          expect(core.routeCoverage.discover).to.have.been.calledWith({
+            signature: `App.${method}('/{f*o}', [Function])`,
+            url: '/{f*o}',
+            normalizedUrl: '/{f*o}',
+            method,
+            framework
+          });
+        });
+      });
+    });
+
+    it('does not discover and App.use route with no path and no router', function () {
+      const app = express();
+      app.use(fn);
+      expect(core.routeCoverage.discover).not.have.been.called;
+    });
+
+    it('discovers an App.use route', function () {
+      const app = express();
+      app.use('/foo', fn);
+
+      expect(core.routeCoverage.discover).to.have.been.calledWith({
+        signature: 'App.use(\'/foo\', [Function])',
+        url: '/foo',
+        normalizedUrl: '/foo',
+        method: 'use',
+        framework
+      });
+    });
+
+    it('discovers an App.use route with a non-string url', function () {
+      const app = express();
+      app.use(['/foo'], fn);
+
+      expect(core.routeCoverage.discover).to.have.been.calledWith({
+        signature: 'App.use(\'/[/foo]\', [Function])',
+        url: '/[/foo]',
+        normalizedUrl: '/[/foo]',
+        method: 'use',
+        framework
+      });
+    });
+
+    it('discovers a route with middleware defined in an array', function() {
+      const app = express();
+      app.use('/foo', [fn]);
+
+      expect(core.routeCoverage.discover).to.have.been.calledWith({
+        signature: 'App.use(\'/foo\', [Function])',
+        url: '/foo',
+        normalizedUrl: '/foo',
+        method: 'use',
+        framework
+      });
+    });
+
+    it('does not observe a route with an undefined method', function () {
+      const app = express();
+      app.get('/path/to/foo', fn);
+
+      express.Router.handle({
+        originalUrl: '/path/to/foo',
+        route: { path: '/path/to/foo' }
+      });
+      expect(core.routeCoverage.observe).to.not.have.been.called;
+    });
+
+    it('observes a route when a route handler is exercised', function () {
+      const app = express();
+      app.get('/path/to/foo', fn);
+
+      express.Router.stack[0].handle({
+        method: 'GET',
+        originalUrl: '/path/to/foo',
+        route: { path: '/path/to/foo' }
+      });
+      expect(core.routeCoverage.observe).to.have.been.calledWith({
+        signature: "App.get('/path/to/foo', [Function])",
+        url: '/path/to/foo',
+        normalizedUrl: '/path/to/foo',
+        method: 'get',
+        framework
+      });
+    });
+
+    it('observes a route with a regExp path', function () {
+      const app = express();
+      app.get(/.*/, fn);
+
+      express.Router.stack[0].handle({
+        method: 'GET',
+        originalUrl: '/path',
+        route: { path: /.*/ }
+      });
+      expect(core.routeCoverage.observe).to.have.been.calledWith({
+        signature: "App.get('/{.*}', [Function])",
+        url: '/path',
+        normalizedUrl: '/{.*}',
+        method: 'get',
+        framework
+      });
+    });
+
+    it('observes a route with an Array path', function () {
+      const app = express();
+      app.get(['/test/foo', '/test/bar'], fn);
+
+      express.Router.stack[0].handle({
+        method: 'GET',
+        originalUrl: '/[/test/foo,/test/bar]',
+        route: { path: ['/test/foo', '/test/bar'] }
+      });
+      expect(core.routeCoverage.observe).to.have.been.calledWith({
+        signature: "App.get('/[/test/foo,/test/bar]', [Function])",
+        url: '/[/test/foo,/test/bar]',
+        normalizedUrl: '/[/test/foo,/test/bar]',
+        method: 'get',
+        framework
+      });
+    });
+
+    it('updates route prefixes', function () {
+      const app = express();
+      const router = express.Router();
+      router.get('/foo', fn);
+      app.use('/prefix', router);
+      expect(core.routeCoverage.discover).to.have.been.calledWith({
+        signature: "Router.get('/prefix/foo', [Function])",
+        url: '/prefix/foo',
+        normalizedUrl: '/prefix/foo',
+        method: 'get',
+        framework
+      });
+    });
+  });
+
+  describe('router', function () {
+    METHODS.forEach((method) => {
+      describe(`${method}`, function () {
+        it('does not report a non-existent route', function () {
+          const app = express();
+          const router = express.Router();
+          router[method]();
+          app.use(router);
+          expect(core.routeCoverage.discover).not.to.have.been.called;
+        });
+
+        it('does not report an invalid route', function () {
+          const app = express();
+          const router = express.Router();
+          router[method](42);
+          app.use(router);
+          expect(core.routeCoverage.discover).not.to.have.been.called;
+        });
+
+        it('does not report a route missing a handler', function () {
+          const app = express();
+          const router = express.Router();
+          router[method]('/test/route');
+          app.use(router);
+          expect(core.routeCoverage.discover).not.to.have.been.called;
+        });
+
+        it('discovers a route', function () {
+          const app = express();
+          const router = express.Router();
+          router[method]('/test/route', fn);
+          app.use(router);
+
+          expect(core.routeCoverage.discover).to.have.been.calledWith({
+            signature: `Router.${method}('/test/route', [Function])`,
+            url: '/test/route',
+            normalizedUrl: '/test/route',
+            method,
+            framework
+          });
+        });
+
+        it('discovers an array route', function () {
+          const app = express();
+          const router = express.Router();
+          router[method](['/test/foo', '/test/bar'], fn);
+          app.use(router);
+
+          expect(core.routeCoverage.discover).to.have.been.calledWith({
+            signature: `Router.${method}('/[/test/foo,/test/bar]', [Function])`,
+            url: '/[/test/foo,/test/bar]',
+            normalizedUrl: '/[/test/foo,/test/bar]',
+            method,
+            framework
+          });
+        });
+
+        it('discovers a regEx route', function () {
+          const app = express();
+          const router = express.Router();
+          router[method](/f*o/, fn);
+          app.use(router);
+
+          expect(core.routeCoverage.discover).to.have.been.calledWith({
+            signature: `Router.${method}('/{f*o}', [Function])`,
+            url: '/{f*o}',
+            normalizedUrl: '/{f*o}',
+            method,
+            framework
+          });
+        });
+      });
+    });
+
+    it('does not observe a route with an undefined method', function () {
+      const app = express();
+      const router = express.Router();
+      router.get('/path/to/foo', fn);
+      app.use(router);
+
+      express.Router.handle({
+        originalUrl: '/path/to/foo',
+        route: { path: '/path/to/foo' }
+      });
+      expect(core.routeCoverage.observe).to.not.have.been.called;
+    });
+
+    it('observes a route when a route handler is exercised', function () {
+      const app = express();
+      const router = express.Router();
+      router.get('/path/to/foo', fn);
+      app.use(router);
+
+      express.Router.stack[0].handle({
+        method: 'GET',
+        originalUrl: '/path/to/foo',
+        route: { path: '/path/to/foo' }
+      });
+      expect(core.routeCoverage.observe).to.have.been.calledWith({
+        signature: "Router.get('/path/to/foo', [Function])",
+        url: '/path/to/foo',
+        normalizedUrl: '/path/to/foo',
+        method: 'get',
+        framework
+      });
+    });
+
+    it('updates route prefixes on nested router', function () {
+      const app = express();
+      const router = express.Router();
+      router.get('/foo', fn);
+      router.use('/prefix', router);
+      app.use(router);
+      expect(core.routeCoverage.discover).to.have.been.calledWith({
+        signature: "Router.get('/prefix/foo', [Function])",
+        url: '/prefix/foo',
+        normalizedUrl: '/prefix/foo',
+        method: 'get',
+        framework
+      });
+    });
+
+    it('updates route prefixes on a non-nested router', function () {
+      const app = express();
+      const router = express.Router();
+      const router2 = express.Router();
+      router.get('/foo', fn);
+      router2.use('/prefix', router);
+      app.use(router);
+      expect(core.routeCoverage.discover).to.have.been.calledWith({
+        signature: "Router.get('/prefix/foo', [Function])",
+        url: '/prefix/foo',
+        normalizedUrl: '/prefix/foo',
+        method: 'get',
+        framework
+      });
+    });
+
+  });
+});

package/lib/install/fastify.test.js

@@ -0,0 +1,203 @@
+'use strict';
+
+const { expect } = require('chai');
+const sinon = require('sinon');
+const scopes = require('@contrast/scopes');
+const patcher = require('@contrast/patcher');
+const mocks = require('@contrast/test/mocks');
+const { getFastifyMethods } = require('../utils/methods');
+
+describe('route-coverage fastify', function () {
+  let core, serverMock, framework;
+
+  beforeEach(function () {
+    core = mocks.core();
+    core.logger = mocks.logger();
+    core.routeCoverage = mocks.routeCoverage();
+    core.scopes = scopes(core);
+    core.depHooks = mocks.depHooks();
+    core.patcher = patcher(core);
+
+    serverMock = {
+      addHook: sinon.stub(),
+      route: sinon.stub(),
+      version: '4.4.0'
+    };
+
+    let fastify;
+    framework = 'fastify';
+    core.depHooks.resolve.callsFake((desc, cb) => {
+      fastify = cb(() => serverMock);
+    });
+
+    require('./fastify')(core).install();
+
+    fastify();
+  });
+
+  it('skips instrumenting if route options does not exist', function () {
+    serverMock.addHook.withArgs('onRoute').yield();
+    expect(core.routeCoverage.discover).not.to.have.been.called;
+  });
+
+  it('skips instrumenting if there is no method provided', function () {
+    serverMock.addHook.withArgs('onRoute').yield({});
+    expect(core.routeCoverage.discover).not.to.have.been.called;
+  });
+
+  it('skips instrumenting if there is no url provided', function () {
+    serverMock.addHook.withArgs('onRoute').yield({ method: 'GET' });
+    expect(core.routeCoverage.discover).not.to.have.been.called;
+  });
+
+  it('discovers a route with a single method', function () {
+    serverMock.addHook
+      .withArgs('onRoute')
+      .yield({ method: 'GET', url: '/test/route', routePath: '/test/route' });
+
+    expect(core.routeCoverage.discover).to.have.been.calledWith({
+      signature: "fastify.get('/test/route', [Function])",
+      url: '/test/route',
+      normalizedUrl: '/test/route',
+      method: 'get',
+      framework
+    });
+    expect(core.routeCoverage.discover).to.have.been.called;
+    expect(core.routeCoverage.discover).to.have.callCount(1);
+  });
+
+  it('discovers a fully declared (.route) route with a single method', function () {
+    serverMock.route({ method: 'GET', url: '/test/route' });
+    serverMock.addHook
+      .withArgs('onRoute')
+      .yield({ method: 'GET', url: '/test/route', routePath: '/test/route' });
+
+    expect(core.routeCoverage.discover).to.have.been.calledWith({
+      signature: "fastify.route({ method: 'get', url: '/test/route', handler: [Function] })",
+      url: '/test/route',
+      normalizedUrl: '/test/route',
+      method: 'get',
+      framework
+    });
+    expect(core.routeCoverage.discover).to.have.been.called;
+    expect(core.routeCoverage.discover).to.have.callCount(1);
+  });
+
+  it('discovers a route with multiple methods', function () {
+    serverMock.addHook.withArgs('onRoute').yield({
+      method: ['GET', 'POST'],
+      url: '/test/route',
+      routePath: '/test/route'
+    });
+
+    expect(core.routeCoverage.discover).to.have.been.calledWith({
+      signature: "fastify.get('/test/route', [Function])",
+      url: '/test/route',
+      normalizedUrl: '/test/route',
+      method: 'get',
+      framework
+    });
+
+    expect(core.routeCoverage.discover).to.have.been.calledWith({
+      signature: "fastify.post('/test/route', [Function])",
+      url: '/test/route',
+      normalizedUrl: '/test/route',
+      method: 'post',
+      framework
+    });
+
+    expect(core.routeCoverage.discover).to.have.callCount(2);
+  });
+
+  it('discovers a route with all methods', function () {
+    const FASTIFY_METHODS = getFastifyMethods('4.4.0');
+    serverMock.addHook.withArgs('onRoute').yield({
+      method: FASTIFY_METHODS,
+      url: '/test/route',
+      routePath: '/test/route'
+    });
+
+    expect(core.routeCoverage.discover).to.have.been.calledWith({
+      signature: "fastify.all('/test/route', [Function])",
+      url: '/test/route',
+      normalizedUrl: '/test/route',
+      method: 'all',
+      framework
+    });
+  });
+
+  it('discovers a fully declared route (.route) with multiple methods', function () {
+    serverMock.route({ method: ['GET', 'POST'], url: '/test/route' });
+
+    serverMock.addHook.withArgs('onRoute').yield({
+      method: ['GET', 'POST'],
+      url: '/test/route',
+      routePath: '/test/route'
+    });
+
+    expect(core.routeCoverage.discover).to.have.been.calledWith({
+      signature: "fastify.route({ method: 'get', url: '/test/route', handler: [Function] })",
+      url: '/test/route',
+      normalizedUrl: '/test/route',
+      method: 'get',
+      framework
+    });
+
+    expect(core.routeCoverage.discover).to.have.been.calledWith({
+      signature: "fastify.route({ method: 'post', url: '/test/route', handler: [Function] })",
+      url: '/test/route',
+      normalizedUrl: '/test/route',
+      method: 'post',
+      framework
+    });
+
+    expect(core.routeCoverage.discover).to.have.callCount(2);
+  });
+
+  it('signals that discovery is finished when the onReady hook is triggered', function () {
+    serverMock.addHook.withArgs('onReady').yield(sinon.stub());
+
+    expect(core.routeCoverage.discoveryFinished).to.have.been.calledOnce;
+  });
+
+  it('observes a route when the route handler is called', function () {
+    const routeOptions = {
+      method: 'GET',
+      url: '/test/route',
+      routePath: '/test/route',
+      handler: sinon.stub(),
+    };
+
+    serverMock.addHook.withArgs('onRoute').yield(routeOptions);
+    routeOptions.handler({ raw: { method: 'GET' }, url: '/test/route' });
+
+    expect(core.routeCoverage.observe).to.have.been.calledWith({
+      signature: "fastify.get('/test/route', [Function])",
+      url: '/test/route',
+      method: 'get',
+      normalizedUrl: '/test/route',
+      framework: 'fastify'
+    });
+  });
+
+  it('removes query string from url before reporting observation', function () {
+    const routeOptions = {
+      method: 'GET',
+      url: '/test/route',
+      routePath: '/test/route',
+      handler: sinon.stub(),
+    };
+
+    serverMock.addHook.withArgs('onRoute').yield(routeOptions);
+    routeOptions.handler({ raw: { method: 'GET' }, url: '/test/route?input=foo' });
+
+    expect(core.routeCoverage.observe).to.have.been.calledWith({
+      signature: "fastify.get('/test/route', [Function])",
+      url: '/test/route',
+      method: 'get',
+      normalizedUrl: '/test/route',
+      framework: 'fastify'
+    });
+  });
+
+});

package/lib/install/hapi.test.js

@@ -0,0 +1,125 @@
+'use strict';
+
+const { expect } = require('chai');
+const sinon = require('sinon');
+const scopes = require('@contrast/scopes');
+const patcher = require('@contrast/patcher');
+const mocks = require('@contrast/test/mocks');
+
+describe('route-coverage hapi', function () {
+  let core, route, _core, hapi, framework;
+
+  beforeEach(function () {
+    core = mocks.core();
+    core.logger = mocks.logger();
+    core.routeCoverage = mocks.routeCoverage();
+    core.scopes = scopes(core);
+    core.depHooks = mocks.depHooks();
+    core.patcher = patcher(core);
+
+    route = {
+      settings: {
+        handler: sinon.stub()
+      }
+    };
+
+    _core = {
+      router: {
+        add() {
+          return { route };
+        }
+      }
+    };
+
+    hapi = {
+      server() {
+        return { _core };
+      },
+      Server() {
+        return { _core };
+      }
+    };
+    framework = 'hapi';
+
+    core.depHooks.resolve.withArgs({ name: '@hapi/hapi', version: '>=18 <22' }).yields(hapi);
+    require('./hapi')(core).install();
+  });
+
+
+  ['server', 'Server'].forEach((server) => {
+
+    it('does not report a non-existent route', function () {
+      const hapiServer = hapi[server]();
+      hapiServer._core.router.add();
+      expect(core.routeCoverage.discover).not.to.have.been.called;
+    });
+
+    it('does not report a route missing a method', function () {
+      const hapiServer = hapi[server]();
+      hapiServer._core.router.add({ path: '/foo' });
+      expect(core.routeCoverage.discover).not.to.have.been.called;
+    });
+
+    it('does not report a route missing a path', function () {
+      const hapiServer = hapi[server]();
+      hapiServer._core.router.add({ method: 'GET' });
+      expect(core.routeCoverage.discover).not.to.have.been.called;
+    });
+
+    it('discovers a route with a single method', function () {
+      const hapiServer = hapi[server]();
+      hapiServer._core.router.add({ method: 'GET', path: '/foo' });
+
+      expect(core.routeCoverage.discover).to.have.been.calledWith({
+        signature: "server.route({ method: 'get', path: '/foo', handler: [Function] })",
+        url: '/foo',
+        normalizedUrl: '/foo',
+        method: 'get',
+        framework
+      });
+    });
+
+    it('discovers a route with multiple methods', function () {
+      const hapiServer = hapi[server]();
+      hapiServer._core.router.add({ method: ['GET', 'PUT'], path: '/foo' });
+
+      expect(core.routeCoverage.discover).to.have.been.calledWith({
+        signature: "server.route({ method: 'get', path: '/foo', handler: [Function] })",
+        url: '/foo',
+        normalizedUrl: '/foo',
+        method: 'get',
+        framework
+      });
+
+      expect(core.routeCoverage.discover).to.have.been.calledWith({
+        signature: "server.route({ method: 'put', path: '/foo', handler: [Function] })",
+        url: '/foo',
+        normalizedUrl: '/foo',
+        method: 'put',
+        framework
+      });
+    });
+
+    it('observes a route when a route handler is exercised', async function () {
+      const hapiServer = hapi[server]();
+      const { route } = hapiServer._core.router.add({ method: 'get', path: '/foo' });
+      route.settings.handler({ method: 'get', path: '/foo', route: { path: '/foo' } });
+      expect(core.routeCoverage.observe).to.have.been.calledWith({
+        url: '/foo',
+        normalizedUrl: '/foo',
+        method: 'get'
+      });
+    });
+
+    it('observes a route when a route contains parameters', async function () {
+      const hapiServer = hapi[server]();
+      const { route } = hapiServer._core.router.add({ method: 'get', path: '/foo/{id}' });
+      route.settings.handler({ method: 'get', path: '/foo/1', route: { path: '/foo/{id}' } });
+      expect(core.routeCoverage.observe).to.have.been.calledWith({
+        url: '/foo/1',
+        normalizedUrl: '/foo/{id}',
+        method: 'get'
+      });
+    });
+  });
+});

package/lib/install/koa.test.js

@@ -0,0 +1,152 @@
+'use strict';
+
+const { expect } = require('chai');
+const sinon = require('sinon');
+const scopes = require('@contrast/scopes');
+const patcher = require('@contrast/patcher');
+const mocks = require('@contrast/test/mocks');
+const { METHODS } = require('../utils/methods');
+
+describe('route-coverage koa', function () {
+  let core, Router, framework, Koa, app, handlerFn;
+
+  beforeEach(function () {
+    core = mocks.core();
+    core.logger = mocks.logger();
+    core.routeCoverage = mocks.routeCoverage();
+    core.scopes = scopes(core);
+    core.depHooks = mocks.depHooks();
+    core.patcher = patcher(core);
+
+    framework = 'koa';
+    Router = function Router() { };
+    Router.router = {
+      stack: []
+    };
+
+    handlerFn = sinon.stub();
+    Router.prototype.use = (path, fn) => Router.router.stack.push({ methods: [], path, stack: [fn] });
+    Router.prototype.get = (path, fn) => Router.router.stack.push({ methods: ['GET'], path, stack: [fn] });
+    Router.prototype.all = (path, fn) => Router.router.stack.push({ methods: METHODS, path, stack: [fn] });
+    Router.prototype.routes = () => Router;
+
+    Koa = function() {};
+    Koa.prototype.use = sinon.stub();
+    core.depHooks.resolve.withArgs({ name: 'koa', version: '>=2.3.0' }).yields(Koa);
+    require('./koa')(core).install();
+  });
+
+  it('does not report when called with nothing', function () {
+    app = new Koa();
+    app.use();
+    expect(core.routeCoverage.discover).not.to.have.been.called;
+  });
+
+  it('does not report when called with non-router', function () {
+    app = new Koa();
+    app.use({ not: 'a router' });
+    expect(core.routeCoverage.discover).not.to.have.been.called;
+  });
+
+  it('does not report unmounted routes', function () {
+    const router = new Router();
+    router.get('/test/route', handlerFn);
+
+    expect(core.routeCoverage.discover).not.to.have.been.called;
+  });
+
+  it('does not report a non-existent route', function () {
+    const router = new Router();
+    router.get();
+
+    app = new Koa();
+    app.use(router.routes());
+    expect(core.routeCoverage.discover).not.to.have.been.called;
+  });
+
+  it('does not report when path is an array', function () {
+    const router = new Router();
+    router.get(['/test/route'], handlerFn);
+
+    app = new Koa();
+    app.use(router.routes());
+    expect(core.routeCoverage.discover).not.to.have.been.called;
+  });
+
+  it('discovers a route', function () {
+    const router = new Router();
+    router.get('/test/route', handlerFn);
+
+    app = new Koa();
+    app.use(router.routes());
+    expect(core.routeCoverage.discover).to.have.been.calledWith({
+      signature: "Router.get('/test/route', [Function])",
+      url: '/test/route',
+      normalizedUrl: '/test/route',
+      method: 'get',
+      framework
+    });
+  });
+
+  it('discovers a .use route', function () {
+    const router = new Router();
+    router.use('/test/route', handlerFn);
+
+    app = new Koa();
+    app.use(router.routes());
+    expect(core.routeCoverage.discover).to.have.been.calledWith({
+      signature: "Router.use('/test/route', [Function])",
+      url: '/test/route',
+      normalizedUrl: '/test/route',
+      method: 'use',
+      framework
+    });
+  });
+
+  it('discovers a .all route', function () {
+    const router = new Router();
+    router.all('/test/route', handlerFn);
+
+    app = new Koa();
+    app.use(router.routes());
+    expect(core.routeCoverage.discover).to.have.been.calledWith({
+      signature: "Router.all('/test/route', [Function])",
+      url: '/test/route',
+      normalizedUrl: '/test/route',
+      method: 'all',
+      framework
+    });
+  });
+
+  it('does not observe a route without a valid request', async function () {
+    const router = new Router();
+    router.get('/test/route', handlerFn);
+
+    app = new Koa();
+    app.use(router.routes());
+
+    Router.router.stack[0].stack[0]({});
+    expect(core.routeCoverage.observe).to.not.have.been.called;
+  });
+
+  it('observes a route when a route handler is exercised', async function () {
+    const router = new Router();
+    router.get('/test/route', handlerFn);
+
+    app = new Koa();
+    app.use(router.routes());
+
+    const request = {
+      url: '/test/route',
+      method: 'get'
+    };
+    Router.router.stack[0].stack[0]({ request });
+    expect(core.routeCoverage.observe).to.have.been.calledWith({
+      signature: "Router.get('/test/route', [Function])",
+      url: '/test/route',
+      normalizedUrl: '/test/route',
+      method: 'get',
+      framework: 'koa'
+    });
+  });
+});

package/lib/install/restify.test.js

@@ -0,0 +1,92 @@
+'use strict';
+
+const { expect } = require('chai');
+const sinon = require('sinon');
+const scopes = require('@contrast/scopes');
+const patcher = require('@contrast/patcher');
+const mocks = require('@contrast/test/mocks');
+
+describe('route-coverage restify', function () {
+  let core, restify, serverMock, handler, framework;
+
+  beforeEach(function () {
+    core = mocks.core();
+    core.logger = mocks.logger();
+    core.routeCoverage = mocks.routeCoverage();
+    core.scopes = scopes(core);
+    core.depHooks = mocks.depHooks();
+    core.patcher = patcher(core);
+
+    handler = sinon.stub();
+    serverMock = {
+      router: {
+        mount (path, method) {
+          return {
+            path,
+            method,
+            chain: {
+              _stack: [
+                handler
+              ]
+            }
+          };
+        }
+      }
+    };
+
+    framework = 'restify';
+    restify = {
+      createServer: () => serverMock
+    };
+    core.depHooks.resolve.withArgs({ name: 'restify', version: '>= 8.0.0' }).yields(restify);
+    require('./restify')(core).install();
+  });
+
+  it('does not report a non-existent route', function () {
+    const { router } = restify.createServer();
+    router.mount();
+    expect(core.routeCoverage.discover).not.to.have.been.called;
+  });
+
+  it('does not report an incomplete route', function () {
+    const { router } = restify.createServer();
+    router.mount('/foo');
+    expect(core.routeCoverage.discover).not.to.have.been.called;
+  });
+
+  it('does not report an invalid route', function () {
+    const { router } = restify.createServer();
+    router.mount(42, 'GET');
+    expect(core.routeCoverage.discover).not.to.have.been.called;
+  });
+
+  it('discovers a route', function () {
+    const { router } = restify.createServer();
+    router.mount('/foo', 'GET');
+
+    expect(core.routeCoverage.discover).to.have.been.calledWith({
+      signature: "server.get('/foo', [Function])",
+      url: '/foo',
+      normalizedUrl: '/foo',
+      method: 'get',
+      framework
+    });
+  });
+
+  it('observes a route', async function () {
+    const { router } = restify.createServer();
+    const route = router.mount('/foo', 'GET');
+    const handler = route.chain._stack[0];
+    handler({
+      url: '/foo?input=bar',
+      method: 'GET'
+    });
+    expect(core.routeCoverage.observe).to.have.been.calledWith({
+      signature: "server.get('/foo', [Function])",
+      url: '/foo',
+      normalizedUrl: '/foo',
+      method: 'get',
+      framework
+    });
+  });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/route-coverage",
-  "version": "1.21.0",
+  "version": "1.22.0",
   "description": "Handles route discovery and observation",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -17,7 +17,7 @@
     "test": "../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/common": "1.22.0",
+    "@contrast/common": "1.23.0",
     "@contrast/fn-inspect": "^4.0.0"
   }
 }