@decohere/http 0.0.1-dev.125 → 0.0.1-dev.5

package/tests/http.static.spec.ts

@@ -0,0 +1,111 @@
+import { describe, expect, it } from "vitest";
+import { STATIC_DEFAULT_IMMUTABLE, staticFiles } from "../src/http/http.static.js";
+
+describe("static file rules", () => {
+	it.each([
+		"assets/index-DiwrgTda.js",
+		"assets/index-3f9a8c1b.js",
+		"assets/style.3f9a8c1b.css",
+		"assets/vendor-x9Kd02_a.js.map",
+		"chunk-1a2b3c4d5e6f.js",
+	])("treats %s as hashed", (file) => {
+		expect(STATIC_DEFAULT_IMMUTABLE.test(file)).toBe(true);
+	});
+
+	it.each([
+		"index.html",
+		"remoteEntry.js",
+		"favicon.ico",
+		"assets/logo-background.png",
+		"assets/short-abc123.js",
+		"fonts/inter.woff2",
+		"main.min.js",
+	])("does not treat %s as hashed", (file) => {
+		expect(STATIC_DEFAULT_IMMUTABLE.test(file)).toBe(false);
+	});
+
+	it.each([
+		["/ui/", "/ui/"],
+		["/ui", "/ui/"],
+		["ui", "/ui/"],
+		["//apps//crypto/", "/apps/crypto/"],
+		["/", "/"],
+		["//", "/"],
+	])("mounts %s at %s", (given, expected) => {
+		expect(staticFiles.toMount(given, "ui").prefix).toBe(expected);
+	});
+
+	it.each(["", "/ui/../api", "/ui/*"])("refuses the prefix %j", (given) => {
+		expect(() => staticFiles.toMount(given, "ui")).toThrow(/withStatic/);
+	});
+
+	it.each([
+		["/portfolio", false],
+		["/portfolio/42/edit", false],
+		["/portfolio/", false],
+		["/", false],
+		["/app.js", true],
+		["/assets/x.map", true],
+		["/.env", true],
+		["/.well-known/x", true],
+		["/v1.2/overview/", false],
+	])("treats %s as a file: %s", (pathname, expected) => {
+		expect(staticFiles.looksLikeFile(pathname)).toBe(expected);
+	});
+
+	it.each([
+		["text/html", true],
+		["text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", true],
+		["application/json, TEXT/HTML;q=0.5", true],
+		["text/html;q=0", false],
+		["application/json", false],
+		["*/*", false],
+		["text/*", false],
+		["", false],
+		[undefined, false],
+	])("reads the Accept header %j as html: %s", (accept, expected) => {
+		expect(staticFiles.acceptsHtml(accept)).toBe(expected);
+	});
+
+	it("takes the first segment of every route that is not a parameter", () => {
+		const segments = staticFiles.routeSegments([
+			"/lp/portfolio",
+			"/health",
+			"/:id",
+			"/*",
+			"/",
+			"/lp/x",
+		]);
+
+		expect([...segments].sort()).toEqual(["health", "lp"]);
+	});
+
+	it.each([
+		["/lp/portfolo", true],
+		["/lp", true],
+		["/lp/a/b/c", true],
+		["/lpx", false],
+		["/portfolio", false],
+		["/", false],
+	])("decides whether %s is under a route: %s", (pathname, expected) => {
+		expect(staticFiles.isUnderRoute(pathname, new Set(["lp", "health"]))).toBe(expected);
+	});
+
+	it.each([
+		[["/api/**"], "/api/x", true],
+		[["/api/**"], "/api", true],
+		[["/api/**"], "/apix", false],
+		[["/docs/*"], "/docs/a/b", false],
+		[["/docs/*"], "/docs/a", true],
+		[["/api/**", "/docs/**"], "/docs/a/b", true],
+		[["/api/**"], "/api/.hidden", true],
+		[[], "/api/x", false],
+	])("matches exclude %j against %s: %s", (patterns, pathname, expected) => {
+		expect(staticFiles.excluder(patterns)(pathname)).toBe(expected);
+	});
+
+	it("normalises the path: no query, decoded, one slash", () => {
+		expect(staticFiles.normalizePathname("//api%2Fx//y?z=1")).toBe("/api/x/y");
+		expect(staticFiles.normalizePathname("/bad%zz")).toBe("/bad%zz");
+	});
+});

package/tests/http.surface.integration.spec.ts

@@ -0,0 +1,167 @@
+import { injectable } from "@decohere/di/decorators";
+import axios from "axios";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import type { App } from "../src/app/app.js";
+import { Builder } from "../src/builder/builder.js";
+import "../src/http/http.extensions.js";
+import { FastifyProvider } from "../src/providers/fastify.provider.js";
+import {
+	Catch,
+	Controller,
+	type ExceptionContext,
+	type ExceptionFilter,
+	type ExceptionResult,
+	Get,
+	Header,
+	HttpCode,
+	HttpError,
+	type Middleware,
+	type MiddlewareContext,
+	Post,
+} from "../src/routing/index.js";
+import { listenEphemeral } from "./helpers/listen-ephemeral.js";
+
+class NotFoundError extends HttpError {
+	public constructor(message = "Not Found") {
+		super(message, 404);
+	}
+}
+
+@Catch(NotFoundError)
+@injectable()
+class NotFoundFilter implements ExceptionFilter {
+	public catch(error: NotFoundError, _ctx: ExceptionContext): ExceptionResult {
+		return { status: error.status, body: { code: "NOT_FOUND", message: error.message } };
+	}
+}
+
+@injectable()
+class TraceMiddleware implements Middleware {
+	public static calls = 0;
+	public async use(ctx: MiddlewareContext, next: () => Promise<unknown>) {
+		TraceMiddleware.calls += 1;
+		ctx.request.headers["x-mw"] = "1";
+		return next();
+	}
+}
+
+@Controller({ prefix: "/scope" })
+class ScopedController {
+	private static nextId = 0;
+	private readonly id = ++ScopedController.nextId;
+
+	@Get()
+	public who() {
+		return { id: this.id };
+	}
+}
+
+@Controller({ prefix: "/widgets" })
+class WidgetController {
+	@HttpCode(201)
+	@Header("X-Widget", "yes")
+	@Post()
+	public create() {
+		return { id: 1 };
+	}
+
+	@Get("/missing")
+	public missing() {
+		throw new NotFoundError("widget gone");
+	}
+
+	@Get("/boom")
+	public boom() {
+		throw new Error("kaboom");
+	}
+
+	@Get()
+	public list() {
+		return { ok: true };
+	}
+}
+
+describe("HTTP surface (filters, HttpCode/Header, middleware, CORS, global prefix)", () => {
+	let app: App;
+
+	beforeEach(() => {
+		TraceMiddleware.calls = 0;
+	});
+
+	afterEach(async () => {
+		await app?.dispose();
+	});
+
+	it("applies global prefix, HttpCode, Header, middleware, CORS, and exception filters", async () => {
+		app = await Builder.create()
+			.withGlobalPrefix("/api")
+			.withCors({ origin: "https://example.com", credentials: true })
+			.withMiddleware(TraceMiddleware)
+			.withExceptionFilters(NotFoundFilter)
+			.withHttpProvider(FastifyProvider)
+			.withControllers(WidgetController)
+			.build();
+		axios.defaults.baseURL = await listenEphemeral(app);
+
+		const created = await axios.post(
+			"/api/widgets",
+			{},
+			{
+				headers: { "Content-Type": "application/json" },
+			},
+		);
+		expect(created.status).toBe(201);
+		expect(created.headers["x-widget"]).toBe("yes");
+		expect(created.data).toEqual({ id: 1 });
+		expect(TraceMiddleware.calls).toBeGreaterThanOrEqual(1);
+
+		const missing = await axios.get("/api/widgets/missing", { validateStatus: () => true });
+		expect(missing.status).toBe(404);
+		expect(missing.data).toEqual({ code: "NOT_FOUND", message: "widget gone" });
+
+		const boom = await axios.get("/api/widgets/boom", { validateStatus: () => true });
+		expect(boom.status).toBe(500);
+		expect(boom.data).toEqual({ message: "Internal Server Error" });
+		expect(JSON.stringify(boom.data)).not.toMatch(/kaboom/i);
+
+		const preflight = await axios.options("/api/widgets", {
+			headers: {
+				Origin: "https://example.com",
+				"Access-Control-Request-Method": "POST",
+			},
+			validateStatus: () => true,
+		});
+		expect(preflight.status).toBe(204);
+		expect(preflight.headers["access-control-allow-origin"]).toBe("https://example.com");
+		expect(preflight.headers["access-control-allow-credentials"]).toBe("true");
+
+		const listed = await axios.get("/api/widgets", {
+			headers: { Origin: "https://example.com" },
+		});
+		expect(listed.status).toBe(200);
+		expect(listed.headers["access-control-allow-origin"]).toBe("https://example.com");
+	});
+
+	it("returns 404 for an unregistered path", async () => {
+		app = await Builder.create()
+			.withHttpProvider(FastifyProvider)
+			.withControllers(WidgetController)
+			.build();
+		axios.defaults.baseURL = await listenEphemeral(app);
+
+		const missing = await axios.get("/nope", { validateStatus: () => true });
+		expect(missing.status).toBe(404);
+	});
+
+	it("creates a new controller instance per request", async () => {
+		app = await Builder.create()
+			.withHttpProvider(FastifyProvider)
+			.withControllers(ScopedController)
+			.build();
+		axios.defaults.baseURL = await listenEphemeral(app);
+
+		const first = await axios.get("/scope");
+		const second = await axios.get("/scope");
+		expect(first.data.id).not.toBe(second.data.id);
+	});
+});

package/tests/openapi.integration.spec.ts

@@ -0,0 +1,193 @@
+import axios from "axios";
+import { afterEach, describe, expect, it } from "vitest";
+import type { App } from "../src/app/app.js";
+import { Builder } from "../src/builder/builder.js";
+import "../src/http/http.extensions.js";
+import { FastifyProvider } from "../src/providers/fastify.provider.js";
+import {
+	Controller,
+	Field,
+	Get,
+	Param,
+	Post,
+	Put,
+	Query,
+	RequestParts,
+} from "../src/routing/index.js";
+import { listenEphemeral } from "./helpers/listen-ephemeral.js";
+
+class CreateBody {
+	@Field(RequestParts.body, "message")
+	public message!: string;
+}
+
+@Controller({ prefix: "/widgets" })
+class WidgetController {
+	@Get("/:id")
+	public getOne(@Param("id") id: string) {
+		return { id };
+	}
+
+	@Post()
+	public create(body: CreateBody) {
+		return { message: body.message };
+	}
+}
+
+/** Mirrors scaffolded HelloController + HelloBody for dogfood validation. */
+class HelloBody {
+	@Field(RequestParts.body, "message")
+	public message!: string;
+}
+
+@Controller({ prefix: "/hello" })
+class HelloController {
+	@Get()
+	public getAll(@Query("filter") filter: string) {
+		return { filter, message: "hello" };
+	}
+
+	@Get("/:id")
+	public getOne(@Param("id") id: string) {
+		return { id, message: `Hello ${id}!` };
+	}
+
+	@Post()
+	public create(body: HelloBody) {
+		return { message: body.message };
+	}
+
+	@Put("/:id")
+	public update(@Param("id") id: string, body: HelloBody) {
+		return { id, message: body.message };
+	}
+}
+
+describe("OpenAPI integration", () => {
+	let app: App;
+
+	afterEach(async () => {
+		await app?.dispose();
+	});
+
+	it("serves the OpenAPI document and rejects invalid bodies with typed 400", async () => {
+		app = await Builder.create()
+			.withOpenApi({
+				info: { title: "Widgets API", version: "1.0.0" },
+				path: "/openapi.json",
+			})
+			.withHttpProvider(FastifyProvider)
+			.withControllers(WidgetController)
+			.build();
+		axios.defaults.baseURL = await listenEphemeral(app);
+
+		const spec = await axios.get("/openapi.json");
+		expect(spec.status).toBe(200);
+		expect(spec.data.openapi).toBe("3.0.3");
+		expect(spec.data.paths["/widgets/{id}"].get).toBeDefined();
+		expect(spec.data.paths["/widgets"].post.requestBody).toBeDefined();
+
+		const bad = await axios.post(
+			"/widgets",
+			{},
+			{ headers: { "Content-Type": "application/json" }, validateStatus: () => true },
+		);
+		expect(bad.status).toBe(400);
+		expect(bad.data).toMatchObject({
+			statusCode: 400,
+			error: "Bad Request",
+			message: "Validation failed",
+		});
+		expect(bad.data.errors).toEqual(
+			expect.arrayContaining([
+				expect.objectContaining({
+					keyword: "required",
+					message: expect.stringContaining("message"),
+				}),
+			]),
+		);
+
+		const wrongType = await axios.post(
+			"/widgets",
+			{ message: 42 },
+			{ headers: { "Content-Type": "application/json" }, validateStatus: () => true },
+		);
+		expect(wrongType.status).toBe(400);
+		expect(wrongType.data.statusCode).toBe(400);
+		expect(wrongType.data.errors).toEqual(
+			expect.arrayContaining([
+				expect.objectContaining({
+					path: "/body/message",
+					keyword: "type",
+				}),
+			]),
+		);
+
+		const extra = await axios.post(
+			"/widgets",
+			{ message: "hi", surprise: true },
+			{ headers: { "Content-Type": "application/json" }, validateStatus: () => true },
+		);
+		expect(extra.status).toBe(400);
+		expect(extra.data.errors).toEqual(
+			expect.arrayContaining([
+				expect.objectContaining({
+					keyword: "additionalProperties",
+				}),
+			]),
+		);
+
+		const ok = await axios.post(
+			"/widgets",
+			{ message: "hi" },
+			{ headers: { "Content-Type": "application/json" } },
+		);
+		expect(ok.status).toBe(200);
+		expect(ok.data).toEqual({ message: "hi" });
+
+		const one = await axios.get("/widgets/abc");
+		expect(one.status).toBe(200);
+		expect(one.data).toEqual({ id: "abc" });
+	});
+
+	it("dogfoods Hello routes: fail-closed body validation with typed 400", async () => {
+		app = await Builder.create()
+			.withOpenApi({
+				info: { title: "hello.api", version: "1.0.0" },
+			})
+			.withHttpProvider(FastifyProvider)
+			.withControllers(HelloController)
+			.build();
+		axios.defaults.baseURL = await listenEphemeral(app);
+
+		const missing = await axios.post(
+			"/hello",
+			{},
+			{ headers: { "Content-Type": "application/json" }, validateStatus: () => true },
+		);
+		expect(missing.status).toBe(400);
+		expect(missing.data).toMatchObject({
+			statusCode: 400,
+			error: "Bad Request",
+			message: "Validation failed",
+		});
+		expect(Array.isArray(missing.data.errors)).toBe(true);
+		expect(missing.data.errors.length).toBeGreaterThan(0);
+
+		const created = await axios.post(
+			"/hello",
+			{ message: "hello" },
+			{ headers: { "Content-Type": "application/json" } },
+		);
+		expect(created.status).toBe(200);
+		expect(created.data).toEqual({ message: "hello" });
+
+		const updated = await axios.put(
+			"/hello/1",
+			{ message: "updated" },
+			{ headers: { "Content-Type": "application/json" } },
+		);
+		expect(updated.status).toBe(200);
+		expect(updated.data).toEqual({ id: "1", message: "updated" });
+	});
+});

package/tests/openapi.validator-cache.integration.spec.ts

@@ -0,0 +1,55 @@
+import { Ajv } from "ajv";
+import axios from "axios";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import type { App } from "../src/app/app.js";
+import { Builder } from "../src/builder/builder.js";
+import "../src/http/http.extensions.js";
+import { FastifyProvider } from "../src/providers/fastify.provider.js";
+import { Controller, Field, Param, Post, RequestParts } from "../src/routing/index.js";
+import { listenEphemeral } from "./helpers/listen-ephemeral.js";
+
+class NoteBody {
+	@Field(RequestParts.body, "text")
+	public text!: string;
+}
+
+@Controller({ prefix: "/notes" })
+class NoteController {
+	@Post("/:id")
+	public save(@Param("id") id: string, body: NoteBody) {
+		return { id, text: body.text };
+	}
+}
+
+// #498: validators were compiled on every request, and AJV keeps every compiled schema,
+// so memory grew with traffic. Each route's validators must be compiled once and reused.
+describe("request validation compiles each route's schemas once", () => {
+	let app: App;
+
+	afterEach(async () => {
+		await app?.dispose();
+		vi.restoreAllMocks();
+	});
+
+	it("does not compile again for later requests to the same route", async () => {
+		app = await Builder.create()
+			.withOpenApi({ info: { title: "Notes", version: "1.0.0" }, path: "/openapi.json" })
+			.withHttpProvider(FastifyProvider)
+			.withControllers(NoteController)
+			.build();
+		const baseURL = await listenEphemeral(app);
+		const compile = vi.spyOn(Ajv.prototype, "compile");
+		const post = (body: object) =>
+			axios.post("/notes/1", body, { baseURL, validateStatus: () => true });
+
+		expect((await post({ text: "first" })).status).toBe(200);
+		const afterFirst = compile.mock.calls.length;
+
+		for (let i = 0; i < 20; i++) {
+			expect((await post({ text: `note ${i}` })).status).toBe(200);
+		}
+		expect((await post({})).status).toBe(400);
+
+		expect(compile.mock.calls.length).toBe(afterFirst);
+	});
+});

package/tests/routing.decorators.spec.ts

@@ -0,0 +1,15 @@
+import { describe, expect, it } from "vitest";
+import { RouteConfigurationError } from "../src/routing/anvil.types.js";
+import { Get } from "../src/routing/decorators/index.js";
+
+describe("routing decorators", () => {
+	it("throws RouteConfigurationError when a path does not start with /", () => {
+		expect(() => {
+			class BadController {
+				@Get("noslash")
+				public bad() {}
+			}
+			new BadController();
+		}).toThrow(RouteConfigurationError);
+	});
+});

package/tests/routing.registry.spec.ts

@@ -0,0 +1,44 @@
+import { describe, expect, it } from "vitest";
+import { RouteConfigurationError } from "../src/routing/anvil.types.js";
+import { Argument, Controller, Field, Get } from "../src/routing/index.js";
+import { RouteRegistry } from "../src/routing/services/route-registry.js";
+
+describe("RouteRegistry", () => {
+	it("throws when a field has no location and no arg-level location", () => {
+		class BadParams {
+			@Field()
+			public q: string;
+		}
+
+		@Controller()
+		class BadController {
+			@Get("/bad")
+			public bad(@Argument({}) _params: BadParams) {}
+		}
+
+		const registry = new RouteRegistry();
+		expect(() => registry.addController(BadController)).toThrow(RouteConfigurationError);
+	});
+
+	// #503: two handlers for the same method and path used to overwrite each other silently,
+	// so one of them was never reachable.
+	it("throws when two handlers register the same method and path", () => {
+		@Controller({ prefix: "/items" })
+		class FirstController {
+			@Get()
+			public list() {}
+		}
+
+		@Controller({ prefix: "/items" })
+		class SecondController {
+			@Get()
+			public listAgain() {}
+		}
+
+		const registry = new RouteRegistry();
+		registry.addController(FirstController);
+		expect(() => registry.addController(SecondController)).toThrow(
+			/GET \/items.*FirstController\.list.*SecondController\.listAgain/,
+		);
+	});
+});

package/tests/routing.resolver.spec.ts

@@ -0,0 +1,92 @@
+import { describe, expect, it } from "vitest";
+import { HttpRequest, TransformError, ValidationError } from "../src/routing/anvil.types.js";
+import { BooleanPipe, DatePipe, JsonPipe, NumberPipe } from "../src/routing/pipes/pipes.js";
+import { RouteArgumentResolve } from "../src/routing/services/route-argument-resolver.js";
+
+describe("BooleanPipe", () => {
+	const pipe = new BooleanPipe();
+
+	it("converts query-shaped strings including 1 / 0", () => {
+		expect(pipe.transform("true")).toBe(true);
+		expect(pipe.transform("FALSE")).toBe(false);
+		expect(pipe.transform("1")).toBe(true);
+		expect(pipe.transform("0")).toBe(false);
+		expect(pipe.transform(1)).toBe(true);
+		expect(pipe.transform(0)).toBe(false);
+	});
+
+	it("throws ValidationError for unrecognised values", () => {
+		expect(() => pipe.transform("yes")).toThrow(ValidationError);
+	});
+});
+
+describe("NumberPipe", () => {
+	const pipe = new NumberPipe();
+
+	it("throws ValidationError for non-numeric strings (#503)", () => {
+		expect(() => pipe.transform("abc")).toThrow(ValidationError);
+	});
+});
+
+describe("DatePipe", () => {
+	const pipe = new DatePipe();
+
+	it("converts an ISO date string to Date", () => {
+		const result = pipe.transform("2024-01-15T00:00:00.000Z");
+		expect(result).toBeInstanceOf(Date);
+		expect(result.getFullYear()).toBe(2024);
+	});
+
+	it("throws ValidationError for an invalid or empty date string", () => {
+		expect(() => pipe.transform("not-a-date")).toThrow(ValidationError);
+		expect(() => pipe.transform("")).toThrow(ValidationError);
+		expect(() => pipe.transform("   ")).toThrow(ValidationError);
+	});
+});
+
+describe("JsonPipe", () => {
+	const pipe = new JsonPipe();
+
+	it("throws TransformError for invalid JSON", () => {
+		expect(() => pipe.transform("not json")).toThrow(TransformError);
+	});
+});
+
+describe("RouteArgumentResolve", () => {
+	const resolver = new RouteArgumentResolve();
+
+	it("passes fieldMap types into JsonPipe so Date fields revive", () => {
+		const iso = "2024-03-01T00:00:00.000Z";
+		const request = new HttpRequest({
+			requestId: "r1",
+			method: "GET",
+			url: "/",
+			params: {},
+			query: { payload: JSON.stringify({ birthday: iso }) },
+			body: {},
+		});
+		const args = resolver.resolveArguments(request, [
+			{
+				argumentIndex: 0,
+				argumentType: String,
+				argumentLocation: "query",
+				mappingKey: "payload",
+				pipes: [JsonPipe],
+				fieldMap: new Map([
+					[
+						"birthday",
+						{
+							fieldKey: "birthday",
+							fieldType: Date,
+							mappingKey: "birthday",
+							fieldLocation: "query" as const,
+							pipes: [],
+						},
+					],
+				]),
+			},
+		]);
+		expect((args[0] as { birthday: Date }).birthday).toBeInstanceOf(Date);
+		expect((args[0] as { birthday: Date }).birthday.toISOString()).toBe(iso);
+	});
+});