@decohere/http 0.0.1-dev.126 → 0.0.1-dev.5

package/tests/app.spec.ts

@@ -0,0 +1,132 @@
+import { scribe } from "@decohere/scribe";
+import axios from "axios";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import type { App } from "../src/app/app.js";
+import { Builder } from "../src/builder/builder.js";
+import { FastifyProvider } from "../src/providers/fastify.provider.js";
+import { Controller, Get, Param, Query } from "../src/routing/index.js";
+import "../src/http/http.extensions.js";
+import { listenEphemeral } from "./helpers/listen-ephemeral.js";
+
+@Controller({ prefix: "/echo" })
+class EchoController {
+	@Get()
+	public root() {
+		return { ok: true };
+	}
+
+	@Get("/query")
+	public getWithArgs(@Query("arg1") arg1: string) {
+		return { arg1 };
+	}
+
+	@Get("/:param1/:param2")
+	public getWithParams(@Param("param1") param1: string, @Param("param2") param2: string) {
+		return { param1, param2 };
+	}
+
+	@Get("/count")
+	public count(@Query("n") n: number) {
+		return { n };
+	}
+}
+
+describe("App HTTP routing", () => {
+	let app: App;
+
+	beforeEach(async () => {
+		app = await Builder.create()
+			.withHttpProvider(FastifyProvider)
+			.withControllers(EchoController)
+			.build();
+		axios.defaults.baseURL = await listenEphemeral(app);
+	});
+
+	afterEach(async () => {
+		await app.dispose();
+	});
+
+	it("returns the handler body for GET with no arguments", async () => {
+		const res = await axios.get("/echo");
+		expect(res.status).toBe(200);
+		expect(res.data).toEqual({ ok: true });
+	});
+
+	it("binds a query string argument into the response", async () => {
+		const res = await axios.get("/echo/query", { params: { arg1: "arg1Value" } });
+		expect(res.status).toBe(200);
+		expect(res.data).toEqual({ arg1: "arg1Value" });
+	});
+
+	it("binds path params into the response", async () => {
+		const res = await axios.get("/echo/arg1Value/arg2Value");
+		expect(res.status).toBe(200);
+		expect(res.data).toEqual({ param1: "arg1Value", param2: "arg2Value" });
+	});
+
+	it("coerces a numeric query argument", async () => {
+		const res = await axios.get("/echo/count", { params: { n: "5" } });
+		expect(res.status).toBe(200);
+		expect(res.data).toEqual({ n: 5 });
+	});
+
+	it("advertises the OS-assigned port after listen(0)", () => {
+		const origin = axios.defaults.baseURL;
+		expect(origin).toMatch(/^http:\/\/127\.0\.0\.1:\d+$/);
+		expect(Number(new URL(origin ?? "").port)).toBeGreaterThan(0);
+		expect(app.addresses).toContain(origin);
+	});
+
+	it("starts two apps without a port collision", async () => {
+		const originA = axios.defaults.baseURL;
+		const other = await Builder.create()
+			.withHttpProvider(FastifyProvider)
+			.withControllers(EchoController)
+			.build();
+		try {
+			const originB = await listenEphemeral(other);
+			expect(originA).not.toBe(originB);
+			expect(originB).toMatch(/^http:\/\/127\.0\.0\.1:\d+$/);
+		} finally {
+			await other.dispose();
+		}
+	});
+
+	it("dispose drains scribe after the container", async () => {
+		const stop = vi.spyOn(scribe, "stop").mockResolvedValue();
+		await app.dispose();
+		expect(stop).toHaveBeenCalledOnce();
+		stop.mockRestore();
+	});
+});
+
+describe("App container dispose", () => {
+	class SocketHub {
+		public closed = false;
+		public async [Symbol.asyncDispose]() {
+			this.closed = true;
+		}
+	}
+
+	it("closes HTTP and constructed DI services on dispose", async () => {
+		let hub: SocketHub | undefined;
+		const builder = Builder.create()
+			.withHttpProvider(FastifyProvider)
+			.withControllers(EchoController)
+			.withServices((cb) => {
+				cb.registerSingleton(SocketHub);
+			});
+		builder.registerPostBuildStep((container) => {
+			hub = container.resolve(SocketHub);
+		});
+		const disposable = await builder.build();
+		const origin = await listenEphemeral(disposable);
+		await axios.get(`${origin}/echo`);
+
+		await disposable.dispose();
+		await disposable.dispose();
+
+		expect(hub?.closed).toBe(true);
+		await expect(axios.get(`${origin}/echo`, { timeout: 1_000 })).rejects.toThrow();
+	});
+});

package/tests/auth.ability.spec.ts

@@ -0,0 +1,48 @@
+import { describe, expect, it } from "vitest";
+import {
+	ADMIN_ROLE,
+	createPrincipalFromPayload,
+	defineAbilitiesFor,
+} from "../src/auth/ability.js";
+import { CaslAuthorizationService } from "../src/auth/casl-authorization.service.js";
+import { ForbiddenError } from "../src/routing/anvil.types.js";
+
+describe("defineAbilitiesFor", () => {
+	it("grants manage/all for the admin role", async () => {
+		const svc = new CaslAuthorizationService(defineAbilitiesFor);
+		await expect(
+			svc.authorize({ sub: "a", roles: [ADMIN_ROLE] }, "delete", "Hello"),
+		).resolves.toBeUndefined();
+		await expect(
+			svc.authorize({ sub: "a", roles: [ADMIN_ROLE] }, "create", "Invoice"),
+		).resolves.toBeUndefined();
+	});
+
+	it("maps action:Subject scopes for non-admin principals", async () => {
+		const svc = new CaslAuthorizationService(defineAbilitiesFor);
+		const user = { sub: "u", scopes: ["read:Hello", "create:Hello"] };
+		await expect(svc.authorize(user, "read", "Hello")).resolves.toBeUndefined();
+		await expect(svc.authorize(user, "create", "Hello")).resolves.toBeUndefined();
+		await expect(svc.authorize(user, "delete", "Hello")).rejects.toThrow(ForbiddenError);
+	});
+});
+
+describe("createPrincipalFromPayload", () => {
+	it("merges scope string and permissions claim", () => {
+		const principal = createPrincipalFromPayload({
+			sub: "auth0|user",
+			scope: "read:Hello openid",
+			permissions: ["create:Hello", "read:Hello"],
+			roles: ["viewer"],
+		});
+		expect(principal.sub).toBe("auth0|user");
+		expect(principal.roles).toEqual(["viewer"]);
+		expect(principal.scopes?.sort()).toEqual(["create:Hello", "openid", "read:Hello"].sort());
+	});
+
+	it("returns undefined roles/scopes when absent", () => {
+		const principal = createPrincipalFromPayload({ sub: "x" });
+		expect(principal.roles).toBeUndefined();
+		expect(principal.scopes).toBeUndefined();
+	});
+});

package/tests/auth.decorators.spec.ts

@@ -0,0 +1,20 @@
+import { describe, expect, it } from "vitest";
+import {
+	Authorize,
+	Controller,
+	Get,
+	getAuthorizeOptions,
+} from "../src/routing/decorators/index.js";
+
+describe("@Authorize decorator", () => {
+	it("defaults subject to 'all' when omitted", () => {
+		@Controller()
+		class TestController {
+			@Authorize("read")
+			@Get("/")
+			public index() {}
+		}
+		const opts = getAuthorizeOptions(TestController.prototype, TestController.prototype.index);
+		expect(opts).toEqual({ action: "read", subject: "all" });
+	});
+});

package/tests/auth.fail-closed.pentest.spec.ts

@@ -0,0 +1,77 @@
+import axios from "axios";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import type { App } from "../src/app/app.js";
+import { AuthConfig } from "../src/auth/auth.config.js";
+import "../src/auth/auth.extensions.js";
+import { Builder } from "../src/builder/builder.js";
+import "../src/http/http.extensions.js";
+import type { IConfigurationService } from "@decohere/core/configuration";
+import { ConfigurationServiceToken } from "@decohere/core/configuration";
+import type { Constructable } from "@decohere/core/reflection";
+import { FastifyProvider } from "../src/providers/fastify.provider.js";
+import { AllowAnonymous, Controller, Get } from "../src/routing/index.js";
+import { listenEphemeral } from "./helpers/listen-ephemeral.js";
+
+class DevStaticConfigService implements IConfigurationService {
+	public get dataSources() {
+		return [];
+	}
+	public async get<T extends object>(type: Constructable<T> | string): Promise<T> {
+		if (type === AuthConfig) {
+			const config = new AuthConfig();
+			config.devStatic = { sub: "dev-user", scopes: ["read:Article"] };
+			return config as unknown as T;
+		}
+		return {} as T;
+	}
+}
+
+/** No @Authorize / @AllowAnonymous — must not be open when auth is enabled. */
+@Controller()
+class UndecoratedController {
+	@Get("/open-by-mistake")
+	public openByMistake() {
+		return { ok: true };
+	}
+
+	@AllowAnonymous()
+	@Get("/explicit-open")
+	public explicitOpen() {
+		return { ok: true };
+	}
+}
+
+describe("pen-test — fail closed undecorated routes with withAuth", () => {
+	let app: App;
+
+	beforeEach(async () => {
+		vi.stubEnv("NODE_ENV", "development");
+
+		app = await Builder.create()
+			.withHttpProvider(FastifyProvider)
+			.withServices((c) => {
+				c.registerSingleton(ConfigurationServiceToken, new DevStaticConfigService());
+			})
+			.withAuth()
+			.withControllers(UndecoratedController)
+			.build();
+
+		axios.defaults.baseURL = await listenEphemeral(app);
+	});
+
+	afterEach(async () => {
+		await app.dispose();
+		vi.unstubAllEnvs();
+	});
+
+	it("rejects unauthenticated access to an undecorated route when auth is enabled", async () => {
+		await expect(axios.get("/undecorated/open-by-mistake")).rejects.toMatchObject({
+			response: { status: 401 },
+		});
+	});
+
+	it("still allows explicitly @AllowAnonymous routes", async () => {
+		const res = await axios.get("/undecorated/explicit-open");
+		expect(res.status).toBe(200);
+	});
+});

package/tests/auth.integration.spec.ts

@@ -0,0 +1,234 @@
+import axios from "axios";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import type { App } from "../src/app/app.js";
+import { AuthConfig } from "../src/auth/auth.config.js";
+import "../src/auth/auth.extensions.js";
+import type { IPrincipalProvider } from "../src/auth/principal-provider.js";
+import { Builder } from "../src/builder/builder.js";
+import { IPrincipalProviderToken } from "../src/const.js";
+import "../src/http/http.extensions.js";
+import { inject } from "@decohere/di/decorators";
+import type { IConfigurationService } from "@decohere/core/configuration";
+import { ConfigurationServiceToken } from "@decohere/core/configuration";
+import type { Constructable } from "@decohere/core/reflection";
+import type { Principal } from "../src/auth/auth.types.js";
+import { FastifyProvider } from "../src/providers/fastify.provider.js";
+import {
+	AllowAnonymous,
+	Authorize,
+	Controller,
+	CurrentUser,
+	Get,
+	Query,
+} from "../src/routing/index.js";
+import { listenEphemeral } from "./helpers/listen-ephemeral.js";
+
+// Provides devStatic auth config — no JWT signing required.
+class DevStaticConfigService implements IConfigurationService {
+	public get dataSources() {
+		return [];
+	}
+	public async get<T extends object>(type: Constructable<T> | string): Promise<T> {
+		if (type === AuthConfig) {
+			const config = new AuthConfig();
+			config.devStatic = { sub: "dev-user", scopes: ["read:Article"] };
+			return config as unknown as T;
+		}
+		return {} as T;
+	}
+}
+
+// Defined at module scope so decorator metadata is stable across all tests.
+// Class name "GuardController" → prefix "guard" → routes at /guard/...
+@Controller()
+class GuardController {
+	public constructor(
+		@inject(IPrincipalProviderToken) private readonly principalProvider: IPrincipalProvider,
+	) {}
+
+	@Authorize("read", "Article")
+	@Get("/me")
+	public me(@CurrentUser() user: Principal) {
+		return { sub: user?.sub };
+	}
+
+	@Authorize("read", "Article")
+	@Get("/me-search")
+	public meSearch(@CurrentUser() user: Principal, @Query("q") q: string) {
+		return { sub: user?.sub, q };
+	}
+
+	@Authorize("read", "Article")
+	@Get("/protected")
+	public secure() {
+		return { sub: this.principalProvider.currentPrincipal?.sub };
+	}
+
+	@Authorize("delete", "Article")
+	@Get("/admin")
+	public admin() {
+		return { ok: true };
+	}
+
+	@AllowAnonymous()
+	@Get("/open")
+	public open() {
+		return { ok: true };
+	}
+}
+
+// Class-level @Authorize — methods inherit unless they override or opt out.
+@Authorize("read", "Article")
+@Controller()
+class ClassAuthController {
+	@Get("/inherited")
+	public inherited() {
+		return { ok: true };
+	}
+
+	@AllowAnonymous()
+	@Get("/opt-out")
+	public optOut() {
+		return { ok: true };
+	}
+
+	@Authorize("delete", "Article")
+	@Get("/override")
+	public override() {
+		return { ok: true };
+	}
+}
+
+describe("Auth integration — devStatic", () => {
+	let app: App;
+
+	beforeEach(async () => {
+		vi.stubEnv("NODE_ENV", "development");
+
+		app = await Builder.create()
+			.withHttpProvider(FastifyProvider)
+			.withServices((c) => {
+				c.registerSingleton(ConfigurationServiceToken, new DevStaticConfigService());
+			})
+			.withAuth()
+			.withControllers(GuardController, ClassAuthController)
+			.build();
+
+		axios.defaults.baseURL = await listenEphemeral(app);
+	});
+
+	afterEach(async () => {
+		await app.dispose();
+		vi.unstubAllEnvs();
+	});
+
+	describe("@AllowAnonymous", () => {
+		it("allows requests with no token", async () => {
+			const res = await axios.get("/guard/open");
+			expect(res.status).toBe(200);
+			expect(res.data).toEqual({ ok: true });
+		});
+	});
+
+	describe("missing token", () => {
+		it("returns 401 when no Authorization header is present", async () => {
+			await expect(axios.get("/guard/protected")).rejects.toMatchObject({
+				response: { status: 401 },
+			});
+		});
+
+		it("returns a generic Unauthorized body (no internal auth detail)", async () => {
+			const res = await axios.get("/guard/protected", { validateStatus: () => true });
+			expect(res.status).toBe(401);
+			expect(res.data).toEqual({ message: "Unauthorized" });
+			expect(JSON.stringify(res.data)).not.toMatch(/Authorization|header|Bearer/i);
+		});
+
+		it("returns 401 when the Authorization header has no Bearer prefix", async () => {
+			await expect(
+				axios.get("/guard/protected", { headers: { Authorization: "any-token" } }),
+			).rejects.toMatchObject({ response: { status: 401 } });
+		});
+
+		it("sanitizes malformed Authorization header bodies to Unauthorized", async () => {
+			const res = await axios.get("/guard/protected", {
+				headers: { Authorization: "any-token" },
+				validateStatus: () => true,
+			});
+			expect(res.status).toBe(401);
+			expect(res.data).toEqual({ message: "Unauthorized" });
+		});
+	});
+
+	describe("insufficient ability", () => {
+		it("returns 403 when the principal cannot perform the required action", async () => {
+			// devStatic principal has read:Article but not delete:Article
+			const res = await axios.get("/guard/admin", {
+				headers: { Authorization: "Bearer any-token" },
+				validateStatus: () => true,
+			});
+			expect(res.status).toBe(403);
+			expect(res.data).toEqual({ message: expect.stringMatching(/delete.*Article/) });
+		});
+	});
+
+	describe("authorized access", () => {
+		it("allows the devStatic principal to access a permitted route", async () => {
+			const res = await axios.get("/guard/protected", {
+				headers: { Authorization: "Bearer any-token" },
+			});
+			expect(res.status).toBe(200);
+		});
+
+		it("resolves the principal via IPrincipalProvider", async () => {
+			const res = await axios.get("/guard/protected", {
+				headers: { Authorization: "Bearer any-token" },
+			});
+			expect(res.data).toEqual({ sub: "dev-user" });
+		});
+
+		it("injects the principal through @CurrentUser", async () => {
+			const res = await axios.get("/guard/me", {
+				headers: { Authorization: "Bearer any-token" },
+			});
+			expect(res.status).toBe(200);
+			expect(res.data).toEqual({ sub: "dev-user" });
+		});
+
+		it("injects @CurrentUser alongside a query argument", async () => {
+			const res = await axios.get("/guard/me-search", {
+				headers: { Authorization: "Bearer any-token" },
+				params: { q: "hi" },
+			});
+			expect(res.status).toBe(200);
+			expect(res.data).toEqual({ sub: "dev-user", q: "hi" });
+		});
+	});
+
+	describe("class-level @Authorize", () => {
+		it("protects a method with no decorator using the class-level constraint", async () => {
+			await expect(axios.get("/classauth/inherited")).rejects.toMatchObject({
+				response: { status: 401 },
+			});
+		});
+
+		it("allows access to an inherited route when the principal satisfies the class constraint", async () => {
+			const res = await axios.get("/classauth/inherited", {
+				headers: { Authorization: "Bearer any-token" },
+			});
+			expect(res.status).toBe(200);
+		});
+
+		it("allows anonymous access to a method decorated with @AllowAnonymous", async () => {
+			const res = await axios.get("/classauth/opt-out");
+			expect(res.status).toBe(200);
+		});
+
+		it("uses the method-level constraint when it overrides the class-level one", async () => {
+			// devStatic principal has read:Article but not delete:Article
+			await expect(
+				axios.get("/classauth/override", { headers: { Authorization: "Bearer any-token" } }),
+			).rejects.toMatchObject({ response: { status: 403 } });
+		});
+	});
+});

package/tests/auth.jwks-cache.spec.ts

@@ -0,0 +1,52 @@
+import { createServer, type Server } from "node:http";
+import type { AddressInfo } from "node:net";
+import { exportJWK, generateKeyPair, SignJWT } from "jose";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { TokenService } from "../src/auth/token-service.js";
+
+// #499: in jwksUrl mode the signing keys were fetched again for every token verified.
+// The key set must be created once and reused, so keys are fetched once and then cached.
+describe("TokenService with jwksUrl", () => {
+	let server: Server | undefined;
+
+	afterEach(async () => {
+		vi.unstubAllEnvs();
+		await new Promise((resolve) => server?.close(resolve));
+		server = undefined;
+	});
+
+	it("fetches the key set once across many verifications", async () => {
+		vi.stubEnv("NODE_ENV", "test"); // loopback URLs are only allowed in development/test
+		const { publicKey, privateKey } = await generateKeyPair("RS256");
+		const jwk = { ...(await exportJWK(publicKey)), kid: "k1", alg: "RS256", use: "sig" };
+		let fetches = 0;
+		server = createServer((_req, res) => {
+			fetches++;
+			res.setHeader("content-type", "application/json");
+			res.end(JSON.stringify({ keys: [jwk] }));
+		});
+		await new Promise<void>((resolve) => server?.listen(0, "127.0.0.1", resolve));
+		const { port } = server.address() as AddressInfo;
+
+		const service = new TokenService({
+			jwksUrl: `http://127.0.0.1:${port}/jwks.json`,
+			issuer: "test-issuer",
+			audience: "test-audience",
+		});
+		const mint = (sub: string) =>
+			new SignJWT({})
+				.setProtectedHeader({ alg: "RS256", kid: "k1" })
+				.setSubject(sub)
+				.setIssuer("test-issuer")
+				.setAudience("test-audience")
+				.setExpirationTime("5m")
+				.sign(privateKey);
+
+		for (let i = 0; i < 5; i++) {
+			const principal = await service.verify(await mint(`user-${i}`));
+			expect(principal.sub).toBe(`user-${i}`);
+		}
+
+		expect(fetches).toBe(1);
+	});
+});

package/tests/auth.missing-auth.pentest.spec.ts

@@ -0,0 +1,56 @@
+import { afterEach, describe, expect, it } from "vitest";
+import type { App } from "../src/app/app.js";
+import { Builder } from "../src/builder/builder.js";
+import "../src/http/http.extensions.js";
+import { FastifyProvider } from "../src/providers/fastify.provider.js";
+import { AllowAnonymous, Authorize, Controller, Get } from "../src/routing/index.js";
+import { listenEphemeral } from "./helpers/listen-ephemeral.js";
+
+@Controller({ prefix: "/admin" })
+class AdminController {
+	@Authorize("manage", "all")
+	@Get()
+	public secrets() {
+		return { secret: true };
+	}
+}
+
+@Controller({ prefix: "/public" })
+class PublicController {
+	@AllowAnonymous()
+	@Get()
+	public hello() {
+		return { hello: true };
+	}
+}
+
+// #500: without withAuth() there is nothing to check tokens, and routes marked @Authorize
+// used to be served to anyone. The app must refuse to start instead.
+describe("pen test: @Authorize without withAuth()", () => {
+	let app: App | undefined;
+
+	afterEach(async () => {
+		await app?.dispose();
+		app = undefined;
+	});
+
+	it("refuses to start when a route requires authorization but auth is not configured", async () => {
+		const start = async () => {
+			app = await Builder.create()
+				.withHttp(FastifyProvider)
+				.withControllers(AdminController)
+				.build();
+			await listenEphemeral(app);
+		};
+
+		await expect(start()).rejects.toThrow(/@Authorize.*withAuth/s);
+	});
+
+	it("still starts when no route requires authorization", async () => {
+		app = await Builder.create()
+			.withHttp(FastifyProvider)
+			.withControllers(PublicController)
+			.build();
+		await expect(listenEphemeral(app)).resolves.toBeTruthy();
+	});
+});

package/tests/auth.oidc-ssrf.pentest.spec.ts

@@ -0,0 +1,72 @@
+import { describe, expect, it, vi } from "vitest";
+import { assertSafeOutboundUrl } from "../src/auth/safe-outbound-url.js";
+import { TokenService } from "../src/auth/token-service.js";
+
+/**
+ * Pen test: OIDC discovery / JWKS URL SSRF.
+ *
+ * Scenario: discoveryUrl or a discovery document's jwks_uri points at cloud
+ * metadata / private network. The HTTP package must refuse the fetch instead of making
+ * a server-side request.
+ */
+describe("pen test — OIDC discovery / JWKS SSRF CU-869eh25et", () => {
+	it("rejects discoveryUrl targeting link-local metadata", async () => {
+		const service = new TokenService({
+			discoveryUrl: "http://169.254.169.254",
+			audience: "https://api.example",
+		});
+
+		await expect(service.verify("not.a.jwt")).rejects.toThrow(/blocked|not allowed|https/i);
+	});
+
+	it("rejects explicit jwksUrl targeting private network", async () => {
+		const service = new TokenService({
+			jwksUrl: "https://10.0.0.5/jwks.json",
+			issuer: "https://idp.example",
+			audience: "https://api.example",
+		});
+
+		await expect(service.verify("not.a.jwt")).rejects.toThrow(/blocked|not allowed/i);
+	});
+
+	it("rejects jwks_uri from discovery when it points at metadata", async () => {
+		vi.stubEnv("NODE_ENV", "test");
+		const fetchMock = vi.spyOn(globalThis, "fetch").mockResolvedValue(
+			new Response(
+				JSON.stringify({
+					issuer: "http://127.0.0.1:9",
+					jwks_uri: "http://169.254.169.254/latest/meta-data/",
+				}),
+				{ status: 200, headers: { "Content-Type": "application/json" } },
+			),
+		);
+
+		const service = new TokenService({
+			discoveryUrl: "http://127.0.0.1:9",
+			audience: "https://api.example",
+		});
+
+		await expect(service.verify("not.a.jwt")).rejects.toThrow(
+			/jwks_uri|blocked|not allowed|https/i,
+		);
+		expect(fetchMock).toHaveBeenCalled();
+		fetchMock.mockRestore();
+		vi.unstubAllEnvs();
+	});
+
+	it("assertSafeOutboundUrl allows loopback https/http in test", async () => {
+		vi.stubEnv("NODE_ENV", "test");
+		await expect(
+			assertSafeOutboundUrl("http://127.0.0.1:8080", "discoveryUrl"),
+		).resolves.toBeInstanceOf(URL);
+		vi.unstubAllEnvs();
+	});
+
+	it("assertSafeOutboundUrl blocks http to non-loopback", async () => {
+		vi.stubEnv("NODE_ENV", "test");
+		await expect(
+			assertSafeOutboundUrl("http://93.184.215.14", "discoveryUrl"),
+		).rejects.toThrow(/https/i);
+		vi.unstubAllEnvs();
+	});
+});