@edge-base/server 0.1.1

package/src/__tests__/config.test.ts

@@ -0,0 +1,469 @@
+/**
+ * 서버 단위 테스트 — bundled runtime config + public config route helpers
+ *
+ * 실행: cd packages/server && npx vitest run src/__tests__/config.test.ts
+ */
+
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { parseConfig, setConfig } from '../lib/do-router.js';
+import type { EdgeBaseConfig } from '@edge-base/shared';
+import {
+  parseProcessEnvConfig,
+  resolveStartupConfig,
+} from '../lib/startup-config.js';
+
+afterEach(() => {
+  setConfig({} as EdgeBaseConfig);
+});
+
+async function loadFreshDoRouter() {
+  vi.resetModules();
+  return import('../lib/do-router.js');
+}
+
+function getCaptchaFromRuntime(env: {
+  CAPTCHA_SITE_KEY?: string;
+}): { siteKey: string } | null {
+  if (env.CAPTCHA_SITE_KEY) {
+    return { siteKey: env.CAPTCHA_SITE_KEY };
+  }
+
+  const config = parseConfig();
+  const captchaCfg = (config as { captcha?: { siteKey?: string } }).captcha;
+  if (captchaCfg?.siteKey) {
+    return { siteKey: captchaCfg.siteKey };
+  }
+
+  return null;
+}
+
+describe('parseConfig', () => {
+  it('returns empty object when no startup config has been injected', () => {
+    expect(parseConfig()).toEqual({});
+  });
+
+  it('returns the injected bundled config', () => {
+    const cfg: EdgeBaseConfig = {
+      databases: {
+        shared: {
+          tables: {
+            posts: {},
+          },
+        },
+      },
+    };
+
+    setConfig(cfg);
+
+    expect(parseConfig()).toBe(cfg);
+  });
+
+  it('ignores unrelated runtime input and keeps singleton config authoritative', () => {
+    setConfig({ databases: { shared: { tables: { posts: {} } } } } as EdgeBaseConfig);
+
+    expect(parseConfig({ arbitrary: true })).toEqual({
+      databases: { shared: { tables: { posts: {} } } },
+    });
+  });
+
+  it('empty injected config stays authoritative', () => {
+    setConfig({} as EdgeBaseConfig);
+
+    expect(parseConfig({ arbitrary: true })).toEqual({});
+  });
+
+  it('request-scoped EDGEBASE_CONFIG overrides singleton config', () => {
+    setConfig({ databases: { shared: { tables: { posts: {} } } } } as EdgeBaseConfig);
+
+    expect(parseConfig({
+      EDGEBASE_CONFIG: JSON.stringify({
+        databases: {
+          shared: {
+            tables: {
+              comments: {
+                schema: {
+                  body: { type: 'string' },
+                },
+              },
+            },
+          },
+        },
+      }),
+    })).toEqual({
+      databases: {
+        shared: {
+          tables: {
+            comments: {
+              schema: {
+                body: { type: 'string' },
+              },
+            },
+          },
+        },
+      },
+    });
+  });
+
+  it('fresh module without startup config returns empty object', async () => {
+    const fresh = await loadFreshDoRouter();
+    expect(fresh.parseConfig({ arbitrary: true })).toEqual({});
+  });
+
+  it('fresh module reads request-scoped EDGEBASE_CONFIG when present', async () => {
+    const fresh = await loadFreshDoRouter();
+    expect(fresh.parseConfig({
+      EDGEBASE_CONFIG: JSON.stringify({
+        databases: {
+          shared: {
+            tables: {
+              posts: {
+                schema: {
+                  title: { type: 'string' },
+                },
+              },
+            },
+          },
+        },
+      }),
+    })).toEqual({
+      databases: {
+        shared: {
+          tables: {
+            posts: {
+              schema: {
+                title: { type: 'string' },
+              },
+            },
+          },
+        },
+      },
+    });
+  });
+
+  it('accepts request-scoped EDGEBASE_CONFIG when Wrangler provides it as an object binding', () => {
+    setConfig({ databases: { from: 'singleton' } } as EdgeBaseConfig);
+
+    expect(parseConfig({
+      EDGEBASE_CONFIG: {
+        databases: {
+          shared: {
+            tables: {
+              posts: {
+                schema: {
+                  title: { type: 'string' },
+                },
+              },
+            },
+          },
+        },
+      },
+    })).toEqual({
+      databases: {
+        shared: {
+          tables: {
+            posts: {
+              schema: {
+                title: { type: 'string' },
+              },
+            },
+          },
+        },
+      },
+    });
+  });
+});
+
+describe('startup config resolution', () => {
+  it('prefers process env EDGEBASE_CONFIG over generated or test config', async () => {
+    const resolved = await resolveStartupConfig(
+      {
+        databases: {
+          shared: {
+            tables: {
+              generated: {},
+            },
+          },
+        },
+      },
+      async () => ({
+        default: {
+          databases: {
+            shared: {
+              tables: {
+                fromTest: {},
+              },
+            },
+          },
+        },
+      }),
+      {
+        EDGEBASE_CONFIG: JSON.stringify({
+          databases: {
+            shared: {
+              tables: {
+                fromEnv: {},
+              },
+            },
+          },
+        }),
+      },
+    );
+
+    expect(resolved).toEqual({
+      databases: {
+        shared: {
+          tables: {
+            fromEnv: {},
+          },
+        },
+      },
+    });
+  });
+
+  it('prefers generated config over test config when no process env config exists', async () => {
+    const resolved = await resolveStartupConfig(
+      {
+        databases: {
+          shared: {
+            tables: {
+              generated: {},
+            },
+          },
+        },
+      },
+      async () => ({
+        default: {
+          databases: {
+            shared: {
+              tables: {
+                fromTest: {},
+              },
+            },
+          },
+        },
+      }),
+      {},
+    );
+
+    expect(resolved).toEqual({
+      databases: {
+        shared: {
+          tables: {
+            generated: {},
+          },
+        },
+      },
+    });
+  });
+
+  it('prefers test config in vitest environments', async () => {
+    const resolved = await resolveStartupConfig(
+      {
+        databases: {
+          shared: {
+            tables: {
+              generated: {},
+            },
+          },
+        },
+      },
+      async () => ({
+        default: {
+          databases: {
+            shared: {
+              tables: {
+                fromTest: {},
+              },
+            },
+          },
+        },
+      }),
+      { VITEST: 'true' },
+    );
+
+    expect(resolved).toEqual({
+      databases: {
+        shared: {
+          tables: {
+            fromTest: {},
+          },
+        },
+      },
+    });
+  });
+
+  it('prefers test config when explicitly requested by the caller', async () => {
+    const resolved = await resolveStartupConfig(
+      {
+        databases: {
+          shared: {
+            tables: {
+              generated: {},
+            },
+          },
+        },
+      },
+      async () => ({
+        default: {
+          databases: {
+            shared: {
+              tables: {
+                fromTest: {},
+              },
+            },
+          },
+        },
+      }),
+      {},
+      { preferTestConfig: true },
+    );
+
+    expect(resolved).toEqual({
+      databases: {
+        shared: {
+          tables: {
+            fromTest: {},
+          },
+        },
+      },
+    });
+  });
+
+  it('falls back to test config when generated config is empty', async () => {
+    const resolved = await resolveStartupConfig(
+      {},
+      async () => ({
+        default: {
+          databases: {
+            shared: {
+              tables: {
+                fromTest: {},
+              },
+            },
+          },
+        },
+      }),
+      {},
+    );
+
+    expect(resolved).toEqual({
+      databases: {
+        shared: {
+          tables: {
+            fromTest: {},
+          },
+        },
+      },
+    });
+  });
+
+  it('returns generated config when test config is unavailable', async () => {
+    const resolved = await resolveStartupConfig(
+      {
+        databases: {
+          shared: {
+            tables: {
+              generated: {},
+            },
+          },
+        },
+      },
+      async () => {
+        throw new Error('missing');
+      },
+      {},
+    );
+
+    expect(resolved).toEqual({
+      databases: {
+        shared: {
+          tables: {
+            generated: {},
+          },
+        },
+      },
+    });
+  });
+
+  it('parses process env config safely', () => {
+    expect(parseProcessEnvConfig({
+      EDGEBASE_CONFIG: '{"databases":{"shared":{"tables":{"posts":{}}}}}',
+    })).toEqual({
+      databases: {
+        shared: {
+          tables: {
+            posts: {},
+          },
+        },
+      },
+    });
+  });
+});
+
+describe('public captcha config resolution', () => {
+  it('uses CAPTCHA_SITE_KEY when present', () => {
+    expect(getCaptchaFromRuntime({ CAPTCHA_SITE_KEY: '0x12345' })).toEqual({
+      siteKey: '0x12345',
+    });
+  });
+
+  it('prefers CAPTCHA_SITE_KEY over bundled captcha config', () => {
+    setConfig({ captcha: { siteKey: 'config-key' } } as EdgeBaseConfig);
+
+    expect(getCaptchaFromRuntime({ CAPTCHA_SITE_KEY: 'env-key' })).toEqual({
+      siteKey: 'env-key',
+    });
+  });
+
+  it('falls back to bundled captcha config', () => {
+    setConfig({ captcha: { siteKey: 'config-site-key' } } as EdgeBaseConfig);
+
+    expect(getCaptchaFromRuntime({})).toEqual({
+      siteKey: 'config-site-key',
+    });
+  });
+
+  it('returns null when no captcha config exists', () => {
+    setConfig({ auth: {} } as EdgeBaseConfig);
+
+    expect(getCaptchaFromRuntime({})).toBeNull();
+  });
+});
+
+describe('config materialization', () => {
+  it('accepts empty config', () => {
+    setConfig({} as EdgeBaseConfig);
+
+    expect(parseConfig()).toEqual({});
+  });
+
+  it('preserves nested config structure', () => {
+    const cfg: EdgeBaseConfig = {
+      databases: {
+        shared: {
+          tables: {
+            users: { schema: { name: { type: 'string' } } },
+          },
+        },
+      },
+      auth: { passwordPolicy: { minLength: 12 } },
+    };
+
+    setConfig(cfg);
+
+    expect(parseConfig()).toBe(cfg);
+  });
+});
+
+describe('config route cache headers', () => {
+  it('uses public cache header', () => {
+    const header = 'public, max-age=60, s-maxage=60';
+    expect(header).toContain('public');
+    expect(header).toContain('max-age=60');
+  });
+
+  it('uses CDN cache header', () => {
+    const header = 'public, max-age=60';
+    expect(header).toContain('public');
+  });
+});

package/src/__tests__/cors.test.ts

@@ -0,0 +1,154 @@
+/**
+ * Regression tests for CORS helpers.
+ *
+ * Key regression: when user explicitly configures cors.origin,
+ * localhost must NOT be auto-allowed as an override.
+ */
+import { describe, it, expect } from 'vitest';
+import { Hono } from 'hono';
+import { setConfig } from '../lib/do-router.js';
+import { corsMiddleware, decorateResponseHeaders, isOriginAllowed, wildcardToRegex } from '../middleware/cors.js';
+
+// ─── wildcardToRegex ───
+
+describe('wildcardToRegex', () => {
+  it('matches wildcard subdomain pattern', () => {
+    const re = wildcardToRegex('*.example.com');
+    expect(re.test('https://app.example.com')).toBe(true);
+    expect(re.test('http://app.example.com')).toBe(true);
+    expect(re.test('https://sub.app.example.com')).toBe(true);
+    expect(re.test('https://evil.com')).toBe(false);
+  });
+
+  it('escapes dots in pattern', () => {
+    const re = wildcardToRegex('app.example.com');
+    // Should NOT match appXexampleXcom (dots are literal)
+    expect(re.test('https://appXexampleXcom')).toBe(false);
+    expect(re.test('https://app.example.com')).toBe(true);
+  });
+});
+
+// ─── isOriginAllowed ───
+
+describe('isOriginAllowed', () => {
+  it('allows everything with wildcard "*"', () => {
+    expect(isOriginAllowed('https://anything.com', '*')).toBe(true);
+  });
+
+  it('matches exact origin', () => {
+    expect(isOriginAllowed('https://app.example.com', 'https://app.example.com')).toBe(true);
+    expect(isOriginAllowed('https://other.com', 'https://app.example.com')).toBe(false);
+  });
+
+  it('matches against array of origins', () => {
+    const origins = ['https://app.example.com', 'https://staging.example.com'];
+    expect(isOriginAllowed('https://app.example.com', origins)).toBe(true);
+    expect(isOriginAllowed('https://staging.example.com', origins)).toBe(true);
+    expect(isOriginAllowed('https://evil.com', origins)).toBe(false);
+  });
+
+  it('supports wildcard patterns in array', () => {
+    const origins = ['*.example.com'];
+    expect(isOriginAllowed('https://app.example.com', origins)).toBe(true);
+    expect(isOriginAllowed('https://evil.com', origins)).toBe(false);
+  });
+
+  // ── REGRESSION: localhost must NOT be allowed when not in config ──
+  it('rejects localhost when not in configured origins', () => {
+    const origins = ['https://app.example.com'];
+    expect(isOriginAllowed('http://localhost:3000', origins)).toBe(false);
+    expect(isOriginAllowed('http://127.0.0.1:3000', origins)).toBe(false);
+  });
+
+  it('allows localhost only when explicitly configured', () => {
+    const origins = ['https://app.example.com', 'http://localhost:3000'];
+    expect(isOriginAllowed('http://localhost:3000', origins)).toBe(true);
+  });
+});
+
+describe('corsMiddleware', () => {
+  it('applies CORS headers to downstream JSON responses', async () => {
+    setConfig({
+      cors: {
+        origin: ['http://localhost:5174'],
+        credentials: true,
+      },
+    });
+
+    const app = new Hono();
+    app.use('*', corsMiddleware as never);
+    app.get('/json', (c) => c.json({ ok: true }));
+
+    const res = await app.request('http://localhost/json', {
+      headers: { Origin: 'http://localhost:5174' },
+    });
+
+    expect(res.headers.get('Access-Control-Allow-Origin')).toBe('http://localhost:5174');
+    expect(res.headers.get('Access-Control-Allow-Credentials')).toBe('true');
+    expect(res.headers.get('Vary')).toBe('Origin');
+  });
+
+  it('applies CORS headers even when downstream returns a raw Response', async () => {
+    setConfig({
+      cors: {
+        origin: ['http://localhost:5174'],
+        credentials: true,
+      },
+    });
+
+    const app = new Hono();
+    app.use('*', corsMiddleware as never);
+    app.get('/raw', () => new Response(JSON.stringify({ ok: true }), {
+      headers: { 'Content-Type': 'application/json' },
+    }));
+
+    const res = await app.request('http://localhost/raw', {
+      headers: { Origin: 'http://localhost:5174' },
+    });
+
+    expect(res.headers.get('Access-Control-Allow-Origin')).toBe('http://localhost:5174');
+    expect(res.headers.get('Access-Control-Allow-Credentials')).toBe('true');
+    expect(res.headers.get('Vary')).toBe('Origin');
+  });
+
+  it('includes canonical auth headers in preflight allow-headers', async () => {
+    setConfig({
+      cors: {
+        origin: ['http://localhost:5174'],
+        credentials: true,
+      },
+    });
+
+    const app = new Hono();
+    app.use('*', corsMiddleware as never);
+    app.options('/preflight', (c) => c.body(null, 204));
+
+    const res = await app.request('http://localhost/preflight', {
+      method: 'OPTIONS',
+      headers: {
+        Origin: 'http://localhost:5174',
+        'Access-Control-Request-Method': 'POST',
+        'Access-Control-Request-Headers': 'X-EdgeBase-Service-Key',
+      },
+    });
+
+    expect(res.headers.get('Access-Control-Allow-Headers')).toContain('X-EdgeBase-Service-Key');
+  });
+
+  it('leaves websocket upgrade responses untouched', () => {
+    const upgradeResponse = {
+      status: 101,
+      headers: new Headers(),
+    } as Response;
+
+    const decorated = decorateResponseHeaders(upgradeResponse, {
+      allowOrigin: 'http://localhost:5174',
+      allowMethods: 'GET, POST',
+      allowHeaders: 'Content-Type',
+      allowCredentials: true,
+      maxAge: '86400',
+    });
+
+    expect(decorated).toBe(upgradeResponse);
+  });
+});