@fastify/cookie 6.0.0

package/test/plugin.test-d.ts

@@ -0,0 +1,191 @@
+import fastify, { FastifyInstance, FastifyPluginCallback, FastifyReply, setCookieWrapper } from 'fastify';
+import { Server } from 'http';
+import { expectType } from 'tsd';
+import * as fastifyCookieStar from '..';
+import fastifyCookieDefault, {
+  CookieSerializeOptions,
+  fastifyCookie as fastifyCookieNamed
+} from '..';
+import cookie, { FastifyCookieOptions } from '../plugin';
+
+import fastifyCookieCjsImport = require('..');
+const fastifyCookieCjs = require('..');
+
+const app: FastifyInstance = fastify();
+app.register(fastifyCookieNamed);
+app.register(fastifyCookieDefault);
+app.register(fastifyCookieCjs);
+app.register(fastifyCookieCjsImport.default);
+app.register(fastifyCookieCjsImport.fastifyCookie);
+app.register(fastifyCookieStar.default);
+app.register(fastifyCookieStar.fastifyCookie);
+
+expectType<FastifyPluginCallback<FastifyCookieOptions, Server>>(fastifyCookieNamed);
+expectType<FastifyPluginCallback<FastifyCookieOptions, Server>>(fastifyCookieDefault);
+expectType<FastifyPluginCallback<FastifyCookieOptions, Server>>(fastifyCookieCjsImport.default);
+expectType<FastifyPluginCallback<FastifyCookieOptions, Server>>(fastifyCookieCjsImport.fastifyCookie);
+expectType<FastifyPluginCallback<FastifyCookieOptions, Server>>(fastifyCookieStar.default);
+expectType<FastifyPluginCallback<FastifyCookieOptions, Server>>(
+  fastifyCookieStar.fastifyCookie
+);
+expectType<any>(fastifyCookieCjs);
+
+const server = fastify();
+
+server.register(cookie);
+
+server.after((_err) => {
+  expectType<{ [key: string]: string }>(
+    // See https://github.com/fastify/fastify-cookie#manual-cookie-parsing
+    server.parseCookie('sessionId=aYb4uTIhdBXC')
+  );
+
+  server.get('/', (request, reply) => {
+    const test = request.cookies.test;
+
+    expectType<setCookieWrapper>(reply.cookie);
+    expectType<setCookieWrapper>(reply.setCookie);
+
+    expectType<FastifyReply>(
+      reply
+        .setCookie('test', test, { domain: 'example.com', path: '/' })
+        .clearCookie('foo')
+        .send({ hello: 'world' })
+    );
+  });
+});
+
+const serverWithHttp2 = fastify({ http2: true });
+
+serverWithHttp2.register(cookie);
+
+serverWithHttp2.after(() => {
+  serverWithHttp2.get('/', (request, reply) => {
+    const test = request.cookies.test;
+    reply
+      .setCookie('test', test, { domain: 'example.com', path: '/' })
+      .clearCookie('foo')
+      .send({ hello: 'world' });
+  });
+});
+
+const testSamesiteOptionsApp = fastify();
+
+testSamesiteOptionsApp.register(cookie);
+testSamesiteOptionsApp.after(() => {
+  server.get('/test-samesite-option-true', (request, reply) => {
+    const test = request.cookies.test;
+    reply.setCookie('test', test, { sameSite: true }).send({ hello: 'world' });
+  });
+  server.get('/test-samesite-option-false', (request, reply) => {
+    const test = request.cookies.test;
+    reply.setCookie('test', test, { sameSite: false }).send({ hello: 'world' });
+  });
+  server.get('/test-samesite-option-lax', (request, reply) => {
+    const test = request.cookies.test;
+    reply.setCookie('test', test, { sameSite: 'lax' }).send({ hello: 'world' });
+  });
+  server.get('/test-samesite-option-strict', (request, reply) => {
+    const test = request.cookies.test;
+    reply
+      .setCookie('test', test, { sameSite: 'strict' })
+      .send({ hello: 'world' });
+  });
+  server.get('/test-samesite-option-none', (request, reply) => {
+    const test = request.cookies.test;
+    reply
+      .setCookie('test', test, { sameSite: 'none' })
+      .send({ hello: 'world' });
+  });
+});
+
+const appWithImplicitHttpSigned = fastify();
+
+appWithImplicitHttpSigned.register(cookie, {
+  secret: 'testsecret',
+});
+appWithImplicitHttpSigned.after(() => {
+  server.get('/', (request, reply) => {
+    appWithImplicitHttpSigned.unsignCookie(request.cookies.test);
+    appWithImplicitHttpSigned.unsignCookie('test');
+
+    reply.unsignCookie(request.cookies.test);
+    reply.unsignCookie('test');
+
+    request.unsignCookie(request.cookies.anotherTest);
+    request.unsignCookie('anotherTest');
+
+    reply.send({ hello: 'world' });
+  });
+});
+
+const appWithRotationSecret = fastify();
+
+appWithRotationSecret.register(cookie, {
+  secret: ['testsecret'],
+});
+appWithRotationSecret.after(() => {
+  server.get('/', (request, reply) => {
+    reply.unsignCookie(request.cookies.test);
+    const { valid, renew, value } = reply.unsignCookie('test');
+
+    expectType<boolean>(valid);
+    expectType<boolean>(renew);
+    expectType<string | null>(value);
+
+    reply.send({ hello: 'world' });
+  });
+});
+
+const appWithParseOptions = fastify();
+
+const parseOptions: fastifyCookieStar.CookieSerializeOptions = {
+  domain: 'example.com',
+  encode: (value: string) => value,
+  expires: new Date(),
+  httpOnly: true,
+  maxAge: 3600,
+  path: '/',
+  sameSite: 'lax',
+  secure: true,
+  signed: true,
+};
+expectType<fastifyCookieStar.CookieSerializeOptions>(parseOptions);
+
+appWithParseOptions.register(cookie, {
+  secret: 'testsecret',
+  parseOptions,
+});
+appWithParseOptions.after(() => {
+  server.get('/', (request, reply) => {
+    const { valid, renew, value } = reply.unsignCookie(request.cookies.test);
+
+    expectType<boolean>(valid);
+    expectType<boolean>(renew);
+    expectType<string | null>(value);
+  });
+});
+
+const appWithCustomSigner = fastify()
+
+appWithCustomSigner.register(cookie, {
+  secret: {
+    sign: (x) => x + '.signed',
+    unsign: (x) => {
+      if (x.endsWith('.signed')) { return { renew: false, valid: true, value: x.slice(0, -7) } }
+      return { renew: false, valid: false, value: null }
+    }
+  }
+})
+appWithCustomSigner.after(() => {
+  server.get('/', (request, reply) => {
+    reply.unsignCookie(request.cookies.test)
+    const { valid, renew, value } = reply.unsignCookie('test')
+
+    expectType<boolean>(valid)
+    expectType<boolean>(renew)
+    expectType<string | null>(value)
+
+    reply.send({ hello: 'world' })
+  })
+})

package/test/signer.test.js

@@ -0,0 +1,79 @@
+'use strict'
+
+const { test } = require('tap')
+const sinon = require('sinon')
+const cookieSignature = require('cookie-signature')
+const signerFactory = require('../signer')
+
+test('default', (t) => {
+  t.plan(2)
+
+  const secret = 'my-secret'
+  const signer = signerFactory(secret)
+
+  t.test('signer.sign', (t) => {
+    t.plan(1)
+
+    const input = 'some-value'
+    const result = signer.sign(input)
+
+    t.equal(result, cookieSignature.sign(input, secret))
+  })
+
+  t.test('signer.unsign', (t) => {
+    t.plan(3)
+
+    const input = cookieSignature.sign('some-value', secret)
+    const result = signer.unsign(input)
+
+    t.equal(result.valid, true)
+    t.equal(result.renew, false)
+    t.equal(result.value, 'some-value')
+  })
+})
+
+test('key rotation', (t) => {
+  t.plan(3)
+  const secret1 = 'my-secret-1'
+  const secret2 = 'my-secret-2'
+  const secret3 = 'my-secret-3'
+  const signer = signerFactory([secret1, secret2, secret3])
+  const unsignSpy = sinon.spy(cookieSignature, 'unsign')
+
+  t.beforeEach(() => {
+    unsignSpy.resetHistory()
+  })
+
+  t.test('signer.sign always signs using first key', (t) => {
+    t.plan(1)
+
+    const input = 'some-value'
+    const result = signer.sign(input)
+
+    t.equal(result, cookieSignature.sign(input, secret1))
+  })
+
+  t.test('signer.unsign tries to decode using all keys till it finds', (t) => {
+    t.plan(4)
+
+    const input = cookieSignature.sign('some-value', secret2)
+    const result = signer.unsign(input)
+
+    t.equal(result.valid, true)
+    t.equal(result.renew, true)
+    t.equal(result.value, 'some-value')
+    t.equal(unsignSpy.callCount, 2) // should have returned early when the right key was found
+  })
+
+  t.test('signer.unsign failure response', (t) => {
+    t.plan(4)
+
+    const input = cookieSignature.sign('some-value', 'invalid-secret')
+    const result = signer.unsign(input)
+
+    t.equal(result.valid, false)
+    t.equal(result.renew, false)
+    t.equal(result.value, null)
+    t.equal(unsignSpy.callCount, 3) // should have tried all 3
+  })
+})