@geekmidas/testkit 10.0.0-alpha.43 → 10.0.0-alpha.45
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/browser.cjs +23 -1
- package/dist/browser.cjs.map +1 -1
- package/dist/browser.d.cts +15 -0
- package/dist/browser.d.cts.map +1 -1
- package/dist/browser.d.mts +15 -0
- package/dist/browser.d.mts.map +1 -1
- package/dist/browser.mjs +23 -1
- package/dist/browser.mjs.map +1 -1
- package/package.json +7 -7
package/dist/browser.cjs
CHANGED
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
|
|
2
2
|
const require_context = require("./context.cjs");
|
|
3
|
+
let node_crypto = require("node:crypto");
|
|
3
4
|
let tough_cookie = require("tough-cookie");
|
|
4
5
|
//#region src/browser.ts
|
|
5
6
|
/**
|
|
@@ -26,6 +27,16 @@ var Browser = class {
|
|
|
26
27
|
/** The cookies this browser holds. */
|
|
27
28
|
jar = new tough_cookie.CookieJar();
|
|
28
29
|
/**
|
|
30
|
+
* The address this browser connects from, sent as `x-forwarded-for` the way
|
|
31
|
+
* a proxy in front of the app adds it. Each browser is a different person on
|
|
32
|
+
* a different connection, so what an app keys by client — an auth server's
|
|
33
|
+
* rate limit — counts each on its own. Without it every browser was the same
|
|
34
|
+
* client, and concurrent tests queued on the same rate-limit row of each
|
|
35
|
+
* other's open transactions. A request that sets the header itself — a test
|
|
36
|
+
* that is several machines — keeps its own.
|
|
37
|
+
*/
|
|
38
|
+
address;
|
|
39
|
+
/**
|
|
29
40
|
* This browser's `fetch`: cookies from the jar on the way out, `Set-Cookie`
|
|
30
41
|
* into the jar on the way back, redirects followed hop by hop so each hop's
|
|
31
42
|
* cookies are kept.
|
|
@@ -38,6 +49,7 @@ var Browser = class {
|
|
|
38
49
|
send;
|
|
39
50
|
constructor(options = {}) {
|
|
40
51
|
this.send = options.fetch ?? globalThis.fetch;
|
|
52
|
+
this.address = options.address ?? privateAddress();
|
|
41
53
|
this.fetch = (input, init) => {
|
|
42
54
|
if (require_context.currentTestContext()?.side === "server") return this.send(input, init);
|
|
43
55
|
return this.start(new Request(input, init), init?.redirect);
|
|
@@ -65,10 +77,12 @@ var Browser = class {
|
|
|
65
77
|
/** Read the body once, so a redirect that keeps the method can send it again. */
|
|
66
78
|
async start(request, redirect) {
|
|
67
79
|
const body = request.method === "GET" || request.method === "HEAD" ? void 0 : await request.arrayBuffer();
|
|
80
|
+
const headers = new Headers(request.headers);
|
|
81
|
+
if (!headers.has("x-forwarded-for")) headers.set("x-forwarded-for", this.address);
|
|
68
82
|
return this.request({
|
|
69
83
|
url: request.url,
|
|
70
84
|
method: request.method,
|
|
71
|
-
headers
|
|
85
|
+
headers,
|
|
72
86
|
body
|
|
73
87
|
}, redirect);
|
|
74
88
|
}
|
|
@@ -120,6 +134,14 @@ var TooManyRedirects = class extends Error {
|
|
|
120
134
|
this.name = "TooManyRedirects";
|
|
121
135
|
}
|
|
122
136
|
};
|
|
137
|
+
/**
|
|
138
|
+
* An address from 10.0.0.0/8, which nothing routes to. Random rather than
|
|
139
|
+
* counted: test files run in separate workers that share no counter.
|
|
140
|
+
*/
|
|
141
|
+
function privateAddress() {
|
|
142
|
+
const n = (0, node_crypto.randomInt)(1, 2 ** 24 - 1);
|
|
143
|
+
return `10.${n >> 16 & 255}.${n >> 8 & 255}.${n & 255}`;
|
|
144
|
+
}
|
|
123
145
|
//#endregion
|
|
124
146
|
exports.Browser = Browser;
|
|
125
147
|
exports.TooManyRedirects = TooManyRedirects;
|
package/dist/browser.cjs.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"browser.cjs","names":["CookieJar","currentTestContext"],"sources":["../src/browser.ts"],"sourcesContent":["/**\n * A browser, for tests: a `fetch` that keeps cookies the way a browser does.\n *\n * An app's real clients — its typed API client, better-auth's client — run on\n * whatever `fetch` they are given. Give them this one and a test signs in the\n * way a person does: the auth server's `Set-Cookie` lands in the jar, and every\n * later request to a URL the cookie belongs to carries it. The jar follows the\n * browser's rules (RFC 6265 — Domain, Path, Secure, Expires), so a cookie set\n * for the wrong domain is not sent, exactly as a browser would not send it.\n *\n * Extend it once per app with that app's clients:\n *\n * ```ts\n * export class Browser extends TestBrowser {\n * readonly api = createApi({ baseURL: process.env.API_URL, fetch: this.fetch });\n * }\n * ```\n */\n\nimport { CookieJar } from 'tough-cookie';\nimport { currentTestContext } from './context';\n\n/** How many redirects `fetch` follows before giving up, as browsers do. */\nconst MAX_REDIRECTS = 20;\n\nexport interface BrowserOptions {\n\t/**\n\t * The `fetch` requests go out on. Defaults to the global one at the time\n\t * the browser is created — so a browser made inside a test goes through\n\t * whatever the test installed (MSW, the context stamp) and never through\n\t * itself once installed.\n\t */\n\tfetch?: typeof fetch;\n}\n\nexport class Browser {\n\t/** The cookies this browser holds. */\n\treadonly jar = new CookieJar();\n\n\t/**\n\t * This browser's `fetch`: cookies from the jar on the way out, `Set-Cookie`\n\t * into the jar on the way back, redirects followed hop by hop so each hop's\n\t * cookies are kept.\n\t *\n\t * On the server side of a test — a handler serving a request — it is the\n\t * plain `fetch`: a server forwards what it was handed and never reaches into\n\t * a browser's jar.\n\t */\n\treadonly fetch: typeof fetch;\n\n\tprivate readonly send: typeof fetch;\n\n\tconstructor(options: BrowserOptions = {}) {\n\t\tthis.send = options.fetch ?? globalThis.fetch;\n\t\tthis.fetch = (input, init) => {\n\t\t\tif (currentTestContext()?.side === 'server') {\n\t\t\t\treturn this.send(input, init);\n\t\t\t}\n\t\t\treturn this.start(new Request(input, init), init?.redirect);\n\t\t};\n\t}\n\n\t/** Open a URL the way clicking a link does: a GET, redirects followed. */\n\tvisit(url: string | URL): Promise<Response> {\n\t\treturn this.fetch(String(url));\n\t}\n\n\t/** The cookies this browser would send to `url`, as a header value. */\n\tcookieHeader(url: string | URL): Promise<string> {\n\t\treturn this.jar.getCookieString(String(url));\n\t}\n\n\t/**\n\t * Make this browser the global `fetch`, for code that uses the global one —\n\t * an app's module-level clients. Returns what puts the previous one back.\n\t */\n\tinstall(): () => void {\n\t\tconst previous = globalThis.fetch;\n\t\tglobalThis.fetch = this.fetch;\n\t\treturn () => {\n\t\t\tglobalThis.fetch = previous;\n\t\t};\n\t}\n\n\t/** Read the body once, so a redirect that keeps the method can send it again. */\n\tprivate async start(\n\t\trequest: Request,\n\t\tredirect: RequestInit['redirect'],\n\t): Promise<Response> {\n\t\tconst body =\n\t\t\trequest.method === 'GET' || request.method === 'HEAD'\n\t\t\t\t? undefined\n\t\t\t\t: await request.arrayBuffer();\n\t\
|
|
1
|
+
{"version":3,"file":"browser.cjs","names":["CookieJar","currentTestContext","randomInt"],"sources":["../src/browser.ts"],"sourcesContent":["/**\n * A browser, for tests: a `fetch` that keeps cookies the way a browser does.\n *\n * An app's real clients — its typed API client, better-auth's client — run on\n * whatever `fetch` they are given. Give them this one and a test signs in the\n * way a person does: the auth server's `Set-Cookie` lands in the jar, and every\n * later request to a URL the cookie belongs to carries it. The jar follows the\n * browser's rules (RFC 6265 — Domain, Path, Secure, Expires), so a cookie set\n * for the wrong domain is not sent, exactly as a browser would not send it.\n *\n * Extend it once per app with that app's clients:\n *\n * ```ts\n * export class Browser extends TestBrowser {\n * readonly api = createApi({ baseURL: process.env.API_URL, fetch: this.fetch });\n * }\n * ```\n */\n\nimport { randomInt } from 'node:crypto';\nimport { CookieJar } from 'tough-cookie';\nimport { currentTestContext } from './context';\n\n/** How many redirects `fetch` follows before giving up, as browsers do. */\nconst MAX_REDIRECTS = 20;\n\nexport interface BrowserOptions {\n\t/**\n\t * The `fetch` requests go out on. Defaults to the global one at the time\n\t * the browser is created — so a browser made inside a test goes through\n\t * whatever the test installed (MSW, the context stamp) and never through\n\t * itself once installed.\n\t */\n\tfetch?: typeof fetch;\n\t/**\n\t * The address this browser connects from. A fresh one by default, from a\n\t * private range nothing routes to — see {@link Browser.address}.\n\t */\n\taddress?: string;\n}\n\nexport class Browser {\n\t/** The cookies this browser holds. */\n\treadonly jar = new CookieJar();\n\n\t/**\n\t * The address this browser connects from, sent as `x-forwarded-for` the way\n\t * a proxy in front of the app adds it. Each browser is a different person on\n\t * a different connection, so what an app keys by client — an auth server's\n\t * rate limit — counts each on its own. Without it every browser was the same\n\t * client, and concurrent tests queued on the same rate-limit row of each\n\t * other's open transactions. A request that sets the header itself — a test\n\t * that is several machines — keeps its own.\n\t */\n\treadonly address: string;\n\n\t/**\n\t * This browser's `fetch`: cookies from the jar on the way out, `Set-Cookie`\n\t * into the jar on the way back, redirects followed hop by hop so each hop's\n\t * cookies are kept.\n\t *\n\t * On the server side of a test — a handler serving a request — it is the\n\t * plain `fetch`: a server forwards what it was handed and never reaches into\n\t * a browser's jar.\n\t */\n\treadonly fetch: typeof fetch;\n\n\tprivate readonly send: typeof fetch;\n\n\tconstructor(options: BrowserOptions = {}) {\n\t\tthis.send = options.fetch ?? globalThis.fetch;\n\t\tthis.address = options.address ?? privateAddress();\n\t\tthis.fetch = (input, init) => {\n\t\t\tif (currentTestContext()?.side === 'server') {\n\t\t\t\treturn this.send(input, init);\n\t\t\t}\n\t\t\treturn this.start(new Request(input, init), init?.redirect);\n\t\t};\n\t}\n\n\t/** Open a URL the way clicking a link does: a GET, redirects followed. */\n\tvisit(url: string | URL): Promise<Response> {\n\t\treturn this.fetch(String(url));\n\t}\n\n\t/** The cookies this browser would send to `url`, as a header value. */\n\tcookieHeader(url: string | URL): Promise<string> {\n\t\treturn this.jar.getCookieString(String(url));\n\t}\n\n\t/**\n\t * Make this browser the global `fetch`, for code that uses the global one —\n\t * an app's module-level clients. Returns what puts the previous one back.\n\t */\n\tinstall(): () => void {\n\t\tconst previous = globalThis.fetch;\n\t\tglobalThis.fetch = this.fetch;\n\t\treturn () => {\n\t\t\tglobalThis.fetch = previous;\n\t\t};\n\t}\n\n\t/** Read the body once, so a redirect that keeps the method can send it again. */\n\tprivate async start(\n\t\trequest: Request,\n\t\tredirect: RequestInit['redirect'],\n\t): Promise<Response> {\n\t\tconst body =\n\t\t\trequest.method === 'GET' || request.method === 'HEAD'\n\t\t\t\t? undefined\n\t\t\t\t: await request.arrayBuffer();\n\t\tconst headers = new Headers(request.headers);\n\t\tif (!headers.has('x-forwarded-for')) {\n\t\t\theaders.set('x-forwarded-for', this.address);\n\t\t}\n\t\treturn this.request(\n\t\t\t{ url: request.url, method: request.method, headers, body },\n\t\t\tredirect,\n\t\t);\n\t}\n\n\tprivate async request(\n\t\trequest: Hop,\n\t\tredirect: RequestInit['redirect'],\n\t\thops = 0,\n\t): Promise<Response> {\n\t\tconst headers = new Headers(request.headers);\n\t\tconst cookie = await this.jar.getCookieString(request.url);\n\t\tif (cookie) {\n\t\t\tconst existing = headers.get('cookie');\n\t\t\theaders.set('cookie', existing ? `${existing}; ${cookie}` : cookie);\n\t\t}\n\n\t\tconst response = await this.send(request.url, {\n\t\t\tmethod: request.method,\n\t\t\theaders,\n\t\t\tbody: request.body,\n\t\t\tredirect: 'manual',\n\t\t});\n\n\t\tfor (const set of response.headers.getSetCookie()) {\n\t\t\t// A cookie a browser would refuse — the wrong domain, Secure over\n\t\t\t// plain HTTP — is dropped silently, as a browser drops it.\n\t\t\tawait this.jar.setCookie(set, request.url, { ignoreError: true });\n\t\t}\n\n\t\tconst location = response.headers.get('location');\n\t\tif (\n\t\t\tredirect === 'manual' ||\n\t\t\t!location ||\n\t\t\tresponse.status < 300 ||\n\t\t\tresponse.status >= 400\n\t\t) {\n\t\t\treturn response;\n\t\t}\n\n\t\tif (hops >= MAX_REDIRECTS) {\n\t\t\tthrow new TooManyRedirects(request.url, MAX_REDIRECTS);\n\t\t}\n\n\t\t// 303, and 301/302 after a POST, continue as a GET without a body — what\n\t\t// every browser does, whatever the spec once said about 302.\n\t\tconst keepsMethod =\n\t\t\tresponse.status === 307 ||\n\t\t\tresponse.status === 308 ||\n\t\t\trequest.method === 'GET' ||\n\t\t\trequest.method === 'HEAD';\n\n\t\tconst url = new URL(location, request.url).toString();\n\t\tconst next: Hop = keepsMethod\n\t\t\t? { ...request, url }\n\t\t\t: { url, method: 'GET', headers: withoutBody(request.headers) };\n\n\t\treturn this.request(next, redirect, hops + 1);\n\t}\n}\n\n/** One request in a redirect chain, with its body already read. */\ninterface Hop {\n\turl: string;\n\tmethod: string;\n\theaders: Headers;\n\tbody?: ArrayBuffer;\n}\n\n/** Headers for a request that no longer carries the body they described. */\nfunction withoutBody(headers: Headers): Headers {\n\tconst next = new Headers(headers);\n\tnext.delete('content-type');\n\tnext.delete('content-length');\n\treturn next;\n}\n\n/** A redirect chain longer than any browser follows. */\nexport class TooManyRedirects extends Error {\n\tconstructor(\n\t\treadonly url: string,\n\t\treadonly limit: number,\n\t) {\n\t\tsuper(\n\t\t\t`${url} redirected more than ${limit} times. A browser gives up here ` +\n\t\t\t\t`too — look for a redirect loop.`,\n\t\t);\n\t\tthis.name = 'TooManyRedirects';\n\t}\n}\n\n/**\n * An address from 10.0.0.0/8, which nothing routes to. Random rather than\n * counted: test files run in separate workers that share no counter.\n */\nfunction privateAddress(): string {\n\tconst n = randomInt(1, 2 ** 24 - 1);\n\treturn `10.${(n >> 16) & 255}.${(n >> 8) & 255}.${n & 255}`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAwBA,MAAM,gBAAgB;AAiBtB,IAAa,UAAb,MAAqB;;CAEpB,MAAe,IAAIA,aAAAA,UAAU;;;;;;;;;;CAW7B;;;;;;;;;;CAWA;CAEA;CAEA,YAAY,UAA0B,CAAC,GAAG;EACzC,KAAK,OAAO,QAAQ,SAAS,WAAW;EACxC,KAAK,UAAU,QAAQ,WAAW,eAAe;EACjD,KAAK,SAAS,OAAO,SAAS;GAC7B,IAAIC,gBAAAA,mBAAmB,CAAC,EAAE,SAAS,UAClC,OAAO,KAAK,KAAK,OAAO,IAAI;GAE7B,OAAO,KAAK,MAAM,IAAI,QAAQ,OAAO,IAAI,GAAG,MAAM,QAAQ;EAC3D;CACD;;CAGA,MAAM,KAAsC;EAC3C,OAAO,KAAK,MAAM,OAAO,GAAG,CAAC;CAC9B;;CAGA,aAAa,KAAoC;EAChD,OAAO,KAAK,IAAI,gBAAgB,OAAO,GAAG,CAAC;CAC5C;;;;;CAMA,UAAsB;EACrB,MAAM,WAAW,WAAW;EAC5B,WAAW,QAAQ,KAAK;EACxB,aAAa;GACZ,WAAW,QAAQ;EACpB;CACD;;CAGA,MAAc,MACb,SACA,UACoB;EACpB,MAAM,OACL,QAAQ,WAAW,SAAS,QAAQ,WAAW,SAC5C,KAAA,IACA,MAAM,QAAQ,YAAY;EAC9B,MAAM,UAAU,IAAI,QAAQ,QAAQ,OAAO;EAC3C,IAAI,CAAC,QAAQ,IAAI,iBAAiB,GACjC,QAAQ,IAAI,mBAAmB,KAAK,OAAO;EAE5C,OAAO,KAAK,QACX;GAAE,KAAK,QAAQ;GAAK,QAAQ,QAAQ;GAAQ;GAAS;EAAK,GAC1D,QACD;CACD;CAEA,MAAc,QACb,SACA,UACA,OAAO,GACa;EACpB,MAAM,UAAU,IAAI,QAAQ,QAAQ,OAAO;EAC3C,MAAM,SAAS,MAAM,KAAK,IAAI,gBAAgB,QAAQ,GAAG;EACzD,IAAI,QAAQ;GACX,MAAM,WAAW,QAAQ,IAAI,QAAQ;GACrC,QAAQ,IAAI,UAAU,WAAW,GAAG,SAAS,IAAI,WAAW,MAAM;EACnE;EAEA,MAAM,WAAW,MAAM,KAAK,KAAK,QAAQ,KAAK;GAC7C,QAAQ,QAAQ;GAChB;GACA,MAAM,QAAQ;GACd,UAAU;EACX,CAAC;EAED,KAAK,MAAM,OAAO,SAAS,QAAQ,aAAa,GAG/C,MAAM,KAAK,IAAI,UAAU,KAAK,QAAQ,KAAK,EAAE,aAAa,KAAK,CAAC;EAGjE,MAAM,WAAW,SAAS,QAAQ,IAAI,UAAU;EAChD,IACC,aAAa,YACb,CAAC,YACD,SAAS,SAAS,OAClB,SAAS,UAAU,KAEnB,OAAO;EAGR,IAAI,QAAQ,eACX,MAAM,IAAI,iBAAiB,QAAQ,KAAK,aAAa;EAKtD,MAAM,cACL,SAAS,WAAW,OACpB,SAAS,WAAW,OACpB,QAAQ,WAAW,SACnB,QAAQ,WAAW;EAEpB,MAAM,MAAM,IAAI,IAAI,UAAU,QAAQ,GAAG,CAAC,CAAC,SAAS;EACpD,MAAM,OAAY,cACf;GAAE,GAAG;GAAS;EAAI,IAClB;GAAE;GAAK,QAAQ;GAAO,SAAS,YAAY,QAAQ,OAAO;EAAE;EAE/D,OAAO,KAAK,QAAQ,MAAM,UAAU,OAAO,CAAC;CAC7C;AACD;;AAWA,SAAS,YAAY,SAA2B;CAC/C,MAAM,OAAO,IAAI,QAAQ,OAAO;CAChC,KAAK,OAAO,cAAc;CAC1B,KAAK,OAAO,gBAAgB;CAC5B,OAAO;AACR;;AAGA,IAAa,mBAAb,cAAsC,MAAM;CAEjC;CACA;CAFV,YACC,KACA,OACC;EACD,MACC,GAAG,IAAI,wBAAwB,MAAM,gEAEtC;EANS,KAAA,MAAA;EACA,KAAA,QAAA;EAMT,KAAK,OAAO;CACb;AACD;;;;;AAMA,SAAS,iBAAyB;CACjC,MAAM,KAAA,GAAIC,YAAAA,UAAAA,CAAU,GAAG,KAAK,KAAK,CAAC;CAClC,OAAO,MAAO,KAAK,KAAM,IAAI,GAAI,KAAK,IAAK,IAAI,GAAG,IAAI;AACvD"}
|
package/dist/browser.d.cts
CHANGED
|
@@ -8,10 +8,25 @@ export interface BrowserOptions {
|
|
|
8
8
|
* itself once installed.
|
|
9
9
|
*/
|
|
10
10
|
fetch?: typeof fetch;
|
|
11
|
+
/**
|
|
12
|
+
* The address this browser connects from. A fresh one by default, from a
|
|
13
|
+
* private range nothing routes to — see {@link Browser.address}.
|
|
14
|
+
*/
|
|
15
|
+
address?: string;
|
|
11
16
|
}
|
|
12
17
|
export declare class Browser {
|
|
13
18
|
/** The cookies this browser holds. */
|
|
14
19
|
readonly jar: CookieJar;
|
|
20
|
+
/**
|
|
21
|
+
* The address this browser connects from, sent as `x-forwarded-for` the way
|
|
22
|
+
* a proxy in front of the app adds it. Each browser is a different person on
|
|
23
|
+
* a different connection, so what an app keys by client — an auth server's
|
|
24
|
+
* rate limit — counts each on its own. Without it every browser was the same
|
|
25
|
+
* client, and concurrent tests queued on the same rate-limit row of each
|
|
26
|
+
* other's open transactions. A request that sets the header itself — a test
|
|
27
|
+
* that is several machines — keeps its own.
|
|
28
|
+
*/
|
|
29
|
+
readonly address: string;
|
|
15
30
|
/**
|
|
16
31
|
* This browser's `fetch`: cookies from the jar on the way out, `Set-Cookie`
|
|
17
32
|
* into the jar on the way back, redirects followed hop by hop so each hop's
|
package/dist/browser.d.cts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"browser.d.cts","names":[],"sources":["../src/browser.ts"],"mappings":";;
|
|
1
|
+
{"version":3,"file":"browser.d.cts","names":[],"sources":["../src/browser.ts"],"mappings":";;iBA0BiB;;;;;;;EAOhB,eAAe;;;;;EAKf;;qBAGY;;WAEH,KAAG;;;;;;;;;;WAWH;;;;;;;;;;WAWA,cAAc;mBAEN;EAEjB,YAAY,UAAS;;EAYrB,MAAM,cAAc,MAAM,QAAQ;;EAKlC,aAAa,cAAc,MAAM;;;;;EAQjC;;UASc;UAkBA;;;qBAyEF,yBAAyB;WAE3B;WACA;EAFV,YACU,aACA"}
|
package/dist/browser.d.mts
CHANGED
|
@@ -8,10 +8,25 @@ export interface BrowserOptions {
|
|
|
8
8
|
* itself once installed.
|
|
9
9
|
*/
|
|
10
10
|
fetch?: typeof fetch;
|
|
11
|
+
/**
|
|
12
|
+
* The address this browser connects from. A fresh one by default, from a
|
|
13
|
+
* private range nothing routes to — see {@link Browser.address}.
|
|
14
|
+
*/
|
|
15
|
+
address?: string;
|
|
11
16
|
}
|
|
12
17
|
export declare class Browser {
|
|
13
18
|
/** The cookies this browser holds. */
|
|
14
19
|
readonly jar: CookieJar;
|
|
20
|
+
/**
|
|
21
|
+
* The address this browser connects from, sent as `x-forwarded-for` the way
|
|
22
|
+
* a proxy in front of the app adds it. Each browser is a different person on
|
|
23
|
+
* a different connection, so what an app keys by client — an auth server's
|
|
24
|
+
* rate limit — counts each on its own. Without it every browser was the same
|
|
25
|
+
* client, and concurrent tests queued on the same rate-limit row of each
|
|
26
|
+
* other's open transactions. A request that sets the header itself — a test
|
|
27
|
+
* that is several machines — keeps its own.
|
|
28
|
+
*/
|
|
29
|
+
readonly address: string;
|
|
15
30
|
/**
|
|
16
31
|
* This browser's `fetch`: cookies from the jar on the way out, `Set-Cookie`
|
|
17
32
|
* into the jar on the way back, redirects followed hop by hop so each hop's
|
package/dist/browser.d.mts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"browser.d.mts","names":[],"sources":["../src/browser.ts"],"mappings":";;
|
|
1
|
+
{"version":3,"file":"browser.d.mts","names":[],"sources":["../src/browser.ts"],"mappings":";;iBA0BiB;;;;;;;EAOhB,eAAe;;;;;EAKf;;qBAGY;;WAEH,KAAG;;;;;;;;;;WAWH;;;;;;;;;;WAWA,cAAc;mBAEN;EAEjB,YAAY,UAAS;;EAYrB,MAAM,cAAc,MAAM,QAAQ;;EAKlC,aAAa,cAAc,MAAM;;;;;EAQjC;;UASc;UAkBA;;;qBAyEF,yBAAyB;WAE3B;WACA;EAFV,YACU,aACA"}
|
package/dist/browser.mjs
CHANGED
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
import { currentTestContext } from "./context.mjs";
|
|
2
|
+
import { randomInt } from "node:crypto";
|
|
2
3
|
import { CookieJar } from "tough-cookie";
|
|
3
4
|
//#region src/browser.ts
|
|
4
5
|
/**
|
|
@@ -25,6 +26,16 @@ var Browser = class {
|
|
|
25
26
|
/** The cookies this browser holds. */
|
|
26
27
|
jar = new CookieJar();
|
|
27
28
|
/**
|
|
29
|
+
* The address this browser connects from, sent as `x-forwarded-for` the way
|
|
30
|
+
* a proxy in front of the app adds it. Each browser is a different person on
|
|
31
|
+
* a different connection, so what an app keys by client — an auth server's
|
|
32
|
+
* rate limit — counts each on its own. Without it every browser was the same
|
|
33
|
+
* client, and concurrent tests queued on the same rate-limit row of each
|
|
34
|
+
* other's open transactions. A request that sets the header itself — a test
|
|
35
|
+
* that is several machines — keeps its own.
|
|
36
|
+
*/
|
|
37
|
+
address;
|
|
38
|
+
/**
|
|
28
39
|
* This browser's `fetch`: cookies from the jar on the way out, `Set-Cookie`
|
|
29
40
|
* into the jar on the way back, redirects followed hop by hop so each hop's
|
|
30
41
|
* cookies are kept.
|
|
@@ -37,6 +48,7 @@ var Browser = class {
|
|
|
37
48
|
send;
|
|
38
49
|
constructor(options = {}) {
|
|
39
50
|
this.send = options.fetch ?? globalThis.fetch;
|
|
51
|
+
this.address = options.address ?? privateAddress();
|
|
40
52
|
this.fetch = (input, init) => {
|
|
41
53
|
if (currentTestContext()?.side === "server") return this.send(input, init);
|
|
42
54
|
return this.start(new Request(input, init), init?.redirect);
|
|
@@ -64,10 +76,12 @@ var Browser = class {
|
|
|
64
76
|
/** Read the body once, so a redirect that keeps the method can send it again. */
|
|
65
77
|
async start(request, redirect) {
|
|
66
78
|
const body = request.method === "GET" || request.method === "HEAD" ? void 0 : await request.arrayBuffer();
|
|
79
|
+
const headers = new Headers(request.headers);
|
|
80
|
+
if (!headers.has("x-forwarded-for")) headers.set("x-forwarded-for", this.address);
|
|
67
81
|
return this.request({
|
|
68
82
|
url: request.url,
|
|
69
83
|
method: request.method,
|
|
70
|
-
headers
|
|
84
|
+
headers,
|
|
71
85
|
body
|
|
72
86
|
}, redirect);
|
|
73
87
|
}
|
|
@@ -119,6 +133,14 @@ var TooManyRedirects = class extends Error {
|
|
|
119
133
|
this.name = "TooManyRedirects";
|
|
120
134
|
}
|
|
121
135
|
};
|
|
136
|
+
/**
|
|
137
|
+
* An address from 10.0.0.0/8, which nothing routes to. Random rather than
|
|
138
|
+
* counted: test files run in separate workers that share no counter.
|
|
139
|
+
*/
|
|
140
|
+
function privateAddress() {
|
|
141
|
+
const n = randomInt(1, 2 ** 24 - 1);
|
|
142
|
+
return `10.${n >> 16 & 255}.${n >> 8 & 255}.${n & 255}`;
|
|
143
|
+
}
|
|
122
144
|
//#endregion
|
|
123
145
|
export { Browser, TooManyRedirects };
|
|
124
146
|
|
package/dist/browser.mjs.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"browser.mjs","names":[],"sources":["../src/browser.ts"],"sourcesContent":["/**\n * A browser, for tests: a `fetch` that keeps cookies the way a browser does.\n *\n * An app's real clients — its typed API client, better-auth's client — run on\n * whatever `fetch` they are given. Give them this one and a test signs in the\n * way a person does: the auth server's `Set-Cookie` lands in the jar, and every\n * later request to a URL the cookie belongs to carries it. The jar follows the\n * browser's rules (RFC 6265 — Domain, Path, Secure, Expires), so a cookie set\n * for the wrong domain is not sent, exactly as a browser would not send it.\n *\n * Extend it once per app with that app's clients:\n *\n * ```ts\n * export class Browser extends TestBrowser {\n * readonly api = createApi({ baseURL: process.env.API_URL, fetch: this.fetch });\n * }\n * ```\n */\n\nimport { CookieJar } from 'tough-cookie';\nimport { currentTestContext } from './context';\n\n/** How many redirects `fetch` follows before giving up, as browsers do. */\nconst MAX_REDIRECTS = 20;\n\nexport interface BrowserOptions {\n\t/**\n\t * The `fetch` requests go out on. Defaults to the global one at the time\n\t * the browser is created — so a browser made inside a test goes through\n\t * whatever the test installed (MSW, the context stamp) and never through\n\t * itself once installed.\n\t */\n\tfetch?: typeof fetch;\n}\n\nexport class Browser {\n\t/** The cookies this browser holds. */\n\treadonly jar = new CookieJar();\n\n\t/**\n\t * This browser's `fetch`: cookies from the jar on the way out, `Set-Cookie`\n\t * into the jar on the way back, redirects followed hop by hop so each hop's\n\t * cookies are kept.\n\t *\n\t * On the server side of a test — a handler serving a request — it is the\n\t * plain `fetch`: a server forwards what it was handed and never reaches into\n\t * a browser's jar.\n\t */\n\treadonly fetch: typeof fetch;\n\n\tprivate readonly send: typeof fetch;\n\n\tconstructor(options: BrowserOptions = {}) {\n\t\tthis.send = options.fetch ?? globalThis.fetch;\n\t\tthis.fetch = (input, init) => {\n\t\t\tif (currentTestContext()?.side === 'server') {\n\t\t\t\treturn this.send(input, init);\n\t\t\t}\n\t\t\treturn this.start(new Request(input, init), init?.redirect);\n\t\t};\n\t}\n\n\t/** Open a URL the way clicking a link does: a GET, redirects followed. */\n\tvisit(url: string | URL): Promise<Response> {\n\t\treturn this.fetch(String(url));\n\t}\n\n\t/** The cookies this browser would send to `url`, as a header value. */\n\tcookieHeader(url: string | URL): Promise<string> {\n\t\treturn this.jar.getCookieString(String(url));\n\t}\n\n\t/**\n\t * Make this browser the global `fetch`, for code that uses the global one —\n\t * an app's module-level clients. Returns what puts the previous one back.\n\t */\n\tinstall(): () => void {\n\t\tconst previous = globalThis.fetch;\n\t\tglobalThis.fetch = this.fetch;\n\t\treturn () => {\n\t\t\tglobalThis.fetch = previous;\n\t\t};\n\t}\n\n\t/** Read the body once, so a redirect that keeps the method can send it again. */\n\tprivate async start(\n\t\trequest: Request,\n\t\tredirect: RequestInit['redirect'],\n\t): Promise<Response> {\n\t\tconst body =\n\t\t\trequest.method === 'GET' || request.method === 'HEAD'\n\t\t\t\t? undefined\n\t\t\t\t: await request.arrayBuffer();\n\t\
|
|
1
|
+
{"version":3,"file":"browser.mjs","names":[],"sources":["../src/browser.ts"],"sourcesContent":["/**\n * A browser, for tests: a `fetch` that keeps cookies the way a browser does.\n *\n * An app's real clients — its typed API client, better-auth's client — run on\n * whatever `fetch` they are given. Give them this one and a test signs in the\n * way a person does: the auth server's `Set-Cookie` lands in the jar, and every\n * later request to a URL the cookie belongs to carries it. The jar follows the\n * browser's rules (RFC 6265 — Domain, Path, Secure, Expires), so a cookie set\n * for the wrong domain is not sent, exactly as a browser would not send it.\n *\n * Extend it once per app with that app's clients:\n *\n * ```ts\n * export class Browser extends TestBrowser {\n * readonly api = createApi({ baseURL: process.env.API_URL, fetch: this.fetch });\n * }\n * ```\n */\n\nimport { randomInt } from 'node:crypto';\nimport { CookieJar } from 'tough-cookie';\nimport { currentTestContext } from './context';\n\n/** How many redirects `fetch` follows before giving up, as browsers do. */\nconst MAX_REDIRECTS = 20;\n\nexport interface BrowserOptions {\n\t/**\n\t * The `fetch` requests go out on. Defaults to the global one at the time\n\t * the browser is created — so a browser made inside a test goes through\n\t * whatever the test installed (MSW, the context stamp) and never through\n\t * itself once installed.\n\t */\n\tfetch?: typeof fetch;\n\t/**\n\t * The address this browser connects from. A fresh one by default, from a\n\t * private range nothing routes to — see {@link Browser.address}.\n\t */\n\taddress?: string;\n}\n\nexport class Browser {\n\t/** The cookies this browser holds. */\n\treadonly jar = new CookieJar();\n\n\t/**\n\t * The address this browser connects from, sent as `x-forwarded-for` the way\n\t * a proxy in front of the app adds it. Each browser is a different person on\n\t * a different connection, so what an app keys by client — an auth server's\n\t * rate limit — counts each on its own. Without it every browser was the same\n\t * client, and concurrent tests queued on the same rate-limit row of each\n\t * other's open transactions. A request that sets the header itself — a test\n\t * that is several machines — keeps its own.\n\t */\n\treadonly address: string;\n\n\t/**\n\t * This browser's `fetch`: cookies from the jar on the way out, `Set-Cookie`\n\t * into the jar on the way back, redirects followed hop by hop so each hop's\n\t * cookies are kept.\n\t *\n\t * On the server side of a test — a handler serving a request — it is the\n\t * plain `fetch`: a server forwards what it was handed and never reaches into\n\t * a browser's jar.\n\t */\n\treadonly fetch: typeof fetch;\n\n\tprivate readonly send: typeof fetch;\n\n\tconstructor(options: BrowserOptions = {}) {\n\t\tthis.send = options.fetch ?? globalThis.fetch;\n\t\tthis.address = options.address ?? privateAddress();\n\t\tthis.fetch = (input, init) => {\n\t\t\tif (currentTestContext()?.side === 'server') {\n\t\t\t\treturn this.send(input, init);\n\t\t\t}\n\t\t\treturn this.start(new Request(input, init), init?.redirect);\n\t\t};\n\t}\n\n\t/** Open a URL the way clicking a link does: a GET, redirects followed. */\n\tvisit(url: string | URL): Promise<Response> {\n\t\treturn this.fetch(String(url));\n\t}\n\n\t/** The cookies this browser would send to `url`, as a header value. */\n\tcookieHeader(url: string | URL): Promise<string> {\n\t\treturn this.jar.getCookieString(String(url));\n\t}\n\n\t/**\n\t * Make this browser the global `fetch`, for code that uses the global one —\n\t * an app's module-level clients. Returns what puts the previous one back.\n\t */\n\tinstall(): () => void {\n\t\tconst previous = globalThis.fetch;\n\t\tglobalThis.fetch = this.fetch;\n\t\treturn () => {\n\t\t\tglobalThis.fetch = previous;\n\t\t};\n\t}\n\n\t/** Read the body once, so a redirect that keeps the method can send it again. */\n\tprivate async start(\n\t\trequest: Request,\n\t\tredirect: RequestInit['redirect'],\n\t): Promise<Response> {\n\t\tconst body =\n\t\t\trequest.method === 'GET' || request.method === 'HEAD'\n\t\t\t\t? undefined\n\t\t\t\t: await request.arrayBuffer();\n\t\tconst headers = new Headers(request.headers);\n\t\tif (!headers.has('x-forwarded-for')) {\n\t\t\theaders.set('x-forwarded-for', this.address);\n\t\t}\n\t\treturn this.request(\n\t\t\t{ url: request.url, method: request.method, headers, body },\n\t\t\tredirect,\n\t\t);\n\t}\n\n\tprivate async request(\n\t\trequest: Hop,\n\t\tredirect: RequestInit['redirect'],\n\t\thops = 0,\n\t): Promise<Response> {\n\t\tconst headers = new Headers(request.headers);\n\t\tconst cookie = await this.jar.getCookieString(request.url);\n\t\tif (cookie) {\n\t\t\tconst existing = headers.get('cookie');\n\t\t\theaders.set('cookie', existing ? `${existing}; ${cookie}` : cookie);\n\t\t}\n\n\t\tconst response = await this.send(request.url, {\n\t\t\tmethod: request.method,\n\t\t\theaders,\n\t\t\tbody: request.body,\n\t\t\tredirect: 'manual',\n\t\t});\n\n\t\tfor (const set of response.headers.getSetCookie()) {\n\t\t\t// A cookie a browser would refuse — the wrong domain, Secure over\n\t\t\t// plain HTTP — is dropped silently, as a browser drops it.\n\t\t\tawait this.jar.setCookie(set, request.url, { ignoreError: true });\n\t\t}\n\n\t\tconst location = response.headers.get('location');\n\t\tif (\n\t\t\tredirect === 'manual' ||\n\t\t\t!location ||\n\t\t\tresponse.status < 300 ||\n\t\t\tresponse.status >= 400\n\t\t) {\n\t\t\treturn response;\n\t\t}\n\n\t\tif (hops >= MAX_REDIRECTS) {\n\t\t\tthrow new TooManyRedirects(request.url, MAX_REDIRECTS);\n\t\t}\n\n\t\t// 303, and 301/302 after a POST, continue as a GET without a body — what\n\t\t// every browser does, whatever the spec once said about 302.\n\t\tconst keepsMethod =\n\t\t\tresponse.status === 307 ||\n\t\t\tresponse.status === 308 ||\n\t\t\trequest.method === 'GET' ||\n\t\t\trequest.method === 'HEAD';\n\n\t\tconst url = new URL(location, request.url).toString();\n\t\tconst next: Hop = keepsMethod\n\t\t\t? { ...request, url }\n\t\t\t: { url, method: 'GET', headers: withoutBody(request.headers) };\n\n\t\treturn this.request(next, redirect, hops + 1);\n\t}\n}\n\n/** One request in a redirect chain, with its body already read. */\ninterface Hop {\n\turl: string;\n\tmethod: string;\n\theaders: Headers;\n\tbody?: ArrayBuffer;\n}\n\n/** Headers for a request that no longer carries the body they described. */\nfunction withoutBody(headers: Headers): Headers {\n\tconst next = new Headers(headers);\n\tnext.delete('content-type');\n\tnext.delete('content-length');\n\treturn next;\n}\n\n/** A redirect chain longer than any browser follows. */\nexport class TooManyRedirects extends Error {\n\tconstructor(\n\t\treadonly url: string,\n\t\treadonly limit: number,\n\t) {\n\t\tsuper(\n\t\t\t`${url} redirected more than ${limit} times. A browser gives up here ` +\n\t\t\t\t`too — look for a redirect loop.`,\n\t\t);\n\t\tthis.name = 'TooManyRedirects';\n\t}\n}\n\n/**\n * An address from 10.0.0.0/8, which nothing routes to. Random rather than\n * counted: test files run in separate workers that share no counter.\n */\nfunction privateAddress(): string {\n\tconst n = randomInt(1, 2 ** 24 - 1);\n\treturn `10.${(n >> 16) & 255}.${(n >> 8) & 255}.${n & 255}`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAwBA,MAAM,gBAAgB;AAiBtB,IAAa,UAAb,MAAqB;;CAEpB,MAAe,IAAI,UAAU;;;;;;;;;;CAW7B;;;;;;;;;;CAWA;CAEA;CAEA,YAAY,UAA0B,CAAC,GAAG;EACzC,KAAK,OAAO,QAAQ,SAAS,WAAW;EACxC,KAAK,UAAU,QAAQ,WAAW,eAAe;EACjD,KAAK,SAAS,OAAO,SAAS;GAC7B,IAAI,mBAAmB,CAAC,EAAE,SAAS,UAClC,OAAO,KAAK,KAAK,OAAO,IAAI;GAE7B,OAAO,KAAK,MAAM,IAAI,QAAQ,OAAO,IAAI,GAAG,MAAM,QAAQ;EAC3D;CACD;;CAGA,MAAM,KAAsC;EAC3C,OAAO,KAAK,MAAM,OAAO,GAAG,CAAC;CAC9B;;CAGA,aAAa,KAAoC;EAChD,OAAO,KAAK,IAAI,gBAAgB,OAAO,GAAG,CAAC;CAC5C;;;;;CAMA,UAAsB;EACrB,MAAM,WAAW,WAAW;EAC5B,WAAW,QAAQ,KAAK;EACxB,aAAa;GACZ,WAAW,QAAQ;EACpB;CACD;;CAGA,MAAc,MACb,SACA,UACoB;EACpB,MAAM,OACL,QAAQ,WAAW,SAAS,QAAQ,WAAW,SAC5C,KAAA,IACA,MAAM,QAAQ,YAAY;EAC9B,MAAM,UAAU,IAAI,QAAQ,QAAQ,OAAO;EAC3C,IAAI,CAAC,QAAQ,IAAI,iBAAiB,GACjC,QAAQ,IAAI,mBAAmB,KAAK,OAAO;EAE5C,OAAO,KAAK,QACX;GAAE,KAAK,QAAQ;GAAK,QAAQ,QAAQ;GAAQ;GAAS;EAAK,GAC1D,QACD;CACD;CAEA,MAAc,QACb,SACA,UACA,OAAO,GACa;EACpB,MAAM,UAAU,IAAI,QAAQ,QAAQ,OAAO;EAC3C,MAAM,SAAS,MAAM,KAAK,IAAI,gBAAgB,QAAQ,GAAG;EACzD,IAAI,QAAQ;GACX,MAAM,WAAW,QAAQ,IAAI,QAAQ;GACrC,QAAQ,IAAI,UAAU,WAAW,GAAG,SAAS,IAAI,WAAW,MAAM;EACnE;EAEA,MAAM,WAAW,MAAM,KAAK,KAAK,QAAQ,KAAK;GAC7C,QAAQ,QAAQ;GAChB;GACA,MAAM,QAAQ;GACd,UAAU;EACX,CAAC;EAED,KAAK,MAAM,OAAO,SAAS,QAAQ,aAAa,GAG/C,MAAM,KAAK,IAAI,UAAU,KAAK,QAAQ,KAAK,EAAE,aAAa,KAAK,CAAC;EAGjE,MAAM,WAAW,SAAS,QAAQ,IAAI,UAAU;EAChD,IACC,aAAa,YACb,CAAC,YACD,SAAS,SAAS,OAClB,SAAS,UAAU,KAEnB,OAAO;EAGR,IAAI,QAAQ,eACX,MAAM,IAAI,iBAAiB,QAAQ,KAAK,aAAa;EAKtD,MAAM,cACL,SAAS,WAAW,OACpB,SAAS,WAAW,OACpB,QAAQ,WAAW,SACnB,QAAQ,WAAW;EAEpB,MAAM,MAAM,IAAI,IAAI,UAAU,QAAQ,GAAG,CAAC,CAAC,SAAS;EACpD,MAAM,OAAY,cACf;GAAE,GAAG;GAAS;EAAI,IAClB;GAAE;GAAK,QAAQ;GAAO,SAAS,YAAY,QAAQ,OAAO;EAAE;EAE/D,OAAO,KAAK,QAAQ,MAAM,UAAU,OAAO,CAAC;CAC7C;AACD;;AAWA,SAAS,YAAY,SAA2B;CAC/C,MAAM,OAAO,IAAI,QAAQ,OAAO;CAChC,KAAK,OAAO,cAAc;CAC1B,KAAK,OAAO,gBAAgB;CAC5B,OAAO;AACR;;AAGA,IAAa,mBAAb,cAAsC,MAAM;CAEjC;CACA;CAFV,YACC,KACA,OACC;EACD,MACC,GAAG,IAAI,wBAAwB,MAAM,gEAEtC;EANS,KAAA,MAAA;EACA,KAAA,QAAA;EAMT,KAAK,OAAO;CACb;AACD;;;;;AAMA,SAAS,iBAAyB;CACjC,MAAM,IAAI,UAAU,GAAG,KAAK,KAAK,CAAC;CAClC,OAAO,MAAO,KAAK,KAAM,IAAI,GAAI,KAAK,IAAK,IAAI,GAAG,IAAI;AACvD"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@geekmidas/testkit",
|
|
3
|
-
"version": "10.0.0-alpha.
|
|
3
|
+
"version": "10.0.0-alpha.45",
|
|
4
4
|
"private": false,
|
|
5
5
|
"type": "module",
|
|
6
6
|
"exports": {
|
|
@@ -161,17 +161,17 @@
|
|
|
161
161
|
"dependencies": {
|
|
162
162
|
"@faker-js/faker": "~10.6.0",
|
|
163
163
|
"tough-cookie": "~6.0.2",
|
|
164
|
-
"@geekmidas/envkit": "^10.0.0-alpha.
|
|
165
|
-
"@geekmidas/
|
|
166
|
-
"@geekmidas/
|
|
164
|
+
"@geekmidas/envkit": "^10.0.0-alpha.45",
|
|
165
|
+
"@geekmidas/logger": "^10.0.0-alpha.45",
|
|
166
|
+
"@geekmidas/services": "^10.0.0-alpha.45"
|
|
167
167
|
},
|
|
168
168
|
"devDependencies": {
|
|
169
169
|
"@better-auth/test-utils": "~1.7.6",
|
|
170
170
|
"@types/pg": "~8.23.1",
|
|
171
171
|
"better-auth": "~1.7.6",
|
|
172
|
-
"@geekmidas/envkit": "^10.0.0-alpha.
|
|
173
|
-
"@geekmidas/logger": "^10.0.0-alpha.
|
|
174
|
-
"@geekmidas/services": "^10.0.0-alpha.
|
|
172
|
+
"@geekmidas/envkit": "^10.0.0-alpha.45",
|
|
173
|
+
"@geekmidas/logger": "^10.0.0-alpha.45",
|
|
174
|
+
"@geekmidas/services": "^10.0.0-alpha.45"
|
|
175
175
|
},
|
|
176
176
|
"repository": {
|
|
177
177
|
"type": "git",
|