@jasonshimmy/vite-plugin-cer-app 0.23.2 → 0.25.0

package/src/__tests__/cli/adapters/vercel.test.ts

@@ -1,263 +0,0 @@
-import { describe, it, expect, beforeEach, afterEach } from 'vitest'
-import { mkdirSync, writeFileSync, readFileSync, existsSync, rmSync } from 'node:fs'
-import { join } from 'pathe'
-import { tmpdir } from 'node:os'
-import { runVercelAdapter } from '../../../cli/adapters/vercel.js'
-
-// ─── Helpers ──────────────────────────────────────────────────────────────────
-
-function createTempRoot(): string {
-  const dir = join(tmpdir(), `cer-vercel-test-${Date.now()}-${Math.random().toString(36).slice(2)}`)
-  mkdirSync(dir, { recursive: true })
-  return dir
-}
-
-function writeFile(root: string, rel: string, content = 'content'): void {
-  const full = join(root, rel)
-  mkdirSync(join(full, '..'), { recursive: true })
-  writeFileSync(full, content)
-}
-
-function readJson(root: string, rel: string): unknown {
-  return JSON.parse(readFileSync(join(root, rel), 'utf-8'))
-}
-
-function readText(root: string, rel: string): string {
-  return readFileSync(join(root, rel), 'utf-8')
-}
-
-// ─── SSR mode ────────────────────────────────────────────────────────────────
-
-describe('runVercelAdapter — SSR mode', () => {
-  let root: string
-
-  beforeEach(() => {
-    root = createTempRoot()
-    // dist/server/server.js → SSR bundle
-    writeFile(root, 'dist/server/server.js', '// server bundle')
-    // dist/client/index.html → HTML template
-    writeFile(root, 'dist/client/index.html', '<html></html>')
-    // dist/client/assets/main-abc.js → content-hashed asset
-    writeFile(root, 'dist/client/assets/main-abc.js', '// asset')
-    // dist/client/favicon.ico → public file
-    writeFile(root, 'dist/client/favicon.ico', 'ico')
-    // No ssg-manifest.json → SSR mode
-  })
-
-  afterEach(() => {
-    rmSync(root, { recursive: true, force: true })
-  })
-
-  it('creates .vercel/output/config.json with version 3', async () => {
-    await runVercelAdapter(root)
-    const cfg = readJson(root, '.vercel/output/config.json') as { version: number }
-    expect(cfg.version).toBe(3)
-  })
-
-  it('config.json routes include immutable cache for /assets/', async () => {
-    await runVercelAdapter(root)
-    const cfg = readJson(root, '.vercel/output/config.json') as {
-      routes: Array<{ src?: string; headers?: Record<string, string>; handle?: string; dest?: string }>
-    }
-    const assetRoute = cfg.routes.find((r) => r.src === '/assets/(.*)')
-    expect(assetRoute).toBeDefined()
-    expect(assetRoute!.headers!['cache-control']).toBe('public, max-age=31536000, immutable')
-  })
-
-  it('config.json routes include filesystem handler', async () => {
-    await runVercelAdapter(root)
-    const cfg = readJson(root, '.vercel/output/config.json') as {
-      routes: Array<{ handle?: string }>
-    }
-    expect(cfg.routes.some((r) => r.handle === 'filesystem')).toBe(true)
-  })
-
-  it('config.json routes fall through to /index for SSR catch-all', async () => {
-    await runVercelAdapter(root)
-    const cfg = readJson(root, '.vercel/output/config.json') as {
-      routes: Array<{ src?: string; dest?: string }>
-    }
-    const catchAll = cfg.routes.find((r) => r.src === '/(.*)' && r.dest === '/index')
-    expect(catchAll).toBeDefined()
-  })
-
-  it('copies server bundle to functions/index.func/server/server.js', async () => {
-    await runVercelAdapter(root)
-    expect(existsSync(join(root, '.vercel/output/functions/index.func/server/server.js'))).toBe(true)
-  })
-
-  it('copies client HTML to functions/index.func/client/index.html', async () => {
-    await runVercelAdapter(root)
-    expect(existsSync(join(root, '.vercel/output/functions/index.func/client/index.html'))).toBe(true)
-    expect(readText(root, '.vercel/output/functions/index.func/client/index.html')).toBe('<html></html>')
-  })
-
-  it('writes launcher at functions/index.func/index.js', async () => {
-    await runVercelAdapter(root)
-    expect(existsSync(join(root, '.vercel/output/functions/index.func/index.js'))).toBe(true)
-    const launcher = readText(root, '.vercel/output/functions/index.func/index.js')
-    expect(launcher).toContain("import { handler, isrHandler, apiRoutes, runServerMiddleware, runWithRequestContext } from './server/server.js'")
-    expect(launcher).toContain('export default async function cerAppHandler')
-  })
-
-  it('launcher uses isrHandler for SSR fallback (enables ISR stale-while-revalidate)', async () => {
-    await runVercelAdapter(root)
-    const launcher = readText(root, '.vercel/output/functions/index.func/index.js')
-    expect(launcher).toContain('isrHandler')
-    expect(launcher).toContain('await isrHandler(req, res)')
-  })
-
-  it('launcher uses native Node.js streaming — passes real req/res directly, no TransformStream', async () => {
-    await runVercelAdapter(root)
-    const launcher = readText(root, '.vercel/output/functions/index.func/index.js')
-    // Vercel injects real Node.js req/res, so the launcher passes them straight through.
-    // No TransformStream mock is needed — Node.js handles chunked transfer natively.
-    expect(launcher).toContain('await isrHandler(req, res)')
-    expect(launcher).not.toContain('TransformStream')
-  })
-
-  it('launcher routes /api/* requests to apiRoutes', async () => {
-    await runVercelAdapter(root)
-    const launcher = readText(root, '.vercel/output/functions/index.func/index.js')
-    expect(launcher).toContain("urlPath.startsWith('/api/')")
-    expect(launcher).toContain('matchApiPattern')
-  })
-
-  it('launcher attaches req.query (parsed query string) before calling handler', async () => {
-    await runVercelAdapter(root)
-    const launcher = readText(root, '.vercel/output/functions/index.func/index.js')
-    expect(launcher).toContain('parseQuery')
-    expect(launcher).toContain('req.query = parseQuery(')
-  })
-
-  it('launcher attaches req.body (parsed JSON body) before calling handler', async () => {
-    await runVercelAdapter(root)
-    const launcher = readText(root, '.vercel/output/functions/index.func/index.js')
-    expect(launcher).toContain('parseBody')
-    expect(launcher).toContain('req.body = await parseBody(req)')
-  })
-
-  it('writes package.json with type:module in function dir', async () => {
-    await runVercelAdapter(root)
-    const pkg = readJson(root, '.vercel/output/functions/index.func/package.json') as { type: string }
-    expect(pkg.type).toBe('module')
-  })
-
-  it('writes .vc-config.json with nodejs20.x runtime', async () => {
-    await runVercelAdapter(root)
-    const vc = readJson(root, '.vercel/output/functions/index.func/.vc-config.json') as {
-      runtime: string
-      handler: string
-      launcherType: string
-    }
-    expect(vc.runtime).toBe('nodejs20.x')
-    expect(vc.handler).toBe('index.js')
-    expect(vc.launcherType).toBe('Nodejs')
-  })
-
-  it('copies content-hashed assets to static/assets/', async () => {
-    await runVercelAdapter(root)
-    expect(existsSync(join(root, '.vercel/output/static/assets/main-abc.js'))).toBe(true)
-  })
-
-  it('copies other public files (favicon.ico) to static/', async () => {
-    await runVercelAdapter(root)
-    expect(existsSync(join(root, '.vercel/output/static/favicon.ico'))).toBe(true)
-  })
-
-  it('does NOT copy index.html to static/ (served by SSR function)', async () => {
-    await runVercelAdapter(root)
-    expect(existsSync(join(root, '.vercel/output/static/index.html'))).toBe(false)
-  })
-
-  it('cleans existing .vercel/output/ before writing', async () => {
-    // Write a stale file that should be removed.
-    writeFile(root, '.vercel/output/stale-file.txt', 'old')
-    await runVercelAdapter(root)
-    expect(existsSync(join(root, '.vercel/output/stale-file.txt'))).toBe(false)
-  })
-
-  it('throws if dist/ does not exist', async () => {
-    rmSync(join(root, 'dist'), { recursive: true, force: true })
-    await expect(runVercelAdapter(root)).rejects.toThrow("Run 'cer-app build' first")
-  })
-})
-
-// ─── SPA mode ────────────────────────────────────────────────────────────────
-
-describe('runVercelAdapter — SPA mode', () => {
-  let root: string
-
-  beforeEach(() => {
-    root = createTempRoot()
-    // SPA: no server bundle, all files flat in dist/
-    writeFile(root, 'dist/index.html', '<html></html>')
-    writeFile(root, 'dist/assets/app-abc.js', '// app')
-  })
-
-  afterEach(() => {
-    rmSync(root, { recursive: true, force: true })
-  })
-
-  it('copies dist/ to static/', async () => {
-    await runVercelAdapter(root)
-    expect(existsSync(join(root, '.vercel/output/static/index.html'))).toBe(true)
-    expect(existsSync(join(root, '.vercel/output/static/assets/app-abc.js'))).toBe(true)
-  })
-
-  it('config.json SPA fallback routes to /index.html', async () => {
-    await runVercelAdapter(root)
-    const cfg = readJson(root, '.vercel/output/config.json') as {
-      routes: Array<{ src?: string; dest?: string }>
-    }
-    const fallback = cfg.routes.find((r) => r.src === '/(.*)' && r.dest === '/index.html')
-    expect(fallback).toBeDefined()
-  })
-
-  it('does NOT create a serverless function', async () => {
-    await runVercelAdapter(root)
-    expect(existsSync(join(root, '.vercel/output/functions'))).toBe(false)
-  })
-})
-
-// ─── SSG mode ────────────────────────────────────────────────────────────────
-
-describe('runVercelAdapter — SSG mode', () => {
-  let root: string
-
-  beforeEach(() => {
-    root = createTempRoot()
-    // SSG: server bundle exists but ssg-manifest.json is present → static mode
-    writeFile(root, 'dist/server/server.js', '// server bundle')
-    writeFile(root, 'dist/ssg-manifest.json', '{}')
-    writeFile(root, 'dist/index.html', '<html>root</html>')
-    writeFile(root, 'dist/about/index.html', '<html>about</html>')
-    writeFile(root, 'dist/client/index.html', '<html>shell</html>')
-    writeFile(root, 'dist/client/assets/main-abc.js', '// asset')
-  })
-
-  afterEach(() => {
-    rmSync(root, { recursive: true, force: true })
-  })
-
-  it('copies pre-rendered HTML to static/', async () => {
-    await runVercelAdapter(root)
-    expect(existsSync(join(root, '.vercel/output/static/index.html'))).toBe(true)
-    expect(existsSync(join(root, '.vercel/output/static/about/index.html'))).toBe(true)
-  })
-
-  it('copies client assets to static/assets/', async () => {
-    await runVercelAdapter(root)
-    expect(existsSync(join(root, '.vercel/output/static/assets/main-abc.js'))).toBe(true)
-  })
-
-  it('does NOT copy ssg-manifest.json', async () => {
-    await runVercelAdapter(root)
-    expect(existsSync(join(root, '.vercel/output/static/ssg-manifest.json'))).toBe(false)
-  })
-
-  it('does NOT create a serverless function', async () => {
-    await runVercelAdapter(root)
-    expect(existsSync(join(root, '.vercel/output/functions'))).toBe(false)
-  })
-})

package/src/__tests__/cli/preview-hardening.test.ts

@@ -1,265 +0,0 @@
-import { describe, it, expect } from 'vitest'
-import { readFileSync } from 'node:fs'
-import { resolve } from 'pathe'
-
-// Read the preview command source to verify hardening requirements are present.
-const src = readFileSync(
-  resolve(import.meta.dirname, '../../cli/commands/preview.ts'),
-  'utf-8',
-)
-
-// ─── Security headers ─────────────────────────────────────────────────────────
-
-describe('preview server — security headers', () => {
-  it('defines setSecurityHeaders helper', () => {
-    expect(src).toContain('function setSecurityHeaders(')
-  })
-
-  it('sets X-Content-Type-Options: nosniff', () => {
-    expect(src).toContain("'X-Content-Type-Options'")
-    expect(src).toContain('nosniff')
-  })
-
-  it('sets X-Frame-Options: DENY', () => {
-    expect(src).toContain("'X-Frame-Options'")
-    expect(src).toContain('DENY')
-  })
-
-  it('sets Referrer-Policy: strict-origin-when-cross-origin', () => {
-    expect(src).toContain("'Referrer-Policy'")
-    expect(src).toContain('strict-origin-when-cross-origin')
-  })
-
-  it('calls setSecurityHeaders in serveStaticFile', () => {
-    const fnStart = src.indexOf('function serveStaticFile(')
-    const nextFn = src.indexOf('\nfunction ', fnStart + 1)
-    const body = src.slice(fnStart, nextFn > -1 ? nextFn : undefined)
-    expect(body).toContain('setSecurityHeaders(res)')
-  })
-
-  it('calls setSecurityHeaders at the top of the SSR request handler', () => {
-    const handlerStart = src.indexOf('createHttpServer(async (req: IncomingMessage, res: ServerResponse)')
-    const handlerEnd = src.indexOf('server.listen(port', handlerStart)
-    const handler = src.slice(handlerStart, handlerEnd)
-    expect(handler).toContain('setSecurityHeaders(res)')
-    // It should be the first thing done before any routing logic
-    const secHeadersIdx = handler.indexOf('setSecurityHeaders(res)')
-    const urlParseIdx = handler.indexOf('req.url ?? ')
-    expect(secHeadersIdx).toBeLessThan(urlParseIdx)
-  })
-
-  it('calls setSecurityHeaders at the top of the static request handler', () => {
-    const handlerStart = src.indexOf('createHttpServer((req: IncomingMessage, res: ServerResponse)')
-    const handlerEnd = src.indexOf('server.listen(port', handlerStart)
-    const handler = src.slice(handlerStart, handlerEnd)
-    expect(handler).toContain('setSecurityHeaders(res)')
-  })
-})
-
-// ─── Cache-Control ────────────────────────────────────────────────────────────
-
-describe('preview server — Cache-Control', () => {
-  it('defines getCacheControl helper', () => {
-    expect(src).toContain('function getCacheControl(')
-  })
-
-  it('returns immutable cache for /assets/ paths', () => {
-    expect(src).toContain("'/assets/'")
-    expect(src).toContain('public, max-age=31536000, immutable')
-  })
-
-  it('returns no-cache for non-asset paths', () => {
-    // The getCacheControl function must return 'no-cache' as fallback
-    const fnStart = src.indexOf('function getCacheControl(')
-    const fnEnd = src.indexOf('\nfunction ', fnStart + 1)
-    const body = src.slice(fnStart, fnEnd > -1 ? fnEnd : undefined)
-    expect(body).toContain("'no-cache'")
-  })
-
-  it('uses getCacheControl in serveStaticFile instead of hardcoded no-cache', () => {
-    const fnStart = src.indexOf('function serveStaticFile(')
-    const nextFn = src.indexOf('\nfunction ', fnStart + 1)
-    const body = src.slice(fnStart, nextFn > -1 ? nextFn : undefined)
-    expect(body).toContain('getCacheControl(filePath)')
-    // Must NOT have a hardcoded no-cache
-    expect(body).not.toContain("'no-cache'")
-  })
-
-  it('uses getCacheControl for client assets in the static server', () => {
-    // The static server also serves assets from dist/client — it should use getCacheControl
-    const staticHandlerStart = src.indexOf('createHttpServer((req: IncomingMessage, res: ServerResponse)')
-    expect(src.slice(staticHandlerStart)).toContain('getCacheControl(')
-  })
-})
-
-// ─── Graceful shutdown ────────────────────────────────────────────────────────
-
-describe('preview server — graceful shutdown', () => {
-  it('defines registerGracefulShutdown helper', () => {
-    expect(src).toContain('function registerGracefulShutdown(')
-  })
-
-  it('calls server.close() for graceful drain', () => {
-    const fnStart = src.indexOf('function registerGracefulShutdown(')
-    const fnEnd = src.indexOf('\nexport ', fnStart)
-    const body = src.slice(fnStart, fnEnd > -1 ? fnEnd : undefined)
-    expect(body).toContain('server.close(')
-  })
-
-  it('sets a 10-second force-exit timeout', () => {
-    const fnStart = src.indexOf('function registerGracefulShutdown(')
-    const fnEnd = src.indexOf('\nexport ', fnStart)
-    const body = src.slice(fnStart, fnEnd > -1 ? fnEnd : undefined)
-    expect(body).toContain('10_000')
-    expect(body).toContain('process.exit(1)')
-  })
-
-  it('calls t.unref() so the timeout does not keep the event loop alive', () => {
-    const fnStart = src.indexOf('function registerGracefulShutdown(')
-    const fnEnd = src.indexOf('\nexport ', fnStart)
-    const body = src.slice(fnStart, fnEnd > -1 ? fnEnd : undefined)
-    expect(body).toContain('.unref()')
-  })
-
-  it('listens for both SIGTERM and SIGINT', () => {
-    expect(src).toContain("'SIGTERM'")
-    expect(src).toContain("'SIGINT'")
-  })
-
-  it('logs the signal name on shutdown', () => {
-    const fnStart = src.indexOf('function registerGracefulShutdown(')
-    const fnEnd = src.indexOf('\nexport ', fnStart)
-    const body = src.slice(fnStart, fnEnd > -1 ? fnEnd : undefined)
-    expect(body).toContain('signal')
-    expect(body).toContain('console.log(')
-  })
-
-  it('calls registerGracefulShutdown for the SSR server', () => {
-    // registerGracefulShutdown must be called after each server's listen()
-    const firstListen = src.indexOf('server.listen(port')
-    const firstShutdown = src.indexOf('registerGracefulShutdown(server)')
-    expect(firstShutdown).toBeGreaterThan(firstListen)
-  })
-
-  it('calls registerGracefulShutdown for the static server', () => {
-    // Both SSR and static server paths should register graceful shutdown
-    const allShutdowns = src.split('registerGracefulShutdown(server)').length - 1
-    expect(allShutdowns).toBeGreaterThanOrEqual(2)
-  })
-})
-
-// ─── Request timeouts ─────────────────────────────────────────────────────────
-
-describe('preview server — request timeouts', () => {
-  it('sets server.headersTimeout to protect against slow-send attacks', () => {
-    expect(src).toContain('server.headersTimeout')
-    expect(src).toContain('10_000')
-  })
-
-  it('sets server.requestTimeout to limit total request duration', () => {
-    expect(src).toContain('server.requestTimeout')
-    expect(src).toContain('30_000')
-  })
-
-  it('applies timeouts to the SSR server', () => {
-    const ssrListenIdx = src.indexOf("console.log(`[cer-app] SSR preview running at")
-    const ssrTimeoutIdx = src.lastIndexOf('server.requestTimeout', ssrListenIdx)
-    expect(ssrTimeoutIdx).toBeGreaterThan(-1)
-  })
-
-  it('applies timeouts to the static server', () => {
-    const staticListenIdx = src.indexOf("console.log(`[cer-app] Static preview running at")
-    const staticTimeoutIdx = src.lastIndexOf('server.requestTimeout', staticListenIdx)
-    expect(staticTimeoutIdx).toBeGreaterThan(-1)
-  })
-})
-
-// ─── Server middleware + request context ─────────────────────────────────────
-
-describe('preview server — server middleware and request context', () => {
-  it('extracts runServerMiddleware from server bundle', () => {
-    expect(src).toContain('const runServerMiddleware = serverMod.runServerMiddleware')
-  })
-
-  it('extracts runWithRequestContext from server bundle', () => {
-    expect(src).toContain('const runWithRequestContext = serverMod.runWithRequestContext')
-  })
-
-  it('calls runServerMiddleware before API routing and SSR', () => {
-    // runServerMiddleware call must come before the /api/ check in the handler
-    const apiIdx = src.indexOf("urlPath.startsWith('/api/')")
-    const mwIdx = src.indexOf('await runServerMiddleware(req, res)')
-    expect(mwIdx).toBeGreaterThan(0)
-    expect(mwIdx).toBeLessThan(apiIdx)
-  })
-
-  it('short-circuits the request when runServerMiddleware returns false', () => {
-    // The guard pattern: !(await runServerMiddleware(req, res)) => return
-    expect(src).toContain('if (runServerMiddleware && !(await runServerMiddleware(req, res))) return')
-  })
-
-  it('wraps API handler calls in runWithRequestContext so useCookie/useSession work', () => {
-    expect(src).toContain('runWithRequestContext ? runWithRequestContext(req, res, invoke)')
-  })
-
-  it('falls back to direct invocation if runWithRequestContext is not exported by the bundle', () => {
-    // Older bundles without runWithRequestContext: should still call the handler
-    expect(src).toContain(': invoke()')
-  })
-})
-
-// ─── API request body parsing ─────────────────────────────────────────────────
-
-describe('preview server — API request body parsing', () => {
-  it('defines a parseBody helper', () => {
-    expect(src).toContain('async function parseBody(')
-  })
-
-  it('parses JSON bodies for POST/PUT/PATCH requests', () => {
-    const fnStart = src.indexOf('async function parseBody(')
-    const fnEnd = src.indexOf('\nfunction ', fnStart + 1)
-    const body = src.slice(fnStart, fnEnd > -1 ? fnEnd : undefined)
-    expect(body).toContain("application/json")
-    expect(body).toContain("JSON.parse")
-  })
-
-  it('attaches parsed body to augReq.body before invoking the API handler', () => {
-    expect(src).toContain('augReq.body = await parseBody(req)')
-  })
-
-  it('skips body parsing for GET/DELETE requests', () => {
-    const fnStart = src.indexOf('async function parseBody(')
-    const fnEnd = src.indexOf('\nfunction ', fnStart + 1)
-    const body = src.slice(fnStart, fnEnd > -1 ? fnEnd : undefined)
-    expect(body).toContain("'POST'")
-    expect(body).toContain("'PUT'")
-    expect(body).toContain("'PATCH'")
-    expect(body).toContain('return undefined')
-  })
-})
-
-// ─── API query string parsing ─────────────────────────────────────────────────
-
-describe('preview server — API query string parsing', () => {
-  it('defines a parseQuery helper', () => {
-    expect(src).toContain('function parseQuery(')
-  })
-
-  it('attaches parsed query to augReq.query before invoking the API handler', () => {
-    expect(src).toContain('augReq.query = parseQuery(url)')
-  })
-
-  it('parseQuery decodes percent-encoded keys and values', () => {
-    const fnStart = src.indexOf('function parseQuery(')
-    const fnEnd = src.indexOf('\nfunction ', fnStart + 1)
-    const body = src.slice(fnStart, fnEnd > -1 ? fnEnd : undefined)
-    expect(body).toContain('decodeURIComponent')
-  })
-
-  it('parseQuery returns empty object when no query string is present', () => {
-    const fnStart = src.indexOf('function parseQuery(')
-    const fnEnd = src.indexOf('\nfunction ', fnStart + 1)
-    const body = src.slice(fnStart, fnEnd > -1 ? fnEnd : undefined)
-    expect(body).toContain('return {}')
-  })
-})