@jrpool/kilotest 48.0.0 → 50.0.0

package/web/metrics/metrics.test.ts

@@ -0,0 +1,211 @@
+/*
+  metrics.test.ts
+  Unit tests for web/metrics/index.ts.
+*/
+
+// IMPORTS
+
+import {test, before, after} from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs/promises';
+import {parse} from 'node-html-parser';
+import {answer} from './index.ts';
+import {getJSON, metricsPath} from '../../util.ts';
+
+// SETUP AND TEARDOWN
+
+const savedAuthCode = process.env.AUTH_CODE;
+const savedDBDir = process.env.DB_DIR;
+import {fixtureDBDir} from '../../test/dbFixture.ts';
+
+before(() => {
+  process.env.AUTH_CODE = 'test-auth-code';
+  process.env.DB_DIR = fixtureDBDir;
+});
+
+after(() => {
+  if (savedAuthCode !== undefined) {
+    process.env.AUTH_CODE = savedAuthCode;
+  }
+  if (savedDBDir !== undefined) {
+    process.env.DB_DIR = savedDBDir;
+  }
+});
+
+// TESTS
+
+test('metrics returns an error for an invalid auth code on a POST request', async () => {
+  const result: any = await answer(null, 'authCode=wrong', 'POST');
+  assert.equal(result.status, 'error');
+  assert.equal(result.message, 'Invalid request');
+});
+
+test('metrics displays a form requesting an auth code on a GET request', async () => {
+  const result: any = await answer(null, '', 'GET');
+  assert.equal(result.status, 'ok');
+  const html = parse(result.answerPage);
+  const input = html.querySelector('input[name="authCode"]');
+  assert.ok(input);
+  assert.equal(html.querySelectorAll('table').length, 0);
+});
+
+test('metrics displays a clearCounts checkbox in the initial form', async () => {
+  const result: any = await answer(null, '', 'GET');
+  const html = parse(result.answerPage);
+  const checkbox = html.querySelector('input[name="clearCounts"]');
+  assert.ok(checkbox);
+  assert.equal(checkbox.getAttribute('type'), 'checkbox');
+});
+
+test('metrics submits its form as a POST', async () => {
+  const result: any = await answer(null, '', 'GET');
+  const html = parse(result.answerPage);
+  const form = html.querySelector('form');
+  assert.equal(form?.getAttribute('method'), 'post');
+});
+
+test('metrics ignores a valid authCode query string on a GET request', async () => {
+  const result: any = await answer(null, 'authCode=test-auth-code', 'GET');
+  assert.equal(result.status, 'ok');
+  const html = parse(result.answerPage);
+  // The form (not the counts) should still be shown, since only POST submits.
+  assert.ok(html.querySelector('input[name="authCode"]'));
+  assert.equal(html.querySelectorAll('table').length, 0);
+});
+
+test('metrics ignores clearCounts on a GET request, even with a valid authCode', async () => {
+  await fs.writeFile(metricsPath(), getJSON({
+    since: '260101T0000',
+    pageViews: {tutorialWeb: 9},
+    mcpToolCalls: {},
+    apiOperations: {},
+    managerActivity: {}
+  }));
+  const result: any = await answer(null, 'authCode=test-auth-code&clearCounts=on', 'GET');
+  assert.ok(!result.answerPage.includes('Counts cleared.'));
+  const metrics = JSON.parse(await fs.readFile(metricsPath(), 'utf8'));
+  // The counts should NOT have been cleared by a mere GET request.
+  assert.equal(metrics.pageViews.tutorialWeb, 9);
+  await fs.rm(metricsPath(), {force: true});
+});
+
+test('metrics reports no counts yet when the metrics file does not exist', async () => {
+  await fs.rm(metricsPath(), {force: true});
+  const result: any = await answer(null, 'authCode=test-auth-code', 'POST');
+  assert.equal(result.status, 'ok');
+  assert.ok(result.answerPage.includes('Counts recorded since'));
+  const html = parse(result.answerPage);
+  assert.equal(html.querySelectorAll('table').length, 0);
+  await fs.rm(metricsPath(), {force: true});
+});
+
+test('metrics reports recorded counts with a valid auth code on a POST request', async () => {
+  await fs.writeFile(metricsPath(), getJSON({
+    since: '260101T0000',
+    pageViews: {tutorialWeb: 3},
+    mcpToolCalls: {listReports: 5},
+    apiOperations: {},
+    managerActivity: {}
+  }));
+  const result: any = await answer(null, 'authCode=test-auth-code', 'POST');
+  assert.equal(result.status, 'ok');
+  const html = parse(result.answerPage);
+  const tables = html.querySelectorAll('table');
+  assert.equal(tables.length, 2);
+  assert.ok(result.answerPage.includes('tutorialWeb'));
+  assert.ok(result.answerPage.includes('5'));
+  assert.ok(result.answerPage.includes('at 00:00'));
+  await fs.rm(metricsPath(), {force: true});
+});
+
+test('metrics sorts each category by descending count', async () => {
+  await fs.writeFile(metricsPath(), getJSON({
+    since: '260101T0000',
+    pageViews: {manage: 1, tutorialWeb: 9, otherPage: 4},
+    mcpToolCalls: {},
+    apiOperations: {},
+    managerActivity: {}
+  }));
+  const result: any = await answer(null, 'authCode=test-auth-code', 'POST');
+  const html = parse(result.answerPage);
+  const names = html.querySelectorAll('table')[0]!.querySelectorAll('tbody td:first-child')
+  .map(cell => cell.text);
+  assert.deepEqual(names, ['tutorialWeb', 'otherPage', 'manage']);
+  await fs.rm(metricsPath(), {force: true});
+});
+
+test('metrics reports manager page activity, sorted by descending failure count', async () => {
+  await fs.writeFile(metricsPath(), getJSON({
+    since: '260101T0000',
+    pageViews: {},
+    mcpToolCalls: {},
+    apiOperations: {},
+    managerActivity: {
+      metrics: {ok: 5, error: 0},
+      reannotate: {ok: 1, error: 8}
+    }
+  }));
+  const result: any = await answer(null, 'authCode=test-auth-code', 'POST');
+  assert.ok(result.answerPage.includes('Manager page activity'));
+  const html = parse(result.answerPage);
+  const tables = html.querySelectorAll('table');
+  assert.equal(tables.length, 1);
+  const managerTable = tables[0]!;
+  const rows = managerTable.querySelectorAll('tbody tr').map(row =>
+    row.querySelectorAll('td').map(cell => cell.text)
+  );
+  assert.deepEqual(rows, [['reannotate', '1', '8'], ['metrics', '5', '0']]);
+  await fs.rm(metricsPath(), {force: true});
+});
+
+test('metrics reports no manager activity yet when none has been recorded', async () => {
+  await fs.writeFile(metricsPath(), getJSON({
+    since: '260101T0000',
+    pageViews: {},
+    mcpToolCalls: {},
+    apiOperations: {},
+    managerActivity: {}
+  }));
+  const result: any = await answer(null, 'authCode=test-auth-code', 'POST');
+  const html = parse(result.answerPage);
+  assert.equal(html.querySelectorAll('table').length, 0);
+  assert.ok(result.answerPage.includes('None yet.'));
+  await fs.rm(metricsPath(), {force: true});
+});
+
+test('metrics clears all counts and shows a confirmation when clearCounts is submitted via POST', async () => {
+  await fs.writeFile(metricsPath(), getJSON({
+    since: '260101T0000',
+    pageViews: {tutorialWeb: 9},
+    mcpToolCalls: {listReports: 3},
+    apiOperations: {getReport: 1},
+    managerActivity: {reannotate: {ok: 1, error: 2}}
+  }));
+  const result: any = await answer(null, 'authCode=test-auth-code&clearCounts=on', 'POST');
+  assert.equal(result.status, 'ok');
+  assert.ok(result.answerPage.includes('Counts cleared.'));
+  const html = parse(result.answerPage);
+  assert.equal(html.querySelectorAll('table').length, 0);
+  const metrics = JSON.parse(await fs.readFile(metricsPath(), 'utf8'));
+  assert.deepEqual(metrics.pageViews, {});
+  assert.deepEqual(metrics.mcpToolCalls, {});
+  assert.deepEqual(metrics.apiOperations, {});
+  assert.deepEqual(metrics.managerActivity, {});
+  assert.notEqual(metrics.since, '260101T0000');
+  await fs.rm(metricsPath(), {force: true});
+});
+
+test('metrics does not clear counts, and does not show a confirmation, when clearCounts is not submitted', async () => {
+  await fs.writeFile(metricsPath(), getJSON({
+    since: '260101T0000',
+    pageViews: {tutorialWeb: 9},
+    mcpToolCalls: {},
+    apiOperations: {},
+    managerActivity: {}
+  }));
+  const result: any = await answer(null, 'authCode=test-auth-code', 'POST');
+  assert.ok(!result.answerPage.includes('Counts cleared.'));
+  const metrics = JSON.parse(await fs.readFile(metricsPath(), 'utf8'));
+  assert.equal(metrics.pageViews.tutorialWeb, 9);
+  await fs.rm(metricsPath(), {force: true});
+});

package/web/pruneReportsForm/index.html

@@ -14,7 +14,7 @@
     <main>
       <h1><a href="/">Kilotest</a>: Prune reports</h1>
       <p>__intro__</p>
-      <form action="/pruneReportsForm.html">
+      <form action="/pruneReportsForm.html" method="post">
         <fieldset>
           <legend>Reports</legend>
           __reports__

package/web/pruneReportsForm/index.ts

@@ -10,7 +10,7 @@ import {reportDeletionForm} from '../reportDeletion.ts';
 // FUNCTIONS
 
 // Returns a form for deleting non-latest reports.
-export const answer = async (_: any, search: string) => reportDeletionForm(import.meta.dirname, search, {
+export const answer = async (_: any, search: string, method: string) => reportDeletionForm(import.meta.dirname, search, method, {
   intro: 'Choose the superseded reports to delete.',
   emptyIntro: 'Each target has only 1 report, so there are no superseded reports to delete.',
   failurePrefix: 'Deleting superseded reports failed',

package/web/pruneReportsForm/pruneReportsForm.test.ts

@@ -35,32 +35,40 @@ after(async () => {
 
 // TESTS
 
-test('pruneReportsForm displays a list of reports when no submission', async () => {
-  const result = await answer(null, '');
+test('pruneReportsForm displays a list of reports on a GET request', async () => {
+  const result = await answer(null, '', 'GET');
   assert.equal(result.status, 'ok');
   assert.ok(result.answerPage);
   const html = parse(result.answerPage);
   assert.ok(html.querySelector('title'));
 });
 
-test('pruneReportsForm returns an error for an invalid auth code', async () => {
-  const result = await answer(null, 'authCode=wrong&report=260101T0000-mix');
+test('pruneReportsForm ignores a report query string on a GET request', async () => {
+  const reportPath = path.join(reportsPath(), '260101T0000-mix.json');
+  const result = await answer(null, 'authCode=test-auth-code&report=260101T0000-mix', 'GET');
+  assert.equal(result.status, 'ok');
+  // The report should NOT have been deleted by a mere GET request.
+  await fs.access(reportPath);
+});
+
+test('pruneReportsForm returns an error for an invalid auth code on a POST request', async () => {
+  const result = await answer(null, 'authCode=wrong&report=260101T0000-mix', 'POST');
   assert.equal(result.status, 'error');
-  assert.equal(result.message, 'Invalid authorization code');
+  assert.equal(result.message, 'Invalid request');
 });
 
-test('pruneReportsForm returns an error when deleting a nonexistent report', async () => {
-  const result = await answer(null, 'authCode=test-auth-code&report=999999T9999-nope');
+test('pruneReportsForm returns an error when deleting a nonexistent report on a POST request', async () => {
+  const result = await answer(null, 'authCode=test-auth-code&report=999999T9999-nope', 'POST');
   assert.equal(result.status, 'error');
   assert.ok(result.message?.includes('Deleting superseded reports'));
 });
 
-test('pruneReportsForm deletes a superseded report with valid auth code', async () => {
+test('pruneReportsForm deletes a superseded report with valid auth code on a POST request', async () => {
   // 260101T0000-mix is superseded by 260202T0000-new (same URL).
   const reportPath = path.join(reportsPath(), '260101T0000-mix.json');
   const backup = await fs.readFile(reportPath, 'utf8');
   try {
-    const result = await answer(null, 'authCode=test-auth-code&report=260101T0000-mix');
+    const result = await answer(null, 'authCode=test-auth-code&report=260101T0000-mix', 'POST');
     assert.equal(result.status, 'ok');
     await fs.access(reportPath).then(
       () => {throw new Error('Report should have been deleted');},
@@ -77,7 +85,7 @@ test('pruneReportsForm returns an error when a report file is corrupt', async ()
   const backup = await fs.readFile(reportPath, 'utf8');
   try {
     await fs.writeFile(reportPath, 'not valid json');
-    const result = await answer(null, '');
+    const result = await answer(null, '', 'GET');
     assert.equal(result.status, 'error');
   }
   finally {

package/web/reannotate/index.ts

@@ -11,6 +11,7 @@ import {
   getReport,
   getReportPath,
   isReportError,
+  isValidAuthCode,
   readdirOrCreate,
   reportsPath
 } from '../../util.ts';
@@ -22,7 +23,7 @@ import path from 'node:path';
 // Implements a reannotation order and returns an acknowledgement page.
 export const answer = async (authCode: string) => {
   // If the authorization code is valid:
-  if (authCode === process.env.AUTH_CODE) {
+  if (isValidAuthCode(authCode)) {
     // Get the names of the stored report files.
     const reportFileNames = (await readdirOrCreate(reportsPath(), 'Reports directory'))
     .filter(fileName => fileName.endsWith('.json'));
@@ -63,9 +64,12 @@ export const answer = async (authCode: string) => {
       answerPage
     };
   }
-  // Otherwise, i.e. if the authorization code is invalid, return an error page.
+  // Otherwise, i.e. if the authorization code is invalid, return an error page. The
+  // message is deliberately vague so as not to confirm to an attacker that the
+  // authorization code specifically (as opposed to some other part of the request) is
+  // what was wrong.
   return {
     status: 'error',
-    message: 'Invalid authorization code'
+    message: 'Invalid request'
   };
 };

package/web/reannotate/reannotate.test.ts

@@ -59,7 +59,7 @@ test('answer returns an error for an invalid authorization code', async () => {
   const {answer} = await import('./index.ts');
   const result = await answer('wrong-code');
   assert.equal(result.status, 'error');
-  assert.equal(result.message, 'Invalid authorization code');
+  assert.equal(result.message, 'Invalid request');
 });
 
 test('answer returns an error when no reports are available', async () => {

package/web/renewWCAG/index.ts

@@ -7,14 +7,14 @@
 
 import fs from 'node:fs/promises';
 import path from 'node:path';
-import {getJSON} from '../../util.ts';
+import {getJSON, isValidAuthCode} from '../../util.ts';
 
 // FUNCTIONS
 
 // Renews the WCAG map and serves an acknowledgment.
 export const answer = async (authCode: string) => {
   // If the authorization code is valid:
-  if (authCode === process.env.AUTH_CODE) {
+  if (isValidAuthCode(authCode)) {
     // Get the map source response.
     const mapSourceResponse = await fetch('https://www.w3.org/WAI/WCAG22/Understanding/');
     const mapSourceStatus = mapSourceResponse.status;
@@ -61,10 +61,13 @@ export const answer = async (authCode: string) => {
       };
     }
   }
+  // The message is deliberately vague so as not to confirm to an attacker that the
+  // authorization code specifically (as opposed to some other part of the request) is
+  // what was wrong.
   else {
     return {
       status: 'error',
-      message: 'Authorization code invalid'
+      message: 'Invalid request'
     };
   }
 };

package/web/renewWCAG/renewWCAG.test.ts

@@ -65,7 +65,7 @@ test('answer returns an error for an invalid authorization code', async () => {
   const {answer} = await import('./index.ts');
   const result = await answer('wrong-code');
   assert.equal(result.status, 'error');
-  assert.equal(result.message, 'Authorization code invalid');
+  assert.equal(result.message, 'Invalid request');
 });
 
 test('answer returns an error when the WCAG map source returns a non-200 status', async () => {

package/web/reportDeletion.ts

@@ -6,7 +6,8 @@
 // IMPORTS
 
 import {
-  errorMessage, getReportData, objectSort, populateTemplate, readdirOrCreate, reportsPath
+  errorMessage, getReportData, isValidAuthCode, objectSort, populateTemplate, readdirOrCreate,
+  reportsPath
 } from '../util.ts';
 import fs from 'node:fs/promises';
 import path from 'node:path';
@@ -32,20 +33,23 @@ export type DeletionSpec = {
 
 // FUNCTIONS
 
-// Returns a form for deleting the reports that the predicate marks as deletable.
+// Returns a form for deleting the reports that the predicate marks as deletable. A GET
+// request never processes a submission, regardless of its query string; only a POST
+// request (the form's own submission) does.
 export const reportDeletionForm = async (
   dirName: string,
   search: string,
+  method: string,
   deletionSpec: DeletionSpec
 ): Promise<{status: string; message?: string; answerPage?: string}> => {
   const {emptyIntro, failurePrefix, intro, isDeletable} = deletionSpec;
   const searchParams = new URLSearchParams(search);
   const authCode = searchParams?.get('authCode');
   const jobNames = searchParams?.getAll('report');
-  // If the form has been displayed by itself after a submission and any reports are to be deleted:
-  if (jobNames?.length) {
+  // If the form has been submitted and any reports are to be deleted:
+  if (method === 'POST' && jobNames?.length) {
     // If the authorization code is valid:
-    if (authCode === process.env.AUTH_CODE) {
+    if (isValidAuthCode(authCode)) {
       try {
         // For each report to be deleted:
         for (const jobName of jobNames) {
@@ -64,10 +68,12 @@ export const reportDeletionForm = async (
     }
     // Otherwise, i.e. if the authorization code is invalid:
     else {
-      // Report the error.
+      // Report the error, deliberately vague so as not to confirm to an attacker that the
+      // authorization code specifically (as opposed to some other part of the request) is
+      // what was wrong.
       return {
         status: 'error',
-        message: 'Invalid authorization code'
+        message: 'Invalid request'
       };
     }
   }

package/web/rewindReportsForm/index.html

@@ -14,7 +14,7 @@
     <main>
       <h1><a href="/">Kilotest</a>: Rewind reports</h1>
       <p>__intro__</p>
-      <form action="/rewindReportsForm.html">
+      <form action="/rewindReportsForm.html" method="post">
         <fieldset>
           <legend>Reports</legend>
           __reports__

package/web/rewindReportsForm/index.ts

@@ -10,7 +10,7 @@ import {reportDeletionForm} from '../reportDeletion.ts';
 // FUNCTIONS
 
 // Returns a form for deleting latest superseding reports.
-export const answer = async (_: any, search: string) => reportDeletionForm(import.meta.dirname, search, {
+export const answer = async (_: any, search: string, method: string) => reportDeletionForm(import.meta.dirname, search, method, {
   intro: 'Choose the latest superseding reports to delete.',
   emptyIntro: 'Each target has only 1 report, so there are no reports to delete.',
   failurePrefix: 'Deleting latest superseding reports failed',

package/web/rewindReportsForm/rewindReportsForm.test.ts

@@ -35,32 +35,40 @@ after(async () => {
 
 // TESTS
 
-test('rewindReportsForm displays a list of reports when no submission', async () => {
-  const result = await answer(null, '');
+test('rewindReportsForm displays a list of reports on a GET request', async () => {
+  const result = await answer(null, '', 'GET');
   assert.equal(result.status, 'ok');
   assert.ok(result.answerPage);
   const html = parse(result.answerPage);
   assert.ok(html.querySelector('title'));
 });
 
-test('rewindReportsForm returns an error for an invalid auth code', async () => {
-  const result = await answer(null, 'authCode=wrong&report=260202T0000-new');
+test('rewindReportsForm ignores a report query string on a GET request', async () => {
+  const reportPath = path.join(reportsPath(), '260202T0000-new.json');
+  const result = await answer(null, 'authCode=test-auth-code&report=260202T0000-new', 'GET');
+  assert.equal(result.status, 'ok');
+  // The report should NOT have been deleted by a mere GET request.
+  await fs.access(reportPath);
+});
+
+test('rewindReportsForm returns an error for an invalid auth code on a POST request', async () => {
+  const result = await answer(null, 'authCode=wrong&report=260202T0000-new', 'POST');
   assert.equal(result.status, 'error');
-  assert.equal(result.message, 'Invalid authorization code');
+  assert.equal(result.message, 'Invalid request');
 });
 
-test('rewindReportsForm returns an error when deleting a nonexistent report', async () => {
-  const result = await answer(null, 'authCode=test-auth-code&report=999999T9999-nope');
+test('rewindReportsForm returns an error when deleting a nonexistent report on a POST request', async () => {
+  const result = await answer(null, 'authCode=test-auth-code&report=999999T9999-nope', 'POST');
   assert.equal(result.status, 'error');
   assert.ok(result.message?.includes('Deleting latest superseding reports'));
 });
 
-test('rewindReportsForm deletes a latest superseding report with valid auth code', async () => {
+test('rewindReportsForm deletes a latest superseding report with valid auth code on a POST request', async () => {
   // 260202T0000-new is the latest report for its URL, superseding 260101T0000-mix.
   const reportPath = path.join(reportsPath(), '260202T0000-new.json');
   const backup = await fs.readFile(reportPath, 'utf8');
   try {
-    const result = await answer(null, 'authCode=test-auth-code&report=260202T0000-new');
+    const result = await answer(null, 'authCode=test-auth-code&report=260202T0000-new', 'POST');
     assert.equal(result.status, 'ok');
     await fs.access(reportPath).then(
       () => {throw new Error('Report should have been deleted');},
@@ -77,7 +85,7 @@ test('rewindReportsForm returns an error when a report file is corrupt', {timeou
   const backup = await fs.readFile(reportPath, 'utf8');
   try {
     await fs.writeFile(reportPath, 'not valid json');
-    const result = await answer(null, '');
+    const result = await answer(null, '', 'GET');
     assert.equal(result.status, 'error');
   }
   finally {

package/web/showHiddenReportsForm/index.html

@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html lang="en-US">
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <meta name="publisher" content="Jonathan Robert Pool">
+    <meta name="creator" content="Jonathan Robert Pool">
+    <meta name="keywords" content="report,accessibility,a11y">
+    <title>View experimental reports | Kilotest</title>
+    <link rel="icon" href="/favicon.ico">
+    <link rel="stylesheet" href="/style.css">
+  </head>
+  <body>
+    <main>
+      <h1><a href="/">Kilotest</a>: View experimental reports</h1>
+      <form action="/showHiddenReportsForm.html" method="post">
+        <p><label>
+          Authorization code: <input size="3" minLength="3" maxlength="3" name="authCode" required>
+        </label></p>
+        <p><button type="submit">Submit</button></p>
+      </form>
+    </main>
+  </body>
+</html>

package/web/showHiddenReportsForm/index.ts

@@ -0,0 +1,45 @@
+/*
+  index.ts
+  Serves a form requesting an authorization code, and, once a valid code is submitted,
+  serves unhideReportForm's own list of hidden reports and its self-submitting unhide
+  form, so that the names of hidden reports are never disclosed without a valid code.
+*/
+
+// IMPORTS
+
+import {isValidAuthCode, populateTemplate} from '../../util.ts';
+import {answer as unhideReportForm} from '../unhideReportForm/index.ts';
+
+// FUNCTIONS
+
+// Returns a form requesting an authorization code on a GET request or an invalid
+// submission, or, on a POST request with a valid code, unhideReportForm's own page
+// (the list of hidden reports and its unhide form). A GET request, regardless of its
+// query string, never processes a submission, so the code cannot be validated by GET.
+export const answer = async (pathTail: any, search: string, method: string) => {
+  const searchParams = new URLSearchParams(search);
+  const authCode = searchParams?.get('authCode');
+  // If the form has been submitted:
+  if (method === 'POST') {
+    // If the authorization code is invalid:
+    if (!isValidAuthCode(authCode)) {
+      // Report the error, deliberately vague so as not to confirm to an attacker that the
+      // authorization code specifically (as opposed to some other part of the request) is
+      // what was wrong.
+      return {
+        status: 'error',
+        message: 'Invalid request'
+      };
+    }
+    // Otherwise, i.e. if the authorization code is valid, serve unhideReportForm's own
+    // page (the list of hidden reports and its self-submitting unhide form).
+    return unhideReportForm(pathTail, search, 'GET');
+  }
+  // Otherwise, i.e. if the form has not been submitted yet, get the populated template.
+  const answerPage = await populateTemplate(import.meta.dirname, {});
+  // Return the populated page.
+  return {
+    status: 'ok',
+    answerPage
+  };
+};