@luckystack/test-runner 0.1.9 → 0.2.0

package/dist/index.d.ts

@@ -2,6 +2,17 @@ import { z, ZodType } from 'zod';
 import { getPrismaClient } from '@luckystack/core';
 
 type HttpMethod = 'GET' | 'POST' | 'PUT' | 'DELETE';
+type ApiMethodMap$1 = Partial<Record<string, Partial<Record<string, Partial<Record<string, string>>>>>>;
+type SyncMethodMap = Partial<Record<string, Partial<Record<string, Partial<Record<string, string>>>>>>;
+interface ApiMetaEntry {
+    method: string;
+    auth: {
+        login: boolean;
+        additional?: Record<string, unknown>[];
+    };
+    rateLimit?: number | false;
+}
+type ApiMetaMap = Partial<Record<string, Partial<Record<string, Partial<Record<string, ApiMetaEntry>>>>>>;
 interface EndpointDescriptor {
     page: string;
     name: string;
@@ -27,8 +38,9 @@ interface RunContractSummary {
     results: ContractCheckResult[];
 }
 
-type ApiMethodMap$6 = Partial<Record<string, Partial<Record<string, Partial<Record<string, string>>>>>>;
-declare const walkEndpoints: (apiMethodMap: ApiMethodMap$6) => EndpointDescriptor[];
+type ApiMethodMap = Partial<Record<string, Partial<Record<string, Partial<Record<string, string>>>>>>;
+declare const walkEndpoints: (apiMethodMap: ApiMethodMap) => EndpointDescriptor[];
+declare const walkSyncEndpoints: (syncMethodMap: SyncMethodMap) => EndpointDescriptor[];
 
 interface ContractCheckInput {
     endpoint: EndpointDescriptor;
@@ -51,9 +63,8 @@ interface ContractCheckInput {
 }
 declare const runContractCheck: (input: ContractCheckInput) => Promise<ContractCheckResult>;
 
-type ApiMethodMap$5 = Partial<Record<string, Partial<Record<string, Partial<Record<string, string>>>>>>;
 interface RunContractTestsInput {
-    apiMethodMap: ApiMethodMap$5;
+    apiMethodMap: ApiMethodMap$1;
     baseUrl: string;
     /**
      * Endpoints to skip. Matched against `<page>/<name>` (version-agnostic) and
@@ -76,18 +87,9 @@ interface AuthEnforcementCheckInput {
 }
 declare const runAuthEnforcementCheck: (input: AuthEnforcementCheckInput) => Promise<ContractCheckResult>;
 
-type ApiMethodMap$4 = Partial<Record<string, Partial<Record<string, Partial<Record<string, string>>>>>>;
-type ApiMetaMap$2 = Partial<Record<string, Partial<Record<string, Partial<Record<string, {
-    method: string;
-    auth: {
-        login: boolean;
-        additional?: Record<string, unknown>[];
-    };
-    rateLimit?: number | false;
-}>>>>>>;
 interface RunAuthEnforcementTestsInput {
-    apiMethodMap: ApiMethodMap$4;
-    apiMetaMap: ApiMetaMap$2;
+    apiMethodMap: ApiMethodMap$1;
+    apiMetaMap: ApiMetaMap;
     baseUrl: string;
     skip?: string[];
     inputFor?: (endpoint: EndpointDescriptor) => unknown;
@@ -106,18 +108,9 @@ interface RateLimitCheckInput {
 }
 declare const runRateLimitCheck: (input: RateLimitCheckInput) => Promise<ContractCheckResult>;
 
-type ApiMethodMap$3 = Partial<Record<string, Partial<Record<string, Partial<Record<string, string>>>>>>;
-type ApiMetaMap$1 = Partial<Record<string, Partial<Record<string, Partial<Record<string, {
-    method: string;
-    auth: {
-        login: boolean;
-        additional?: Record<string, unknown>[];
-    };
-    rateLimit?: number | false;
-}>>>>>>;
 interface RunRateLimitTestsInput {
-    apiMethodMap: ApiMethodMap$3;
-    apiMetaMap: ApiMetaMap$1;
+    apiMethodMap: ApiMethodMap$1;
+    apiMetaMap: ApiMetaMap;
     baseUrl: string;
     skip?: string[];
     inputFor?: (endpoint: EndpointDescriptor) => unknown;
@@ -143,6 +136,42 @@ interface RunRateLimitTestsInput {
 }
 declare const runRateLimitTests: (input: RunRateLimitTestsInput) => Promise<RunContractSummary>;
 
+interface CsrfEnforcementCheckInput {
+    endpoint: EndpointDescriptor;
+    baseUrl: string;
+    /**
+     * A valid session Cookie header (`<name>=<token>`). The probe deliberately
+     * carries it so the request passes the auth guard and reaches the CSRF check.
+     */
+    authCookie: string;
+    inputFor?: (endpoint: EndpointDescriptor) => unknown;
+    /** Per-call request timeout in ms. Defaults to 5000. */
+    requestTimeoutMs?: number;
+    /** Error code expected on CSRF rejection. Defaults to `auth.csrfMismatch`. */
+    expectedErrorCode?: string;
+    /** HTTP status expected on CSRF rejection. Defaults to 403; pass `false` to skip. */
+    expectedHttpStatus?: number | false;
+}
+declare const runCsrfEnforcementCheck: (input: CsrfEnforcementCheckInput) => Promise<ContractCheckResult>;
+
+interface RunCsrfEnforcementTestsInput {
+    apiMethodMap: ApiMethodMap$1;
+    apiMetaMap: ApiMetaMap;
+    baseUrl: string;
+    /** Valid session Cookie header (`<name>=<token>`) the probes carry so they reach the CSRF check. */
+    authCookie: string;
+    skip?: string[];
+    inputFor?: (endpoint: EndpointDescriptor) => unknown;
+    /** Per-call request timeout in ms forwarded to each check. */
+    requestTimeoutMs?: number;
+    /** Error code expected on CSRF rejection. Defaults to `auth.csrfMismatch`. */
+    expectedErrorCode?: string;
+    /** HTTP status expected on CSRF rejection. Defaults to 403; pass `false` to skip. */
+    expectedHttpStatus?: number | false;
+    onResult?: (result: ContractCheckResult) => void;
+}
+declare const runCsrfEnforcementTests: (input: RunCsrfEnforcementTestsInput) => Promise<RunContractSummary>;
+
 interface FuzzCheckInput {
     endpoint: EndpointDescriptor;
     baseUrl: string;
@@ -152,9 +181,8 @@ interface FuzzCheckInput {
 }
 declare const runFuzzCheck: (input: FuzzCheckInput) => Promise<ContractCheckResult>;
 
-type ApiMethodMap$2 = Partial<Record<string, Partial<Record<string, Partial<Record<string, string>>>>>>;
 interface RunFuzzTestsInput {
-    apiMethodMap: ApiMethodMap$2;
+    apiMethodMap: ApiMethodMap$1;
     baseUrl: string;
     skip?: string[];
     headers?: Record<string, string>;
@@ -165,8 +193,9 @@ declare const runFuzzTests: (input: RunFuzzTestsInput) => Promise<RunContractSum
 interface ResetServerStateInput {
     baseUrl: string;
     token?: string;
+    requestTimeoutMs?: number;
 }
-declare const resetServerState: ({ baseUrl, token }: ResetServerStateInput) => Promise<boolean>;
+declare const resetServerState: ({ baseUrl, token, requestTimeoutMs }: ResetServerStateInput) => Promise<boolean>;
 
 declare const sampleSchemaInput: (schema: z.ZodType) => unknown;
 
@@ -211,7 +240,6 @@ interface OpenStreamWatcherInput {
 }
 declare const openStreamWatcher: <TChunk extends StreamChunkFrame = StreamChunkFrame>(input: OpenStreamWatcherInput) => Promise<StreamWatcher<TChunk>>;
 
-type ApiMethodMap$1 = Partial<Record<string, Partial<Record<string, Partial<Record<string, string>>>>>>;
 interface CustomTestCase {
     name: string;
     run: (ctx: TestContext) => Promise<void>;
@@ -312,18 +340,9 @@ interface TestExpect {
 }
 declare const runCustomTests: (input: RunCustomTestsInput) => Promise<RunCustomTestsSummary>;
 
-type ApiMethodMap = Partial<Record<string, Partial<Record<string, Partial<Record<string, string>>>>>>;
-type ApiMetaMap = Partial<Record<string, Partial<Record<string, Partial<Record<string, {
-    method: string;
-    auth: {
-        login: boolean;
-        additional?: Record<string, unknown>[];
-    };
-    rateLimit?: number | false;
-}>>>>>>;
 type ApiInputSchemas = Partial<Record<string, Partial<Record<string, Partial<Record<string, ZodType | undefined>>>>>>;
 interface RunAllTestsInput {
-    apiMethodMap: ApiMethodMap;
+    apiMethodMap: ApiMethodMap$1;
     apiMetaMap: ApiMetaMap;
     apiInputSchemas: ApiInputSchemas;
     baseUrl: string;
@@ -339,12 +358,19 @@ interface RunAllTestsInput {
     noSweep?: boolean;
     noFuzz?: boolean;
     noRateLimit?: boolean;
+    /**
+     * Disable the CSRF-enforcement layer. Defaults to ON (the layer runs) — but it
+     * can only probe past the auth guard with a session, so it is a no-op unless an
+     * `authToken` is supplied.
+     */
+    noCsrf?: boolean;
     noCustom?: boolean;
 }
 interface RunAllTestsSummary {
     contract?: RunContractSummary;
     auth?: RunContractSummary;
     rateLimit?: RunContractSummary;
+    csrf?: RunContractSummary;
     fuzz?: RunContractSummary;
     custom?: RunCustomTestsSummary;
     totalPassed: number;
@@ -430,4 +456,13 @@ declare const registerTestReporter: (newReporter: TestReporter | null) => void;
 declare const getTestReporter: () => TestReporter | null;
 declare const resetTestExtensionsForTests: () => void;
 
-export { type AuthEnforcementCheckInput, type ContractCheckInput, type ContractCheckResult, type CustomTestCase, type CustomTestResult, type EndpointDescriptor, type FuzzCheckInput, type HttpMethod, type OpenStreamWatcherInput, type RateLimitCheckInput, type ResetServerStateInput, type RunAllTestsInput, type RunAllTestsSummary, type RunAuthEnforcementTestsInput, type RunContractSummary, type RunContractTestsInput, type RunCustomTestsInput, type RunCustomTestsSummary, type RunFuzzTestsInput, type RunRateLimitTestsInput, type StreamChunkFrame, type StreamWatcher, type TestContext, type TestExpect, type TestFixture, type TestLayer, type TestLayerInput, type TestLayerResult, type TestReporter, type TestResult, type TestSummary, discoverCustomTestFiles, getTestFixture, getTestReporter, listTestLayers, logContractResult, logContractSummary, logRunAllSummary, openStreamWatcher, registerTestFixture, registerTestLayer, registerTestReporter, resetServerState, resetTestExtensionsForTests, runAllTests, runAuthEnforcementCheck, runAuthEnforcementTests, runContractCheck, runContractTests, runCustomTests, runFuzzCheck, runFuzzTests, runRateLimitCheck, runRateLimitTests, sampleSchemaInput, walkEndpoints };
+declare const LAYER_KEYS: {
+    readonly contract: "contract";
+    readonly auth: "auth-enforcement";
+    readonly rateLimit: "rate-limit";
+    readonly csrf: "csrf-enforcement";
+    readonly fuzz: "fuzz";
+    readonly custom: "custom";
+};
+
+export { type ApiMetaEntry, type ApiMetaMap, type ApiMethodMap$1 as ApiMethodMap, type AuthEnforcementCheckInput, type ContractCheckInput, type ContractCheckResult, type CsrfEnforcementCheckInput, type CustomTestCase, type CustomTestResult, type EndpointDescriptor, type FuzzCheckInput, type HttpMethod, LAYER_KEYS, type OpenStreamWatcherInput, type RateLimitCheckInput, type ResetServerStateInput, type RunAllTestsInput, type RunAllTestsSummary, type RunAuthEnforcementTestsInput, type RunContractSummary, type RunContractTestsInput, type RunCsrfEnforcementTestsInput, type RunCustomTestsInput, type RunCustomTestsSummary, type RunFuzzTestsInput, type RunRateLimitTestsInput, type StreamChunkFrame, type StreamWatcher, type SyncMethodMap, type TestContext, type TestExpect, type TestFixture, type TestLayer, type TestLayerInput, type TestLayerResult, type TestReporter, type TestResult, type TestSummary, discoverCustomTestFiles, getTestFixture, getTestReporter, listTestLayers, logContractResult, logContractSummary, logRunAllSummary, openStreamWatcher, registerTestFixture, registerTestLayer, registerTestReporter, resetServerState, resetTestExtensionsForTests, runAllTests, runAuthEnforcementCheck, runAuthEnforcementTests, runContractCheck, runContractTests, runCsrfEnforcementCheck, runCsrfEnforcementTests, runCustomTests, runFuzzCheck, runFuzzTests, runRateLimitCheck, runRateLimitTests, sampleSchemaInput, walkEndpoints, walkSyncEndpoints };