@mandujs/core 0.54.32 → 0.55.0-beta.1

package/src/filling/head-method.test.ts

@@ -1,154 +1,154 @@
-/**
- * Regression test for issue #319: a route that only registers a GET handler
- * via `Mandu.filling().get(...)` must serve HEAD requests as a body-less GET
- * (RFC 7231 §4.3.2) — returning the same status + headers with an empty body,
- * not a 405 Method Not Allowed.
- */
-import { describe, it, expect } from "bun:test";
-import { ManduFillingFactory } from "./filling";
-
-describe("Filling HEAD handling (#319)", () => {
-  it("serves HEAD via the GET handler with status + headers and an empty body", async () => {
-    const filling = ManduFillingFactory.filling().get((ctx) =>
-      ctx.json({ ok: true }),
-    );
-
-    const getRes = await filling.handle(
-      new Request("http://localhost/api/health", { method: "GET" }),
-    );
-    expect(getRes.status).toBe(200);
-
-    const headRes = await filling.handle(
-      new Request("http://localhost/api/health", { method: "HEAD" }),
-    );
-
-    expect(headRes.status).toBe(200);
-    expect(headRes.headers.get("content-type")).toBe(
-      getRes.headers.get("content-type"),
-    );
-    const headBody = await headRes.text();
-    expect(headBody).toBe("");
-  });
-
-  it("prefers an explicit HEAD handler when one is registered", async () => {
-    const filling = ManduFillingFactory.filling()
-      .get((ctx) => ctx.json({ ok: true }))
-      .head((ctx) => {
-        const res = ctx.json({ ignored: true });
-        res.headers.set("X-Explicit-Head", "1");
-        return res;
-      });
-
-    const headRes = await filling.handle(
-      new Request("http://localhost/api/health", { method: "HEAD" }),
-    );
-
-    expect(headRes.status).toBe(200);
-    expect(headRes.headers.get("X-Explicit-Head")).toBe("1");
-  });
-
-  it("still returns 405 for a method with no GET fallback", async () => {
-    const filling = ManduFillingFactory.filling().post((ctx) => ctx.json({ ok: true }));
-
-    const headRes = await filling.handle(
-      new Request("http://localhost/api/health", { method: "HEAD" }),
-    );
-
-    expect(headRes.status).toBe(405);
-  });
-
-  it("lists HEAD in the Allow set when GET is registered but the method is unsupported", async () => {
-    const filling = ManduFillingFactory.filling().get((ctx) => ctx.json({ ok: true }));
-
-    const putRes = await filling.handle(
-      new Request("http://localhost/api/health", { method: "PUT" }),
-    );
-
-    expect(putRes.status).toBe(405);
-    const body = (await putRes.json()) as { allowed: string[] };
-    expect(body.allowed).toContain("GET");
-    expect(body.allowed).toContain("HEAD");
-  });
-
-  // Issue #321: 405 responses MUST carry an `Allow` header listing every
-  // supported method — for multi-method routes too, not just single-method.
-  it("sets the Allow header to a single method route's methods", async () => {
-    const filling = ManduFillingFactory.filling().get((ctx) => ctx.json({ ok: true }));
-
-    const putRes = await filling.handle(
-      new Request("http://localhost/api/health", { method: "PUT" }),
-    );
-
-    expect(putRes.status).toBe(405);
-    const allow = putRes.headers.get("Allow") ?? "";
-    expect(allow.split(", ")).toContain("GET");
-    expect(allow.split(", ")).toContain("HEAD");
-  });
-
-  it("sets the Allow header to ALL methods for a multi-method route (#321)", async () => {
-    const filling = ManduFillingFactory.filling()
-      .get((ctx) => ctx.json({ ok: true }))
-      .post((ctx) => ctx.json({ ok: true }))
-      .delete((ctx) => ctx.json({ ok: true }));
-
-    const putRes = await filling.handle(
-      new Request("http://localhost/api/pledges", { method: "PUT" }),
-    );
-
-    expect(putRes.status).toBe(405);
-    const allow = putRes.headers.get("Allow") ?? "";
-    const methods = allow.split(", ");
-    expect(methods).toContain("GET");
-    expect(methods).toContain("POST");
-    expect(methods).toContain("DELETE");
-    // HEAD is implied by GET.
-    expect(methods).toContain("HEAD");
-  });
-
-  // RFC 7231 §4.3.7: a plain OPTIONS request (no explicit OPTIONS handler)
-  // should return 204 with an Allow header, not 405.
-  it("auto-responds to a plain OPTIONS request with 204 + Allow", async () => {
-    const filling = ManduFillingFactory.filling()
-      .get((ctx) => ctx.json({ ok: true }))
-      .post((ctx) => ctx.json({ ok: true }));
-
-    const res = await filling.handle(
-      new Request("http://localhost/api/pledges", { method: "OPTIONS" }),
-    );
-
-    expect(res.status).toBe(204);
-    const methods = (res.headers.get("Allow") ?? "").split(", ");
-    expect(methods).toContain("GET");
-    expect(methods).toContain("POST");
-    expect(methods).toContain("HEAD");
-    expect(methods).toContain("OPTIONS");
-  });
-
-  it("defers CORS preflight OPTIONS (Access-Control-Request-Method) instead of auto-answering", async () => {
-    const filling = ManduFillingFactory.filling().get((ctx) => ctx.json({ ok: true }));
-
-    const res = await filling.handle(
-      new Request("http://localhost/api/pledges", {
-        method: "OPTIONS",
-        headers: { "Access-Control-Request-Method": "GET", Origin: "https://x" },
-      }),
-    );
-
-    // No CORS middleware registered → falls through to 405 (not the 204
-    // auto-OPTIONS path), leaving preflight handling to CORS middleware.
-    expect(res.status).toBe(405);
-  });
-
-  it("an explicit OPTIONS handler still takes precedence", async () => {
-    const filling = ManduFillingFactory.filling()
-      .get((ctx) => ctx.json({ ok: true }))
-      .options((ctx) => ctx.json({ custom: true }));
-
-    const res = await filling.handle(
-      new Request("http://localhost/api/pledges", { method: "OPTIONS" }),
-    );
-
-    expect(res.status).toBe(200);
-    expect(await res.json()).toEqual({ custom: true });
-  });
-});
+/**
+ * Regression test for issue #319: a route that only registers a GET handler
+ * via `Mandu.filling().get(...)` must serve HEAD requests as a body-less GET
+ * (RFC 7231 §4.3.2) — returning the same status + headers with an empty body,
+ * not a 405 Method Not Allowed.
+ */
+import { describe, it, expect } from "bun:test";
+import { ManduFillingFactory } from "./filling";
+
+describe("Filling HEAD handling (#319)", () => {
+  it("serves HEAD via the GET handler with status + headers and an empty body", async () => {
+    const filling = ManduFillingFactory.filling().get((ctx) =>
+      ctx.json({ ok: true }),
+    );
+
+    const getRes = await filling.handle(
+      new Request("http://localhost/api/health", { method: "GET" }),
+    );
+    expect(getRes.status).toBe(200);
+
+    const headRes = await filling.handle(
+      new Request("http://localhost/api/health", { method: "HEAD" }),
+    );
+
+    expect(headRes.status).toBe(200);
+    expect(headRes.headers.get("content-type")).toBe(
+      getRes.headers.get("content-type"),
+    );
+    const headBody = await headRes.text();
+    expect(headBody).toBe("");
+  });
+
+  it("prefers an explicit HEAD handler when one is registered", async () => {
+    const filling = ManduFillingFactory.filling()
+      .get((ctx) => ctx.json({ ok: true }))
+      .head((ctx) => {
+        const res = ctx.json({ ignored: true });
+        res.headers.set("X-Explicit-Head", "1");
+        return res;
+      });
+
+    const headRes = await filling.handle(
+      new Request("http://localhost/api/health", { method: "HEAD" }),
+    );
+
+    expect(headRes.status).toBe(200);
+    expect(headRes.headers.get("X-Explicit-Head")).toBe("1");
+  });
+
+  it("still returns 405 for a method with no GET fallback", async () => {
+    const filling = ManduFillingFactory.filling().post((ctx) => ctx.json({ ok: true }));
+
+    const headRes = await filling.handle(
+      new Request("http://localhost/api/health", { method: "HEAD" }),
+    );
+
+    expect(headRes.status).toBe(405);
+  });
+
+  it("lists HEAD in the Allow set when GET is registered but the method is unsupported", async () => {
+    const filling = ManduFillingFactory.filling().get((ctx) => ctx.json({ ok: true }));
+
+    const putRes = await filling.handle(
+      new Request("http://localhost/api/health", { method: "PUT" }),
+    );
+
+    expect(putRes.status).toBe(405);
+    const body = (await putRes.json()) as { allowed: string[] };
+    expect(body.allowed).toContain("GET");
+    expect(body.allowed).toContain("HEAD");
+  });
+
+  // Issue #321: 405 responses MUST carry an `Allow` header listing every
+  // supported method — for multi-method routes too, not just single-method.
+  it("sets the Allow header to a single method route's methods", async () => {
+    const filling = ManduFillingFactory.filling().get((ctx) => ctx.json({ ok: true }));
+
+    const putRes = await filling.handle(
+      new Request("http://localhost/api/health", { method: "PUT" }),
+    );
+
+    expect(putRes.status).toBe(405);
+    const allow = putRes.headers.get("Allow") ?? "";
+    expect(allow.split(", ")).toContain("GET");
+    expect(allow.split(", ")).toContain("HEAD");
+  });
+
+  it("sets the Allow header to ALL methods for a multi-method route (#321)", async () => {
+    const filling = ManduFillingFactory.filling()
+      .get((ctx) => ctx.json({ ok: true }))
+      .post((ctx) => ctx.json({ ok: true }))
+      .delete((ctx) => ctx.json({ ok: true }));
+
+    const putRes = await filling.handle(
+      new Request("http://localhost/api/pledges", { method: "PUT" }),
+    );
+
+    expect(putRes.status).toBe(405);
+    const allow = putRes.headers.get("Allow") ?? "";
+    const methods = allow.split(", ");
+    expect(methods).toContain("GET");
+    expect(methods).toContain("POST");
+    expect(methods).toContain("DELETE");
+    // HEAD is implied by GET.
+    expect(methods).toContain("HEAD");
+  });
+
+  // RFC 7231 §4.3.7: a plain OPTIONS request (no explicit OPTIONS handler)
+  // should return 204 with an Allow header, not 405.
+  it("auto-responds to a plain OPTIONS request with 204 + Allow", async () => {
+    const filling = ManduFillingFactory.filling()
+      .get((ctx) => ctx.json({ ok: true }))
+      .post((ctx) => ctx.json({ ok: true }));
+
+    const res = await filling.handle(
+      new Request("http://localhost/api/pledges", { method: "OPTIONS" }),
+    );
+
+    expect(res.status).toBe(204);
+    const methods = (res.headers.get("Allow") ?? "").split(", ");
+    expect(methods).toContain("GET");
+    expect(methods).toContain("POST");
+    expect(methods).toContain("HEAD");
+    expect(methods).toContain("OPTIONS");
+  });
+
+  it("defers CORS preflight OPTIONS (Access-Control-Request-Method) instead of auto-answering", async () => {
+    const filling = ManduFillingFactory.filling().get((ctx) => ctx.json({ ok: true }));
+
+    const res = await filling.handle(
+      new Request("http://localhost/api/pledges", {
+        method: "OPTIONS",
+        headers: { "Access-Control-Request-Method": "GET", Origin: "https://x" },
+      }),
+    );
+
+    // No CORS middleware registered → falls through to 405 (not the 204
+    // auto-OPTIONS path), leaving preflight handling to CORS middleware.
+    expect(res.status).toBe(405);
+  });
+
+  it("an explicit OPTIONS handler still takes precedence", async () => {
+    const filling = ManduFillingFactory.filling()
+      .get((ctx) => ctx.json({ ok: true }))
+      .options((ctx) => ctx.json({ custom: true }));
+
+    const res = await filling.handle(
+      new Request("http://localhost/api/pledges", { method: "OPTIONS" }),
+    );
+
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({ custom: true });
+  });
+});