@nutin/cli 2.1.1 → 3.0.0

package/templates/base/src/core/services/http-client/helpers/http-builder.helper.test.js.hbs

@@ -1,35 +1,49 @@
-import { HttpBuilder } from '#root/dist/src/core/services/http-client/helpers/http-builder.helper.js';
-
-const mockAbortSignal = {
-    aborted: false,
-    onabort: null,
-    addEventListener: () => {},
-    removeEventListener: () => {},
-    dispatchEvent: () => true,
-  };
+import * as HttpBuilder from '#root/dist/src/core/services/http-client/helpers/http-builder.helper.js';
+import { path } from '#root/dist/src/core/services/http-client/helpers/http-builder.helper.js';
 
 describe('HttpBuilder', () => {
-  // Tests for buildRequestBody
-  it('buildRequestBody returns undefined for null input', () => {
-    const result = HttpBuilder.buildRequestBody(null);
-    expect(result).toBeUndefined();
-  });
+  // The request body, as buildRequestOptions() builds it
+  const bodyOf = (data) => HttpBuilder.buildRequestOptions('POST', data, {}, new Headers(), new AbortController().signal).body;
 
-  it('buildRequestBody returns undefined for undefined input', () => {
-    const result = HttpBuilder.buildRequestBody(undefined);
-    expect(result).toBeUndefined();
+  it('sends no body for null or undefined data', () => {
+    expect(bodyOf(null)).toBeUndefined();
+    expect(bodyOf(undefined)).toBeUndefined();
   });
 
-  it('buildRequestBody returns string for object input', () => {
+  it('JSON-encodes an object body', () => {
     const data = { name: 'Alice' };
-    const result = HttpBuilder.buildRequestBody(data);
-    expect(result).toBe(JSON.stringify(data));
+    expect(bodyOf(data)).toBe(JSON.stringify(data));
+  });
+
+  it('JSON-encodes primitives, falsy ones included', () => {
+    expect(bodyOf(42)).toBe('42');
+    expect(bodyOf('text')).toBe('"text"');
+    expect(bodyOf(0)).toBe('0');
+    expect(bodyOf(false)).toBe('false');
+    expect(bodyOf('')).toBe('""');
+  });
+
+  it('passes fetch body types through unchanged', () => {
+    const bodies = [new FormData(), new Blob(['x']), new URLSearchParams('a=1'), new ArrayBuffer(1), new Uint8Array(1), new ReadableStream()];
+    bodies.forEach((body) => expect(bodyOf(body)).toBe(body));
   });
 
-  it('buildRequestBody handles primitive types', () => {
-    expect(HttpBuilder.buildRequestBody(42)).toBe('42');
-    expect(HttpBuilder.buildRequestBody('text')).toContain('text');
-    expect(HttpBuilder.buildRequestBody(true)).toBeDefined();
+  it('appendQueryParams skips null/undefined, stringifies values and repeats arrays', () => {
+    const url = new URL('https://api.example.com');
+    HttpBuilder.appendQueryParams(url, { a: 1, b: false, c: null, d: undefined, e: ['x', null, 2] });
+    expect(url.search).toBe('?a=1&b=false&e=x&e=2');
+  });
+
+  it('appendQueryParams does nothing without params', () => {
+    const url = new URL('https://api.example.com/?a=1');
+    HttpBuilder.appendQueryParams(url, undefined);
+    expect(url.search).toBe('?a=1');
+  });
+
+  it('mergeHeaders merges case-insensitively, later records winning, and skips undefined', () => {
+    const headers = HttpBuilder.mergeHeaders({ 'Content-Type': 'a', 'X-One': '1' }, undefined, { 'content-type': 'b' });
+    expect(headers.get('content-type')).toBe('b');
+    expect(headers.get('x-one')).toBe('1');
   });
 
   // Tests for appendQueryParams
@@ -60,6 +74,65 @@ describe('HttpBuilder', () => {
   });
 
   // Tests for buildRequestUrl
+  it('resolveUrl keeps an absolute endpoint when there is no base URL', () => {
+    expect(HttpBuilder.resolveUrl('', 'https://api.example.com/users').href).toBe('https://api.example.com/users');
+  });
+
+  it('resolveUrl resolves a relative endpoint against the page origin when there is no base URL', () => {
+    expect(HttpBuilder.resolveUrl('', '/api/users').href).toBe('http://localhost/api/users');
+    expect(HttpBuilder.resolveUrl('', 'api/users?x=1').href).toBe('http://localhost/api/users?x=1');
+  });
+
+  it('resolveUrl joins endpoints under the base URL with or without slashes', () => {
+    expect(HttpBuilder.resolveUrl('https://api.example.com', '/users/1').href).toBe('https://api.example.com/users/1');
+    expect(HttpBuilder.resolveUrl('https://api.example.com/v1', '/users').href).toBe('https://api.example.com/v1/users');
+    expect(HttpBuilder.resolveUrl('https://api.example.com/v1/', 'users').href).toBe('https://api.example.com/v1/users');
+    expect(HttpBuilder.resolveUrl('https://api.example.com/v1', '').href).toBe('https://api.example.com/v1/');
+  });
+
+  it('resolveUrl keeps host-like endpoints on the base origin', () => {
+    expect(HttpBuilder.resolveUrl('https://api.example.com', '@other.example/x').href).toBe('https://api.example.com/@other.example/x');
+    expect(HttpBuilder.resolveUrl('https://api.example.com', '.other.example/x').href).toBe('https://api.example.com/.other.example/x');
+    expect(HttpBuilder.resolveUrl('https://api.example.com', '//other.example/x').href).toBe('https://api.example.com/other.example/x');
+  });
+
+  it('resolveUrl keeps the base URL query ahead of the endpoint query', () => {
+    expect(HttpBuilder.resolveUrl('https://api.example.com/v1?v=2', '/users?page=3').href).toBe('https://api.example.com/v1/users?v=2&page=3');
+  });
+
+  it('resolveUrl only allows http and https', () => {
+    expect(HttpBuilder.resolveUrl('', 'http://api.example.com/a').protocol).toBe('http:');
+    expect(() => HttpBuilder.resolveUrl('', 'ftp://files.example.com/a')).toThrow('must use http or https');
+  });
+
+  it('resolveUrl rejects an encoded slash or backslash in the path unless the URL is under a trusted API', () => {
+    expect(() => HttpBuilder.resolveUrl('https://api.example.com', '/files/a%2Fb')).toThrow('trustedAPIs');
+    expect(() => HttpBuilder.resolveUrl('https://api.example.com', '/files/a%5cb')).toThrow('trustedAPIs');
+    const trusted = ['https://api.example.com/files/'];
+    expect(HttpBuilder.resolveUrl('https://api.example.com', '/files/a%2Fb', trusted).pathname).toBe('/files/a%2Fb');
+    expect(() => HttpBuilder.resolveUrl('https://api.example.com', '/other/a%2Fb', trusted)).toThrow('trustedAPIs');
+    expect(() => HttpBuilder.resolveUrl('', 'https://cdn.example.com/files/a%2Fb', trusted)).toThrow('trustedAPIs');
+  });
+
+  it('resolveUrl matches trusted APIs on whole path segments', () => {
+    const trusted = ['https://api.example.com/v1'];
+    expect(HttpBuilder.resolveUrl('', 'https://api.example.com/v1/a%2Fb', trusted).pathname).toBe('/v1/a%2Fb');
+    expect(() => HttpBuilder.resolveUrl('', 'https://api.example.com/v10/a%2Fb', trusted)).toThrow('trustedAPIs');
+  });
+
+  it('describe shows origin and path only', () => {
+    expect(HttpBuilder.describe(new URL('https://api.example.com/a?key=secret#h'))).toBe('https://api.example.com/a');
+  });
+
+  it('resolveUrl rejects absolute URLs on another origin', () => {
+    expect(() => HttpBuilder.resolveUrl('https://api.example.com', 'https://other.example/x')).toThrow();
+  });
+
+  it('resolveUrl rejects endpoints that leave the base path', () => {
+    expect(() => HttpBuilder.resolveUrl('https://api.example.com/v1', '/users/../../admin')).toThrow();
+    expect(() => HttpBuilder.resolveUrl('https://api.example.com/v1', '%2e%2e/admin')).toThrow();
+  });
+
   it('buildRequestUrl returns URL without query params', () => {
     const url = HttpBuilder.buildRequestUrl('https://api.example.com');
     expect(url.search).toBe('');
@@ -81,54 +154,64 @@ describe('HttpBuilder', () => {
   });
 
   // Tests for buildRequestOptions
-  it('buildRequestOptions sets GET without body', () => {
-    const options = HttpBuilder.buildRequestOptions(
-      'GET',
-      null,
-      { headers: { 'X-Test': 'value' } },
-      mockAbortSignal
-    );
+  it('buildRequestOptions sets GET without body or content type', () => {
+    const headers = new Headers({ 'X-Test': 'value' });
+    const signal = new AbortController().signal;
+    const options = HttpBuilder.buildRequestOptions('GET', null, {}, headers, signal);
     expect(options.method).toBe('GET');
     expect(options.body).toBeUndefined();
-    expect(JSON.stringify(options.headers)).toBe(JSON.stringify({ 'X-Test': 'value' }));
-    expect(options.signal).toBe(mockAbortSignal);
+    expect(options.headers.get('x-test')).toBe('value');
+    expect(options.headers.has('content-type')).toBe(false);
+    expect(options.signal).toBe(signal);
   });
 
-  it('buildRequestOptions sets POST with body', () => {
-    const data = { name: 'Alice' };
+  it('buildRequestOptions sets a JSON body and content type', () => {
+    const options = HttpBuilder.buildRequestOptions('POST', { name: 'Alice' }, {}, new Headers(), new AbortController().signal);
+    expect(options.body).toBe('{"name":"Alice"}');
+    expect(options.headers.get('content-type')).toBe('application/json');
+  });
+
+  it('buildRequestOptions keeps an explicit content type and passes fetch options through', () => {
     const options = HttpBuilder.buildRequestOptions(
       'POST',
-      data,
-      { headers: { 'Content-Type': 'application/json' } },
-      mockAbortSignal
+      { a: 1 },
+      { credentials: 'include', cache: 'no-store', referrerPolicy: 'no-referrer', redirect: 'manual' },
+      new Headers({ 'content-type': 'text/plain' }),
+      new AbortController().signal
     );
-    expect(options.method).toBe('POST');
-    expect(options.body).toBe(JSON.stringify(data));
-  });
-
-  it('buildRequestOptions handles empty config', () => {
-    const options = HttpBuilder.buildRequestOptions('GET', null, {}, mockAbortSignal);
-    expect(options.body).toBeUndefined();
-    expect(options.headers).toBeUndefined();
+    expect(options.headers.get('content-type')).toBe('text/plain');
+    expect(options.credentials).toBe('include');
+    expect(options.cache).toBe('no-store');
+    expect(options.referrerPolicy).toBe('no-referrer');
+    expect(options.redirect).toBe('manual');
   });
 
   it('buildRequestOptions sets PUT with body', () => {
     const data = { id: 1, name: 'Updated' };
-    const options = HttpBuilder.buildRequestOptions('PUT', data, {}, mockAbortSignal);
+    const options = HttpBuilder.buildRequestOptions('PUT', data, {}, new Headers(), new AbortController().signal);
     expect(options.method).toBe('PUT');
     expect(options.body).toBe(JSON.stringify(data));
   });
 
   it('buildRequestOptions sets PATCH with body', () => {
     const data = { name: 'Patched' };
-    const options = HttpBuilder.buildRequestOptions('PATCH', data, {}, mockAbortSignal);
+    const options = HttpBuilder.buildRequestOptions('PATCH', data, {}, new Headers(), new AbortController().signal);
     expect(options.method).toBe('PATCH');
     expect(options.body).toBe(JSON.stringify(data));
   });
 
   it('buildRequestOptions sets DELETE without body', () => {
-    const options = HttpBuilder.buildRequestOptions('DELETE', undefined, {}, mockAbortSignal);
+    const options = HttpBuilder.buildRequestOptions('DELETE', undefined, {}, new Headers(), new AbortController().signal);
     expect(options.method).toBe('DELETE');
     expect(options.body).toBeUndefined();
   });
-})
+
+  it('path encodes values and keeps the static parts', () => {
+    expect(path`/users/${'a b'}/files/${'x/y'}?v=${1}`).toBe('/users/a%20b/files/x%2Fy?v=1');
+  });
+
+  it('path rejects "." and ".." values', () => {
+    expect(() => path`/a/${'.'}`).toThrow('not a valid path value');
+    expect(() => path`/a/${'..'}`).toThrow('not a valid path value');
+  });
+});

package/templates/base/src/core/services/http-client/helpers/http-builder.helper.ts.hbs

@@ -1,48 +1,156 @@
-export type HttpMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
-
-/**
- * headers?: Record<string, string>;
- * queryParams?: Record<string, string>;
- * timeout?: number;
- */
-export interface IRequestConfig {
-  headers?: Record<string, string>;
-  queryParams?: Record<string, string>;
-  timeout?: number;
-}
-
-export class HttpBuilder {
-  public static buildRequestOptions(
-    method: HttpMethod,
-    data: unknown,
-    config: IRequestConfig,
-    signal: AbortSignal
-  ): RequestInit {
-    return {
-      method,
-      headers: config.headers,
-      body: this.buildRequestBody(data),
-      signal
-    };
+const ALLOWED_PROTOCOLS = new Set(['http:', 'https:']);
+const ENCODED_SEPARATOR = /%2f|%5c/i;
+
+export function buildRequestOptions(
+  method: Nutin.HttpMethod,
+  data: unknown,
+  config: Nutin.RequestConfig,
+  headers: Headers,
+  signal: AbortSignal
+): RequestInit {
+  const body = buildRequestBody(data);
+  if (isJsonBody(data) && !headers.has('content-type')) {
+    headers.set('content-type', 'application/json');
   }
 
-  public static buildRequestUrl(endpoint: string, queryParams?: Record<string, string>): URL {
-    const url = new URL(endpoint);
-    
-    if (queryParams) {
-      this.appendQueryParams(url, queryParams);
-    }
+  const options: RequestInit = { method, headers, body, signal };
+  if (config.credentials) options.credentials = config.credentials;
+  if (config.cache) options.cache = config.cache;
+  if (config.referrerPolicy) options.referrerPolicy = config.referrerPolicy;
+  if (config.redirect) options.redirect = config.redirect;
+  return options;
+}
 
-    return url;
-  }
+// Merges header records case-insensitively: later records win ("content-type" overrides "Content-Type").
+export function mergeHeaders(...records: Array<Record<string, string> | undefined>): Headers {
+  const headers = new Headers();
+  records.forEach((record) => {
+    if (record) new Headers(record).forEach((value, name) => headers.set(name, value));
+  });
+  return headers;
+}
+
+// Resolves an endpoint to the URL that will be fetched.
+// - With a base URL, the endpoint is joined onto it as a URL (never as a string), and the
+//   result must stay on the base origin and under the base path; the base's query is kept.
+// - Without one, a relative endpoint resolves against the page's origin (not document.baseURI).
+// Only http(s) is allowed, and an encoded "/" or "\" in the path is rejected (servers may decode
+// it into a separator) unless the URL is under one of `trustedAPIs`.
+export function resolveUrl(baseUrl: string, endpoint: string, trustedAPIs: string[] = []): URL {
+  const url = baseUrl ? resolveAgainstBase(baseUrl, endpoint) : new URL(endpoint, window.location.origin);
 
-  private static buildRequestBody(data: unknown): string | undefined {
-    return data ? JSON.stringify(data) : undefined;
+  if (!ALLOWED_PROTOCOLS.has(url.protocol)) {
+    throw new Error(`Request URL must use http or https, got "${url.protocol}".`);
   }
+  if (ENCODED_SEPARATOR.test(url.pathname) && !isTrusted(url, trustedAPIs)) {
+    throw new Error(
+      `Request URL "${describe(url)}" contains an encoded "/" or "\\". ` +
+        'List its API in the HttpClient "trustedAPIs" option if it expects them.'
+    );
+  }
+  return url;
+}
+
+export function buildRequestUrl(endpoint: string, queryParams?: Nutin.RequestConfig['queryParams']): URL {
+  const url = new URL(endpoint);
+  appendQueryParams(url, queryParams);
+  return url;
+}
 
-  private static appendQueryParams(url: URL, queryParams: Record<string, string>): void {
-    Object.entries(queryParams).forEach(([key, value]) => {
-      url.searchParams.append(key, value);
+export function appendQueryParams(url: URL, queryParams?: Nutin.RequestConfig['queryParams']): void {
+  if (!queryParams) return;
+  Object.entries(queryParams).forEach(([key, value]) => {
+    const values = Array.isArray(value) ? value : [value];
+    values.forEach((item) => {
+      if (item !== null && item !== undefined) url.searchParams.append(key, String(item));
     });
+  });
+}
+
+// Origin + path only: query strings often carry keys or tokens.
+export function describe(url: URL): string {
+  return `${url.origin}${url.pathname}`;
+}
+
+// A followed redirect must end where the request itself was allowed to go: under the base
+// URL, or (without one) on the requested origin. Otherwise the response is another origin's,
+// and custom headers (unlike Authorization) were forwarded to it.
+export function assertRedirectTarget(baseUrl: string, requested: URL, finalUrl: string): void {
+  const final = new URL(finalUrl);
+  const allowed = baseUrl ? isUnderBase(final, baseUrl) : final.origin === requested.origin;
+  if (!allowed) {
+    throw new Error(
+      `Request to "${describe(requested)}" was redirected to "${describe(final)}", outside ` +
+        `${baseUrl ? `the HttpClient base URL "${describe(new URL(baseUrl))}"` : 'its origin'}.`
+    );
+  }
+}
+
+function isUnderBase(url: URL, baseUrl: string): boolean {
+  const base = new URL(baseUrl);
+  const basePath = base.pathname.endsWith('/') ? base.pathname : `${base.pathname}/`;
+  const underBase = url.pathname.startsWith(basePath) || `${url.pathname}/` === basePath;
+  return url.origin === base.origin && underBase;
+}
+
+function resolveAgainstBase(baseUrl: string, endpoint: string): URL {
+  const base = new URL(baseUrl);
+  const basePath = base.pathname.endsWith('/') ? base.pathname : `${base.pathname}/`;
+  const url = new URL(endpoint.replace(/^\/+/, ''), `${base.origin}${basePath}`);
+
+  if (!isUnderBase(url, baseUrl)) {
+    throw new Error(
+      `Request URL "${describe(url)}" is outside the HttpClient base URL "${describe(base)}".`
+    );
+  }
+
+  // Keep the base URL's own query (e.g. an API version), before the endpoint's.
+  if (base.search) {
+    const params = new URLSearchParams(base.search);
+    url.searchParams.forEach((value, key) => params.append(key, value));
+    url.search = params.toString();
+  }
+  return url;
+}
+
+// Same segment boundary as the base URL: a trusted ".../v1" doesn't cover ".../v10".
+function isTrusted(url: URL, trustedAPIs: string[]): boolean {
+  return trustedAPIs.some((entry) => isUnderBase(url, entry));
+}
+
+// Only null/undefined mean "no body"; fetch's own body types are sent as they are.
+function buildRequestBody(data: unknown): BodyInit | undefined {
+  if (data === null || data === undefined) return undefined;
+  if (isNativeBody(data)) return data as BodyInit;
+  return JSON.stringify(data);
+}
+
+function isJsonBody(data: unknown): boolean {
+  return data !== null && data !== undefined && !isNativeBody(data);
+}
+
+function isNativeBody(data: unknown): boolean {
+  return (
+    (typeof FormData !== 'undefined' && data instanceof FormData) ||
+    (typeof Blob !== 'undefined' && data instanceof Blob) ||
+    (typeof URLSearchParams !== 'undefined' && data instanceof URLSearchParams) ||
+    (typeof ReadableStream !== 'undefined' && data instanceof ReadableStream) ||
+    data instanceof ArrayBuffer ||
+    ArrayBuffer.isView(data)
+  );
+}
+
+// Builds an endpoint path from values: each value is URL-encoded, so it stays one path
+// segment ("a/b" becomes "a%2Fb", which resolveUrl only accepts under `trustedAPIs`).
+// "." and ".." are rejected: as a whole segment they would move up the path.
+export function path(strings: TemplateStringsArray, ...values: unknown[]): string {
+  return strings.reduce((out, str, i) => out + encodePathValue(values[i - 1]) + str);
+}
+
+function encodePathValue(value: unknown): string {
+  const text = String(value);
+  if (text === '.' || text === '..') {
+    throw new Error(`path\`\`: "${text}" is not a valid path value.`);
   }
+  return encodeURIComponent(text);
 }

package/templates/base/src/core/services/http-client/helpers/http-manager.helper.test.js.hbs

@@ -1,4 +1,5 @@
-import { HttpManager, HttpError } from '#root/dist/src/core/services/http-client/helpers/http-manager.helper.js';
+import * as HttpManager from '#root/dist/src/core/services/http-client/helpers/http-manager.helper.js';
+import { HttpError } from '#root/dist/src/core/services/http-client/helpers/http-manager.helper.js';
 
 describe('HttpManager', () => {
   it('should create an AbortController with a timeout', () => {
@@ -9,25 +10,69 @@ describe('HttpManager', () => {
   });
 
   it('should create an AbortController without a timeout', () => {
-    const { controller, timeoutId } = HttpManager.createAbortController();
+    const { controller, timeoutId, timedOut } = HttpManager.createAbortController();
     expect(controller).toBeInstanceOf(AbortController);
     expect(timeoutId).toBe(null);
+    expect(timedOut()).toBe(false);
   });
 
-  it('should parse a valid JSON error response', async () => {
+  it('should mark the request as timed out when its timeout fires', () => {
+    useFakeTimers();
+    try {
+      const { controller, timedOut, cleanup } = HttpManager.createAbortController(5);
+      advanceTimersByTime(4);
+      expect(timedOut()).toBe(false);
+      advanceTimersByTime(1);
+      expect(controller.signal.aborted).toBe(true);
+      expect(timedOut()).toBe(true);
+      cleanup();
+    } finally {
+      useRealTimers();
+    }
+  });
+
+  it('should reject a timeout that is not a positive number', () => {
+    expect(() => HttpManager.createAbortController(0)).toThrow('positive number');
+    expect(() => HttpManager.createAbortController(-5)).toThrow('positive number');
+  });
+
+  it('should forward an abort from the caller signal, and stop forwarding after cleanup', () => {
+    const caller = new AbortController();
+    const first = HttpManager.createAbortController(undefined, caller.signal);
+    caller.abort();
+    expect(first.controller.signal.aborted).toBe(true);
+    expect(first.timedOut()).toBe(false);
+
+    const other = new AbortController();
+    const second = HttpManager.createAbortController(undefined, other.signal);
+    second.cleanup();
+    other.abort();
+    expect(second.controller.signal.aborted).toBe(false);
+  });
+
+  it('should start aborted when the caller signal already is', () => {
+    const caller = new AbortController();
+    caller.abort();
+    expect(HttpManager.createAbortController(undefined, caller.signal).controller.signal.aborted).toBe(true);
+  });
+
+  it('parses a JSON error response into the HttpError', async () => {
     const mockResponse = new Response(JSON.stringify({ error: 'Invalid' }), {
+      status: 422,
       headers: { 'Content-Type': 'application/json' }
     });
-    const result = await HttpManager.safeParseErrorResponse(mockResponse);
-    expect(JSON.stringify(result)).toBe(JSON.stringify({ error: 'Invalid' }));
+    const error = await HttpManager.validateResponse(mockResponse).catch((e) => e);
+    expect(JSON.stringify(error.response)).toBe(JSON.stringify({ error: 'Invalid' }));
   });
 
-  it('should return null for non-JSON error response', async () => {
+  it('gives the HttpError a null response for a non-JSON error body', async () => {
     const mockResponse = new Response('Not JSON', {
+      status: 500,
       headers: { 'Content-Type': 'text/plain' }
     });
-    const result = await HttpManager.safeParseErrorResponse(mockResponse);
-    expect(result).toBe(null);
+    const error = await HttpManager.validateResponse(mockResponse).catch((e) => e);
+    expect(error.status).toBe(500);
+    expect(error.response).toBe(null);
   });
 
   it('should not throw for ok responses in validateResponse', async () => {
@@ -75,11 +120,14 @@ describe('HttpManager', () => {
     expect(thrown).toBe(true);
   });
 
-  it('should detect JSON content types', () => {
-    expect(HttpManager.isJsonResponse('application/json')).toBe(true);
-    expect(HttpManager.isJsonResponse('application/json; charset=utf-8')).toBe(true);
-    expect(HttpManager.isJsonResponse('text/html')).toBe(false);
-    expect(HttpManager.isJsonResponse(null)).toBe(false);
+  it('parses JSON and +json content types, and returns anything else as text', async () => {
+    const parse = (contentType) => HttpManager.parseSuccessResponse(new Response('{"a":1}', contentType ? { headers: { 'Content-Type': contentType } } : {}));
+    for (const type of ['application/json', 'application/json; charset=utf-8', 'Application/JSON', 'application/problem+json']) {
+      expect(await parse(type)).toEqual({ a: 1 });
+    }
+    for (const type of ['application/jsonp', 'text/html', null]) {
+      expect(await parse(type)).toBe('{"a":1}');
+    }
   });
 
   it('should parse success JSON response', async () => {
@@ -90,6 +138,13 @@ describe('HttpManager', () => {
     expect(JSON.stringify(result)).toBe(JSON.stringify({ message: 'ok' }));
   });
 
+  it('should resolve 204, 205 and empty bodies to undefined', async () => {
+    expect(await HttpManager.parseSuccessResponse(new Response(null, { status: 204 }))).toBe(undefined);
+    expect(await HttpManager.parseSuccessResponse(new Response(null, { status: 205 }))).toBe(undefined);
+    const empty = new Response('', { headers: { 'Content-Type': 'application/json' } });
+    expect(await HttpManager.parseSuccessResponse(empty)).toBe(undefined);
+  });
+
   it('should parse success text response as fallback', async () => {
     const mockResponse = new Response('plain text', {
       headers: { 'Content-Type': 'text/plain' }
@@ -98,19 +153,20 @@ describe('HttpManager', () => {
     expect(result).toBe('plain text');
   });
 
-  it('should detect timeout errors', () => {
-    const err = new DOMException('Aborted', 'AbortError');
-    expect(HttpManager.isTimeoutError(err)).toBe(true);
+  it('reports only an AbortError as a timeout', () => {
+    expect(() => HttpManager.handleRequestError(new DOMException('Aborted', 'AbortError'), true)).toThrow('Request timed out');
+    expect(() => HttpManager.handleRequestError(new Error('Other'), true)).toThrow('Other');
+  });
 
-    const otherErr = new Error('Other');
-    expect(HttpManager.isTimeoutError(otherErr)).toBe(false);
+  it('should rethrow an abort that was not the timeout as it is', () => {
+    expect(() => HttpManager.handleRequestError(new DOMException('Aborted', 'AbortError'))).toThrow('Aborted');
   });
 
   it('should throw timeout error from handleRequestError', () => {
     const err = new DOMException('Aborted', 'AbortError');
     let thrown = false;
     try {
-      HttpManager.handleRequestError(err);
+      HttpManager.handleRequestError(err, true);
     } catch (e) {
       thrown = true;
       expect(e.message).toBe('Request timed out');