@oxyhq/core 13.0.0 → 14.0.0

package/src/mixins/__tests__/followGraphPagination.test.ts

@@ -0,0 +1,250 @@
+/**
+ * Follow-graph pagination + ordering tests.
+ *
+ * Regression coverage for the silent "every page is page one" bug.
+ * `buildPaginationParams` used to return a `URLSearchParams`, which it then
+ * handed to `makeRequest` as a GET's `params`. `HttpService` reads that object
+ * with `Object.keys(...)` in TWO places — `buildURL` (decide whether to append
+ * a query string) and `generateBaseCacheKey` (build the cache key) — and
+ * `Object.keys(new URLSearchParams({ limit: '20' }))` is `[]`, because a
+ * `URLSearchParams` exposes its entries through iterator methods rather than
+ * own enumerable properties. The consequences were both invisible from the
+ * call site:
+ *
+ *  - no query string was ever sent, so every caller silently got the server's
+ *    DEFAULT page no matter which `limit`/`offset` it asked for, and
+ *  - every page collapsed onto ONE cache key, so page 2 was served page 1's
+ *    cached body without a network call.
+ *
+ * These tests assert on the URL `fetch` actually received (not on the helper's
+ * return value), so they fail against the old `URLSearchParams` implementation
+ * and cannot pass vacuously.
+ */
+
+import { OxyServices } from '../../OxyServices';
+
+/**
+ * Build a non-verified JWT whose payload decodes to the given claims.
+ * `jwtDecode` only base64url-decodes the middle segment (no signature check).
+ */
+function makeJwt(payload: Record<string, unknown>): string {
+  const b64url = (obj: Record<string, unknown>): string =>
+    Buffer.from(JSON.stringify(obj)).toString('base64url');
+  const fullPayload = { exp: Math.floor(Date.now() / 1000) + 3600, ...payload };
+  return `${b64url({ alg: 'none', typ: 'JWT' })}.${b64url(fullPayload)}.sig`;
+}
+
+/** A paginated `{ data, pagination }` body — passed through by `unwrapResponse`. */
+function pageResponse(data: unknown[], total = 100, hasMore = true): Response {
+  return new Response(JSON.stringify({ data, pagination: { total, hasMore } }), {
+    status: 200,
+    headers: { 'content-type': 'application/json' },
+  });
+}
+
+/** A JSON `{ data: ... }` success envelope. */
+function jsonResponse(data: unknown): Response {
+  return new Response(JSON.stringify({ data }), {
+    status: 200,
+    headers: { 'content-type': 'application/json' },
+  });
+}
+
+describe('follow-graph pagination and ordering', () => {
+  let originalFetch: typeof globalThis.fetch;
+  let fetchMock: jest.Mock<Promise<Response>, [RequestInfo | URL, RequestInit?]>;
+  let oxy: OxyServices;
+
+  /** The URL string passed to `fetch` on call `n` (0-based). */
+  const requestedUrl = (n: number): string => String(fetchMock.mock.calls[n][0]);
+
+  beforeEach(() => {
+    originalFetch = globalThis.fetch;
+    fetchMock = jest.fn();
+    globalThis.fetch = fetchMock as unknown as typeof globalThis.fetch;
+    oxy = new OxyServices({ baseURL: 'http://test.invalid' });
+    oxy.httpService.setTokens(makeJwt({ userId: 'me' }));
+  });
+
+  afterEach(() => {
+    globalThis.fetch = originalFetch;
+    jest.clearAllMocks();
+  });
+
+  describe('the request actually carries the pagination the caller asked for', () => {
+    it('sends limit and offset on getUserFollowers', async () => {
+      fetchMock.mockResolvedValueOnce(pageResponse([]));
+      await oxy.getUserFollowers('target-1', { limit: 20, offset: 40 });
+
+      const url = new URL(requestedUrl(0));
+      expect(url.pathname).toBe('/users/target-1/followers');
+      expect(url.searchParams.get('limit')).toBe('20');
+      expect(url.searchParams.get('offset')).toBe('40');
+    });
+
+    it('sends limit and offset on getUserFollowing', async () => {
+      fetchMock.mockResolvedValueOnce(pageResponse([]));
+      await oxy.getUserFollowing('target-1', { limit: 5, offset: 10 });
+
+      const url = new URL(requestedUrl(0));
+      expect(url.pathname).toBe('/users/target-1/following');
+      expect(url.searchParams.get('limit')).toBe('5');
+      expect(url.searchParams.get('offset')).toBe('10');
+    });
+
+    it('sends limit and offset on getUserMutuals', async () => {
+      fetchMock.mockResolvedValueOnce(pageResponse([]));
+      await oxy.getUserMutuals('target-1', { limit: 7, offset: 14 });
+
+      const url = new URL(requestedUrl(0));
+      expect(url.pathname).toBe('/users/target-1/mutuals');
+      expect(url.searchParams.get('limit')).toBe('7');
+      expect(url.searchParams.get('offset')).toBe('14');
+    });
+
+    it('sends limit on the id-only graph seeds', async () => {
+      fetchMock.mockResolvedValueOnce(jsonResponse([]));
+      await oxy.getMutualUserIds({ limit: 33 });
+      expect(new URL(requestedUrl(0)).searchParams.get('limit')).toBe('33');
+
+      fetchMock.mockResolvedValueOnce(jsonResponse([]));
+      await oxy.getFollowsOfFollowsIds({ limit: 44 });
+      expect(new URL(requestedUrl(1)).searchParams.get('limit')).toBe('44');
+    });
+
+    it('omits the query string entirely when no pagination is given', async () => {
+      fetchMock.mockResolvedValueOnce(pageResponse([]));
+      await oxy.getUserFollowers('target-1');
+
+      expect(requestedUrl(0)).toBe('http://test.invalid/users/target-1/followers');
+    });
+  });
+
+  describe('each page is its own cache entry', () => {
+    it('does NOT serve page 1 cached body to a page 2 request', async () => {
+      fetchMock.mockResolvedValueOnce(pageResponse([{ id: 'a' }]));
+      const first = await oxy.getUserFollowers('target-1', { limit: 1, offset: 0 });
+      expect(first.followers).toEqual([{ id: 'a' }]);
+      expect(fetchMock).toHaveBeenCalledTimes(1);
+
+      // Different offset ⇒ different cache key ⇒ a real second network call.
+      fetchMock.mockResolvedValueOnce(pageResponse([{ id: 'b' }]));
+      const second = await oxy.getUserFollowers('target-1', { limit: 1, offset: 1 });
+
+      expect(fetchMock).toHaveBeenCalledTimes(2);
+      expect(second.followers).toEqual([{ id: 'b' }]);
+      expect(new URL(requestedUrl(1)).searchParams.get('offset')).toBe('1');
+    });
+
+    it('still serves a warm cache hit for the SAME page', async () => {
+      fetchMock.mockResolvedValueOnce(pageResponse([{ id: 'a' }]));
+      await oxy.getUserFollowers('target-1', { limit: 1, offset: 0 });
+      await oxy.getUserFollowers('target-1', { limit: 1, offset: 0 });
+
+      expect(fetchMock).toHaveBeenCalledTimes(1);
+    });
+  });
+
+  describe('sort', () => {
+    it('sends sort=oldest and keeps it out of the request when unset', async () => {
+      fetchMock.mockResolvedValueOnce(pageResponse([]));
+      await oxy.getUserFollowers('target-1', { limit: 10, sort: 'oldest' });
+      expect(new URL(requestedUrl(0)).searchParams.get('sort')).toBe('oldest');
+
+      fetchMock.mockResolvedValueOnce(pageResponse([]));
+      await oxy.getUserFollowers('target-1', { limit: 10 });
+      expect(new URL(requestedUrl(1)).searchParams.has('sort')).toBe(false);
+    });
+
+    it('discriminates the cache key, so flipping sort re-fetches', async () => {
+      fetchMock.mockResolvedValueOnce(pageResponse([{ id: 'newest' }]));
+      const recent = await oxy.getUserFollowers('target-1', { limit: 2, offset: 0, sort: 'recent' });
+      expect(recent.followers).toEqual([{ id: 'newest' }]);
+      expect(fetchMock).toHaveBeenCalledTimes(1);
+
+      fetchMock.mockResolvedValueOnce(pageResponse([{ id: 'oldest' }]));
+      const oldest = await oxy.getUserFollowers('target-1', { limit: 2, offset: 0, sort: 'oldest' });
+
+      expect(fetchMock).toHaveBeenCalledTimes(2);
+      expect(oldest.followers).toEqual([{ id: 'oldest' }]);
+    });
+
+    it('threads sort through getUserFollowing and getUserMutuals', async () => {
+      fetchMock.mockResolvedValueOnce(pageResponse([]));
+      await oxy.getUserFollowing('target-1', { sort: 'oldest' });
+      expect(new URL(requestedUrl(0)).searchParams.get('sort')).toBe('oldest');
+
+      fetchMock.mockResolvedValueOnce(pageResponse([]));
+      await oxy.getUserMutuals('target-1', { sort: 'oldest' });
+      expect(new URL(requestedUrl(1)).searchParams.get('sort')).toBe('oldest');
+    });
+  });
+
+  describe('follow writes invalidate the cached follower/following lists', () => {
+    it('re-fetches the followers list after followUser', async () => {
+      fetchMock.mockResolvedValueOnce(pageResponse([{ id: 'a' }], 1, false));
+      await oxy.getUserFollowers('target-1', { limit: 10, offset: 0 });
+      expect(fetchMock).toHaveBeenCalledTimes(1);
+
+      fetchMock.mockResolvedValueOnce(jsonResponse({ success: true, message: 'ok' }));
+      await oxy.followUser('target-1');
+      expect(fetchMock).toHaveBeenCalledTimes(2);
+
+      // The viewer is now a follower — the list must not come from cache.
+      fetchMock.mockResolvedValueOnce(pageResponse([{ id: 'a' }, { id: 'me' }], 2, false));
+      const after = await oxy.getUserFollowers('target-1', { limit: 10, offset: 0 });
+
+      expect(fetchMock).toHaveBeenCalledTimes(3);
+      expect(after.followers).toHaveLength(2);
+    });
+
+    it('re-fetches the viewer own following list after followUser', async () => {
+      fetchMock.mockResolvedValueOnce(pageResponse([], 0, false));
+      await oxy.getUserFollowing('me', { limit: 10, offset: 0 });
+      expect(fetchMock).toHaveBeenCalledTimes(1);
+
+      fetchMock.mockResolvedValueOnce(jsonResponse({ success: true, message: 'ok' }));
+      await oxy.followUser('target-1');
+
+      fetchMock.mockResolvedValueOnce(pageResponse([{ id: 'target-1' }], 1, false));
+      const after = await oxy.getUserFollowing('me', { limit: 10, offset: 0 });
+
+      expect(fetchMock).toHaveBeenCalledTimes(3);
+      expect(after.following).toEqual([{ id: 'target-1' }]);
+    });
+
+    it('invalidates every page and sort variant, not just the one that was read', async () => {
+      const clearPrefixSpy = jest.spyOn(oxy, 'clearCacheByPrefix');
+      fetchMock.mockResolvedValueOnce(jsonResponse({ success: true, message: 'ok' }));
+
+      await oxy.followUser('target-1');
+
+      // Prefix invalidation is what makes this page/sort agnostic — an exact-key
+      // clear would only bust the single variant the caller happened to read.
+      expect(clearPrefixSpy).toHaveBeenCalledWith('GET:/users/target-1/followers');
+      expect(clearPrefixSpy).toHaveBeenCalledWith('GET:/users/target-1/mutuals');
+      expect(clearPrefixSpy).toHaveBeenCalledWith('GET:/users/me/following');
+      clearPrefixSpy.mockRestore();
+    });
+
+    it('invalidates the follower lists of every id in a bulk follow', async () => {
+      const clearPrefixSpy = jest.spyOn(oxy, 'clearCacheByPrefix');
+      fetchMock.mockResolvedValueOnce(
+        jsonResponse({
+          results: [
+            { userId: 'a', success: true, alreadyFollowing: false },
+            { userId: 'b', success: true, alreadyFollowing: false },
+          ],
+          followedCount: 2,
+        }),
+      );
+
+      await oxy.followUsers(['a', 'b']);
+
+      expect(clearPrefixSpy).toHaveBeenCalledWith('GET:/users/a/followers');
+      expect(clearPrefixSpy).toHaveBeenCalledWith('GET:/users/b/followers');
+      expect(clearPrefixSpy).toHaveBeenCalledWith('GET:/users/me/following');
+      clearPrefixSpy.mockRestore();
+    });
+  });
+});

package/src/server/__tests__/securityHeaders.test.ts

@@ -0,0 +1,244 @@
+import type { NextFunction, Request, Response } from 'express';
+import {
+  buildOxyCspDirectives,
+  buildOxyPagesHeaders,
+  createOxySecurityHeaders,
+  formatOxyCspPolicy,
+  OXY_CSP_BASELINE,
+  type OxyCspExtensions,
+} from '../securityHeaders';
+
+const CLOUDFLARE_SCRIPT_HOST = 'https://static.cloudflareinsights.com';
+const CLOUDFLARE_REPORT_HOST = 'https://cloudflareinsights.com';
+
+/** Run the middleware and return the CSP header exactly as a browser would see it. */
+function renderPolicy(options: Parameters<typeof createOxySecurityHeaders>[0]): string {
+  const headers: Record<string, string> = {};
+  const res = {
+    setHeader: (name: string, value: string | number | readonly string[]): void => {
+      headers[name] = String(value);
+    },
+    removeHeader: (): void => undefined,
+  } as unknown as Response;
+  const req = { method: 'GET', headers: {} } as unknown as Request;
+  const next = jest.fn() as unknown as NextFunction;
+
+  createOxySecurityHeaders(options)(req, res, next);
+  return headers['Content-Security-Policy'] ?? '';
+}
+
+/** The sources of one directive, parsed back out of the rendered header. */
+function policySources(policy: string, directive: string): string[] {
+  const found = policy
+    .split(';')
+    .map((segment) => segment.trim())
+    .find((segment) => segment === directive || segment.startsWith(`${directive} `));
+  if (found === undefined) return [];
+  return found.split(/\s+/).slice(1);
+}
+
+describe('@oxyhq/core/server buildOxyCspDirectives', () => {
+  it('carries the Cloudflare Insights beacon on BOTH halves of the baseline', () => {
+    // The bug this helper exists for: the script host alone leaves the beacon
+    // loading but unable to report, which looks fixed and is not.
+    const directives = buildOxyCspDirectives();
+    expect(directives['script-src']).toContain(CLOUDFLARE_SCRIPT_HOST);
+    expect(directives['connect-src']).toContain(CLOUDFLARE_REPORT_HOST);
+  });
+
+  it('carries the Oxy platform origins every app reaches through the SDK', () => {
+    const directives = buildOxyCspDirectives();
+    expect(directives['connect-src']).toEqual(
+      expect.arrayContaining(['https://api.oxy.so', 'wss://api.oxy.so', 'https://cloud.oxy.so']),
+    );
+    expect(directives['img-src']).toContain('https://cloud.oxy.so');
+    expect(directives['media-src']).toContain('https://cloud.oxy.so');
+  });
+
+  it('emits the hardening floor: closed object-src/script-src-attr and upgrade-insecure-requests', () => {
+    const directives = buildOxyCspDirectives();
+    expect(directives['object-src']).toEqual(["'none'"]);
+    expect(directives['script-src-attr']).toEqual(["'none'"]);
+    expect(directives['frame-ancestors']).toEqual(["'none'"]);
+    expect(directives['upgrade-insecure-requests']).toEqual([]);
+  });
+
+  it('MERGES an extension into the baseline instead of replacing it', () => {
+    const directives = buildOxyCspDirectives({
+      scriptSrc: ['https://app.example.com'],
+      connectSrc: ['wss://api.example.com'],
+    });
+
+    // The extension is present…
+    expect(directives['script-src']).toContain('https://app.example.com');
+    expect(directives['connect-src']).toContain('wss://api.example.com');
+    // …and every baseline source SURVIVED it.
+    for (const source of OXY_CSP_BASELINE.scriptSrc ?? []) {
+      expect(directives['script-src']).toContain(source);
+    }
+    for (const source of OXY_CSP_BASELINE.connectSrc ?? []) {
+      expect(directives['connect-src']).toContain(source);
+    }
+  });
+
+  it("retains 'self' in every extended directive, including directives absent from the baseline", () => {
+    // The footgun: an explicit `script-src` replaces helmet's default and drops
+    // `'self'`, so the app's own bundle stops loading.
+    const extensions: OxyCspExtensions = {
+      scriptSrc: ['https://app.example.com'],
+      connectSrc: ['https://api.example.com'],
+      imgSrc: ['blob:'],
+      mediaSrc: ['blob:'],
+      styleSrc: ['https://fonts.example.com'],
+      fontSrc: ['https://fonts.example.com'],
+      // Not in the baseline at all — must still be seeded with 'self'.
+      frameSrc: ['https://player.vimeo.com'],
+      workerSrc: ['blob:'],
+      manifestSrc: ['https://cdn.example.com'],
+      scriptSrcElem: ['https://app.example.com'],
+      styleSrcElem: ['https://cdn.example.com'],
+    };
+    const directives = buildOxyCspDirectives(extensions);
+
+    for (const directive of Object.keys(extensions)) {
+      const headerName = directive.replace(/[A-Z]/g, (letter) => `-${letter.toLowerCase()}`);
+      expect(directives[headerName]).toContain("'self'");
+    }
+  });
+
+  it('dedupes sources a caller repeats or that already exist in the baseline', () => {
+    const directives = buildOxyCspDirectives({
+      scriptSrc: ["'self'", CLOUDFLARE_SCRIPT_HOST, 'https://app.example.com'],
+      frameSrc: ["'self'", 'https://player.vimeo.com', 'https://player.vimeo.com'],
+    });
+
+    expect(directives['script-src']).toEqual([
+      "'self'",
+      CLOUDFLARE_SCRIPT_HOST,
+      'https://app.example.com',
+    ]);
+    expect(directives['frame-src']).toEqual(["'self'", 'https://player.vimeo.com']);
+  });
+
+  it("drops the 'none' sentinel when a closed directive is opened, and keeps it otherwise", () => {
+    // 'none' alongside any other source is meaningless per the CSP spec, so an
+    // app that must be framable opts back in explicitly.
+    expect(buildOxyCspDirectives({ frameAncestors: ["'self'"] })['frame-ancestors']).toEqual([
+      "'self'",
+    ]);
+    expect(buildOxyCspDirectives({ objectSrc: [] })['object-src']).toEqual(["'none'"]);
+  });
+
+  it('rejects sources that would terminate the directive or the policy', () => {
+    expect(() => buildOxyCspDirectives({ scriptSrc: ["https://a.example.com; script-src 'unsafe-inline'"] })).toThrow(
+      /script-src/,
+    );
+    expect(() => buildOxyCspDirectives({ connectSrc: ['https://a.example.com,https://b.example.com'] })).toThrow(
+      /connect-src/,
+    );
+    expect(() => buildOxyCspDirectives({ imgSrc: [''] })).toThrow(/img-src/);
+  });
+
+  it('never mutates the exported baseline across calls', () => {
+    const before = [...(OXY_CSP_BASELINE.scriptSrc ?? [])];
+    buildOxyCspDirectives({ scriptSrc: ['https://app.example.com'] });
+    buildOxyCspDirectives({ scriptSrc: ['https://other.example.com'] });
+    expect([...(OXY_CSP_BASELINE.scriptSrc ?? [])]).toEqual(before);
+    expect(buildOxyCspDirectives()['script-src']).toEqual(before);
+  });
+});
+
+describe('@oxyhq/core/server formatOxyCspPolicy', () => {
+  it('serializes directives into a single CSP header value', () => {
+    const policy = formatOxyCspPolicy(buildOxyCspDirectives());
+    expect(policy).toContain("script-src 'self' https://static.cloudflareinsights.com");
+    expect(policy).toContain('upgrade-insecure-requests');
+    expect(policy.endsWith('upgrade-insecure-requests')).toBe(true);
+  });
+});
+
+describe('@oxyhq/core/server buildOxyPagesHeaders', () => {
+  it('emits a Cloudflare Pages _headers block with CSP and hardening headers', () => {
+    const block = buildOxyPagesHeaders();
+    expect(block.startsWith('/*\n')).toBe(true);
+    expect(block).toContain('Content-Security-Policy:');
+    expect(block).toContain(CLOUDFLARE_SCRIPT_HOST);
+    expect(block).toContain(CLOUDFLARE_REPORT_HOST);
+    expect(block).toContain('X-Frame-Options: DENY');
+    expect(block).toContain('Strict-Transport-Security:');
+  });
+
+  it('merges per-app CSP extensions into the deployed header', () => {
+    const block = buildOxyPagesHeaders({
+      csp: { workerSrc: ["'self'"], imgSrc: ['blob:', 'https:'] },
+    });
+    expect(block).toContain("worker-src 'self'");
+    expect(block).toContain('blob:');
+    expect(block).toContain('https:');
+    expect(block).toContain(CLOUDFLARE_SCRIPT_HOST);
+  });
+});
+
+describe('@oxyhq/core/server createOxySecurityHeaders', () => {
+  it('sends the resolved baseline as a real Content-Security-Policy header', () => {
+    const policy = renderPolicy({});
+
+    expect(policySources(policy, 'script-src')).toEqual(["'self'", CLOUDFLARE_SCRIPT_HOST]);
+    expect(policySources(policy, 'connect-src')).toEqual([
+      "'self'",
+      CLOUDFLARE_REPORT_HOST,
+      'https://api.oxy.so',
+      'wss://api.oxy.so',
+      'https://cloud.oxy.so',
+    ]);
+    expect(policy).toContain('upgrade-insecure-requests');
+  });
+
+  it('sends merged app extensions without losing the baseline', () => {
+    const policy = renderPolicy({
+      csp: {
+        connectSrc: ['https://api.mention.earth', 'wss://api.mention.earth'],
+        frameSrc: ['https://www.youtube-nocookie.com'],
+      },
+    });
+
+    expect(policySources(policy, 'connect-src')).toEqual([
+      "'self'",
+      CLOUDFLARE_REPORT_HOST,
+      'https://api.oxy.so',
+      'wss://api.oxy.so',
+      'https://cloud.oxy.so',
+      'https://api.mention.earth',
+      'wss://api.mention.earth',
+    ]);
+    expect(policySources(policy, 'frame-src')).toEqual([
+      "'self'",
+      'https://www.youtube-nocookie.com',
+    ]);
+  });
+
+  it('passes non-CSP helmet options through and calls next()', () => {
+    const headers: Record<string, string> = {};
+    const res = {
+      setHeader: (name: string, value: string | number | readonly string[]): void => {
+        headers[name] = String(value);
+      },
+      removeHeader: (): void => undefined,
+    } as unknown as Response;
+    const next = jest.fn() as unknown as NextFunction & jest.Mock;
+
+    createOxySecurityHeaders({
+      helmet: {
+        crossOriginResourcePolicy: { policy: 'cross-origin' },
+        frameguard: { action: 'deny' },
+        referrerPolicy: { policy: 'strict-origin-when-cross-origin' },
+      },
+    })({ method: 'GET', headers: {} } as unknown as Request, res, next);
+
+    expect(headers['Cross-Origin-Resource-Policy']).toBe('cross-origin');
+    expect(headers['X-Frame-Options']).toBe('DENY');
+    expect(headers['Referrer-Policy']).toBe('strict-origin-when-cross-origin');
+    expect(headers['Content-Security-Policy']).toContain("script-src 'self'");
+    expect(next).toHaveBeenCalledTimes(1);
+  });
+});

package/src/server/index.ts

@@ -63,6 +63,22 @@ export type {
 export { createOxyCors } from './cors';
 export type { OxyCorsOptions } from './cors';
 
+// Shared Helmet + Content-Security-Policy baseline (Cloudflare Insights beacon,
+// Oxy API/CDN origins) with additive, per-app extensions.
+export {
+  buildOxyCspDirectives,
+  buildOxyPagesHeaders,
+  createOxySecurityHeaders,
+  formatOxyCspPolicy,
+  OXY_CSP_BASELINE,
+} from './securityHeaders';
+export type {
+  OxyCspDirective,
+  OxyCspExtensions,
+  OxyPagesHeadersOptions,
+  OxySecurityHeadersOptions,
+} from './securityHeaders';
+
 // Constant-time secret comparison.
 export { verifySecret } from './verifySecret';