@pikku/core 0.12.96 → 0.12.97

package/CHANGELOG.md

@@ -1,3 +1,26 @@
+## 0.12.97
+
+### Patch Changes
+
+- 8154b1c: Restore the `SecretService.getSecret` JSDoc noting its failure mode, and state the `optional` carve-out `defineSecret` already documents: a key declared `optional` resolves `undefined` when absent rather than throwing. The line was on `main` and was removed by mistake in a comment cleanup on #1411 — the PR that changes what that throw says — leaving `getSecret` the only one of the interface's methods without its documented failure mode.
+- 6d9c09c: Resolve a variable's declared default instead of dropping it.
+
+  `defineVariable` takes a schema, and a schema can carry a default — `z.enum(['https://api.github.com']).default('https://api.github.com')` is the shape most addons declare their base URL with. Nothing read it. `variables.get('GITHUB_BASE_URL')` returned `undefined` on a host that had not set it, and the `as string` at the call site hid that until a request went to `undefined/repos/...`.
+
+  The default now resolves in `TypedVariablesService`, which is the layer that knows what was declared — `VariablesService` only knows what a host put in it. A stored value always wins; a schema with no default still resolves to `undefined`.
+
+  `VariableStatus` gains `hasDefault`, and `getMissing()` no longer lists a variable that defaults: it has a value, just not one anybody has to supply. `isConfigured` still means what it said — that a host set it.
+
+  For this to work the generated `TYPED_VARIABLES_META` now carries the schema as a value rather than only `z.infer`-ing its type, so the schema module is retained in the emit instead of being elided.
+
+- 239332b: Move first-party product analytics out of application code and into the framework.
+
+  `createAnalytics<Event>({ endpoint })` in `@pikku/react` is the buffered beacon client: it is typed against the app's own event union, flushes on an interval, on size and on `pagehide`/`visibilitychange` (via `sendBeacon`, so the abandon-point events survive unload), never surfaces a failure to the user and never retries. It also carries the delegated `data-analytics-click` listener, registered in the capture phase so a component calling `stopPropagation()` cannot silence instrumentation, and merging `data-analytics-meta` from ancestors with nearest-wins. Put the client on the Pikku instance and `usePikkuAnalytics<Event>()` reaches it from the provider, alongside `usePikkuFetch` and `usePikkuRPC`.
+
+  `requireOrigin()` in `@pikku/core/middleware` is a server-side origin lock for any unauthed route, and is re-exported from the generated `#pikku/middleware` leaf alongside `cors`. Unlike `cors()` — which only sets response headers a non-browser client ignores — it rejects with a 403 before the function body. Comparison is exact on the parsed origin, so `https://evil-myapp.com` cannot suffix-match `myapp.com`, and a missing `Origin` is rejected because a real browser always sets one on a cross-origin-capable POST. Allowed origins default to the request's own host and can be extended with a list or a resolver over services. `isAllowedOrigin` and `toOrigin` are exported for direct unit testing.
+
+  Together these let an app keep only its event registry and its wiring, instead of a few hundred lines of copied transport.
+
 ## 0.12.96
 
 ### Patch Changes

package/dist/middleware/index.d.ts

@@ -3,6 +3,7 @@ export { authCookie } from './auth-cookie.js';
 export { authBearer } from './auth-bearer.js';
 export { pikkuRemoteAuthMiddleware } from './remote-auth.js';
 export { cors } from './cors.js';
+export { requireOrigin, isAllowedOrigin, toOrigin } from './require-origin.js';
 export { telemetryOuter, telemetryInner } from './telemetry.js';
 export { addTagMiddleware, addTagMiddleware as addMiddleware, addGlobalMiddleware, runMiddleware, } from '../middleware-runner.js';
 export { addGlobalPermission } from '../permissions.js';

package/dist/middleware/index.js

@@ -3,6 +3,7 @@ export { authCookie } from './auth-cookie.js';
 export { authBearer } from './auth-bearer.js';
 export { pikkuRemoteAuthMiddleware } from './remote-auth.js';
 export { cors } from './cors.js';
+export { requireOrigin, isAllowedOrigin, toOrigin } from './require-origin.js';
 export { telemetryOuter, telemetryInner } from './telemetry.js';
 export { addTagMiddleware, addTagMiddleware as addMiddleware, addGlobalMiddleware, runMiddleware, } from '../middleware-runner.js';
 export { addGlobalPermission } from '../permissions.js';

package/dist/middleware/require-origin.d.ts

@@ -0,0 +1,23 @@
+import type { CoreSingletonServices } from '../types/core.types.js';
+/** Scheme + host + port, or null for anything unparseable including the literal `"null"` origin. */
+export declare const toOrigin: (value: string | null | undefined) => string | null;
+/**
+ * Whether a request origin may post to an origin-locked route.
+ *
+ * The comparison is exact on the parsed origin, never a suffix match:
+ * `endsWith('myapp.com')` also accepts `https://evil-myapp.com`.
+ */
+export declare const isAllowedOrigin: (requestOrigin: string | null, hostOrigin: string | null, configuredOrigins: string[]) => boolean;
+/**
+ * Rejects a request with a 403 unless its `Origin` is this app's own or explicitly allowed.
+ *
+ * This is not what `cors()` does. CORS sets response headers and is enforced by the
+ * browser, so a non-browser client ignores them and the request still runs; this rejects
+ * before the function body. It stops another site's page from posting to an unauthed
+ * route — it is not flood control, because `Origin` is trusted from nobody but a browser.
+ * A missing `Origin` is rejected too: a real browser sets one on a cross-origin-capable POST.
+ */
+export declare const requireOrigin: import("./middleware.types.js").CorePikkuMiddlewareFactory<{
+    /** Extra allowed origins beyond the request's own host, or a resolver for them. */
+    origins?: string[] | ((services: CoreSingletonServices) => string[] | Promise<string[]>);
+}>;

package/dist/middleware/require-origin.js

@@ -0,0 +1,57 @@
+import { InvalidOriginError } from '../errors/errors.js';
+import { pikkuMiddleware, pikkuMiddlewareFactory, } from './middleware-factories.js';
+/** Scheme + host + port, or null for anything unparseable including the literal `"null"` origin. */
+export const toOrigin = (value) => {
+    if (!value)
+        return null;
+    try {
+        const url = new URL(value);
+        return url.protocol && url.host ? url.origin : null;
+    }
+    catch {
+        return null;
+    }
+};
+/**
+ * Whether a request origin may post to an origin-locked route.
+ *
+ * The comparison is exact on the parsed origin, never a suffix match:
+ * `endsWith('myapp.com')` also accepts `https://evil-myapp.com`.
+ */
+export const isAllowedOrigin = (requestOrigin, hostOrigin, configuredOrigins) => {
+    if (!requestOrigin)
+        return false;
+    if (hostOrigin && requestOrigin === hostOrigin)
+        return true;
+    return configuredOrigins.some((allowed) => toOrigin(allowed) === requestOrigin);
+};
+/**
+ * Rejects a request with a 403 unless its `Origin` is this app's own or explicitly allowed.
+ *
+ * This is not what `cors()` does. CORS sets response headers and is enforced by the
+ * browser, so a non-browser client ignores them and the request still runs; this rejects
+ * before the function body. It stops another site's page from posting to an unauthed
+ * route — it is not flood control, because `Origin` is trusted from nobody but a browser.
+ * A missing `Origin` is rejected too: a real browser sets one on a cross-origin-capable POST.
+ */
+export const requireOrigin = pikkuMiddlewareFactory(({ origins = [] } = {}) => pikkuMiddleware({
+    name: 'requireOrigin',
+    description: 'Rejects requests that did not come from this app.',
+    func: async (services, { http }, next) => {
+        const request = http?.request;
+        if (!request)
+            return next();
+        const requestOrigin = toOrigin(request.header('origin')) ??
+            toOrigin(request.header('referer'));
+        const host = request.header('host');
+        const proto = request.header('x-forwarded-proto') ?? 'https';
+        const hostOrigin = host ? toOrigin(`${proto}://${host}`) : null;
+        const configured = typeof origins === 'function'
+            ? await origins(services)
+            : origins;
+        if (!isAllowedOrigin(requestOrigin, hostOrigin, configured)) {
+            throw new InvalidOriginError(`Rejected origin ${requestOrigin ?? '(none)'}`);
+        }
+        return next();
+    },
+}));

package/dist/services/secret-service.d.ts

@@ -4,6 +4,11 @@ export type SecretValues<T> = {
     [K in keyof T]: SecretValue<T[K]>;
 };
 export interface SecretService {
+    /**
+     * Throws if the secret is not found, unless `defineSecret` declared it
+     * `optional` — then absence resolves `undefined`. Unwrap the result with
+     * `.reveal()`.
+     */
     getSecret<T = string>(key: string): Promise<SecretValue<T>>;
     /** Answers for any key, including a disallowed one — it must not throw. */
     hasSecret(key: string): Promise<boolean>;

package/dist/services/typed-variables-service.d.ts

@@ -1,14 +1,34 @@
+import type { StandardSchemaV1 } from '@standard-schema/spec';
 import type { VariablesService } from './variables-service.js';
 export interface VariableStatus {
     variableId: string;
     name: string;
     displayName: string;
     isConfigured: boolean;
+    /** Whether the declaration answers for itself when the host sets nothing. */
+    hasDefault: boolean;
 }
 export type VariableMeta = {
     name: string;
     displayName: string;
+    /**
+     * The shape the variable was declared with. It is the schema itself rather
+     * than a description of it, because a default is only knowable by running it:
+     * `undefined` goes in and, if the declaration carries one, the default comes
+     * back out.
+     *
+     * A thunk is accepted, and is what code generation emits. The generated file
+     * and the file declaring the schema import each other, so reading the schema
+     * while the modules are still initializing throws — deferring the read until
+     * a variable is actually asked for is what keeps the cycle harmless.
+     */
+    schema?: StandardSchemaV1 | (() => StandardSchemaV1);
 };
+/**
+ * A declared default is the answer to a variable nobody set, so it is resolved
+ * here rather than in `VariablesService`: the store knows what a host has put
+ * in it, and only this layer knows what was declared.
+ */
 export declare class TypedVariablesService<TMap = Record<string, unknown>> implements VariablesService {
     private variables;
     private variablesMeta;
@@ -21,5 +41,19 @@ export declare class TypedVariablesService<TMap = Record<string, unknown>> imple
     has(name: string): Promise<boolean> | boolean;
     delete(name: string): Promise<void> | void;
     getAllStatus(): Promise<VariableStatus[]>;
+    /**
+     * What a deployment still has to be told. A variable that defaults is not on
+     * this list — it has a value, just not one anybody has to supply.
+     */
     getMissing(): Promise<VariableStatus[]>;
+    /**
+     * The value the declaration answers with when the host set nothing, or
+     * `undefined` when it does not answer for itself.
+     */
+    private resolveDefault;
+    /**
+     * Kept synchronous when the defaults resolve synchronously, so a caller that
+     * did not await `getVariables` before does not have to start.
+     */
+    private withDefaults;
 }

package/dist/services/typed-variables-service.js

@@ -1,3 +1,9 @@
+const isPromise = (value) => typeof value?.then === 'function';
+/**
+ * A declared default is the answer to a variable nobody set, so it is resolved
+ * here rather than in `VariablesService`: the store knows what a host has put
+ * in it, and only this layer knows what was declared.
+ */
 export class TypedVariablesService {
     variables;
     variablesMeta;
@@ -6,10 +12,18 @@ export class TypedVariablesService {
         this.variablesMeta = variablesMeta;
     }
     get(name) {
-        return this.variables.get(name);
+        const stored = this.variables.get(name);
+        if (isPromise(stored)) {
+            return stored.then((value) => value === undefined ? this.resolveDefault(name) : value);
+        }
+        return stored === undefined ? this.resolveDefault(name) : stored;
     }
     getVariables(names) {
-        return this.variables.getVariables(names);
+        const stored = this.variables.getVariables(names);
+        if (isPromise(stored)) {
+            return stored.then((values) => this.withDefaults(names, values));
+        }
+        return this.withDefaults(names, stored);
     }
     getAll() {
         return this.variables.getAll();
@@ -32,12 +46,64 @@ export class TypedVariablesService {
                 name: meta.name,
                 displayName: meta.displayName,
                 isConfigured: all[variableId] !== undefined,
+                hasDefault: (await this.resolveDefault(variableId)) !== undefined,
             });
         }
         return results;
     }
+    /**
+     * What a deployment still has to be told. A variable that defaults is not on
+     * this list — it has a value, just not one anybody has to supply.
+     */
     async getMissing() {
         const all = await this.getAllStatus();
-        return all.filter((v) => !v.isConfigured);
+        return all.filter((v) => !v.isConfigured && !v.hasDefault);
+    }
+    /**
+     * The value the declaration answers with when the host set nothing, or
+     * `undefined` when it does not answer for itself.
+     */
+    resolveDefault(name) {
+        const declared = this.variablesMeta[name]?.schema;
+        if (!declared) {
+            return undefined;
+        }
+        const schema = typeof declared === 'function' ? declared() : declared;
+        const result = schema['~standard'].validate(undefined);
+        if (isPromise(result)) {
+            return result.then(unwrapDefault);
+        }
+        return unwrapDefault(result);
+    }
+    /**
+     * Kept synchronous when the defaults resolve synchronously, so a caller that
+     * did not await `getVariables` before does not have to start.
+     */
+    withDefaults(names, values) {
+        const out = { ...values };
+        const pending = [];
+        for (const name of names) {
+            if (out[name] !== undefined)
+                continue;
+            const fallback = this.resolveDefault(name);
+            if (isPromise(fallback)) {
+                pending.push(fallback.then((value) => {
+                    if (value !== undefined)
+                        out[name] = value;
+                }));
+            }
+            else if (fallback !== undefined) {
+                out[name] = fallback;
+            }
+        }
+        if (pending.length > 0) {
+            return Promise.all(pending).then(() => out);
+        }
+        return out;
     }
 }
+/**
+ * A schema with no default rejects `undefined`, which is not a failure here —
+ * it is the answer that there is nothing to fall back to.
+ */
+const unwrapDefault = (result) => result.issues ? undefined : result.value;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/core",
-  "version": "0.12.96",
+  "version": "0.12.97",
   "description": "The Pikku runtime — functions, wirings, services, middleware and types",
   "author": "yasser.fadl@gmail.com",
   "license": "MIT",

package/src/middleware/index.ts

@@ -3,6 +3,7 @@ export { authCookie } from './auth-cookie.js'
 export { authBearer } from './auth-bearer.js'
 export { pikkuRemoteAuthMiddleware } from './remote-auth.js'
 export { cors } from './cors.js'
+export { requireOrigin, isAllowedOrigin, toOrigin } from './require-origin.js'
 export { telemetryOuter, telemetryInner } from './telemetry.js'
 export {
   addTagMiddleware,

package/src/middleware/require-origin.test.ts

@@ -0,0 +1,115 @@
+import { describe, test, beforeEach } from 'node:test'
+import assert from 'node:assert'
+import { requireOrigin, isAllowedOrigin, toOrigin } from './require-origin.js'
+import { InvalidOriginError } from '../errors/errors.js'
+import { resetPikkuState } from '../pikku-state.js'
+
+beforeEach(() => {
+  resetPikkuState()
+})
+
+const headers = (values: Record<string, string | undefined>) => ({
+  method: () => 'post',
+  header: (name: string) => values[name],
+})
+
+const run = async (
+  config: Parameters<typeof requireOrigin>[0],
+  values: Record<string, string | undefined>
+) => {
+  let reached = false
+  const middleware = requireOrigin(config)
+  await middleware({} as any, { http: { request: headers(values) } } as any, async () => {
+    reached = true
+  })
+  return reached
+}
+
+describe('toOrigin', () => {
+  test('keeps scheme, host and port and drops the rest', () => {
+    assert.equal(toOrigin('https://app.com:8443/a/b?c=1'), 'https://app.com:8443')
+  })
+
+  test('rejects the sandboxed-iframe "null" origin and unparseable values', () => {
+    assert.equal(toOrigin('null'), null)
+    assert.equal(toOrigin(''), null)
+    assert.equal(toOrigin(undefined), null)
+  })
+})
+
+describe('isAllowedOrigin', () => {
+  test('matches the request host exactly', () => {
+    assert.equal(isAllowedOrigin('https://app.com', 'https://app.com', []), true)
+  })
+
+  test('does not suffix-match a lookalike domain', () => {
+    assert.equal(isAllowedOrigin('https://evil-app.com', null, ['https://app.com']), false)
+    assert.equal(isAllowedOrigin('https://app.com.evil.net', null, ['https://app.com']), false)
+  })
+
+  test('normalises a configured origin before comparing', () => {
+    assert.equal(isAllowedOrigin('https://app.com', null, ['https://app.com/path']), true)
+  })
+
+  test('rejects a missing origin', () => {
+    assert.equal(isAllowedOrigin(null, 'https://app.com', ['https://app.com']), false)
+  })
+})
+
+describe('requireOrigin', () => {
+  test('allows a beacon from the request own host', async () => {
+    assert.equal(
+      await run({}, { origin: 'https://app.com', host: 'app.com' }),
+      true
+    )
+  })
+
+  test('falls back to referer when only it is sent', async () => {
+    assert.equal(
+      await run({}, { referer: 'https://app.com/pricing', host: 'app.com' }),
+      true
+    )
+  })
+
+  test('honours x-forwarded-proto when deriving the host origin', async () => {
+    assert.equal(
+      await run(
+        {},
+        { origin: 'http://app.com', host: 'app.com', 'x-forwarded-proto': 'http' }
+      ),
+      true
+    )
+  })
+
+  test('rejects another site with a 403', async () => {
+    await assert.rejects(
+      () => run({}, { origin: 'https://evil.com', host: 'app.com' }),
+      InvalidOriginError
+    )
+  })
+
+  test('rejects a non-browser caller that sends no origin', async () => {
+    await assert.rejects(
+      () => run({}, { host: 'app.com' }),
+      InvalidOriginError
+    )
+  })
+
+  test('resolves configured origins from services when given a function', async () => {
+    assert.equal(
+      await run(
+        { origins: async () => ['https://other.com'] },
+        { origin: 'https://other.com', host: 'app.com' }
+      ),
+      true
+    )
+  })
+
+  test('passes through when there is no http wire at all', async () => {
+    let reached = false
+    await requireOrigin({})({} as any, {} as any, async () => {
+      reached = true
+    })
+    assert.equal(reached, true)
+  })
+})

package/src/middleware/require-origin.ts

@@ -0,0 +1,79 @@
+import type { CoreSingletonServices } from '../types/core.types.js'
+import { InvalidOriginError } from '../errors/errors.js'
+import {
+  pikkuMiddleware,
+  pikkuMiddlewareFactory,
+} from './middleware-factories.js'
+
+/** Scheme + host + port, or null for anything unparseable including the literal `"null"` origin. */
+export const toOrigin = (value: string | null | undefined): string | null => {
+  if (!value) return null
+  try {
+    const url = new URL(value)
+    return url.protocol && url.host ? url.origin : null
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Whether a request origin may post to an origin-locked route.
+ *
+ * The comparison is exact on the parsed origin, never a suffix match:
+ * `endsWith('myapp.com')` also accepts `https://evil-myapp.com`.
+ */
+export const isAllowedOrigin = (
+  requestOrigin: string | null,
+  hostOrigin: string | null,
+  configuredOrigins: string[]
+): boolean => {
+  if (!requestOrigin) return false
+  if (hostOrigin && requestOrigin === hostOrigin) return true
+  return configuredOrigins.some((allowed) => toOrigin(allowed) === requestOrigin)
+}
+
+/**
+ * Rejects a request with a 403 unless its `Origin` is this app's own or explicitly allowed.
+ *
+ * This is not what `cors()` does. CORS sets response headers and is enforced by the
+ * browser, so a non-browser client ignores them and the request still runs; this rejects
+ * before the function body. It stops another site's page from posting to an unauthed
+ * route — it is not flood control, because `Origin` is trusted from nobody but a browser.
+ * A missing `Origin` is rejected too: a real browser sets one on a cross-origin-capable POST.
+ */
+export const requireOrigin = pikkuMiddlewareFactory<{
+  /** Extra allowed origins beyond the request's own host, or a resolver for them. */
+  origins?:
+    | string[]
+    | ((services: CoreSingletonServices) => string[] | Promise<string[]>)
+}>(({ origins = [] } = {}) =>
+  pikkuMiddleware({
+    name: 'requireOrigin',
+    description: 'Rejects requests that did not come from this app.',
+    func: async (services, { http }, next) => {
+      const request = http?.request
+      if (!request) return next()
+
+      const requestOrigin =
+        toOrigin(request.header('origin')) ??
+        toOrigin(request.header('referer'))
+
+      const host = request.header('host')
+      const proto = request.header('x-forwarded-proto') ?? 'https'
+      const hostOrigin = host ? toOrigin(`${proto}://${host}`) : null
+
+      const configured =
+        typeof origins === 'function'
+          ? await origins(services as CoreSingletonServices)
+          : origins
+
+      if (!isAllowedOrigin(requestOrigin, hostOrigin, configured)) {
+        throw new InvalidOriginError(
+          `Rejected origin ${requestOrigin ?? '(none)'}`
+        )
+      }
+
+      return next()
+    },
+  })
+)

package/src/public-surface.json

@@ -10,15 +10,18 @@
     "authBearer",
     "authCookie",
     "cors",
+    "isAllowedOrigin",
     "pikkuAgentMiddleware",
     "pikkuChannelMiddleware",
     "pikkuChannelMiddlewareFactory",
     "pikkuMiddleware",
     "pikkuMiddlewareFactory",
     "pikkuRemoteAuthMiddleware",
+    "requireOrigin",
     "runMiddleware",
     "telemetryInner",
-    "telemetryOuter"
+    "telemetryOuter",
+    "toOrigin"
   ],
   "./function": [
     "AbandonedError",

package/src/services/secret-service.ts

@@ -4,6 +4,11 @@ import type { SecretValue } from '../classification/secret-value.js'
 export type SecretValues<T> = { [K in keyof T]: SecretValue<T[K]> }
 
 export interface SecretService {
+  /**
+   * Throws if the secret is not found, unless `defineSecret` declared it
+   * `optional` — then absence resolves `undefined`. Unwrap the result with
+   * `.reveal()`.
+   */
   getSecret<T = string>(key: string): Promise<SecretValue<T>>
   /** Answers for any key, including a disallowed one — it must not throw. */
   hasSecret(key: string): Promise<boolean>

package/src/services/typed-variables-service.test.ts

@@ -2,6 +2,7 @@ import { describe, test } from 'node:test'
 import assert from 'node:assert'
 import { TypedVariablesService } from './typed-variables-service.js'
 import { LocalVariablesService } from './local-variables.js'
+import type { StandardSchemaV1 } from '@standard-schema/spec'
 
 describe('TypedVariablesService', () => {
   const createService = (vars: Record<string, string | undefined> = {}) => {
@@ -71,3 +72,95 @@ describe('TypedVariablesService', () => {
     assert.strictEqual(missing.length, 0)
   })
 })
+
+/**
+ * Stands in for `z.enum([...]).default(...)`: a schema that answers `undefined`
+ * with a value rather than an issue. Core declares no schema library of its
+ * own, so the contract under test is Standard Schema's, not Zod's.
+ */
+const withDefault = <T>(value: T): StandardSchemaV1<unknown, T> => ({
+  '~standard': {
+    version: 1,
+    vendor: 'test',
+    validate: (input: unknown) =>
+      input === undefined ? { value } : { value: input as T },
+  },
+})
+
+const noDefault: StandardSchemaV1<unknown, string> = {
+  '~standard': {
+    version: 1,
+    vendor: 'test',
+    validate: (input: unknown) =>
+      typeof input === 'string'
+        ? { value: input }
+        : { issues: [{ message: 'expected a string' }] },
+  },
+}
+
+describe('TypedVariablesService schema defaults', () => {
+  const createService = (vars: Record<string, string | undefined> = {}) =>
+    new TypedVariablesService(new LocalVariablesService(vars), {
+      GITHUB_BASE_URL: {
+        name: 'GITHUB_BASE_URL',
+        displayName: 'GitHub Base URL',
+        schema: withDefault('https://api.github.com'),
+      },
+      API_KEY: {
+        name: 'API_KEY',
+        displayName: 'API Key',
+        schema: noDefault,
+      },
+      // The form code generation emits, deferred past the import cycle.
+      REGION: {
+        name: 'REGION',
+        displayName: 'Region',
+        schema: () => withDefault('eu-west-1'),
+      },
+    })
+
+  test('resolves a declared default when the host sets nothing', async () => {
+    const service = createService()
+    assert.strictEqual(
+      await service.get('GITHUB_BASE_URL'),
+      'https://api.github.com'
+    )
+  })
+
+  test('prefers the host value over the default', async () => {
+    const service = createService({ GITHUB_BASE_URL: 'https://ghe.internal' })
+    assert.strictEqual(
+      await service.get('GITHUB_BASE_URL'),
+      'https://ghe.internal'
+    )
+  })
+
+  test('stays undefined when the schema carries no default', async () => {
+    const service = createService()
+    assert.strictEqual(await service.get('API_KEY'), undefined)
+  })
+
+  test('resolves a default behind a thunk', async () => {
+    const service = createService()
+    assert.strictEqual(await service.get('REGION'), 'eu-west-1')
+  })
+
+  test('a defaulted variable is not missing', async () => {
+    const service = createService()
+    const missing = await service.getMissing()
+    assert.deepStrictEqual(
+      missing.map((v) => v.variableId),
+      ['API_KEY']
+    )
+  })
+
+  test('status separates having a default from being configured', async () => {
+    const service = createService()
+    const status = await service.getAllStatus()
+    const github = status.find((s) => s.variableId === 'GITHUB_BASE_URL')!
+    assert.strictEqual(github.isConfigured, false)
+    assert.strictEqual(github.hasDefault, true)
+    const apiKey = status.find((s) => s.variableId === 'API_KEY')!
+    assert.strictEqual(apiKey.hasDefault, false)
+  })
+})