@selvajs/server 0.2.0-beta.3 → 0.2.0-beta.5

package/src/compute/__tests__/definition-byte-cache.test.ts

@@ -1,129 +0,0 @@
-import { describe, it, expect, vi } from 'vitest';
-import { createDefinitionByteCache } from '../definition-byte-cache.js';
-
-/** A `Uint8Array` of `n` bytes filled with a marker so equality is checkable. */
-function bytes(n: number, marker = 0): Uint8Array {
-	return new Uint8Array(n).fill(marker);
-}
-
-describe('createDefinitionByteCache', () => {
-	it('serves a warm entry without re-invoking the loader (hit) and reports it', async () => {
-		const cache = createDefinitionByteCache(10 * 1024 * 1024);
-		const load = vi.fn(async () => bytes(1024, 7));
-
-		const first = await cache.getOrLoad('v-1', load).load();
-		const second = await cache.getOrLoad('v-1', load).load();
-
-		expect(first).toEqual(second);
-		expect(load).toHaveBeenCalledTimes(1); // second call served from cache
-		const s = cache.stats();
-		expect(s.hits).toBe(1);
-		expect(s.misses).toBe(1);
-		expect(s.entries).toBe(1);
-		expect(s.bytes).toBe(1024);
-	});
-
-	it('per-ref outcome distinguishes miss (loader) from hit (warm)', async () => {
-		const cache = createDefinitionByteCache(10 * 1024 * 1024);
-		const load = async () => bytes(512);
-
-		const refMiss = cache.getOrLoad('v-1', load);
-		await refMiss.load();
-		expect(refMiss.outcome).toEqual({ loaded: true, fromCache: false });
-
-		const refHit = cache.getOrLoad('v-1', load);
-		await refHit.load();
-		expect(refHit.outcome).toEqual({ loaded: true, fromCache: true });
-	});
-
-	it("a ref whose load() is never called leaves outcome.loaded false (the 'skipped' verdict)", () => {
-		const cache = createDefinitionByteCache(10 * 1024 * 1024);
-		const ref = cache.getOrLoad('v-1', async () => bytes(1));
-		// The scheduler served a pointer-known solve — load() never ran.
-		expect(ref.outcome).toEqual({ loaded: false, fromCache: false });
-	});
-
-	it('evicts least-recently-used entries when the byte budget is exceeded', async () => {
-		// Budget holds ~2 of these 1 KB entries.
-		const cache = createDefinitionByteCache(2 * 1024);
-		const load = (marker: number) => async () => bytes(1024, marker);
-
-		await cache.getOrLoad('a', load(1)).load(); // [a]
-		await cache.getOrLoad('b', load(2)).load(); // [a,b]
-		// Touch 'a' so 'b' becomes the LRU victim.
-		await cache.getOrLoad('a', load(1)).load(); // hit → [b,a]
-		await cache.getOrLoad('c', load(3)).load(); // insert c → evict b → [a,c]
-
-		expect(cache.stats().entries).toBe(2);
-		expect(cache.stats().evictions).toBe(1);
-		expect(cache.stats().bytes).toBe(2 * 1024);
-
-		// 'a' survived (it was touched, so 'b' was the LRU victim) → served from
-		// cache without the loader. Checked BEFORE re-loading 'b', since bringing 'b'
-		// back would itself evict 'a' under the 2-entry budget.
-		const aLoad = vi.fn(load(1));
-		await cache.getOrLoad('a', aLoad).load();
-		expect(aLoad).toHaveBeenCalledTimes(0);
-
-		// 'b' was evicted → its next load calls the loader again (miss).
-		const bLoad = vi.fn(load(2));
-		await cache.getOrLoad('b', bLoad).load();
-		expect(bLoad).toHaveBeenCalledTimes(1);
-	});
-
-	it('never retains an entry larger than the whole budget (serves through, caches nothing)', async () => {
-		const cache = createDefinitionByteCache(1024);
-		const load = vi.fn(async () => bytes(4096));
-
-		const out = await cache.getOrLoad('big', load).load();
-		expect(out.byteLength).toBe(4096); // still served
-		expect(cache.stats().entries).toBe(0); // but not retained
-		expect(cache.stats().bytes).toBe(0);
-
-		// Every load re-fetches — nothing was cached.
-		await cache.getOrLoad('big', load).load();
-		expect(load).toHaveBeenCalledTimes(2);
-	});
-
-	it('keys on the passed version id — two versions that reused a fileKey never collide', async () => {
-		// The trap this cache exists to avoid: delete-latest-then-reupload reused a
-		// fileKey, but the version id (the KEY) is always fresh. Distinct ids →
-		// distinct entries, so the new version never serves the old bytes.
-		const cache = createDefinitionByteCache(10 * 1024 * 1024);
-		const oldBytes = bytes(1024, 1);
-		const newBytes = bytes(1024, 2);
-
-		const a = await cache.getOrLoad('version-old', async () => oldBytes).load();
-		const b = await cache.getOrLoad('version-new', async () => newBytes).load();
-
-		expect(a).toEqual(oldBytes);
-		expect(b).toEqual(newBytes);
-		expect(a).not.toEqual(b); // no cross-contamination despite a shared fileKey
-		expect(cache.stats().entries).toBe(2);
-	});
-
-	it('budget 0 disables caching entirely (every load hits the loader, nothing retained)', async () => {
-		const cache = createDefinitionByteCache(0);
-		const load = vi.fn(async () => bytes(16));
-
-		const ref1 = cache.getOrLoad('v-1', load);
-		await ref1.load();
-		await cache.getOrLoad('v-1', load).load();
-
-		expect(load).toHaveBeenCalledTimes(2);
-		expect(cache.stats().entries).toBe(0);
-		expect(cache.stats().bytes).toBe(0);
-		// Outcome still reports loaded, but never fromCache.
-		expect(ref1.outcome).toEqual({ loaded: true, fromCache: false });
-	});
-
-	it('re-storing the same key updates bytes without double-counting the budget', async () => {
-		const cache = createDefinitionByteCache(10 * 1024 * 1024);
-		// clear() to force a re-store path: first load caches, clear drops it, second caches again.
-		await cache.getOrLoad('v-1', async () => bytes(1024)).load();
-		expect(cache.stats().bytes).toBe(1024);
-		cache.clear();
-		expect(cache.stats().bytes).toBe(0);
-		expect(cache.stats().entries).toBe(0);
-	});
-});

package/src/compute/__tests__/rate-limit.test.ts

@@ -1,106 +0,0 @@
-import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
-import { createComputeRateLimiter, type ComputeRateLimiter } from '../rate-limit.js';
-
-const WINDOW_MS = 100_000;
-const MAX_PER_WINDOW = 120;
-
-describe('createComputeRateLimiter', () => {
-	let limiter: ComputeRateLimiter;
-
-	beforeEach(() => {
-		limiter = createComputeRateLimiter({ windowMs: WINDOW_MS, maxPerWindow: MAX_PER_WINDOW });
-		vi.useFakeTimers();
-		vi.setSystemTime(new Date('2026-01-01T00:00:00Z'));
-	});
-
-	afterEach(() => {
-		vi.useRealTimers();
-	});
-
-	it('allows up to maxPerWindow requests in the window', () => {
-		for (let i = 0; i < MAX_PER_WINDOW; i++) {
-			expect(limiter.check('user:alice').allowed).toBe(true);
-		}
-	});
-
-	it('rejects the (MAX+1)th request with retryAfter set', () => {
-		for (let i = 0; i < MAX_PER_WINDOW; i++) limiter.check('user:alice');
-		const result = limiter.check('user:alice');
-		expect(result.allowed).toBe(false);
-		expect(result.retryAfter).toBeGreaterThan(0);
-		expect(result.retryAfter).toBeLessThanOrEqual(WINDOW_MS / 1000);
-	});
-
-	it('isolates buckets per key', () => {
-		for (let i = 0; i < MAX_PER_WINDOW; i++) limiter.check('user:alice');
-		expect(limiter.check('user:alice').allowed).toBe(false);
-		expect(limiter.check('user:bob').allowed).toBe(true);
-	});
-
-	it("share-link buckets don't collide with user buckets sharing an id", () => {
-		const id = '00000000-0000-0000-0000-000000000001';
-		for (let i = 0; i < MAX_PER_WINDOW; i++) limiter.check(`share:${id}`);
-		expect(limiter.check(`share:${id}`).allowed).toBe(false);
-		expect(limiter.check(`user:${id}`).allowed).toBe(true);
-	});
-
-	it('rolls over when the window expires', () => {
-		for (let i = 0; i < MAX_PER_WINDOW; i++) limiter.check('user:alice');
-		expect(limiter.check('user:alice').allowed).toBe(false);
-
-		vi.advanceTimersByTime(WINDOW_MS + 1);
-
-		expect(limiter.check('user:alice').allowed).toBe(true);
-	});
-
-	it('does not pre-increment a fresh bucket past the cap', () => {
-		// Regression guard: an off-by-one in the "no entry yet" branch could
-		// initialize at count=1 but treat the FIRST call as already capped.
-		expect(limiter.check('user:fresh').allowed).toBe(true);
-	});
-
-	it('separate limiters own separate bucket state', () => {
-		const other = createComputeRateLimiter({ windowMs: WINDOW_MS, maxPerWindow: MAX_PER_WINDOW });
-		for (let i = 0; i < MAX_PER_WINDOW; i++) limiter.check('user:alice');
-		expect(limiter.check('user:alice').allowed).toBe(false);
-		// A different limiter instance is unaffected.
-		expect(other.check('user:alice').allowed).toBe(true);
-	});
-
-	// peek + clear support failure-counting flows (login limiting): peek gates
-	// the attempt without spending budget, check records a failure, clear
-	// forgives on success.
-	describe('peek / clear', () => {
-		it('peek never increments the counter', () => {
-			for (let i = 0; i < 1000; i++) expect(limiter.peek('ip:1.2.3.4').allowed).toBe(true);
-			// Full budget still available after all those peeks.
-			for (let i = 0; i < MAX_PER_WINDOW; i++) {
-				expect(limiter.check('ip:1.2.3.4').allowed).toBe(true);
-			}
-		});
-
-		it('peek reports a full bucket with retryAfter, still without mutating it', () => {
-			for (let i = 0; i < MAX_PER_WINDOW; i++) limiter.check('ip:1.2.3.4');
-			const result = limiter.peek('ip:1.2.3.4');
-			expect(result.allowed).toBe(false);
-			expect(result.retryAfter).toBeGreaterThan(0);
-		});
-
-		it('peek allows again once the window expires', () => {
-			for (let i = 0; i < MAX_PER_WINDOW; i++) limiter.check('ip:1.2.3.4');
-			expect(limiter.peek('ip:1.2.3.4').allowed).toBe(false);
-			vi.advanceTimersByTime(WINDOW_MS + 1);
-			expect(limiter.peek('ip:1.2.3.4').allowed).toBe(true);
-		});
-
-		it('clear drops only the given key', () => {
-			for (let i = 0; i < MAX_PER_WINDOW; i++) {
-				limiter.check('ip:1.2.3.4');
-				limiter.check('ip:5.6.7.8');
-			}
-			limiter.clear('ip:1.2.3.4');
-			expect(limiter.peek('ip:1.2.3.4').allowed).toBe(true);
-			expect(limiter.peek('ip:5.6.7.8').allowed).toBe(false);
-		});
-	});
-});

package/src/compute/__tests__/remote-definition.test.ts

@@ -1,140 +0,0 @@
-/**
- * Tests for `createRemoteDefinitionFetcher` — the SSRF-guarded, capped, TTL-cached
- * remote `.gh` fetch (K3).
- *
- * `safe-url` is mocked so the host check is a controllable pass/fail (its own
- * SSRF logic is covered in safe-url.test.ts), and `fetch` is stubbed per test to
- * return scripted bodies/headers. The injected `now` clock makes the TTL cache
- * deterministic without real time.
- */
-
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-
-// --- Mock the SSRF guard ---------------------------------------------------
-const assertSafe = vi.fn(async (_url: string) => {});
-vi.mock('../safe-url.js', () => ({
-	assertSafeRemoteDefinitionUrl: (url: string) => assertSafe(url)
-}));
-
-import { createRemoteDefinitionFetcher, readBodyWithCap } from '../index.js';
-
-/** A Response whose body streams the given bytes in one chunk. */
-function streamResponse(bytes: Uint8Array, init: { contentLength?: string | null } = {}): Response {
-	const body = new ReadableStream<Uint8Array>({
-		start(controller) {
-			controller.enqueue(bytes);
-			controller.close();
-		}
-	});
-	const headers = new Headers();
-	if (init.contentLength !== null && init.contentLength !== undefined) {
-		headers.set('content-length', init.contentLength);
-	}
-	return new Response(body, { status: 200, headers });
-}
-
-const baseConfig = () => ({
-	maxBytes: 1024,
-	fetchTimeoutMs: 5_000,
-	cacheTtlMs: 60_000,
-	now: () => 1_000
-});
-
-let fetchMock: ReturnType<typeof vi.fn>;
-
-beforeEach(() => {
-	assertSafe.mockClear();
-	assertSafe.mockResolvedValue(undefined);
-	fetchMock = vi.fn();
-	vi.stubGlobal('fetch', fetchMock);
-});
-
-afterEach(() => {
-	vi.unstubAllGlobals();
-});
-
-describe('createRemoteDefinitionFetcher — happy path', () => {
-	it('runs the SSRF guard and returns the fetched bytes', async () => {
-		const bytes = new Uint8Array([9, 8, 7]);
-		fetchMock.mockResolvedValue(streamResponse(bytes, { contentLength: '3' }));
-		const fetcher = createRemoteDefinitionFetcher(baseConfig());
-
-		const out = await fetcher.load('https://example.com/def.gh');
-		expect(out).toEqual(bytes);
-		expect(assertSafe).toHaveBeenCalledWith('https://example.com/def.gh');
-		expect(fetchMock).toHaveBeenCalledWith(
-			'https://example.com/def.gh',
-			expect.objectContaining({ redirect: 'error' })
-		);
-	});
-
-	it('caches within TTL (one fetch) and refetches after TTL expires', async () => {
-		const bytes = new Uint8Array([1]);
-		// Fresh Response per call — a stream body can only be read once.
-		fetchMock.mockImplementation(async () => streamResponse(bytes, { contentLength: '1' }));
-		let clock = 1_000;
-		const fetcher = createRemoteDefinitionFetcher({ ...baseConfig(), now: () => clock });
-
-		await fetcher.load('https://example.com/a.gh');
-		await fetcher.load('https://example.com/a.gh'); // within TTL → cached
-		expect(fetchMock).toHaveBeenCalledTimes(1);
-
-		clock += 60_001; // past the 60s TTL
-		await fetcher.load('https://example.com/a.gh');
-		expect(fetchMock).toHaveBeenCalledTimes(2);
-	});
-});
-
-describe('createRemoteDefinitionFetcher — rejections', () => {
-	it('does not fetch when the SSRF guard rejects', async () => {
-		assertSafe.mockRejectedValue(new Error('blocked private host'));
-		const fetcher = createRemoteDefinitionFetcher(baseConfig());
-		await expect(fetcher.load('http://169.254.169.254/')).rejects.toThrow('blocked private host');
-		expect(fetchMock).not.toHaveBeenCalled();
-	});
-
-	it('throws on a non-2xx response', async () => {
-		fetchMock.mockResolvedValue(new Response('nope', { status: 404, statusText: 'Not Found' }));
-		const fetcher = createRemoteDefinitionFetcher(baseConfig());
-		await expect(fetcher.load('https://example.com/missing.gh')).rejects.toThrow('HTTP 404');
-	});
-
-	it('rejects early when the declared content-length exceeds the cap', async () => {
-		fetchMock.mockResolvedValue(streamResponse(new Uint8Array([1, 2]), { contentLength: '99999' }));
-		const fetcher = createRemoteDefinitionFetcher({ ...baseConfig(), maxBytes: 10 });
-		await expect(fetcher.load('https://example.com/big.gh')).rejects.toThrow('exceeds size limit');
-	});
-
-	it('rejects when the streamed body exceeds the cap despite a missing content-length', async () => {
-		// No content-length header — the streaming cap must still catch it.
-		fetchMock.mockResolvedValue(streamResponse(new Uint8Array(50), { contentLength: null }));
-		const fetcher = createRemoteDefinitionFetcher({ ...baseConfig(), maxBytes: 10 });
-		await expect(fetcher.load('https://example.com/lying.gh')).rejects.toThrow(
-			'exceeds size limit'
-		);
-	});
-});
-
-describe('readBodyWithCap', () => {
-	it('reads a streamed body under the cap', async () => {
-		const bytes = new Uint8Array([1, 2, 3, 4]);
-		const out = await readBodyWithCap(streamResponse(bytes), 10, new AbortController());
-		expect(out).toEqual(bytes);
-	});
-
-	it('aborts and throws once the running total crosses the cap', async () => {
-		const controller = new AbortController();
-		await expect(
-			readBodyWithCap(streamResponse(new Uint8Array(20)), 5, controller)
-		).rejects.toThrow('exceeds size limit');
-		expect(controller.signal.aborted).toBe(true);
-	});
-
-	it('falls back to arrayBuffer when there is no stream body', async () => {
-		// A Response built from a string still exposes a body stream in undici, so
-		// construct one without a body to hit the fallback branch.
-		const noBody = new Response(null, { status: 200 });
-		const out = await readBodyWithCap(noBody, 10, new AbortController());
-		expect(out).toEqual(new Uint8Array(0));
-	});
-});

package/src/compute/__tests__/safe-url.test.ts

@@ -1,72 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { isSafeRemoteDefinitionUrl } from '../safe-url.js';
-
-/**
- * SSRF guard for `loadRemoteDefinition`. Each rejection row corresponds to
- * an attack the helper exists to block — leaving any of them unsuppressed
- * would let an authenticated user have the server fetch arbitrary
- * intranet/cloud-metadata/loopback hosts on their behalf.
- *
- * Hostname-only — DNS rebinding is not addressed here. See the helper's
- * file-level comment.
- */
-describe('isSafeRemoteDefinitionUrl', () => {
-	it.each([
-		'https://example.com/foo.gh',
-		'http://example.com/foo.gh',
-		'https://cdn.example.com:443/path/to/file.ghx',
-		'https://1.2.3.4/file.gh',
-		// 172.32 is outside the 172.16-31 private range — must be allowed.
-		'https://172.32.0.1/file.gh',
-		// Edge of the private /16 — 192.169 is public.
-		'https://192.169.0.1/file.gh'
-	])('accepts public URL %j', (url) => {
-		expect(isSafeRemoteDefinitionUrl(url)).toBe(true);
-	});
-
-	it.each([
-		// Loopback
-		['http://localhost/foo', 'localhost'],
-		['http://localhost:8080/foo', 'localhost with port'],
-		['http://api.localhost/foo', '*.localhost'],
-		['http://127.0.0.1/foo', '127.0.0.1'],
-		['http://127.0.0.5/foo', '127/8'],
-		['http://0.0.0.0/foo', '0.0.0.0'],
-		['http://[::1]/foo', 'IPv6 loopback'],
-		// Cloud metadata service — the canonical reason this guard exists.
-		['http://169.254.169.254/latest/meta-data/', 'AWS/GCP/Azure metadata'],
-		['http://169.254.0.1/foo', '169.254/16 link-local'],
-		// IPv4 RFC1918 private ranges
-		['http://10.0.0.1/foo', '10/8'],
-		['http://10.255.255.255/foo', '10/8 upper'],
-		['http://192.168.0.1/foo', '192.168/16'],
-		['http://172.16.0.1/foo', '172.16 lower bound'],
-		['http://172.31.255.255/foo', '172.31 upper bound'],
-		['http://172.20.0.1/foo', '172.20 mid-range'],
-		// IPv6 unique-local + link-local
-		['http://[fc00::1]/foo', 'IPv6 unique-local fc'],
-		['http://[fd12:3456::1]/foo', 'IPv6 unique-local fd'],
-		['http://[fe80::1]/foo', 'IPv6 link-local'],
-		// IPv4-mapped IPv6 — must unwrap and apply the v4 rules.
-		['http://[::ffff:127.0.0.1]/foo', 'IPv4-mapped loopback'],
-		['http://[::ffff:169.254.169.254]/foo', 'IPv4-mapped metadata'],
-		['http://[::ffff:10.0.0.1]/foo', 'IPv4-mapped RFC1918'],
-		// Alternate IPv4 encodings that glibc/inet_aton resolve to loopback.
-		['http://2130706433/foo', 'integer loopback'],
-		['http://0x7f000001/foo', 'hex loopback'],
-		['http://0177.0.0.1/foo', 'octal loopback'],
-		['http://127.1/foo', 'short-form loopback'],
-		['http://0/foo', 'integer 0.0.0.0'],
-		// Alternate encodings of the cloud-metadata address.
-		['http://2852039166/foo', 'integer metadata 169.254.169.254'],
-		// Non-http(s) schemes
-		['file:///etc/passwd', 'file scheme'],
-		['gopher://evil/', 'gopher scheme'],
-		['javascript:alert(1)', 'javascript scheme'],
-		// Malformed
-		['not a url', 'unparseable'],
-		['', 'empty']
-	])('rejects %j (%s)', (url) => {
-		expect(isSafeRemoteDefinitionUrl(url)).toBe(false);
-	});
-});