acrylblends 0.3.0 → 0.4.0

package/plugins/acryl-router/tests/helpers.spec.ts

@@ -1,172 +0,0 @@
-/** The route helpers (spec 046): bounded body reading, server-sent events, and validation. */
-
-import { Context } from '@deepseek-ai/cordis'
-import z from '@deepseek-ai/schemastery'
-import { afterEach, describe, expect, it } from 'vitest'
-import { apply, name, type Router } from '../src/index.ts'
-import { readBytes, readJson, readText, streamSSE, valid, validate } from '../src/helpers/index.ts'
-import { bodyLimit } from '../src/middleware/index.ts'
-
-const contexts: Context[] = []
-const settle = (ms = 0): Promise<void> => new Promise(resolve => setTimeout(resolve, ms))
-afterEach(async () => {
-  while (contexts.length > 0) await contexts.pop()?.fiber.dispose()
-})
-
-async function mount(): Promise<{ ctx: Context, router: Router }> {
-  const ctx = new Context()
-  contexts.push(ctx)
-  ctx.plugin({ name, apply })
-  await settle()
-  return { ctx, router: ctx.router }
-}
-
-describe('readJson / readText / readBytes', () => {
-  it('reads a JSON body, and an empty body as no bytes', async () => {
-    const { router } = await mount()
-    router.post('/j', async c => c.json({ got: await readJson(c) }))
-    router.post('/t', async c => c.text(String((await readBytes(c)).byteLength)))
-    expect(await (await router.request('/j', { method: 'POST', body: '{"a":1}' })).json()).toEqual({ got: { a: 1 } })
-    expect(await (await router.request('/t', { method: 'POST' })).text()).toBe('0')
-  })
-
-  it('answers 400 for bad JSON and 413 over the limit, counting the bytes it reads', async () => {
-    const { router } = await mount()
-    router.post('/j', async c => c.json(await readJson(c, { maxBytes: 16 })))
-    expect((await router.request('/j', { method: 'POST', body: '{nope' })).status).toBe(400)
-    const big = await router.request('/j', { method: 'POST', body: JSON.stringify({ pad: 'x'.repeat(100) }) })
-    expect(big.status).toBe(413)
-  })
-
-  it('stops a chunked body that has no declared length at the limit', async () => {
-    const { router } = await mount()
-    router.post('/t', async c => c.text(await readText(c, { maxBytes: 8 })))
-    const stream = new ReadableStream<Uint8Array>({ start(controller) { controller.enqueue(new TextEncoder().encode('0123456789')); controller.close() } })
-    const response = await router.request(new Request('http://localhost/t', { method: 'POST', body: stream, duplex: 'half' } as RequestInit))
-    expect(response.status).toBe(413)
-  })
-
-  it('uses the limit the bodyLimit middleware set', async () => {
-    const { router } = await mount()
-    router.use(bodyLimit({ maxBytes: 4 }))
-    router.post('/t', async c => c.text(await readText(c)))
-    const stream = new ReadableStream<Uint8Array>({ start(controller) { controller.enqueue(new TextEncoder().encode('abcdefgh')); controller.close() } })
-    expect((await router.request(new Request('http://localhost/t', { method: 'POST', body: stream, duplex: 'half' } as RequestInit))).status).toBe(413)
-  })
-})
-
-describe('streamSSE', () => {
-  async function read(response: Response, count: number): Promise<string[]> {
-    const reader = response.body!.getReader()
-    const decoder = new TextDecoder()
-    let buffer = ''
-    const out: string[] = []
-    while (out.length < count) {
-      const { done, value } = await reader.read()
-      if (done) break
-      buffer += decoder.decode(value, { stream: true })
-      for (let at = buffer.indexOf('\n\n'); at !== -1; at = buffer.indexOf('\n\n')) { out.push(buffer.slice(0, at)); buffer = buffer.slice(at + 2) }
-    }
-    reader.releaseLock()
-    return out
-  }
-
-  it('sends events with ids, names, JSON and multi-line text, and a comment', async () => {
-    const { router } = await mount()
-    router.get('/s', c => streamSSE(c, stream => {
-      stream.send({ n: 1 }, { event: 'tick', id: '7' })
-      stream.send('line one\nline two')
-      stream.comment('keep-alive')
-    }))
-    const events = await read(await router.request('/s'), 3)
-    expect(events).toEqual(['id: 7\nevent: tick\ndata: {"n":1}', 'data: line one\ndata: line two', ': keep-alive'])
-  })
-
-  it('runs its cleanup once when the client aborts, and ends the stream', async () => {
-    const { router } = await mount()
-    let cleaned = 0
-    router.get('/s', c => streamSSE(c, () => () => { cleaned += 1 }))
-    const controller = new AbortController()
-    const response = await router.request('/s', { signal: controller.signal })
-    const reader = response.body!.getReader()
-    controller.abort()
-    await expect(reader.read()).resolves.toMatchObject({ done: true })
-    await settle(5)
-    expect(cleaned).toBe(1)
-  })
-
-  it('lets the server close the stream, and runs the cleanup once even if cancelled afterwards', async () => {
-    const { router } = await mount()
-    let cleaned = 0
-    router.get('/s', c => streamSSE(c, stream => { stream.send('only'); stream.close(); return () => { cleaned += 1 } }))
-    const response = await router.request('/s')
-    const reader = response.body!.getReader()
-    expect((await reader.read()).done).toBe(false)
-    await expect(reader.read()).resolves.toMatchObject({ done: true })
-    await reader.cancel()
-    expect(cleaned).toBe(1)
-  })
-
-  it('is ended and awaited when its plugin unloads the router', async () => {
-    const { ctx, router } = await mount()
-    let cleaned = 0
-    router.get('/s', c => streamSSE(c, () => () => { cleaned += 1 }))
-    const response = await router.request('/s')
-    const reader = response.body!.getReader()
-    const ended = reader.read()
-    await ctx.fiber.dispose()
-    contexts.length = 0
-    await expect(ended).resolves.toMatchObject({ done: true })
-    expect(cleaned).toBe(1)
-  })
-})
-
-describe('validate', () => {
-  const Body = z.object({ name: z.string().required(), age: z.number().default(0) })
-
-  it('hands the handler the parsed value, with defaults applied', async () => {
-    const { router } = await mount()
-    router.post('/u', validate('json', Body), c => c.json(valid<{ name: string, age: number }>(c, 'json')))
-    const response = await router.request('/u', { method: 'POST', body: '{"name":"ada"}' })
-    expect(response.status).toBe(200)
-    expect(await response.json()).toEqual({ name: 'ada', age: 0 })
-  })
-
-  it('answers 400 with the issues for an invalid body, query or parameter', async () => {
-    const { router } = await mount()
-    router.post('/u', validate('json', Body), c => c.text('ok'))
-    router.get('/q', validate('query', z.object({ page: z.string().required() })), c => c.text('ok'))
-    router.get('/p/:id', validate('param', z.object({ id: z.string().pattern(/^\d+$/u).required() })), c => c.text('ok'))
-    const bad = await router.request('/u', { method: 'POST', body: '{}' })
-    expect(bad.status).toBe(400)
-    expect(((await bad.json()) as { error: string }).error).toBe('invalid json')
-    expect((await router.request('/q')).status).toBe(400)
-    expect((await router.request('/q?page=2')).status).toBe(200)
-    expect((await router.request('/p/abc')).status).toBe(400)
-    expect((await router.request('/p/42')).status).toBe(200)
-  })
-
-  it('tells the author when valid() is used without validate()', async () => {
-    const { router } = await mount()
-    router.get('/x', c => c.text(String(valid(c, 'json'))))
-    expect((await router.request('/x')).status).toBe(500)
-  })
-})
-
-describe('streamSSE keepalive and validate on bad JSON', () => {
-  it('sends a comment line on an idle stream and stops when it ends', async () => {
-    const { router } = await mount()
-    router.get('/s', c => streamSSE(c, () => undefined, { keepAliveMs: 10 }))
-    const response = await router.request('/s')
-    const reader = response.body!.getReader()
-    const chunk = new TextDecoder().decode((await reader.read()).value)
-    expect(chunk).toBe(': keepalive\n\n')
-    await reader.cancel()
-  })
-
-  it('answers 400, not 500, when the body is not JSON', async () => {
-    const { router } = await mount()
-    router.post('/v', validate('json', z.object({ a: z.number() }) as never), c => c.json(valid(c, 'json')))
-    expect((await router.request('/v', { method: 'POST', body: '{nope' })).status).toBe(400)
-  })
-})

package/plugins/acryl-router/tests/middleware.spec.ts

@@ -1,183 +0,0 @@
-/** The built-in middleware (spec 046), each through the real Cordis service and `router.request`. */
-
-import { Context } from '@deepseek-ai/cordis'
-import { afterEach, describe, expect, it } from 'vitest'
-import { apply, name, type Router } from '../src/index.ts'
-import { bodyLimit, cors, logger, loopbackOnly, requestId, secureHeaders } from '../src/middleware/index.ts'
-
-const contexts: Context[] = []
-const settle = (): Promise<void> => new Promise(resolve => setTimeout(resolve, 0))
-afterEach(async () => {
-  while (contexts.length > 0) await contexts.pop()?.fiber.dispose()
-})
-
-async function mount(): Promise<Router> {
-  const ctx = new Context()
-  contexts.push(ctx)
-  ctx.plugin({ name, apply })
-  await settle()
-  return ctx.router
-}
-
-describe('secureHeaders', () => {
-  it('adds the hardening headers without overriding what the handler set, and lets a default be removed', async () => {
-    const router = await mount()
-    router.use(secureHeaders({ headers: { 'x-frame-options': '' } }))
-    router.get('/a', c => c.text('a'))
-    router.get('/b', () => new Response('b', { headers: { 'referrer-policy': 'origin' } }))
-    const a = await router.request('/a')
-    expect(a.headers.get('x-content-type-options')).toBe('nosniff')
-    expect(a.headers.get('x-frame-options')).toBeNull()
-    expect((await router.request('/b')).headers.get('referrer-policy')).toBe('origin')
-  })
-
-  it('also works on an immutable response', async () => {
-    const router = await mount()
-    router.use(secureHeaders())
-    router.get('/go', () => Response.redirect('http://example.test/x', 302))
-    const response = await router.request('/go')
-    expect(response.status).toBe(302)
-    expect(response.headers.get('x-content-type-options')).toBe('nosniff')
-  })
-})
-
-describe('requestId', () => {
-  it('keeps a well-formed incoming id, replaces a bad one, and exposes it to handlers', async () => {
-    const router = await mount()
-    router.use(requestId({ generate: () => 'generated-1' }))
-    router.get('/id', c => c.text(c.get<string>('requestId') ?? ''))
-    const kept = await router.request('/id', { headers: { 'x-request-id': 'abc-123' } })
-    expect(await kept.text()).toBe('abc-123')
-    expect(kept.headers.get('x-request-id')).toBe('abc-123')
-    const replaced = await router.request('/id', { headers: { 'x-request-id': 'bad id with spaces' } })
-    expect(await replaced.text()).toBe('generated-1')
-    expect((await router.request('/id')).headers.get('x-request-id')).toBe('generated-1')
-  })
-})
-
-describe('logger', () => {
-  it('writes an in line and an out line with status and time to the sink, and reports a throw', async () => {
-    const router = await mount()
-    const lines: string[] = []
-    router.use(logger(line => lines.push(line)))
-    router.get('/ok', c => c.text('ok'))
-    router.get('/boom', () => { throw new Error('boom') })
-    await router.request('/ok')
-    await router.request('/boom')
-    expect(lines[0]).toBe('<-- GET /ok')
-    expect(lines[1]).toMatch(/^--> GET \/ok 200 \d+ms$/)
-    expect(lines[2]).toBe('<-- GET /boom')
-    expect(lines[3]).toMatch(/^--> GET \/boom threw boom \d+ms$/)
-  })
-})
-
-describe('bodyLimit', () => {
-  it('refuses a declared length over the limit and lets a smaller one through', async () => {
-    const router = await mount()
-    router.use(bodyLimit({ maxBytes: 10 }))
-    router.post('/in', async c => c.text(await c.req.text()))
-    const big = await router.request('/in', { method: 'POST', body: 'x'.repeat(50), headers: { 'content-length': '50' } })
-    expect(big.status).toBe(413)
-    expect(await big.json()).toEqual({ error: 'payload too large', maxBytes: 10 })
-    expect(await (await router.request('/in', { method: 'POST', body: 'small', headers: { 'content-length': '5' } })).text()).toBe('small')
-  })
-
-  it('uses a custom error response', async () => {
-    const router = await mount()
-    router.use(bodyLimit({ maxBytes: 1, onError: c => c.text('too big', 400) }))
-    router.post('/in', c => c.text('ok'))
-    const response = await router.request('/in', { method: 'POST', body: 'xx', headers: { 'content-length': '2' } })
-    expect(response.status).toBe(400)
-    expect(await response.text()).toBe('too big')
-  })
-})
-
-describe('cors', () => {
-  it('answers a preflight itself and adds the headers to normal responses', async () => {
-    const router = await mount()
-    router.use(cors({ origin: ['https://app.example'], allowMethods: ['GET', 'POST'], maxAge: 600, credentials: true }))
-    router.get('/x', c => c.text('x'))
-    const preflight = await router.request('/x', { method: 'OPTIONS', headers: { origin: 'https://app.example', 'access-control-request-method': 'POST', 'access-control-request-headers': 'x-a, x-b' } })
-    expect(preflight.status).toBe(204)
-    expect(preflight.headers.get('access-control-allow-origin')).toBe('https://app.example')
-    expect(preflight.headers.get('access-control-allow-methods')).toBe('GET,POST')
-    expect(preflight.headers.get('access-control-allow-headers')).toBe('x-a,x-b')
-    expect(preflight.headers.get('access-control-max-age')).toBe('600')
-    expect(preflight.headers.get('access-control-allow-credentials')).toBe('true')
-    const normal = await router.request('/x', { headers: { origin: 'https://app.example' } })
-    expect(normal.headers.get('access-control-allow-origin')).toBe('https://app.example')
-    expect(normal.headers.get('vary')).toContain('Origin')
-  })
-
-  it('does not allow an origin outside the list', async () => {
-    const router = await mount()
-    router.use(cors({ origin: 'https://app.example' }))
-    router.get('/x', c => c.text('x'))
-    const response = await router.request('/x', { headers: { origin: 'https://evil.example' } })
-    expect(response.headers.get('access-control-allow-origin')).toBeNull()
-  })
-})
-
-describe('loopbackOnly', () => {
-  const peer = { remoteAddress: '127.0.0.1', localPort: 3105 }
-  const headers = (extra: Record<string, string> = {}): Record<string, string> => ({ host: '127.0.0.1:3105', ...extra })
-
-  it('lets a loopback peer on the real port through and refuses everything else with a 403', async () => {
-    const router = await mount()
-    router.use(loopbackOnly())
-    router.get('/x', c => c.text('x'))
-    expect((await router.request('/x', { headers: headers() }, peer)).status).toBe(200)
-    expect((await router.request('/x', { headers: headers() }, { remoteAddress: '203.0.113.9', localPort: 3105 })).status).toBe(403)
-    expect((await router.request('/x', { headers: headers({ host: '127.0.0.1:9999' }) }, peer)).status).toBe(403)
-    expect((await router.request('/x', { headers: headers({ host: 'evil.example:3105' }) }, peer)).status).toBe(403)
-    expect((await router.request('/x', { headers: headers({ 'sec-fetch-site': 'cross-site' }) }, peer)).status).toBe(403)
-    expect((await router.request('/x', { headers: headers() })).status).toBe(403)
-  })
-
-  it('accepts an IPv4-mapped loopback address and ::1', async () => {
-    const router = await mount()
-    router.use(loopbackOnly())
-    router.get('/x', c => c.text('x'))
-    expect((await router.request('/x', { headers: headers() }, { remoteAddress: '::ffff:127.0.0.1', localPort: 3105 })).status).toBe(200)
-    expect((await router.request('/x', { headers: headers() }, { remoteAddress: '::1', localPort: 3105 })).status).toBe(200)
-  })
-
-  it('refuses a change from a foreign or null Origin, and accepts this app\'s own', async () => {
-    const router = await mount()
-    router.use(loopbackOnly())
-    router.post('/do', c => c.text('done'))
-    expect((await router.request('/do', { method: 'POST', headers: headers({ origin: 'http://evil.example' }) }, peer)).status).toBe(403)
-    expect((await router.request('/do', { method: 'POST', headers: headers({ origin: 'null' }) }, peer)).status).toBe(403)
-    expect((await router.request('/do', { method: 'POST', headers: headers({ origin: 'http://127.0.0.1:3105' }) }, peer)).status).toBe(200)
-  })
-
-  it('accepts a change with no Origin (curl) only when the Host is a loopback address with this port', async () => {
-    const router = await mount()
-    router.use(loopbackOnly())
-    router.post('/do', c => c.text('done'))
-    expect((await router.request('/do', { method: 'POST', headers: headers() }, peer)).status).toBe(200)
-    expect((await router.request('/do', { method: 'POST', headers: headers({ host: 'localhost:3105' }) }, peer)).status).toBe(200)
-    expect((await router.request('/do', { method: 'POST', headers: headers({ host: '[::1]:3105' }) }, { remoteAddress: '::1', localPort: 3105 })).status).toBe(200)
-    // DNS rebinding: the page's own domain arrives as the Host, so a foreign Host is refused with or without an Origin.
-    expect((await router.request('/do', { method: 'POST', headers: headers({ host: 'rebind.example:3105' }) }, peer)).status).toBe(403)
-    expect((await router.request('/do', { method: 'POST', headers: headers({ host: '127.0.0.1:9999' }) }, peer)).status).toBe(403)
-  })
-
-  it('refuses an in-process call by default and lets it through when told the caller is the host', async () => {
-    const router = await mount()
-    router.get('/guarded', loopbackOnly(), c => c.text('x'))
-    router.get('/host', loopbackOnly({ inProcess: 'allow' }), c => c.text('x'))
-    expect((await router.request('/guarded')).status).toBe(403)
-    expect((await router.request('/host')).status).toBe(200)
-    // A request with any connection facts is checked in full, even when inProcess is allowed.
-    expect((await router.request('/host', { headers: { host: '127.0.0.1:3105' } }, { remoteAddress: '203.0.113.9', localPort: 3105 })).status).toBe(403)
-    expect((await router.request('/host', { headers: { host: '127.0.0.1:3105' } }, { remoteAddress: '127.0.0.1' })).status).toBe(403)
-  })
-
-  it('can check only the peer when mutations are none', async () => {
-    const router = await mount()
-    router.use(loopbackOnly({ mutations: 'none' }))
-    router.post('/do', c => c.text('done'))
-    expect((await router.request('/do', { method: 'POST', headers: headers() }, peer)).status).toBe(200)
-  })
-})

package/plugins/acryl-router/tests/table.spec.ts

@@ -1,47 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { RouteTable } from '../src/table.ts'
-import { conformance, type Candidate } from './conformance.ts'
-
-function tableCandidate(trailingSlash: 'strict' | 'ignore' = 'strict', onError?: (e: unknown) => void): Candidate & { table: RouteTable } {
-  const table = new RouteTable({ trailingSlash, ...(onError === undefined ? {} : { onError }) })
-  return {
-    table,
-    route: (method, path, handler) => table.add(method, path, handler),
-    use: (path, middleware) => table.use(path, middleware),
-    fetch: request => table.dispatch(request, new AbortController().signal),
-    size: () => table.size,
-  }
-}
-
-conformance('RouteTable (the pure core)', () => tableCandidate())
-
-describe('RouteTable specifics', () => {
-  it('keeps /a and /a/ distinct under strict and joins them under ignore', async () => {
-    const strict = tableCandidate('strict')
-    strict.route('GET', '/a', c => c.text('a'))
-    expect((await strict.fetch(new Request('http://t/a/'))).status).toBe(404)
-    const loose = tableCandidate('ignore')
-    loose.route('GET', '/a', c => c.text('a'))
-    expect((await loose.fetch(new Request('http://t/a/'))).status).toBe(200)
-  })
-
-  it('reports handler errors to onError and still answers 500', async () => {
-    const seen: unknown[] = []
-    const c = tableCandidate('strict', e => seen.push(e))
-    c.route('GET', '/x', () => { throw new Error('nope') })
-    expect((await c.fetch(new Request('http://t/x'))).status).toBe(500)
-    expect(seen).toHaveLength(1)
-  })
-
-  it('answers 499 instead of 500 when the request was aborted', async () => {
-    const c = tableCandidate()
-    const controller = new AbortController()
-    c.route('GET', '/slow', async ctx => {
-      await new Promise((_resolve, reject) => { ctx.signal.addEventListener('abort', () => reject(new Error('aborted')), { once: true }) })
-      return ctx.text('never')
-    })
-    const pending = c.table.dispatch(new Request('http://t/slow'), controller.signal)
-    controller.abort()
-    expect((await pending).status).toBe(499)
-  })
-})