acrylblends 0.6.3 → 0.7.0

package/plugins/acryl-router/src/core/middleware/csrf/index.test.ts

@@ -1,534 +0,0 @@
-import type { Context } from '../../context.ts'
-import { Acryl } from '../../app.ts'
-import { csrf } from './index.ts'
-
-const simplePostHandler = vi.fn(async (c: Context) => {
-  if (c.req.header('content-type') === 'application/json') {
-    return c.text((await c.req.json<{ name: string }>())['name'])
-  } else {
-    const body = await c.req.parseBody<{ name: string }>()
-    return c.text(body['name'])
-  }
-})
-
-const buildSimplePostRequestData = (options: { origin?: string; secFetchSite?: string } = {}) => ({
-  method: 'POST',
-  headers: Object.assign(
-    {
-      'content-type': 'application/x-www-form-urlencoded',
-    },
-    options?.origin ? { origin: options.origin } : {},
-    options?.secFetchSite ? { 'sec-fetch-site': options.secFetchSite } : {}
-  ) as Record<string, string>,
-  body: 'name=acryl',
-})
-
-describe('CSRF by Middleware', () => {
-  beforeEach(() => {
-    simplePostHandler.mockClear()
-  })
-
-  describe('simple usage', () => {
-    const app = new Acryl()
-
-    app.use('*', csrf())
-    app.get('/form', (c) => c.html('<form></form>'))
-    app.options('/form', (c) => c.text('OK'))
-    app.post('/form', simplePostHandler)
-    app.put('/form', (c) => c.text('OK'))
-    app.delete('/form', (c) => c.text('OK'))
-    app.patch('/form', (c) => c.text('OK'))
-
-    describe('GET /form', async () => {
-      it('should be 200 for any request', async () => {
-        const res = await app.request('http://localhost/form')
-
-        expect(res.status).toBe(200)
-        expect(await res.text()).toBe('<form></form>')
-      })
-    })
-
-    describe('HEAD /form', async () => {
-      it('should be 200 for any request', async () => {
-        const res = await app.request('http://localhost/form', { method: 'HEAD' })
-
-        expect(res.status).toBe(200)
-      })
-    })
-
-    describe('OPTIONS /form', async () => {
-      it('should be 200 for any request', async () => {
-        const res = await app.request('http://localhost/form', { method: 'OPTIONS' })
-
-        expect(res.status).toBe(200)
-        expect(await res.text()).toBe('OK')
-      })
-    })
-
-    describe('POST /form', async () => {
-      it('should be 200 for local request', async () => {
-        /*
-         * <form action="/form" method="POST"><input name="name" value="acryl" /></form>
-         * or
-         * <script>
-         * fetch('/form', {
-         *   method: 'POST',
-         *   headers: {
-         *     'content-type': 'application/x-www-form-urlencoded',
-         *   },
-         *   body: 'name=acryl',
-         * });
-         * </script>
-         */
-        const res = await app.request(
-          'http://localhost/form',
-          buildSimplePostRequestData({ origin: 'http://localhost' })
-        )
-
-        expect(res.status).toBe(200)
-        expect(await res.text()).toBe('acryl')
-      })
-
-      it('should be 403 for "application/x-www-form-urlencoded" cross origin', async () => {
-        /*
-         * via http://example.com
-         *
-         * <form action="http://localhost/form" method="POST">
-         *   <input name="name" value="acryl" />
-         * </form>
-         * or
-         * <script>
-         * fetch('http://localhost/form', {
-         *   method: 'POST',
-         *   headers: {
-         *     'content-type': 'application/x-www-form-urlencoded',
-         *   },
-         *   body: 'name=acryl',
-         * });
-         * </script>
-         */
-        const res = await app.request(
-          'http://localhost/form',
-          buildSimplePostRequestData({ origin: 'http://example.com' })
-        )
-
-        expect(res.status).toBe(403)
-        expect(simplePostHandler).not.toHaveBeenCalled()
-      })
-    })
-
-    it('should be 403 for "multipart/form-data" cross origin', async () => {
-      /*
-       * via http://example.com
-       *
-       * <form action="http://localhost/form" method="POST" enctype="multipart/form-data">
-       *   <input name="name" value="acryl" />
-       * </form>
-       * or
-       * <script>
-       * fetch('http://localhost/form', {
-       *   method: 'POST',
-       *   headers: {
-       *     'content-type': 'multipart/form-data',
-       *   },
-       *   body: 'name=acryl',
-       * });
-       * </script>
-       */
-      const res = await app.request(
-        'http://localhost/form',
-        buildSimplePostRequestData({ origin: 'http://example.com' })
-      )
-
-      expect(res.status).toBe(403)
-      expect(simplePostHandler).not.toHaveBeenCalled()
-    })
-
-    it('should be 403 for "text/plain" cross origin', async () => {
-      /*
-       * via http://example.com
-       *
-       * <form action="http://localhost/form" method="POST" enctype="text/plain">
-       *   <input name="name" value="acryl" />
-       * </form>
-       * or
-       * <script>
-       * fetch('http://localhost/form', {
-       *   method: 'POST',
-       *   headers: {
-       *     'content-type': 'text/plain',
-       *   },
-       *   body: 'name=acryl',
-       * });
-       * </script>
-       */
-      const res = await app.request(
-        'http://localhost/form',
-        buildSimplePostRequestData({ origin: 'http://example.com' })
-      )
-
-      expect(res.status).toBe(403)
-      expect(simplePostHandler).not.toHaveBeenCalled()
-    })
-
-    it('should be 403 if request has no origin header', async () => {
-      const res = await app.request('http://localhost/form', buildSimplePostRequestData())
-
-      expect(res.status).toBe(403)
-      expect(simplePostHandler).not.toHaveBeenCalled()
-    })
-
-    it('should be 200 for application/json', async () => {
-      /*
-       * via http://example.com
-       * Assume localhost allows cross origin POST
-       *
-       * <script>
-       * fetch('http://localhost/form', {
-       *   method: 'POST',
-       *   headers: {
-       *     'content-type': 'application/json',
-       *   },
-       *   body: JSON.stringify({ name: 'acryl' }),
-       * });
-       * </script>
-       */
-      const res = await app.request('http://localhost/form', {
-        method: 'POST',
-        headers: {
-          'content-type': 'application/json',
-          origin: 'http://example.com',
-        },
-        body: JSON.stringify({ name: 'acryl' }),
-      })
-
-      expect(res.status).toBe(200)
-      expect(await res.text()).toBe('acryl')
-    })
-
-    it('should be 403 for "Application/x-www-form-urlencoded" cross origin', async () => {
-      const res = await app.request('http://localhost/form', {
-        method: 'POST',
-        headers: Object.assign({
-          'content-type': 'Application/x-www-form-urlencoded',
-        }),
-        body: 'name=acryl',
-      })
-      expect(res.status).toBe(403)
-      expect(simplePostHandler).not.toHaveBeenCalled()
-    })
-
-    it('should be 403 if the content-type is not set', async () => {
-      const res = await app.request('/form', {
-        method: 'POST',
-        body: new Blob(['test'], {}),
-      })
-      expect(res.status).toBe(403)
-      expect(simplePostHandler).not.toHaveBeenCalled()
-    })
-  })
-
-  describe('with origin option', () => {
-    describe('string', () => {
-      const app = new Acryl()
-
-      app.use(
-        '*',
-        csrf({
-          origin: 'https://example.com',
-        })
-      )
-      app.post('/form', simplePostHandler)
-
-      it('should be 200 for allowed origin', async () => {
-        const res = await app.request(
-          'https://example.com/form',
-          buildSimplePostRequestData({ origin: 'https://example.com' })
-        )
-        expect(res.status).toBe(200)
-      })
-
-      it('should be 403 for not allowed origin', async () => {
-        const res = await app.request(
-          'https://example.jp/form',
-          buildSimplePostRequestData({ origin: 'https://example.jp' })
-        )
-        expect(res.status).toBe(403)
-        expect(simplePostHandler).not.toHaveBeenCalled()
-      })
-    })
-
-    describe('string[]', () => {
-      const app = new Acryl()
-
-      app.use(
-        '*',
-        csrf({
-          origin: ['https://example.com', 'https://acryl.example.com'],
-        })
-      )
-      app.post('/form', simplePostHandler)
-
-      it('should be 200 for allowed origin', async () => {
-        let res = await app.request(
-          'https://acryl.example.com/form',
-          buildSimplePostRequestData({ origin: 'https://acryl.example.com' })
-        )
-        expect(res.status).toBe(200)
-
-        res = await app.request(
-          'https://example.com/form',
-          buildSimplePostRequestData({ origin: 'https://example.com' })
-        )
-        expect(res.status).toBe(200)
-      })
-
-      it('should be 403 for not allowed origin', async () => {
-        const res = await app.request(
-          'http://example.jp/form',
-          buildSimplePostRequestData({ origin: 'http://example.jp' })
-        )
-        expect(res.status).toBe(403)
-        expect(simplePostHandler).not.toHaveBeenCalled()
-      })
-    })
-
-    describe('IsAllowedOriginHandler', () => {
-      const app = new Acryl()
-
-      app.use(
-        '*',
-        csrf({
-          origin: (origin) => /https:\/\/(\w+\.)?example\.com$/.test(origin),
-        })
-      )
-      app.post('/form', simplePostHandler)
-
-      it('should be 200 for allowed origin', async () => {
-        let res = await app.request(
-          'https://acryl.example.com/form',
-          buildSimplePostRequestData({ origin: 'https://acryl.example.com' })
-        )
-        expect(res.status).toBe(200)
-
-        res = await app.request(
-          'https://example.com/form',
-          buildSimplePostRequestData({ origin: 'https://example.com' })
-        )
-        expect(res.status).toBe(200)
-      })
-
-      it('should be 403 for not allowed origin', async () => {
-        let res = await app.request(
-          'http://upstream.acryl.example.jp/form',
-          buildSimplePostRequestData({ origin: 'http://example.jp' })
-        )
-        expect(res.status).toBe(403)
-        expect(simplePostHandler).not.toHaveBeenCalled()
-
-        res = await app.request(
-          'http://example.jp/form',
-          buildSimplePostRequestData({ origin: 'http://example.jp' })
-        )
-        expect(res.status).toBe(403)
-        expect(simplePostHandler).not.toHaveBeenCalled()
-      })
-    })
-
-    describe('async IsAllowedOriginHandler', () => {
-      const app = new Acryl()
-
-      app.use(
-        '*',
-        csrf({
-          origin: async (origin) => {
-            await new Promise((r) => setTimeout(r, 10))
-            return /https:\/\/(\w+\.)?example\.com$/.test(origin)
-          },
-        })
-      )
-      app.post('/form', simplePostHandler)
-
-      it('should be 200 for allowed origin with async handler', async () => {
-        let res = await app.request(
-          'https://acryl.example.com/form',
-          buildSimplePostRequestData({ origin: 'https://acryl.example.com' })
-        )
-        expect(res.status).toBe(200)
-
-        res = await app.request(
-          'https://example.com/form',
-          buildSimplePostRequestData({ origin: 'https://example.com' })
-        )
-        expect(res.status).toBe(200)
-      })
-
-      it('should be 403 for not allowed origin with async handler', async () => {
-        let res = await app.request(
-          'http://upstream.acryl.example.jp/form',
-          buildSimplePostRequestData({ origin: 'http://example.jp' })
-        )
-        expect(res.status).toBe(403)
-        expect(simplePostHandler).not.toHaveBeenCalled()
-
-        res = await app.request(
-          'http://example.jp/form',
-          buildSimplePostRequestData({ origin: 'http://example.jp' })
-        )
-        expect(res.status).toBe(403)
-        expect(simplePostHandler).not.toHaveBeenCalled()
-      })
-    })
-  })
-
-  describe('with secFetchSite option', () => {
-    describe('string', () => {
-      const app = new Acryl()
-      app.use('*', csrf({ secFetchSite: 'same-origin' }))
-      app.post('/form', simplePostHandler)
-
-      it('should allow matching value', async () => {
-        const res = await app.request(
-          'http://localhost/form',
-          buildSimplePostRequestData({ secFetchSite: 'same-origin' })
-        )
-        expect(res.status).toBe(200)
-      })
-
-      it('should block non-matching value', async () => {
-        const res = await app.request(
-          'http://localhost/form',
-          buildSimplePostRequestData({ secFetchSite: 'cross-site' })
-        )
-        expect(res.status).toBe(403)
-      })
-
-      it('should block unknown values', async () => {
-        const res = await app.request(
-          'http://localhost/form',
-          buildSimplePostRequestData({ secFetchSite: 'any' })
-        )
-        expect(res.status).toBe(403)
-      })
-    })
-
-    describe('string[]', () => {
-      const app = new Acryl()
-      app.use('*', csrf({ secFetchSite: ['same-origin', 'none'] }))
-      app.post('/form', simplePostHandler)
-
-      it('should allow "same-origin" value', async () => {
-        const res = await app.request(
-          'http://localhost/form',
-          buildSimplePostRequestData({ secFetchSite: 'same-origin' })
-        )
-        expect(res.status).toBe(200)
-      })
-
-      it('should allow "none" value', async () => {
-        const res = await app.request(
-          'http://localhost/form',
-          buildSimplePostRequestData({ secFetchSite: 'none' })
-        )
-        expect(res.status).toBe(200)
-      })
-
-      it('should block not included values', async () => {
-        const res = await app.request(
-          'http://localhost/form',
-          buildSimplePostRequestData({ secFetchSite: 'cross-site' })
-        )
-        expect(res.status).toBe(403)
-      })
-    })
-
-    describe('IsAllowedSecFetchSiteHandler', () => {
-      const app = new Acryl()
-      app.use(
-        '*',
-        csrf({
-          secFetchSite: (secFetchSite, c) => {
-            if (secFetchSite === 'same-origin') {
-              return true
-            }
-            if (c.req.path.startsWith('/webhook/')) {
-              return true
-            }
-            return false
-          },
-        })
-      )
-      app.post('/form', simplePostHandler)
-      app.post('/webhook/test', simplePostHandler)
-
-      it('should use custom logic for allowed values', async () => {
-        const res = await app.request(
-          'http://localhost/form',
-          buildSimplePostRequestData({ secFetchSite: 'same-origin' })
-        )
-        expect(res.status).toBe(200)
-      })
-
-      it('should use custom logic for path-based bypass', async () => {
-        const res = await app.request(
-          'http://localhost/webhook/test',
-          buildSimplePostRequestData({ secFetchSite: 'cross-site' })
-        )
-        expect(res.status).toBe(200)
-      })
-
-      it('should block when custom logic returns false', async () => {
-        const res = await app.request(
-          'http://localhost/form',
-          buildSimplePostRequestData({ secFetchSite: 'cross-site' })
-        )
-        expect(res.status).toBe(403)
-      })
-    })
-
-    describe('async IsAllowedSecFetchSiteHandler', () => {
-      const app = new Acryl()
-      app.use(
-        '*',
-        csrf({
-          secFetchSite: async (secFetchSite, c) => {
-            await new Promise((r) => setTimeout(r, 10))
-            if (secFetchSite === 'same-origin') {
-              return true
-            }
-            if (c.req.path.startsWith('/webhook/')) {
-              return true
-            }
-            return false
-          },
-        })
-      )
-      app.post('/form', simplePostHandler)
-      app.post('/webhook/test', simplePostHandler)
-
-      it('should use async custom logic for allowed values', async () => {
-        const res = await app.request(
-          'http://localhost/form',
-          buildSimplePostRequestData({ secFetchSite: 'same-origin' })
-        )
-        expect(res.status).toBe(200)
-      })
-
-      it('should use async custom logic for path-based bypass', async () => {
-        const res = await app.request(
-          'http://localhost/webhook/test',
-          buildSimplePostRequestData({ secFetchSite: 'cross-site' })
-        )
-        expect(res.status).toBe(200)
-      })
-
-      it('should block when async custom logic returns false', async () => {
-        const res = await app.request(
-          'http://localhost/form',
-          buildSimplePostRequestData({ secFetchSite: 'cross-site' })
-        )
-        expect(res.status).toBe(403)
-      })
-    })
-  })
-})

package/plugins/acryl-router/src/core/middleware/etag/digest.test.ts

@@ -1,21 +0,0 @@
-import { generateDigest } from './digest.ts'
-
-describe('generateDigest', () => {
-  it('Should copy pending bytes from a stream that reuses its buffer', async () => {
-    const scratch = new Uint8Array(4)
-    let pullCount = 0
-    const stream = new ReadableStream({
-      pull(controller) {
-        scratch.fill(pullCount === 0 ? 0x41 : 0x42)
-        controller.enqueue(scratch)
-        if (++pullCount === 2) {
-          controller.close()
-        }
-      },
-    })
-
-    const digest = await generateDigest(stream, (body) => crypto.subtle.digest('SHA-1', body))
-
-    expect(digest).toBe('7cd188ef3a9ea7fa0ee9c62c168709695460f5c0')
-  })
-})