adapt-authoring-server 1.3.0 → 1.4.1

package/.github/workflows/tests.yml

@@ -0,0 +1,15 @@
+name: Tests
+on: push
+jobs:
+  default:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@master
+      - uses: actions/setup-node@master
+        with:
+          node-version: 'lts/*'
+          cache: 'npm'
+      - run: npm ci
+      - run: npm test

package/package.json

@@ -1,12 +1,15 @@
 {
   "name": "adapt-authoring-server",
-  "version": "1.3.0",
+  "version": "1.4.1",
   "description": "Provides an Express application routing and more",
   "homepage": "https://github.com/adapt-security/adapt-authoring-server",
   "license": "GPL-3.0",
   "type": "module",
   "main": "index.js",
   "repository": "github:adapt-security/adapt-authoring-server",
+  "scripts": {
+    "test": "node --test tests/**/*.spec.js"
+  },
   "dependencies": {
     "adapt-authoring-core": "^1.7.0",
     "express": "^5.1.0",

package/tests/Router.spec.js

@@ -0,0 +1,552 @@
+import { describe, it, before } from 'node:test'
+import assert from 'node:assert/strict'
+import express from 'express'
+import { App } from 'adapt-authoring-core'
+
+describe('Router', () => {
+  let Router
+  let mockApp
+
+  before(async () => {
+    const app = App.instance
+    app.logger = { log: () => {}, name: 'adapt-authoring-logger' }
+    app.dependencyloader.instances = app.dependencyloader.instances || {}
+    app.dependencyloader.instances['adapt-authoring-server'] = { url: 'http://localhost:5000' }
+    // Wait for App singleton's async init/setReady to settle and
+    // reset exitCode set by App.init() failure (expected in test context)
+    await app.onReady().catch(() => {})
+    process.exitCode = 0
+
+    const routerModule = await import('../lib/Router.js')
+    Router = routerModule.default
+    mockApp = express()
+  })
+
+  describe('constructor', () => {
+    it('should create a router with default values', () => {
+      const router = new Router('/test', mockApp)
+
+      assert.equal(router.root, '/test')
+      assert.equal(typeof router.expressRouter, 'function')
+      assert.ok(Array.isArray(router.routes))
+      assert.equal(router.routes.length, 0)
+      assert.ok(Array.isArray(router.childRouters))
+      assert.equal(router.childRouters.length, 0)
+      assert.ok(Array.isArray(router.routerMiddleware))
+      assert.ok(Array.isArray(router.handlerMiddleware))
+      assert.equal(router._initialised, false)
+    })
+
+    it('should store the parent router', () => {
+      const router = new Router('/test', mockApp)
+
+      assert.equal(router.parentRouter, mockApp)
+    })
+
+    it('should filter out non-function middleware', () => {
+      const fn1 = () => {}
+      const fn2 = () => {}
+      const middleware = [fn1, 'not a function', fn2, 42, null]
+      const router = new Router('/test', mockApp, [], middleware)
+
+      assert.ok(router.routerMiddleware.includes(fn1))
+      assert.ok(router.routerMiddleware.includes(fn2))
+      assert.ok(!router.routerMiddleware.includes('not a function'))
+    })
+
+    it('should filter out non-function handler middleware', () => {
+      const fn = () => {}
+      const handlerMiddleware = [fn, 'bad', undefined]
+      const router = new Router('/test', mockApp, [], [], handlerMiddleware)
+
+      assert.ok(router.handlerMiddleware.includes(fn))
+      assert.ok(!router.handlerMiddleware.includes('bad'))
+    })
+
+    it('should filter invalid routes passed to constructor', () => {
+      const validRoute = { route: '/users', handlers: { get: () => {} } }
+      const invalidRoute = { route: 123, handlers: { get: () => {} } }
+      const router = new Router('/test', mockApp, [validRoute, invalidRoute])
+
+      assert.equal(router.routes.length, 1)
+      assert.equal(router.routes[0].route, '/users')
+    })
+
+    it('should include default router middleware (addErrorHandler)', () => {
+      const router = new Router('/test', mockApp)
+
+      assert.ok(router.routerMiddleware.length >= 1)
+    })
+
+    it('should include default handler middleware (addExistenceProps, handleInternalRoutes)', () => {
+      const router = new Router('/test', mockApp)
+
+      assert.ok(router.handlerMiddleware.length >= 2)
+    })
+  })
+
+  describe('#path', () => {
+    it('should generate path from parent router', () => {
+      const parentRouter = new Router('/api', mockApp)
+      const childRouter = new Router('users', parentRouter)
+
+      assert.equal(childRouter.path, '/api/users')
+    })
+
+    it('should handle trailing slashes correctly', () => {
+      const parentRouter = new Router('/api/', mockApp)
+      const childRouter = new Router('/users', parentRouter)
+
+      // Documents existing behavior: double slashes are allowed
+      assert.equal(childRouter.path, '/api//users')
+    })
+
+    it('should handle root path without parent path property', () => {
+      const router = new Router('/test', mockApp)
+
+      assert.equal(router.path, '/test')
+    })
+
+    it('should build multi-level nested paths', () => {
+      const root = new Router('/api', mockApp)
+      const child = new Router('v1', root)
+      const grandchild = new Router('users', child)
+
+      assert.equal(grandchild.path, '/api/v1/users')
+    })
+  })
+
+  describe('#url', () => {
+    it('should return server url + path', () => {
+      const router = new Router('/api', mockApp)
+
+      assert.equal(router.url, 'http://localhost:5000/api')
+    })
+
+    it('should include full hierarchy path', () => {
+      const parent = new Router('/api', mockApp)
+      const child = new Router('users', parent)
+
+      assert.equal(child.url, 'http://localhost:5000/api/users')
+    })
+
+    it('should return empty string when server instance is not available', () => {
+      const origInstances = App.instance.dependencyloader.instances
+      App.instance.dependencyloader.instances = {}
+      const router = new Router('/api', mockApp)
+
+      assert.equal(router.url, '')
+
+      App.instance.dependencyloader.instances = origInstances
+    })
+  })
+
+  describe('#map', () => {
+    it('should return a router map object', () => {
+      const api = new Router('api', mockApp)
+      api.createChildRouter('test', [
+        { route: '/test', handlers: { get: () => {} }, post: () => {} },
+        { route: '/test2', handlers: { patch: () => {} } }
+      ])
+
+      const map = api.map
+
+      assert.equal(typeof map, 'object')
+      assert.equal(map.test_endpoints.length, 2)
+    })
+
+    it('should return empty object for router with no routes', () => {
+      const router = new Router('api', mockApp)
+
+      assert.deepEqual(router.map, {})
+    })
+  })
+
+  describe('#addMiddleware()', () => {
+    it('should add middleware to router stack', () => {
+      const router = new Router('/test', mockApp)
+      const middleware = () => {}
+      const initialLength = router.routerMiddleware.length
+
+      router.addMiddleware(middleware)
+
+      assert.equal(router.routerMiddleware.length, initialLength + 1)
+      assert.ok(router.routerMiddleware.includes(middleware))
+    })
+
+    it('should return router instance for chaining', () => {
+      const router = new Router('/test', mockApp)
+      const result = router.addMiddleware(() => {})
+
+      assert.equal(result, router)
+    })
+
+    it('should not add duplicate middleware', () => {
+      const router = new Router('/test', mockApp)
+      const middleware = () => {}
+
+      router.addMiddleware(middleware)
+      const lengthAfterFirst = router.routerMiddleware.length
+      router.addMiddleware(middleware)
+
+      assert.equal(router.routerMiddleware.length, lengthAfterFirst)
+    })
+
+    it('should add multiple middleware in one call', () => {
+      const router = new Router('/test', mockApp)
+      const fn1 = () => {}
+      const fn2 = () => {}
+      const initialLength = router.routerMiddleware.length
+
+      router.addMiddleware(fn1, fn2)
+
+      assert.equal(router.routerMiddleware.length, initialLength + 2)
+    })
+
+    it('should not add non-function values', () => {
+      const router = new Router('/test', mockApp)
+      const initialLength = router.routerMiddleware.length
+
+      router.addMiddleware('not a function')
+
+      assert.equal(router.routerMiddleware.length, initialLength)
+    })
+
+    it('should return router when called with no arguments', () => {
+      const router = new Router('/test', mockApp)
+      const result = router.addMiddleware()
+
+      assert.equal(result, router)
+    })
+  })
+
+  describe('#addHandlerMiddleware()', () => {
+    it('should add handler middleware to stack', () => {
+      const router = new Router('/test', mockApp)
+      const middleware = () => {}
+      const initialLength = router.handlerMiddleware.length
+
+      router.addHandlerMiddleware(middleware)
+
+      assert.equal(router.handlerMiddleware.length, initialLength + 1)
+      assert.ok(router.handlerMiddleware.includes(middleware))
+    })
+
+    it('should return router instance for chaining', () => {
+      const router = new Router('/test', mockApp)
+      const result = router.addHandlerMiddleware(() => {})
+
+      assert.equal(result, router)
+    })
+
+    it('should not add duplicate handler middleware', () => {
+      const router = new Router('/test', mockApp)
+      const middleware = () => {}
+
+      router.addHandlerMiddleware(middleware)
+      const lengthAfterFirst = router.handlerMiddleware.length
+      router.addHandlerMiddleware(middleware)
+
+      assert.equal(router.handlerMiddleware.length, lengthAfterFirst)
+    })
+  })
+
+  describe('#getHandlerMiddleware()', () => {
+    it('should get middleware from router hierarchy', () => {
+      const parentRouter = new Router('/api', mockApp)
+      const childRouter = new Router('users', parentRouter)
+      const middleware = () => {}
+
+      parentRouter.addHandlerMiddleware(middleware)
+      const result = childRouter.getHandlerMiddleware()
+
+      assert.ok(Array.isArray(result))
+      assert.ok(result.includes(middleware))
+    })
+
+    it('should stop recursing when parent is not a Router', () => {
+      const router = new Router('/test', mockApp)
+      const result = router.getHandlerMiddleware()
+
+      assert.ok(Array.isArray(result))
+      assert.ok(result.length > 0)
+    })
+
+    it('should return unique middleware (deduplicated)', () => {
+      const parentRouter = new Router('/api', mockApp)
+      const childRouter = new Router('users', parentRouter)
+
+      const result = childRouter.getHandlerMiddleware()
+      const unique = [...new Set(result)]
+
+      assert.equal(result.length, unique.length)
+    })
+  })
+
+  describe('#addRoute()', () => {
+    it('should add valid route', () => {
+      const router = new Router('/test', mockApp)
+      const route = { route: '/users', handlers: { get: () => {} } }
+
+      router.addRoute(route)
+
+      assert.equal(router.routes.length, 1)
+      assert.equal(router.routes[0].route, '/users')
+    })
+
+    it('should return router instance for chaining', () => {
+      const router = new Router('/test', mockApp)
+      const route = { route: '/users', handlers: { get: () => {} } }
+      const result = router.addRoute(route)
+
+      assert.equal(result, router)
+    })
+
+    it('should add multiple routes in one call', () => {
+      const router = new Router('/test', mockApp)
+      const route1 = { route: '/users', handlers: { get: () => {} } }
+      const route2 = { route: '/posts', handlers: { post: () => {} } }
+
+      router.addRoute(route1, route2)
+
+      assert.equal(router.routes.length, 2)
+    })
+
+    it('should filter out invalid routes', () => {
+      const router = new Router('/test', mockApp)
+      const valid = { route: '/users', handlers: { get: () => {} } }
+      const invalid = { route: 123, handlers: {} }
+
+      router.addRoute(valid, invalid)
+
+      assert.equal(router.routes.length, 1)
+    })
+
+    it('should not add routes after initialisation', () => {
+      const router = new Router('/test', mockApp)
+      router.init()
+
+      router.addRoute({ route: '/late', handlers: { get: () => {} } })
+
+      assert.equal(router.routes.length, 0)
+    })
+  })
+
+  describe('#validateRoute()', () => {
+    it('should return true for valid route', () => {
+      const router = new Router('/test', mockApp)
+      const route = { route: '/users', handlers: { get: () => {} } }
+
+      assert.equal(router.validateRoute(route), true)
+    })
+
+    it('should return false if route is not a string', () => {
+      const router = new Router('/test', mockApp)
+
+      assert.equal(router.validateRoute({ route: 123, handlers: { get: () => {} } }), false)
+    })
+
+    it('should return false if handlers is missing', () => {
+      const router = new Router('/test', mockApp)
+
+      assert.equal(router.validateRoute({ route: '/test' }), false)
+    })
+
+    it('should return false if handler method is not a valid Express method', () => {
+      const router = new Router('/test', mockApp)
+
+      assert.equal(router.validateRoute({ route: '/test', handlers: { badmethod: () => {} } }), false)
+    })
+
+    it('should return false if handler value is not a function or array of functions', () => {
+      const router = new Router('/test', mockApp)
+
+      assert.equal(router.validateRoute({ route: '/test', handlers: { get: 'not a function' } }), false)
+    })
+
+    it('should accept array of functions as handler', () => {
+      const router = new Router('/test', mockApp)
+      const route = { route: '/users', handlers: { get: [() => {}, () => {}] } }
+
+      assert.equal(router.validateRoute(route), true)
+    })
+
+    it('should return false if handler array contains non-functions', () => {
+      const router = new Router('/test', mockApp)
+      const route = { route: '/users', handlers: { get: [() => {}, 'not a function'] } }
+
+      assert.equal(router.validateRoute(route), false)
+    })
+
+    it('should accept multiple HTTP methods', () => {
+      const router = new Router('/test', mockApp)
+      const route = { route: '/users', handlers: { get: () => {}, post: () => {}, put: () => {}, delete: () => {} } }
+
+      assert.equal(router.validateRoute(route), true)
+    })
+  })
+
+  describe('#createChildRouter()', () => {
+    it('should create and return a child router', () => {
+      const router = new Router('/api', mockApp)
+      const child = router.createChildRouter('users')
+
+      assert.ok(child instanceof Router)
+      assert.equal(child.root, 'users')
+      assert.equal(child.parentRouter, router)
+    })
+
+    it('should add child to childRouters array', () => {
+      const router = new Router('/api', mockApp)
+      router.createChildRouter('users')
+
+      assert.equal(router.childRouters.length, 1)
+    })
+
+    it('should pass routes to child router', () => {
+      const router = new Router('/api', mockApp)
+      const routes = [{ route: '/list', handlers: { get: () => {} } }]
+      const child = router.createChildRouter('users', routes)
+
+      assert.equal(child.routes.length, 1)
+    })
+
+    it('should pass middleware to child router', () => {
+      const router = new Router('/api', mockApp)
+      const mw = () => {}
+      const child = router.createChildRouter('users', [], [mw])
+
+      assert.ok(child.routerMiddleware.includes(mw))
+    })
+
+    it('should pass handler middleware to child router', () => {
+      const router = new Router('/api', mockApp)
+      const mw = () => {}
+      const child = router.createChildRouter('users', [], [], [mw])
+
+      assert.ok(child.handlerMiddleware.includes(mw))
+    })
+
+    it('should not create child after initialisation', () => {
+      const router = new Router('/api', mockApp)
+      router.init()
+
+      const result = router.createChildRouter('late')
+
+      assert.equal(result, router)
+      assert.equal(router.childRouters.length, 0)
+    })
+  })
+
+  describe('#warnOnInited()', () => {
+    it('should return false if not initialised', () => {
+      const router = new Router('/test', mockApp)
+
+      assert.equal(router.warnOnInited('test message'), false)
+    })
+
+    it('should return true if initialised', () => {
+      const router = new Router('/test', mockApp)
+      router.init()
+
+      assert.equal(router.warnOnInited('test message'), true)
+    })
+  })
+
+  describe('#init()', () => {
+    it('should set _initialised to true', () => {
+      const router = new Router('/test', mockApp)
+
+      router.init()
+
+      assert.equal(router._initialised, true)
+    })
+
+    it('should apply router middleware to express router', () => {
+      const mw = (req, res, next) => next()
+      const router = new Router('/test', mockApp, [], [mw])
+
+      router.init()
+
+      assert.ok(router.routerMiddleware.includes(mw))
+    })
+
+    it('should initialise child routers', () => {
+      const router = new Router('/api', mockApp)
+      const child = router.createChildRouter('users')
+
+      router.init()
+
+      assert.equal(child._initialised, true)
+    })
+
+    it('should register routes on the express router', () => {
+      const handler = (req, res) => res.json({})
+      const routes = [{ route: '/items', handlers: { get: handler } }]
+      const router = new Router('/test', mockApp, routes)
+
+      router.init()
+
+      assert.equal(router._initialised, true)
+    })
+
+    it('should not re-initialise if already initialised', () => {
+      const router = new Router('/test', mockApp)
+      router.init()
+
+      // Second call should be a no-op
+      router.init()
+
+      assert.equal(router._initialised, true)
+    })
+
+    it('should mount to parent Router via expressRouter.use', () => {
+      const parentRouter = new Router('/api', mockApp)
+      const childRouter = new Router('users', parentRouter)
+
+      childRouter.init()
+
+      assert.equal(childRouter._initialised, true)
+    })
+  })
+
+  describe('#flattenRouters()', () => {
+    it('should return array containing the router itself', () => {
+      const router = new Router('/api', mockApp)
+      const result = router.flattenRouters()
+
+      assert.ok(Array.isArray(result))
+      assert.ok(result.includes(router))
+    })
+
+    it('should include child routers', () => {
+      const router = new Router('/api', mockApp)
+      const child = router.createChildRouter('users')
+
+      const result = router.flattenRouters()
+
+      assert.ok(result.includes(router))
+      assert.ok(result.includes(child))
+    })
+
+    it('should include nested grandchild routers', () => {
+      const router = new Router('/api', mockApp)
+      const child = router.createChildRouter('v1')
+      const grandchild = child.createChildRouter('users')
+
+      const result = router.flattenRouters()
+
+      assert.ok(result.includes(router))
+      assert.ok(result.includes(child))
+      assert.ok(result.includes(grandchild))
+    })
+  })
+
+  describe('#log()', () => {
+    it('should not throw when called', () => {
+      const router = new Router('/test', mockApp)
+
+      assert.doesNotThrow(() => router.log('debug', 'test message'))
+    })
+  })
+})

package/tests/ServerModule.spec.js

@@ -0,0 +1,163 @@
+import { describe, it, before } from 'node:test'
+import assert from 'node:assert/strict'
+import { Hook } from 'adapt-authoring-core'
+
+describe('ServerModule', () => {
+  let ServerModule
+
+  before(async () => {
+    ServerModule = (await import('../lib/ServerModule.js')).default
+  })
+
+  function createMockApp () {
+    return {
+      onReady: () => new Promise(() => {}),
+      logger: { log: () => {}, name: 'adapt-authoring-logger' },
+      dependencyloader: {
+        instances: { 'adapt-authoring-server': { url: 'http://localhost:5000' } },
+        moduleLoadedHook: new Hook()
+      },
+      config: {
+        get: (key) => {
+          const values = {
+            'ServerModule.host': 'localhost',
+            'ServerModule.port': 5000,
+            'ServerModule.trustProxy': true,
+            'ServerModule.url': null,
+            'ServerModule.verboseErrorLogging': false
+          }
+          return values[key]
+        }
+      },
+      errors: {
+        SERVER_START: { setData: (data) => ({ ...data, statusCode: 500 }) }
+      }
+    }
+  }
+
+  describe('constructor', () => {
+    it('should be defined', () => {
+      assert.ok(ServerModule)
+      assert.equal(typeof ServerModule, 'function')
+    })
+  })
+
+  describe('#static()', () => {
+    it('should return express.static middleware', () => {
+      const instance = new ServerModule(createMockApp())
+      const middleware = instance.static('/public')
+
+      assert.equal(typeof middleware, 'function')
+    })
+
+    it('should accept options parameter', () => {
+      const instance = new ServerModule(createMockApp())
+      const middleware = instance.static('/public', { maxAge: 3600 })
+
+      assert.equal(typeof middleware, 'function')
+    })
+  })
+
+  describe('properties', () => {
+    it('should have host property from config', () => {
+      const instance = new ServerModule(createMockApp())
+
+      assert.equal(instance.host, 'localhost')
+    })
+
+    it('should have port property from config', () => {
+      const instance = new ServerModule(createMockApp())
+
+      assert.equal(instance.port, 5000)
+    })
+
+    it('should return url from config when set', () => {
+      const app = createMockApp()
+      const origGet = app.config.get
+      app.config.get = (key) => {
+        if (key === 'ServerModule.url') return 'http://example.com'
+        return origGet(key)
+      }
+      const instance = new ServerModule(app)
+
+      assert.equal(instance.url, 'http://example.com')
+    })
+
+    it('should generate url from host and port when url config is not set', () => {
+      const instance = new ServerModule(createMockApp())
+
+      assert.equal(instance.url, 'localhost:5000')
+    })
+
+    it('should have isListening set to false initially', () => {
+      const instance = new ServerModule(createMockApp())
+
+      assert.equal(instance.isListening, false)
+    })
+
+    it('should have a listeningHook', () => {
+      const instance = new ServerModule(createMockApp())
+
+      assert.ok(instance.listeningHook instanceof Hook)
+    })
+
+    it('should have a requestHook', () => {
+      const instance = new ServerModule(createMockApp())
+
+      assert.ok(instance.requestHook instanceof Hook)
+    })
+
+    it('should have an expressApp', () => {
+      const instance = new ServerModule(createMockApp())
+
+      assert.equal(typeof instance.expressApp, 'function')
+    })
+
+    it('should have an api Router', () => {
+      const instance = new ServerModule(createMockApp())
+
+      assert.ok(instance.api)
+      assert.equal(instance.api.root, '/api')
+    })
+
+    it('should have a root Router', () => {
+      const instance = new ServerModule(createMockApp())
+
+      assert.ok(instance.root)
+      assert.equal(instance.root.root, '/')
+    })
+
+    it('should set httpServer to undefined initially', () => {
+      const instance = new ServerModule(createMockApp())
+
+      assert.equal(instance.httpServer, undefined)
+    })
+
+    it('should set isListening to false initially', () => {
+      const instance = new ServerModule(createMockApp())
+
+      assert.equal(instance.isListening, false)
+    })
+
+    it('should set trust proxy on express app', () => {
+      const instance = new ServerModule(createMockApp())
+
+      assert.equal(instance.expressApp.get('trust proxy'), true)
+    })
+
+    it('should set view engine to hbs', () => {
+      const instance = new ServerModule(createMockApp())
+
+      assert.equal(instance.expressApp.get('view engine'), 'hbs')
+    })
+  })
+
+  describe('#close()', () => {
+    it('should resolve if httpServer is not set', async () => {
+      const instance = new ServerModule(createMockApp())
+      instance.httpServer = undefined
+
+      await assert.doesNotReject(() => instance.close())
+    })
+  })
+})

package/tests/ServerUtils.spec.js

@@ -0,0 +1,555 @@
+import { describe, it, before } from 'node:test'
+import assert from 'node:assert/strict'
+import { App } from 'adapt-authoring-core'
+
+describe('ServerUtils', () => {
+  let ServerUtils
+
+  before(async () => {
+    const app = App.instance
+    app.logger = { log: () => {}, name: 'adapt-authoring-logger' }
+    app.dependencyloader.instances = app.dependencyloader.instances || {}
+    app.dependencyloader.instances['adapt-authoring-server'] = { url: 'http://localhost:5000' }
+    await app.onReady().catch(() => {})
+    process.exitCode = 0
+
+    ServerUtils = (await import('../lib/ServerUtils.js')).default
+  })
+
+  describe('#addExistenceProps()', () => {
+    it('should set hasBody, hasParams, hasQuery to false for empty objects', () => {
+      const req = { method: 'POST', body: {}, params: {}, query: {} }
+      const res = {}
+      let nextCalled = false
+      const next = () => { nextCalled = true }
+
+      ServerUtils.addExistenceProps(req, res, next)
+
+      assert.equal(req.hasBody, false)
+      assert.equal(req.hasParams, false)
+      assert.equal(req.hasQuery, false)
+      assert.equal(nextCalled, true)
+    })
+
+    it('should set hasBody, hasParams, hasQuery to true for populated objects', () => {
+      const req = { method: 'POST', body: { foo: 'bar' }, params: { id: '123' }, query: { search: 'test' } }
+      const res = {}
+      let nextCalled = false
+      const next = () => { nextCalled = true }
+
+      ServerUtils.addExistenceProps(req, res, next)
+
+      assert.equal(req.hasBody, true)
+      assert.equal(req.hasParams, true)
+      assert.equal(req.hasQuery, true)
+      assert.equal(nextCalled, true)
+    })
+
+    it('should remove undefined and null values from request objects', () => {
+      const req = { method: 'POST', body: { foo: 'bar', baz: undefined, qux: null }, params: {}, query: {} }
+      const res = {}
+      const next = () => {}
+
+      ServerUtils.addExistenceProps(req, res, next)
+
+      assert.equal(req.body.foo, 'bar')
+      assert.equal(req.body.baz, undefined)
+      assert.equal(req.body.qux, undefined)
+      assert.equal(req.hasBody, true)
+    })
+
+    it('should clear body for GET requests', () => {
+      const req = { method: 'GET', body: { foo: 'bar' }, params: {}, query: {} }
+      const res = {}
+      const next = () => {}
+
+      ServerUtils.addExistenceProps(req, res, next)
+
+      assert.deepEqual(req.body, {})
+      assert.equal(req.hasBody, false)
+    })
+
+    it('should handle falsy attr values (missing body/params/query)', () => {
+      const req = { method: 'POST', body: null, params: undefined, query: false }
+      const res = {}
+      const next = () => {}
+
+      ServerUtils.addExistenceProps(req, res, next)
+
+      assert.equal(req.hasBody, true)
+      assert.equal(req.hasParams, true)
+      assert.equal(req.hasQuery, true)
+    })
+
+    it('should mark has* false when all entries are null or undefined', () => {
+      const req = { method: 'POST', body: { a: null, b: undefined }, params: {}, query: {} }
+      const res = {}
+      const next = () => {}
+
+      ServerUtils.addExistenceProps(req, res, next)
+
+      assert.equal(req.hasBody, false)
+    })
+  })
+
+  describe('#cacheRouteConfig()', () => {
+    it('should cache route config on request object', () => {
+      const routeConfig = { route: '/test', handlers: {}, internal: false }
+      const middleware = ServerUtils.cacheRouteConfig(routeConfig)
+      const req = {}
+      const res = {}
+      let nextCalled = false
+      const next = () => { nextCalled = true }
+
+      middleware(req, res, next)
+
+      assert.equal(req.routeConfig, routeConfig)
+      assert.equal(nextCalled, true)
+    })
+
+    it('should return a middleware function', () => {
+      const middleware = ServerUtils.cacheRouteConfig({})
+
+      assert.equal(typeof middleware, 'function')
+    })
+  })
+
+  describe('#addErrorHandler()', () => {
+    it('should add sendError method to response object', () => {
+      const req = {}
+      const res = {}
+      let nextCalled = false
+      const next = () => { nextCalled = true }
+
+      ServerUtils.addErrorHandler(req, res, next)
+
+      assert.equal(typeof res.sendError, 'function')
+      assert.equal(nextCalled, true)
+    })
+
+    it('sendError should send AdaptError as JSON with status code', () => {
+      const req = { translate: (error) => error.message }
+      const res = {}
+      const next = () => {}
+
+      ServerUtils.addErrorHandler(req, res, next)
+
+      let statusCode
+      let jsonData
+      res.status = (code) => { statusCode = code; return res }
+      res.json = (data) => { jsonData = data }
+
+      const adaptError = {
+        constructor: { name: 'AdaptError' },
+        statusCode: 404,
+        code: 'NOT_FOUND',
+        message: 'Not found'
+      }
+      res.sendError(adaptError)
+
+      assert.equal(statusCode, 404)
+      assert.equal(jsonData.code, 'NOT_FOUND')
+      assert.equal(jsonData.message, 'Not found')
+    })
+
+    it('sendError should fall back to SERVER_ERROR for unknown errors', () => {
+      App.instance.errors = App.instance.errors || {}
+      App.instance.errors.SERVER_ERROR = {
+        constructor: { name: 'AdaptError' },
+        statusCode: 500,
+        code: 'SERVER_ERROR',
+        message: 'Internal server error'
+      }
+
+      const req = { translate: (error) => error.message }
+      const res = {}
+      const next = () => {}
+
+      ServerUtils.addErrorHandler(req, res, next)
+
+      let statusCode
+      let jsonData
+      res.status = (code) => { statusCode = code; return res }
+      res.json = (data) => { jsonData = data }
+
+      res.sendError(new Error('something broke'))
+
+      assert.equal(statusCode, 500)
+      assert.equal(jsonData.code, 'SERVER_ERROR')
+    })
+
+    it('sendError should look up known error codes on non-AdaptError', () => {
+      App.instance.errors = App.instance.errors || {}
+      App.instance.errors.CUSTOM_CODE = {
+        statusCode: 422,
+        code: 'CUSTOM_CODE',
+        message: 'Custom error'
+      }
+
+      const req = { translate: (error) => error.message }
+      const res = {}
+      const next = () => {}
+
+      ServerUtils.addErrorHandler(req, res, next)
+
+      let statusCode
+      let jsonData
+      res.status = (code) => { statusCode = code; return res }
+      res.json = (data) => { jsonData = data }
+
+      const error = new Error('details')
+      error.code = 'CUSTOM_CODE'
+      res.sendError(error)
+
+      assert.equal(statusCode, 422)
+      assert.equal(jsonData.code, 'CUSTOM_CODE')
+    })
+
+    it('sendError should include data field in response', () => {
+      const req = { translate: (error) => error.message }
+      const res = {}
+      const next = () => {}
+
+      ServerUtils.addErrorHandler(req, res, next)
+
+      let jsonData
+      res.status = () => res
+      res.json = (data) => { jsonData = data }
+
+      const adaptError = {
+        constructor: { name: 'AdaptError' },
+        statusCode: 400,
+        code: 'BAD_REQUEST',
+        message: 'Bad request',
+        data: { field: 'email' }
+      }
+      res.sendError(adaptError)
+
+      assert.deepEqual(jsonData.data, { field: 'email' })
+    })
+
+    it('sendError should use error.message when req.translate is not available', () => {
+      const req = {}
+      const res = {}
+      const next = () => {}
+
+      ServerUtils.addErrorHandler(req, res, next)
+
+      let jsonData
+      res.status = () => res
+      res.json = (data) => { jsonData = data }
+
+      const adaptError = {
+        constructor: { name: 'AdaptError' },
+        statusCode: 500,
+        code: 'ERR',
+        message: 'fallback message'
+      }
+      res.sendError(adaptError)
+
+      assert.equal(jsonData.message, 'fallback message')
+    })
+  })
+
+  describe('#mapHandler()', () => {
+    it('should return a function', () => {
+      const mockRouter = { map: { test: 'data' } }
+      const handler = ServerUtils.mapHandler(mockRouter)
+
+      assert.equal(typeof handler, 'function')
+    })
+
+    it('should respond with router map', () => {
+      const mockRouter = { map: { test: 'data' } }
+      const handler = ServerUtils.mapHandler(mockRouter)
+      const req = {}
+      let responseData = null
+      const res = {
+        json: (data) => { responseData = data }
+      }
+
+      handler(req, res)
+
+      assert.deepEqual(responseData, { test: 'data' })
+    })
+  })
+
+  describe('#getAllRoutes()', () => {
+    it('should collect routes from router hierarchy', () => {
+      const mockRouter = {
+        path: '/api',
+        routes: [
+          { route: '/users', handlers: { get: () => {}, post: () => {} } },
+          { route: '/posts', handlers: { get: () => {} } }
+        ],
+        flattenRouters: () => [mockRouter]
+      }
+
+      const routeMap = ServerUtils.getAllRoutes(mockRouter)
+
+      assert.ok(routeMap instanceof Map)
+      assert.equal(routeMap.size, 2)
+      assert.ok(routeMap.has('/api/users'))
+      assert.ok(routeMap.has('/api/posts'))
+      assert.ok(routeMap.get('/api/users').has('GET'))
+      assert.ok(routeMap.get('/api/users').has('POST'))
+      assert.ok(routeMap.get('/api/posts').has('GET'))
+    })
+
+    it('should collect routes from multiple routers in hierarchy', () => {
+      const childRouter = {
+        path: '/api/v1',
+        routes: [
+          { route: '/items', handlers: { get: () => {} } }
+        ]
+      }
+      const parentRouter = {
+        path: '/api',
+        routes: [
+          { route: '/health', handlers: { get: () => {} } }
+        ],
+        flattenRouters: () => [parentRouter, childRouter]
+      }
+
+      const routeMap = ServerUtils.getAllRoutes(parentRouter)
+
+      assert.equal(routeMap.size, 2)
+      assert.ok(routeMap.has('/api/health'))
+      assert.ok(routeMap.has('/api/v1/items'))
+    })
+
+    it('should handle root path "/" by omitting it from the prefix', () => {
+      const mockRouter = {
+        path: '/',
+        routes: [
+          { route: '/status', handlers: { get: () => {} } }
+        ],
+        flattenRouters: () => [mockRouter]
+      }
+
+      const routeMap = ServerUtils.getAllRoutes(mockRouter)
+
+      assert.ok(routeMap.has('/status'))
+    })
+
+    it('should return empty map for router with no routes', () => {
+      const mockRouter = {
+        path: '/api',
+        routes: [],
+        flattenRouters: () => [mockRouter]
+      }
+
+      const routeMap = ServerUtils.getAllRoutes(mockRouter)
+
+      assert.equal(routeMap.size, 0)
+    })
+  })
+
+  describe('#methodNotAllowedHandler()', () => {
+    it('should return a middleware function', () => {
+      const mockRouter = {
+        path: '/api',
+        routes: [],
+        flattenRouters: () => [mockRouter]
+      }
+      const handler = ServerUtils.methodNotAllowedHandler(mockRouter)
+
+      assert.equal(typeof handler, 'function')
+    })
+
+    it('should call next() when route is not found', () => {
+      const mockRouter = {
+        path: '/api',
+        routes: [
+          { route: '/users', handlers: { get: () => {} } }
+        ],
+        flattenRouters: () => [mockRouter]
+      }
+      const handler = ServerUtils.methodNotAllowedHandler(mockRouter)
+      let nextCalled = false
+
+      handler({ method: 'GET', path: '/unknown', originalUrl: '/api/unknown' }, {}, () => { nextCalled = true })
+
+      assert.equal(nextCalled, true)
+    })
+
+    it('should call next() when method matches', () => {
+      const mockRouter = {
+        path: '/api',
+        routes: [
+          { route: '/users', handlers: { get: () => {} } }
+        ],
+        flattenRouters: () => [mockRouter]
+      }
+      const handler = ServerUtils.methodNotAllowedHandler(mockRouter)
+      let nextCalled = false
+      let nextError = null
+
+      handler(
+        { method: 'GET', path: '/api/users', originalUrl: '/api/users' },
+        {},
+        (err) => { nextCalled = true; nextError = err }
+      )
+
+      assert.equal(nextCalled, true)
+      assert.equal(nextError, undefined)
+    })
+
+    it('should call next with METHOD_NOT_ALLOWED when path exists but method does not match', () => {
+      const mockError = { code: 'METHOD_NOT_ALLOWED' }
+      App.instance.errors = App.instance.errors || {}
+      App.instance.errors.METHOD_NOT_ALLOWED = { setData: () => mockError }
+
+      const mockRouter = {
+        path: '/api',
+        routes: [
+          { route: '/users', handlers: { get: () => {}, post: () => {} } }
+        ],
+        flattenRouters: () => [mockRouter]
+      }
+      const handler = ServerUtils.methodNotAllowedHandler(mockRouter)
+      let nextError = null
+
+      handler(
+        { method: 'DELETE', path: '/api/users', originalUrl: '/api/users' },
+        {},
+        (err) => { nextError = err }
+      )
+
+      assert.equal(nextError.code, 'METHOD_NOT_ALLOWED')
+    })
+  })
+
+  describe('#generateRouterMap()', () => {
+    it('should generate a router map', () => {
+      const mockRouter = {
+        root: 'api',
+        path: '/api',
+        url: 'http://localhost:5000/api',
+        routes: [
+          { route: '/test', handlers: { get: () => {} } }
+        ],
+        childRouters: [],
+        flattenRouters: function () {
+          return [this]
+        }
+      }
+
+      const map = ServerUtils.generateRouterMap(mockRouter)
+
+      assert.equal(typeof map, 'object')
+    })
+
+    it('should return empty object for router with no routes', () => {
+      const mockRouter = {
+        root: 'api',
+        path: '/api',
+        url: 'http://localhost:5000/api',
+        routes: [],
+        childRouters: [],
+        flattenRouters: function () {
+          return [this]
+        }
+      }
+
+      const map = ServerUtils.generateRouterMap(mockRouter)
+
+      assert.deepEqual(map, {})
+    })
+
+    it('should include endpoint URLs and accepted methods', () => {
+      const mockRouter = {
+        root: 'api',
+        route: '/api',
+        path: '/api',
+        url: 'http://localhost:5000/api',
+        routes: [
+          { route: '/users', handlers: { get: () => {}, post: () => {} }, meta: { get: { description: 'list users' } } }
+        ],
+        childRouters: [],
+        parentRouter: null,
+        flattenRouters: function () {
+          return [this]
+        }
+      }
+
+      const map = ServerUtils.generateRouterMap(mockRouter)
+      const keys = Object.keys(map)
+
+      assert.ok(keys.length > 0)
+      const endpoints = map[keys[0]]
+      assert.ok(Array.isArray(endpoints))
+      assert.equal(endpoints[0].url, 'http://localhost:5000/api/users')
+      assert.ok('get' in endpoints[0].accepted_methods)
+      assert.ok('post' in endpoints[0].accepted_methods)
+      assert.deepEqual(endpoints[0].accepted_methods.get, { description: 'list users' })
+      assert.deepEqual(endpoints[0].accepted_methods.post, {})
+    })
+
+    it('should use relative route keys for child routers', () => {
+      const childRouter = {
+        root: 'users',
+        path: '/api/users',
+        url: 'http://localhost:5000/api/users',
+        routes: [
+          { route: '/:id', handlers: { get: () => {} } }
+        ],
+        childRouters: [],
+        parentRouter: null
+      }
+      const mockRouter = {
+        root: 'api',
+        route: '/api',
+        path: '/api',
+        url: 'http://localhost:5000/api',
+        routes: [],
+        childRouters: [childRouter],
+        flattenRouters: function () {
+          return [this, childRouter]
+        }
+      }
+      childRouter.parentRouter = mockRouter
+
+      const map = ServerUtils.generateRouterMap(mockRouter)
+      const keys = Object.keys(map)
+
+      assert.ok(keys.some(k => k.includes('users')))
+    })
+  })
+
+  describe('#rootNotFoundHandler()', () => {
+    it('should respond with NOT_FOUND status code', () => {
+      App.instance.errors = App.instance.errors || {}
+      App.instance.errors.NOT_FOUND = { statusCode: 404 }
+
+      let statusCode
+      let endCalled = false
+      const res = {
+        status: (code) => { statusCode = code; return res },
+        end: () => { endCalled = true }
+      }
+
+      ServerUtils.rootNotFoundHandler({}, res)
+
+      assert.equal(statusCode, 404)
+      assert.equal(endCalled, true)
+    })
+  })
+
+  describe('#apiNotFoundHandler()', () => {
+    it('should call next with ENDPOINT_NOT_FOUND error', () => {
+      const mockError = { code: 'ENDPOINT_NOT_FOUND' }
+      App.instance.errors = App.instance.errors || {}
+      App.instance.errors.ENDPOINT_NOT_FOUND = { setData: () => mockError }
+
+      let nextArg
+      ServerUtils.apiNotFoundHandler(
+        { originalUrl: '/api/missing', method: 'GET' },
+        {},
+        (err) => { nextArg = err }
+      )
+
+      assert.equal(nextArg.code, 'ENDPOINT_NOT_FOUND')
+    })
+  })
+})

package/tests/data/AbstractModuleMock.js

@@ -0,0 +1,27 @@
+/**
+ * Mock AbstractModule for testing
+ */
+class AbstractModuleMock {
+  constructor () {
+    this.app = {
+      onReady: () => new Promise(() => {}),
+      errors: {}
+    }
+  }
+
+  async init () {}
+
+  getConfig (key) {
+    const config = {
+      host: 'localhost',
+      port: 5000,
+      trustProxy: true,
+      url: null
+    }
+    return config[key]
+  }
+
+  log () {}
+}
+
+export default AbstractModuleMock

package/tests/data/AppMock.js

@@ -0,0 +1,17 @@
+/**
+ * Mock App for testing
+ */
+export const App = {
+  instance: {
+    logger: {
+      log: () => {}
+    },
+    dependencyloader: {
+      instances: {
+        'adapt-authoring-server': {
+          url: 'http://localhost:5000'
+        }
+      }
+    }
+  }
+}