alepha 0.14.1 → 0.14.3

package/src/server/helmet/providers/ServerHelmetProvider.spec.ts

@@ -0,0 +1,105 @@
+import { Alepha } from "alepha";
+import { $action, ServerProvider } from "alepha/server";
+import { describe, expect, test } from "vitest";
+import {
+  AlephaServerHelmet,
+  type HelmetOptions,
+  helmetOptions,
+} from "../index.ts";
+
+class TestApp {
+  ping = $action({ handler: () => "pong" });
+}
+
+describe("ServerHelmetProvider", () => {
+  const setupServer = async (options?: HelmetOptions) => {
+    const alepha = Alepha.create({
+      env: { LOG_LEVEL: "error", SERVER_PORT: 0 },
+    })
+      .with(AlephaServerHelmet)
+      .with(TestApp);
+
+    if (options) {
+      alepha.store.mut(helmetOptions, (old) => ({
+        ...old,
+        ...options,
+      }));
+    }
+
+    await alepha.start();
+    const server = alepha.inject(ServerProvider);
+
+    return {
+      hostname: server.hostname,
+      stop: () => alepha.stop(),
+    };
+  };
+
+  test("should add default security headers to the response", async () => {
+    const { hostname, stop } = await setupServer({
+      isSecure: true, // fake secure context
+    });
+
+    const response = await fetch(`${hostname}/api/ping`);
+
+    expect(response.status).toBe(200);
+    expect(response.headers.get("x-content-type-options")).toBe("nosniff");
+    expect(response.headers.get("x-frame-options")).toBe("SAMEORIGIN");
+    expect(response.headers.get("referrer-policy")).toBe(
+      "strict-origin-when-cross-origin",
+    );
+    expect(response.headers.get("strict-transport-security")).toContain(
+      "max-age=15552000",
+    );
+
+    await stop();
+  });
+
+  test("should allow disabling a header by setting its option to undefined", async () => {
+    const { hostname, stop } = await setupServer({
+      xFrameOptions: undefined,
+    });
+
+    const response = await fetch(`${hostname}/api/ping`);
+
+    expect(response.headers.get("x-frame-options")).toBeNull();
+    expect(response.headers.get("x-content-type-options")).toBe("nosniff");
+
+    await stop();
+  });
+
+  test("should allow configuring HSTS", async () => {
+    const { hostname, stop } = await setupServer({
+      isSecure: true, // fake secure context
+      strictTransportSecurity: { maxAge: 31536000, preload: true },
+    });
+
+    const response = await fetch(`${hostname}/api/ping`);
+
+    const hstsHeader = response.headers.get("strict-transport-security");
+    expect(hstsHeader).toContain("max-age=31536000");
+    expect(hstsHeader).toContain("preload");
+
+    await stop();
+  });
+
+  test("should apply a Content Security Policy when configured", async () => {
+    const { hostname, stop } = await setupServer({
+      contentSecurityPolicy: {
+        directives: {
+          defaultSrc: ["'self'"],
+          scriptSrc: ["'self'", "https://trusted.cdn.com"],
+        },
+      },
+    });
+
+    const response = await fetch(`${hostname}/api/ping`);
+
+    const cspHeader = response.headers.get("content-security-policy");
+    expect(cspHeader).toBe(
+      "default-src 'self'; script-src 'self' https://trusted.cdn.com",
+    );
+
+    await stop();
+  });
+});

package/src/server/links/__tests__/$action.spec.ts

@@ -0,0 +1,238 @@
+import { Alepha } from "alepha";
+import { ServerProvider } from "alepha/server";
+import { afterEach, describe, expect, it } from "vitest";
+import {
+  $client,
+  $remote,
+  AlephaServerLinks,
+  type HttpVirtualClient,
+} from "../index.ts";
+import { CrudApp } from "./fixtures/CrudApp.ts";
+
+const ctx = Alepha.create({
+  env: {},
+}).with(AlephaServerLinks);
+
+const app = ctx.inject(CrudApp);
+const linkLocal = ctx.inject(
+  class Client {
+    client = $client<CrudApp>();
+  },
+).client;
+
+const linkRemote = Alepha.create()
+  .with(AlephaServerLinks)
+  .inject(
+    class Client {
+      client = $client<CrudApp>();
+      app = $remote({
+        url: () => ctx.inject(ServerProvider).hostname,
+      });
+    },
+  ).client;
+
+afterEach(() => {
+  app.clear();
+});
+
+describe("$action", () => {
+  const testActionBasicCrud = async (
+    app: CrudApp | HttpVirtualClient<CrudApp>,
+  ) => {
+    expect(await app.findAll.run({})).toEqual([]);
+    expect(await app.findAll.run({})).toEqual([]);
+
+    expect(await app.create.run({ body: { name: "John" } })).toEqual({
+      id: 1,
+      name: "John",
+    });
+
+    expect(await app.create.run({ body: { name: "Jean" } })).toEqual({
+      id: 2,
+      name: "Jean",
+    });
+
+    expect(await app.findAll.run({})).toEqual([
+      {
+        id: 1,
+        name: "John",
+      },
+      {
+        id: 2,
+        name: "Jean",
+      },
+    ]);
+
+    expect(
+      await app.findAll.run({
+        query: { name: "John" },
+      }),
+    ).toEqual([
+      {
+        id: 1,
+        name: "John",
+      },
+    ]);
+
+    expect(
+      await app.findAll.run({
+        query: { name: "J" },
+      }),
+    ).toEqual([
+      {
+        id: 1,
+        name: "John",
+      },
+      {
+        id: 2,
+        name: "Jean",
+      },
+    ]);
+
+    expect(await app.findAll.run({})).toEqual([
+      {
+        id: 1,
+        name: "John",
+      },
+      {
+        id: 2,
+        name: "Jean",
+      },
+    ]);
+
+    expect(await app.findById.run({ params: { id: 1 } })).toEqual({
+      id: 1,
+      name: "John",
+    });
+
+    expect(await app.findById.run({ params: { id: 2 } })).toEqual({
+      id: 2,
+      name: "Jean",
+    });
+
+    expect(
+      await app.update.run({ params: { id: 1 }, body: { name: "John Doe" } }),
+    ).toEqual({
+      id: 1,
+      name: "John Doe",
+    });
+
+    expect(await app.findById.run({ params: { id: 1 } })).toEqual({
+      id: 1,
+      name: "John Doe",
+    });
+
+    expect(
+      await app.update.run({ params: { id: 1 }, body: { name: "Rasmus" } }),
+    ).toEqual({
+      id: 1,
+      name: "Rasmus",
+    });
+
+    expect(await app.findById.run({ params: { id: 1 } })).toEqual({
+      id: 1,
+      name: "Rasmus",
+    });
+
+    expect(await app.delete.run({ params: { id: 1 } })).toEqual(undefined);
+
+    expect(await app.findAll.run({})).toEqual([
+      {
+        id: 2,
+        name: "Jean",
+      },
+    ]);
+  };
+
+  it("should handle basic crud operations (app)", async () => {
+    await testActionBasicCrud(app);
+  });
+
+  it("should handle basic crud operations (linkLocal)", async () => {
+    await testActionBasicCrud(linkLocal);
+  });
+
+  it("should handle basic crud operations (linkRemote)", async () => {
+    await testActionBasicCrud(linkRemote);
+  });
+
+  const testActionHeader = async (
+    app: CrudApp | HttpVirtualClient<CrudApp>,
+  ) => {
+    expect(await app.findAll.run({})).toEqual([]);
+    expect(await app.create.run({ body: { name: "Jean" } })).toEqual({
+      id: 1,
+      name: "Jean",
+    });
+
+    expect(
+      await app.findById.run({
+        params: { id: 1 },
+        headers: { uppercase: true },
+      }),
+    ).toEqual({
+      id: 1,
+      name: "JEAN",
+    });
+
+    expect(
+      await app.findById.run({
+        params: { id: 1 },
+        headers: { uppercase: true },
+      }),
+    ).toEqual({
+      id: 1,
+      name: "JEAN",
+    });
+
+    expect(
+      await app.findById.run({
+        params: { id: 1 },
+        headers: { uppercase: true },
+      }),
+    ).toEqual({
+      id: 1,
+      name: "JEAN",
+    });
+  };
+
+  it("should handle headers transformation (app)", async () => {
+    await testActionHeader(app);
+  });
+
+  it("should handle headers transformation (linkLocal)", async () => {
+    await testActionHeader(linkLocal);
+  });
+
+  it("should handle headers transformation (linkRemote)", async () => {
+    await testActionHeader(linkRemote);
+  });
+
+  const testActionErrors = async (
+    app: CrudApp | HttpVirtualClient<CrudApp>,
+  ) => {
+    await expect(app.findById.run({ params: { id: 2 } })).rejects.toThrowError(
+      "User not found",
+    );
+
+    // as local function, we go the real error
+    // as remove function, we go the http error wrapper
+    await expect(app.internalError.run({})).rejects.toThrowError("Oops");
+  };
+
+  it("should handle errors properly (app)", async () => {
+    await testActionErrors(app);
+  });
+
+  it("should handle errors properly (linkLocal)", async () => {
+    await testActionErrors(linkLocal);
+  });
+
+  it("should handle errors properly (linkRemote)", async () => {
+    await testActionErrors(linkRemote);
+  });
+
+  // TODO - with security (on/off) + forward
+
+  // TODO - body parser (multipart)
+});

package/src/server/links/__tests__/fixtures/CrudApp.ts

@@ -0,0 +1,122 @@
+import { type Static, t } from "alepha";
+import { $action, NotFoundError } from "alepha/server";
+
+export const userSchema = t.object({
+  id: t.integer(),
+  name: t.text(),
+});
+
+export type User = Static<typeof userSchema>;
+
+export class CrudApp {
+  seq = 1;
+  users: User[] = [];
+
+  clear() {
+    this.seq = 1;
+    this.users = [];
+  }
+
+  findById = $action({
+    path: "/users/:id",
+    schema: {
+      headers: t.object({
+        uppercase: t.optional(t.boolean()),
+      }),
+      params: t.object({
+        id: t.integer(),
+      }),
+      response: userSchema,
+    },
+    handler: ({ params, headers }) => {
+      const user = this.users.find((u) => u.id === params.id);
+      if (!user) {
+        throw new NotFoundError("User not found");
+      }
+      if (headers.uppercase) {
+        user.name = user.name.toUpperCase();
+      }
+      return user;
+    },
+  });
+
+  findAll = $action({
+    path: "/users",
+    schema: {
+      query: t.object({
+        name: t.optional(t.text()),
+      }),
+      response: t.array(userSchema),
+    },
+    handler: ({ query }) => {
+      const name = query.name;
+      if (name) {
+        return this.users.filter((u) => u.name.includes(name));
+      }
+      return this.users;
+    },
+  });
+
+  delete = $action({
+    method: "DELETE",
+    path: "/users/:id",
+    schema: {
+      params: t.object({
+        id: t.integer(),
+      }),
+      response: t.void(),
+    },
+    handler: async ({ params }) => {
+      const user = await this.findById.run({ params });
+      this.users = this.users.filter((u) => u.id !== user.id);
+    },
+  });
+
+  update = $action({
+    method: "PUT",
+    path: "/users/:id",
+    schema: {
+      params: t.object({
+        id: t.integer(),
+      }),
+      body: t.object({
+        name: t.text(),
+      }),
+      response: userSchema,
+    },
+    handler: async ({ params, body }) => {
+      const user = await this.findById.run({ params });
+      user.name = body.name;
+      this.users = this.users.map((u) => (u.id === user.id ? user : u));
+      return user;
+    },
+  });
+
+  create = $action({
+    path: "/users",
+    schema: {
+      body: t.object({
+        name: t.text(),
+      }),
+      response: userSchema,
+    },
+    handler: ({ body }) => {
+      const id = this.seq++;
+      const user = {
+        id,
+        name: body.name,
+      };
+      this.users.push(user);
+      return user;
+    },
+  });
+
+  internalError = $action({
+    schema: {
+      response: t.void(),
+    },
+    handler: () => {
+      throw new Error("Oops");
+    },
+  });
+}

package/src/server/links/__tests__/requestId.spec.ts

@@ -0,0 +1,120 @@
+import { Alepha } from "alepha";
+import {
+  LogDestinationProvider,
+  type LogEntry,
+  MemoryDestinationProvider,
+} from "alepha/logger";
+import { $action, ServerProvider } from "alepha/server";
+import { describe, expect, it } from "vitest";
+import { $client, $remote, AlephaServerLinks } from "../index.ts";
+
+describe("requestId", () => {
+  it("should propagate requestId across multiple remote service calls", async () => {
+    class Puppeteer {
+      print = $action({
+        handler: () => {
+          return "Puppeteer is not available in this environment.";
+        },
+      });
+    }
+
+    const entries = [] as Array<LogEntry & { formatted: string }>;
+
+    class SharedMemoryDestinationProvider extends MemoryDestinationProvider {
+      entries = entries;
+
+      clear() {
+        this.entries.splice(0, this.entries.length);
+      }
+    }
+
+    const p1 = Alepha.create({
+      env: {
+        APP_NAME: "PPT",
+        LOG_LEVEL: "info",
+      },
+    })
+      .with({
+        provide: LogDestinationProvider,
+        use: SharedMemoryDestinationProvider,
+      })
+      .with(Puppeteer)
+      .with(AlephaServerLinks);
+
+    const output = p1.inject(SharedMemoryDestinationProvider);
+
+    class Reporting {
+      puppeteer = $remote({
+        url: () => p1.inject(ServerProvider).hostname,
+      });
+
+      puppeteerApi = $client<Puppeteer>();
+
+      exportPdf = $action({
+        handler: () => {
+          return this.puppeteerApi.print();
+        },
+      });
+    }
+
+    const p2 = Alepha.create({
+      env: {
+        APP_NAME: "RPM",
+        LOG_LEVEL: "info",
+      },
+    })
+      .with({
+        provide: LogDestinationProvider,
+        use: SharedMemoryDestinationProvider,
+      })
+      .with(Reporting);
+
+    class Frontend {
+      reporting = $remote({
+        url: () => p2.inject(ServerProvider).hostname,
+      });
+
+      reportingApi = $client<Reporting>();
+
+      download = $action({
+        handler: () => {
+          return this.reportingApi.exportPdf();
+        },
+      });
+    }
+
+    const p3 = Alepha.create({
+      env: {
+        APP_NAME: "ADM",
+        LOG_LEVEL: "info",
+      },
+    })
+      .with({
+        provide: LogDestinationProvider,
+        use: SharedMemoryDestinationProvider,
+      })
+      .with(Frontend);
+
+    await p1.start();
+    await p2.start();
+    await p3.start();
+
+    output.clear();
+
+    await fetch(`${p3.inject(ServerProvider).hostname}/api/download`);
+
+    const uuid = output.logs[0].context;
+    const logs = output.logs.map(
+      (it) => `${it.app} - ${it.message} - ${it.context}`,
+    );
+
+    expect(logs).toEqual([
+      `ADM - Incoming request - ${uuid}`,
+      `RPM - Incoming request - ${uuid}`,
+      `PPT - Incoming request - ${uuid}`,
+      `PPT - Request completed - ${uuid}`,
+      `RPM - Request completed - ${uuid}`,
+      `ADM - Request completed - ${uuid}`,
+    ]);
+  });
+});