alepha 0.14.2 → 0.14.3

package/src/server/core/services/UserAgentParser.spec.ts

@@ -0,0 +1,111 @@
+import { Alepha } from "alepha";
+import { describe, it } from "vitest";
+import { UserAgentParser } from "../index.ts";
+
+describe("UserAgentParser", () => {
+  const alepha = Alepha.create();
+  const parser = alepha.inject(UserAgentParser);
+
+  it("should parse Windows user agent", ({ expect }) => {
+    const ua =
+      "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3";
+    const result = parser.parse(ua);
+    expect(result.os).toBe("Windows");
+    expect(result.browser).toBe("Chrome");
+    expect(result.device).toBe("DESKTOP");
+
+    const ua2 =
+      "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36";
+    const result2 = parser.parse(ua2);
+    expect(result2.os).toBe("Windows");
+    expect(result2.browser).toBe("Chrome");
+    expect(result2.device).toBe("DESKTOP");
+
+    const firefoxUa =
+      "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0";
+    const firefoxResult = parser.parse(firefoxUa);
+    expect(firefoxResult.os).toBe("Windows");
+    expect(firefoxResult.browser).toBe("Firefox");
+    expect(firefoxResult.device).toBe("DESKTOP");
+  });
+
+  it("should parse Android user agent", ({ expect }) => {
+    const ua =
+      "Mozilla/5.0 (Linux; Android 10; Pixel 3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 MOBILE Safari/537.36";
+    const result = parser.parse(ua);
+    expect(result.os).toBe("Android");
+    expect(result.browser).toBe("Chrome");
+    expect(result.device).toBe("MOBILE");
+  });
+
+  it("should parse iOS user agent", ({ expect }) => {
+    const ua =
+      "Mozilla/5.0 (iPhone; CPU iPhone OS 14_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0 MOBILE/15E148 Safari/604.1";
+    const result = parser.parse(ua);
+    expect(result.os).toBe("iOS");
+    expect(result.browser).toBe("Safari");
+    expect(result.device).toBe("MOBILE");
+  });
+
+  it("should parse MacOS user agent", ({ expect }) => {
+    const ua =
+      "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0 Safari/605.1.15";
+    const result = parser.parse(ua);
+    expect(result.os).toBe("MacOS");
+    expect(result.browser).toBe("Safari");
+    expect(result.device).toBe("DESKTOP");
+  });
+
+  it("should parse Linux user agent", ({ expect }) => {
+    const ua =
+      "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36";
+    const result = parser.parse(ua);
+    expect(result.os).toBe("Linux");
+    expect(result.browser).toBe("Chrome");
+    expect(result.device).toBe("DESKTOP");
+  });
+
+  it("should parse FreeBSD user agent", ({ expect }) => {
+    const ua =
+      "Mozilla/5.0 (X11; FreeBSD amd64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36";
+    const result = parser.parse(ua);
+    expect(result.os).toBe("FreeBSD");
+    expect(result.browser).toBe("Chrome");
+    expect(result.device).toBe("DESKTOP");
+  });
+
+  it("should parse OpenBSD user agent", ({ expect }) => {
+    const ua =
+      "Mozilla/5.0 (X11; OpenBSD amd64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36";
+    const result = parser.parse(ua);
+    expect(result.os).toBe("OpenBSD");
+    expect(result.browser).toBe("Chrome");
+    expect(result.device).toBe("DESKTOP");
+  });
+
+  it("should parse ChromeOS user agent", ({ expect }) => {
+    const ua =
+      "Mozilla/5.0 (X11; CrOS x86_64 12345.67.89) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36";
+    const result = parser.parse(ua);
+    expect(result.os).toBe("ChromeOS");
+    expect(result.browser).toBe("Chrome");
+    expect(result.device).toBe("DESKTOP");
+  });
+
+  it("should parse BlackBerry user agent", ({ expect }) => {
+    const ua =
+      "Mozilla/5.0 (BB10; Touch) AppleWebKit/537.36 (KHTML, like Gecko) Version/10.3.2.2876 MOBILE Safari/537.36";
+    const result = parser.parse(ua);
+    expect(result.os).toBe("BlackBerry");
+    expect(result.browser).toBe("Safari");
+    expect(result.device).toBe("MOBILE");
+  });
+
+  it("should parse empty string", ({ expect }) => {
+    const ua = "";
+    const result = parser.parse(ua);
+    expect(result.os).toBe("Windows");
+    expect(result.browser).toBe("Chrome");
+    expect(result.device).toBe("DESKTOP");
+  });
+});

package/src/server/cors/providers/ServerCorsProvider.spec.ts

@@ -0,0 +1,481 @@
+import { Alepha } from "alepha";
+import { $action, AlephaServer, ServerProvider } from "alepha/server";
+import { afterEach, describe, expect, test } from "vitest";
+import {
+  $cors,
+  AlephaServerCors,
+  corsOptions,
+  ServerCorsProvider,
+  type ServerCorsProviderOptions,
+} from "../index.ts";
+
+// A simple test action to hit
+class TestApp {
+  hello = $action({
+    method: "POST",
+    handler: () => "world",
+  });
+}
+
+describe("ServerCorsProvider", () => {
+  let alepha: Alepha;
+  let server: ServerProvider;
+
+  const setupServer = async (options?: Partial<ServerCorsProviderOptions>) => {
+    alepha = Alepha.create()
+      .with(AlephaServer)
+      .with(AlephaServerCors)
+      .with(TestApp);
+
+    if (options) {
+      alepha.store.mut(corsOptions, (old) => ({
+        ...old,
+        ...options,
+      }));
+    }
+
+    server = alepha.inject(ServerProvider);
+
+    await alepha.start();
+  };
+
+  afterEach(async () => {
+    if (alepha) {
+      await alepha.stop();
+    }
+  });
+
+  test("should return correct CORS headers for a simple request from an allowed origin", async () => {
+    await setupServer({
+      origin: "https://allowed.example.com",
+    });
+
+    const response = await fetch(`${server.hostname}/api/hello`, {
+      method: "POST",
+      headers: {
+        Origin: "https://allowed.example.com",
+      },
+    });
+
+    expect(response.status).toBe(200);
+    expect(response.headers.get("access-control-allow-origin")).toBe(
+      "https://allowed.example.com",
+    );
+    expect(response.headers.get("access-control-allow-credentials")).toBe(
+      "true",
+    );
+  });
+
+  test("should handle wildcard origin correctly", async () => {
+    await setupServer({
+      origin: "*",
+    });
+
+    const response = await fetch(`${server.hostname}/api/hello`, {
+      method: "POST",
+      headers: {
+        origin: "https://any.origin.com",
+      },
+    });
+
+    expect(response.status).toBe(200);
+    // Note: Wildcard returns the specific origin, not '*' when credentials are not sent by browser
+    expect(response.headers.get("access-control-allow-origin")).toBe(
+      "https://any.origin.com",
+    );
+  });
+
+  test("should handle preflight OPTIONS request correctly", async () => {
+    await setupServer({
+      origin: "https://preflight.example.com",
+      methods: ["GET", "POST", "OPTIONS"],
+      headers: ["Content-Type", "X-Custom-Header"],
+      maxAge: 86400,
+    });
+
+    const response = await fetch(`${server.hostname}/api/hello`, {
+      method: "OPTIONS",
+      headers: {
+        Origin: "https://preflight.example.com",
+        "Access-Control-Request-Method": "POST",
+        "Access-Control-Request-Headers": "X-Custom-Header",
+      },
+    });
+
+    expect(response.status).toBe(204); // Preflight should return 204 No Content
+    expect(response.headers.get("access-control-allow-origin")).toBe(
+      "https://preflight.example.com",
+    );
+    expect(response.headers.get("access-control-allow-methods")).toBe(
+      "GET, POST, OPTIONS",
+    );
+    expect(response.headers.get("access-control-allow-headers")).toBe(
+      "Content-Type, X-Custom-Header",
+    );
+    expect(response.headers.get("access-control-max-age")).toBe("86400");
+  });
+
+  test("should NOT return CORS headers for a request from a disallowed origin", async () => {
+    await setupServer({
+      origin: "https://allowed.example.com",
+    });
+
+    const response = await fetch(`${server.hostname}/api/hello`, {
+      headers: {
+        Origin: "https://disallowed.example.com",
+      },
+    });
+
+    // The header should not be set because the origin is not in the allow list.
+    // Some servers might omit it, others might return null. Checking for not-allowed is key.
+    expect(response.headers.get("access-control-allow-origin")).not.toBe(
+      "https://disallowed.example.com",
+    );
+  });
+
+  test("should handle an array of allowed origins", async () => {
+    const allowedOrigins = [
+      "https://app1.example.com",
+      "https://app2.example.com",
+    ];
+    await setupServer({
+      origin: allowedOrigins.join(","),
+    });
+
+    // First allowed origin
+    const res1 = await fetch(`${server.hostname}/api/hello`, {
+      method: "POST",
+      headers: { Origin: allowedOrigins[0] },
+    });
+    expect(res1.headers.get("access-control-allow-origin")).toBe(
+      allowedOrigins[0],
+    );
+
+    // Second allowed origin
+    const res2 = await fetch(`${server.hostname}/api/hello`, {
+      method: "POST",
+      headers: { Origin: allowedOrigins[1] },
+    });
+    expect(res2.headers.get("access-control-allow-origin")).toBe(
+      allowedOrigins[1],
+    );
+
+    // Disallowed origin
+    const res3 = await fetch(`${server.hostname}/api/hello`, {
+      method: "POST",
+      headers: { Origin: "https://disallowed.com" },
+    });
+    expect(res3.headers.get("access-control-allow-origin")).toBeNull();
+  });
+
+  test("should not return CORS headers if Origin header is not present", async () => {
+    await setupServer();
+
+    const response = await fetch(`${server.hostname}/api/hello`); // No Origin header
+
+    expect(response.headers.get("access-control-allow-origin")).toBeNull();
+  });
+});
+
+// ---------------------------------------------------------------------------------------------------------------------
+
+describe("$cors primitive", () => {
+  let alepha: Alepha;
+  let server: ServerProvider;
+
+  afterEach(async () => {
+    if (alepha) {
+      await alepha.stop();
+    }
+  });
+
+  test("should apply path-specific CORS config to matching routes", async () => {
+    class AppWithCors {
+      // Path-specific CORS for /api/v1/* routes
+      apiCors = $cors({
+        paths: ["/api/v1/*"],
+        origin: "https://api.example.com",
+        credentials: true,
+      });
+
+      // $action adds /api prefix, so path "/v1/data" becomes "/api/v1/data"
+      apiAction = $action({
+        path: "/v1/data",
+        method: "POST",
+        handler: () => "api",
+      });
+
+      // Path "/public/info" becomes "/api/public/info"
+      publicAction = $action({
+        path: "/public/info",
+        method: "POST",
+        handler: () => "public",
+      });
+    }
+
+    alepha = Alepha.create()
+      .with(AlephaServer)
+      .with(AlephaServerCors)
+      .with(AppWithCors);
+
+    // Set global CORS to different origin
+    alepha.store.mut(corsOptions, (old) => ({
+      ...old,
+      origin: "https://global.example.com",
+    }));
+
+    server = alepha.inject(ServerProvider);
+    await alepha.start();
+
+    // API route should use path-specific CORS (path is /api/v1/data)
+    const apiResponse = await fetch(`${server.hostname}/api/v1/data`, {
+      method: "POST",
+      headers: { Origin: "https://api.example.com" },
+    });
+    expect(apiResponse.headers.get("access-control-allow-origin")).toBe(
+      "https://api.example.com",
+    );
+
+    // Public route should use global CORS (api origin not allowed)
+    const publicResponse = await fetch(`${server.hostname}/api/public/info`, {
+      method: "POST",
+      headers: { Origin: "https://api.example.com" },
+    });
+    expect(
+      publicResponse.headers.get("access-control-allow-origin"),
+    ).toBeNull();
+
+    // Public route with global origin should work
+    const publicGlobalResponse = await fetch(
+      `${server.hostname}/api/public/info`,
+      {
+        method: "POST",
+        headers: { Origin: "https://global.example.com" },
+      },
+    );
+    expect(
+      publicGlobalResponse.headers.get("access-control-allow-origin"),
+    ).toBe("https://global.example.com");
+  });
+
+  test("should apply different CORS configs to different paths", async () => {
+    class MultiCorsApp {
+      // $action adds /api prefix, so patterns need /api/admin/* and /api/public/*
+      adminCors = $cors({
+        paths: ["/api/admin/*"],
+        origin: "https://admin.example.com",
+        methods: ["GET", "POST"],
+      });
+
+      publicCors = $cors({
+        paths: ["/api/public/*"],
+        origin: "*",
+        methods: ["GET"],
+      });
+
+      adminAction = $action({
+        path: "/admin/users",
+        method: "POST",
+        handler: () => "users",
+      });
+
+      publicAction = $action({
+        path: "/public/status",
+        method: "GET",
+        handler: () => "ok",
+      });
+    }
+
+    alepha = Alepha.create()
+      .with(AlephaServer)
+      .with(AlephaServerCors)
+      .with(MultiCorsApp);
+
+    server = alepha.inject(ServerProvider);
+    await alepha.start();
+
+    // Admin route with admin origin (actual path is /api/admin/users)
+    const adminResponse = await fetch(`${server.hostname}/api/admin/users`, {
+      method: "POST",
+      headers: { Origin: "https://admin.example.com" },
+    });
+    expect(adminResponse.headers.get("access-control-allow-origin")).toBe(
+      "https://admin.example.com",
+    );
+    expect(adminResponse.headers.get("access-control-allow-methods")).toBe(
+      "GET, POST",
+    );
+
+    // Public route with any origin (wildcard) (actual path is /api/public/status)
+    const publicResponse = await fetch(`${server.hostname}/api/public/status`, {
+      headers: { Origin: "https://any.example.com" },
+    });
+    expect(publicResponse.headers.get("access-control-allow-origin")).toBe(
+      "https://any.example.com",
+    );
+    expect(publicResponse.headers.get("access-control-allow-methods")).toBe(
+      "GET",
+    );
+  });
+
+  test("should register CORS configs with provider", async () => {
+    class RegistrationApp {
+      cors1 = $cors({
+        name: "api-cors",
+        paths: ["/api/*"],
+        origin: "https://api.example.com",
+      });
+
+      cors2 = $cors({
+        name: "admin-cors",
+        paths: ["/admin/*"],
+        origin: "https://admin.example.com",
+      });
+    }
+
+    alepha = Alepha.create()
+      .with(AlephaServer)
+      .with(AlephaServerCors)
+      .with(RegistrationApp);
+
+    const corsProvider = alepha.inject(ServerCorsProvider);
+    await alepha.start();
+
+    expect(corsProvider.registeredConfigs).toHaveLength(2);
+    expect(corsProvider.registeredConfigs[0].name).toBe("api-cors");
+    expect(corsProvider.registeredConfigs[1].name).toBe("admin-cors");
+  });
+
+  test("should merge path-specific config with global defaults", async () => {
+    class PartialConfigApp {
+      // Only override origin, use defaults for methods/headers
+      // $action creates route at /api/data, so use /api/* pattern
+      apiCors = $cors({
+        paths: ["/api/*"],
+        origin: "https://api.example.com",
+        // methods, headers, credentials should come from global defaults
+      });
+
+      // $action with path "/data" creates route at "/api/data"
+      apiAction = $action({
+        path: "/data",
+        method: "POST",
+        handler: () => "test",
+      });
+    }
+
+    alepha = Alepha.create()
+      .with(AlephaServer)
+      .with(AlephaServerCors)
+      .with(PartialConfigApp);
+
+    server = alepha.inject(ServerProvider);
+    await alepha.start();
+
+    const response = await fetch(`${server.hostname}/api/data`, {
+      method: "POST",
+      headers: { Origin: "https://api.example.com" },
+    });
+
+    // Path-specific origin
+    expect(response.headers.get("access-control-allow-origin")).toBe(
+      "https://api.example.com",
+    );
+    // Default methods
+    expect(response.headers.get("access-control-allow-methods")).toBe(
+      "GET, POST, PUT, PATCH, DELETE, OPTIONS",
+    );
+    // Default headers
+    expect(response.headers.get("access-control-allow-headers")).toBe(
+      "Content-Type, Authorization",
+    );
+    // Default credentials
+    expect(response.headers.get("access-control-allow-credentials")).toBe(
+      "true",
+    );
+  });
+
+  test("should apply maxAge to path-specific CORS", async () => {
+    class MaxAgeApp {
+      apiCors = $cors({
+        paths: ["/api/*"],
+        origin: "https://api.example.com",
+        maxAge: 3600,
+      });
+
+      // $action with path "/data" creates route at "/api/data"
+      apiAction = $action({
+        path: "/data",
+        method: "POST",
+        handler: () => "test",
+      });
+    }
+
+    alepha = Alepha.create()
+      .with(AlephaServer)
+      .with(AlephaServerCors)
+      .with(MaxAgeApp);
+
+    server = alepha.inject(ServerProvider);
+    await alepha.start();
+
+    const response = await fetch(`${server.hostname}/api/data`, {
+      method: "OPTIONS",
+      headers: {
+        Origin: "https://api.example.com",
+        "Access-Control-Request-Method": "POST",
+      },
+    });
+
+    expect(response.headers.get("access-control-max-age")).toBe("3600");
+  });
+
+  test("should handle multiple paths in single $cors primitive", async () => {
+    class MultiPathApp {
+      // $action creates routes at /api/v1/data and /api/v2/data
+      apiCors = $cors({
+        paths: ["/api/v1/*", "/api/v2/*"],
+        origin: "https://api.example.com",
+      });
+
+      // Route created at /api/v1/data
+      action1 = $action({
+        path: "/v1/data",
+        method: "POST",
+        handler: () => "v1",
+      });
+
+      // Route created at /api/v2/data
+      action2 = $action({
+        path: "/v2/data",
+        method: "POST",
+        handler: () => "v2",
+      });
+    }
+
+    alepha = Alepha.create()
+      .with(AlephaServer)
+      .with(AlephaServerCors)
+      .with(MultiPathApp);
+
+    server = alepha.inject(ServerProvider);
+    await alepha.start();
+
+    // Both paths should have the same CORS config
+    const v1Response = await fetch(`${server.hostname}/api/v1/data`, {
+      method: "POST",
+      headers: { Origin: "https://api.example.com" },
+    });
+    expect(v1Response.headers.get("access-control-allow-origin")).toBe(
+      "https://api.example.com",
+    );
+
+    const v2Response = await fetch(`${server.hostname}/api/v2/data`, {
+      method: "POST",
+      headers: { Origin: "https://api.example.com" },
+    });
+    expect(v2Response.headers.get("access-control-allow-origin")).toBe(
+      "https://api.example.com",
+    );
+  });
+});

package/src/server/health/providers/ServerHealthProvider.spec.ts

@@ -0,0 +1,22 @@
+import { Alepha } from "alepha";
+import { ServerProvider } from "alepha/server";
+import { describe, expect, it } from "vitest";
+import { AlephaServerHealth } from "../index.ts";
+
+const alepha = Alepha.create().with(AlephaServerHealth);
+
+describe("ServerHealthProvider", () => {
+  it("should expose health endpoint with server status", async () => {
+    const srv = alepha.inject(ServerProvider);
+    const hostname = srv.hostname;
+
+    const ping = await fetch(`${hostname}/health`);
+
+    expect(await ping.json()).toEqual({
+      message: "OK",
+      uptime: expect.any(Number),
+      date: expect.any(String),
+      ready: true,
+    });
+  });
+});