beavuck-time 3.1.0 → 3.1.1

package/build/__tests__/api.test.js

@@ -0,0 +1,74 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const supertest_1 = __importDefault(require("supertest"));
+const api_1 = require("../api");
+const http_status_codes_1 = require("http-status-codes");
+const isoTimestamp_1 = require("../types/isoTimestamp");
+function getSomeTrustedOrigin() {
+    return process.env.BEAVUCK_TIME_TRUSTED_ORIGINS?.split(',')[0] ?? '';
+}
+/**
+ * Increments the callsMadeSoFar counter and returns the response and trusted origin
+ */
+async function makeSuccessfulCallToNowEndpoint() {
+    const trustedOrigin = getSomeTrustedOrigin();
+    const res = await (0, supertest_1.default)(api_1.api).get('/now').set('Origin', trustedOrigin);
+    return { res, trustedOrigin };
+}
+describe('App Initialization', () => {
+    it('should disable x-powered-by header', async () => {
+        const res = await (0, supertest_1.default)(api_1.api).get('/now');
+        expect(res.header['x-powered-by']).toBeUndefined();
+    });
+    it('should allow requests from trusted origins', async () => {
+        const { res, trustedOrigin } = await makeSuccessfulCallToNowEndpoint();
+        expect(res.header['access-control-allow-origin']).toBe(trustedOrigin);
+        expect(res.status).toBe(http_status_codes_1.StatusCodes.OK);
+    });
+    it('should block requests from non-trusted origins', async () => {
+        const res = await (0, supertest_1.default)(api_1.api).get('/now').set('Origin', 'https://non-trusted.com');
+        expect(res.header['access-control-allow-origin']).toBeUndefined();
+        expect(res.status).toBe(http_status_codes_1.StatusCodes.FORBIDDEN);
+    });
+    it('should block requests with no origin header', async () => {
+        const res = await (0, supertest_1.default)(api_1.api).get('/now');
+        expect(res.header['access-control-allow-origin']).toBeUndefined();
+        expect(res.status).toBe(http_status_codes_1.StatusCodes.FORBIDDEN);
+    });
+    it('should allow requests with no origin header but a referrer header identical to server url', async () => {
+        const REFERRER = process.env.BEAVUCK_TIME_HOST_URL;
+        const res = await (0, supertest_1.default)(api_1.api).get('/now').set('Referrer', REFERRER);
+        expect(res.header['access-control-allow-origin']).toBeUndefined();
+        expect(res.status).toBe(http_status_codes_1.StatusCodes.OK);
+    });
+    it('should allow requests with no origin header but a referer (sic) header identical to server url', async () => {
+        const REFERER = process.env.BEAVUCK_TIME_HOST_URL;
+        const res = await (0, supertest_1.default)(api_1.api).get('/now').set('Referer', REFERER);
+        expect(res.header['access-control-allow-origin']).toBeUndefined();
+        expect(res.status).toBe(http_status_codes_1.StatusCodes.OK);
+    });
+    it('should handle errors using errorHandler middleware', async () => {
+        const res = await (0, supertest_1.default)(api_1.api).get('/nope').set('Origin', getSomeTrustedOrigin());
+        expect(res.status).toBe(http_status_codes_1.StatusCodes.NOT_FOUND);
+    });
+    it('should return the current time in ISO format', async () => {
+        const { res } = await makeSuccessfulCallToNowEndpoint();
+        expect(res.status).toBe(http_status_codes_1.StatusCodes.OK);
+        expect(res.body).toHaveProperty('now');
+        expect(res.body.now).toMatch(isoTimestamp_1.RFC_3339_FORMAT);
+    });
+    it('should return 500 if HOST_URL is not set', async () => {
+        const originalHostUrl = process.env.BEAVUCK_TIME_HOST_URL;
+        delete process.env.BEAVUCK_TIME_HOST_URL;
+        const res = await (0, supertest_1.default)(api_1.api).get('/now');
+        expect(res.status).toBe(http_status_codes_1.StatusCodes.INTERNAL_SERVER_ERROR);
+        process.env.BEAVUCK_TIME_HOST_URL = originalHostUrl;
+    });
+    it('should block requests with non-trusted referrer header if origin is not OK', async () => {
+        const res = await (0, supertest_1.default)(api_1.api).get('/now').set('Referrer', 'https://non-trusted.com');
+        expect(res.status).toBe(http_status_codes_1.StatusCodes.FORBIDDEN);
+    });
+});

package/build/__tests__/config/corsOptions.test.js

@@ -0,0 +1,34 @@
+"use strict";
+// src/__tests__/config/corsOptions.test.ts
+Object.defineProperty(exports, "__esModule", { value: true });
+const corsOptions_1 = require("../../config/corsOptions");
+function setTrustedOrigins(...origins) {
+    process.env.BEAVUCK_TIME_TRUSTED_ORIGINS = origins.join(',');
+    (0, corsOptions_1.initTrustedOrigins)();
+}
+describe('isOriginTrusted', () => {
+    it('returns true for an exact match', () => {
+        setTrustedOrigins('https://app.example.com');
+        expect((0, corsOptions_1.isOriginTrusted)('https://app.example.com')).toBe(true);
+    });
+    it('returns true for a wildcard pattern matching the origin host', () => {
+        setTrustedOrigins('https://app.example.com/*');
+        expect((0, corsOptions_1.isOriginTrusted)('https://app.example.com')).toBe(true);
+    });
+    it('does not allow a domain that merely shares a prefix with a trusted origin', () => {
+        setTrustedOrigins('https://app.example.com');
+        expect((0, corsOptions_1.isOriginTrusted)('https://app.example.com.evil.com')).toBe(false);
+    });
+    it('does not allow a domain that shares a prefix with a wildcard trusted origin', () => {
+        setTrustedOrigins('https://app.example.com/*');
+        expect((0, corsOptions_1.isOriginTrusted)('https://app.example.com.evil.com')).toBe(false);
+    });
+    it('returns false for an untrusted origin', () => {
+        setTrustedOrigins('https://app.example.com');
+        expect((0, corsOptions_1.isOriginTrusted)('https://other.com')).toBe(false);
+    });
+    it('returns false when the trusted origin pattern is malformed', () => {
+        setTrustedOrigins('not-a-url/*');
+        expect((0, corsOptions_1.isOriginTrusted)('not-a-url')).toBe(false);
+    });
+});

package/build/__tests__/middlewares/corsMiddleware.test.js

@@ -0,0 +1,63 @@
+"use strict";
+// src/__tests__/middlewares/corsMiddleware.test.ts
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const cors_1 = __importDefault(require("cors"));
+const corsMiddleware_1 = require("../../middlewares/corsMiddleware");
+const corsError_1 = require("../../errors/corsError");
+const beavuckTimeServerError_1 = require("../../errors/beavuckTimeServerError");
+const logger_1 = require("../../config/logger");
+jest.mock('cors');
+jest.mock('../../config/logger');
+const mockCors = cors_1.default;
+describe('corsMiddleware', () => {
+    let req;
+    let res;
+    let next;
+    beforeEach(() => {
+        req = { headers: {} };
+        res = {};
+        next = jest.fn();
+        mockCors.mockReturnValue((_req, _res, n) => n());
+        process.env.BEAVUCK_TIME_HOST_URL = 'http://localhost:3000';
+    });
+    afterEach(() => {
+        jest.clearAllMocks();
+    });
+    it('delegates to cors() when origin header is present', () => {
+        req.headers.origin = 'http://trusted.com';
+        (0, corsMiddleware_1.corsMiddleware)(req, res, next);
+        expect(mockCors).toHaveBeenCalled();
+        expect(next).toHaveBeenCalledWith();
+    });
+    it('logs the sanitized origin on CORS requests', () => {
+        req.headers.origin = 'http://evil.com\x01injected';
+        (0, corsMiddleware_1.corsMiddleware)(req, res, next);
+        expect(logger_1.logger.debug).toHaveBeenCalledWith('CORS request from http://evil.cominjected');
+    });
+    it('calls next with BeavuckTimeServerError when HOST_URL is not set', () => {
+        delete process.env.BEAVUCK_TIME_HOST_URL;
+        (0, corsMiddleware_1.corsMiddleware)(req, res, next);
+        expect(next).toHaveBeenCalledWith(expect.any(beavuckTimeServerError_1.BeavuckTimeServerError));
+    });
+    it('calls next without error when referrer matches the host', () => {
+        req.headers.referer = 'http://localhost:3000/page';
+        (0, corsMiddleware_1.corsMiddleware)(req, res, next);
+        expect(next).toHaveBeenCalledWith();
+    });
+    it('calls next with CorsError when neither origin nor referrer is trusted', () => {
+        req.headers.referer = 'http://untrusted.com';
+        (0, corsMiddleware_1.corsMiddleware)(req, res, next);
+        expect(next).toHaveBeenCalledWith(expect.any(corsError_1.CorsError));
+    });
+    it('sanitizes control characters from the CorsError message', () => {
+        req.headers.referer = 'http://evil.com\x0ainjected';
+        (0, corsMiddleware_1.corsMiddleware)(req, res, next);
+        const error = next.mock.calls[0][0];
+        // eslint-disable-next-line no-control-regex
+        expect(error.message).not.toMatch(/\x0a/);
+        expect(error.message).toContain('http://evil.cominjected');
+    });
+});

package/build/__tests__/middlewares/errorHandler.test.js

@@ -0,0 +1,80 @@
+"use strict";
+// src/__tests__/middlewares/errorHandler.test.ts
+Object.defineProperty(exports, "__esModule", { value: true });
+const errorHandler_1 = require("../../middlewares/errorHandler");
+const beavuckTimeClientError_1 = require("../../errors/beavuckTimeClientError");
+const beavuckTimeServerError_1 = require("../../errors/beavuckTimeServerError");
+const corsError_1 = require("../../errors/corsError");
+const http_status_codes_1 = require("http-status-codes");
+const logger_1 = require("../../config/logger");
+const tsoa_1 = require("tsoa");
+jest.mock('../../config/logger');
+describe('errorHandler', () => {
+    let req;
+    let res;
+    let next;
+    beforeEach(() => {
+        req = {};
+        res = {
+            status: jest.fn().mockReturnThis(),
+            json: jest.fn().mockReturnThis(),
+        };
+        next = jest.fn();
+    });
+    it('should handle BeavuckTimeClientError', () => {
+        const err = new beavuckTimeClientError_1.BeavuckTimeClientError('Some message');
+        (0, errorHandler_1.errorHandler)(err, req, res, next);
+        expect(logger_1.logger.warn).toHaveBeenCalledWith(err);
+        expect(res.status).toHaveBeenCalledWith(err.code);
+        expect(res.json).toHaveBeenCalledWith({ message: `${err.message}` });
+    });
+    it('should handle CorsError', () => {
+        const err = new corsError_1.CorsError('Some message');
+        (0, errorHandler_1.errorHandler)(err, req, res, next);
+        expect(logger_1.logger.warn).toHaveBeenCalledWith(err);
+        expect(res.status).toHaveBeenCalledWith(err.code);
+        expect(res.json).toHaveBeenCalledWith({ message: `${err.message}` });
+    });
+    it('should handle BeavuckTimeServerError', () => {
+        const err = new beavuckTimeServerError_1.BeavuckTimeServerError('Some message');
+        (0, errorHandler_1.errorHandler)(err, req, res, next);
+        expect(logger_1.logger.error).toHaveBeenCalledWith(err);
+        expect(res.status).toHaveBeenCalledWith(err.code);
+        expect(res.json).toHaveBeenCalledWith({ message: beavuckTimeServerError_1.BeavuckTimeServerError.baseMessage });
+    });
+    it('should handle non-specific error', () => {
+        const err = new Error('Some message');
+        (0, errorHandler_1.errorHandler)(err, req, res, next);
+        const beavuckError = beavuckTimeServerError_1.BeavuckTimeServerError.fromError(err);
+        expect(logger_1.logger.error).toHaveBeenCalledWith(beavuckError);
+        expect(res.status).toHaveBeenCalledWith(http_status_codes_1.StatusCodes.INTERNAL_SERVER_ERROR);
+        expect(res.json).toHaveBeenCalledWith({ message: beavuckTimeServerError_1.BeavuckTimeServerError.baseMessage });
+    });
+    it('should call next if no error', () => {
+        (0, errorHandler_1.errorHandler)(undefined, req, res, next);
+        expect(next).toHaveBeenCalled();
+    });
+    it('should handle ValidateError', () => {
+        const err = new tsoa_1.ValidateError({}, 'Some message');
+        (0, errorHandler_1.errorHandler)(err, req, res, next);
+        expect(logger_1.logger.error).toHaveBeenCalled();
+        expect(res.status).toHaveBeenCalledWith(http_status_codes_1.StatusCodes.UNPROCESSABLE_ENTITY);
+        expect(res.json).toHaveBeenCalledWith({
+            message: 'Validation Error',
+            details: err.fields,
+        });
+    });
+    it('should handle unknown error type', () => {
+        const err = { some: 'unknown error' };
+        (0, errorHandler_1.errorHandler)(err, req, res, next);
+        expect(logger_1.logger.error).toHaveBeenCalled();
+        expect(res.status).toHaveBeenCalledWith(http_status_codes_1.StatusCodes.INTERNAL_SERVER_ERROR);
+        expect(res.json).toHaveBeenCalledWith({
+            message: 'Internal Server Error',
+        });
+    });
+    it('should handle null error', () => {
+        (0, errorHandler_1.errorHandler)(undefined, req, res, next);
+        expect(next).toHaveBeenCalled();
+    });
+});

package/build/__tests__/utils/stringUtil.test.js

@@ -0,0 +1,15 @@
+"use strict";
+// src/__tests__/utils/stringUtil.test.ts
+Object.defineProperty(exports, "__esModule", { value: true });
+const stringUtil_1 = require("../../utils/stringUtil");
+describe('sanitizeForLog', () => {
+    it('strips C0 control characters', () => {
+        expect((0, stringUtil_1.sanitizeForLog)('foo\x00\x01\x1fbar')).toBe('foobar');
+    });
+    it('strips DEL and C1 control characters', () => {
+        expect((0, stringUtil_1.sanitizeForLog)('foo\x7f\x80\x9fbar')).toBe('foobar');
+    });
+    it('leaves printable characters untouched', () => {
+        expect((0, stringUtil_1.sanitizeForLog)('https://evil.com')).toBe('https://evil.com');
+    });
+});

package/build/__tests__/utils/urlUtil.test.js

@@ -0,0 +1,46 @@
+"use strict";
+// src/__tests__/utils/urlUtil.test.ts
+Object.defineProperty(exports, "__esModule", { value: true });
+const urlUtil_1 = require("../../utils/urlUtil");
+const node_url_1 = require("node:url");
+const A_VALID_URL_STRING = 'https://example.com:1234';
+const SAME_VALID_URL_DIFFERENT_PORT = 'https://example.com:81';
+const SOME_OTHER_VALID_URL_STRING = 'https://different.com:1234';
+const AN_INVALID_URL_STRING = 'invalid';
+describe('urlUtil', () => {
+    describe('isSameOrigin', () => {
+        it('returns false when either URL is undefined', () => {
+            const url = new node_url_1.URL(A_VALID_URL_STRING);
+            expect((0, urlUtil_1.isSameOrigin)(url)).toBe(false);
+            expect((0, urlUtil_1.isSameOrigin)(undefined, url)).toBe(false);
+        });
+        it('returns true when URLs have the same origin', () => {
+            const url1 = new node_url_1.URL(A_VALID_URL_STRING);
+            const url2 = new node_url_1.URL(A_VALID_URL_STRING);
+            expect((0, urlUtil_1.isSameOrigin)(url1, url2)).toBe(true);
+        });
+        it('returns false when URLs have the same origin but different ports', () => {
+            const url1 = new node_url_1.URL(A_VALID_URL_STRING);
+            const url2 = new node_url_1.URL(SAME_VALID_URL_DIFFERENT_PORT);
+            expect((0, urlUtil_1.isSameOrigin)(url1, url2)).toBe(false);
+        });
+        it('returns false when URLs have different origins', () => {
+            const url1 = new node_url_1.URL(A_VALID_URL_STRING);
+            const url2 = new node_url_1.URL(SOME_OTHER_VALID_URL_STRING);
+            expect((0, urlUtil_1.isSameOrigin)(url1, url2)).toBe(false);
+        });
+    });
+    describe('tryParseUrl', () => {
+        it('returns undefined when URL string is undefined', () => {
+            expect((0, urlUtil_1.tryParseUrl)()).toBeUndefined();
+        });
+        it('returns a URL object when URL string is valid', () => {
+            const url = (0, urlUtil_1.tryParseUrl)(A_VALID_URL_STRING);
+            expect(url).toBeInstanceOf(node_url_1.URL);
+            expect(url?.origin).toBe(A_VALID_URL_STRING);
+        });
+        it('returns undefined when URL string is invalid', () => {
+            expect((0, urlUtil_1.tryParseUrl)(AN_INVALID_URL_STRING)).toBeUndefined();
+        });
+    });
+});

package/openapi/swagger.json

@@ -32,7 +32,7 @@
 	},
 	"info": {
 		"title": "beavuck-time",
-		"version": "3.1.0",
+		"version": "3.1.1",
 		"description": "Get time in ISO format, in UTC timezone, from a simple, lightweight node server",
 		"license": {
 			"name": "Unlicense"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "beavuck-time",
-  "version": "3.1.0",
+  "version": "3.1.1",
   "description": "Get time in ISO format, in UTC timezone, from a simple, lightweight node server",
   "keywords": [
     "time",
@@ -37,24 +37,28 @@
     "up-patch": "npm version patch --no-git-tag-version",
     "up-minor": "npm version minor --no-git-tag-version",
     "up-major": "npm version major --no-git-tag-version",
-    "upgrade-dependencies": "ncu --format group && ncu -u && npm install --verbose && npm prune --verbose && npm audit fix --verbose",
-    "prepublishOnly": "npm install && npm run build",
-    "lint": "eslint --fix src/",
+    "upgrade-dependencies": "ncu --cooldown=7d --format group && ncu -u && npm run safe-install && npm prune --verbose && npm run audit",
+    "upgrade-dependencies:ci": "ncu --cooldown=7d --format group && ncu -u && npm run safe-install:ci && npm prune --verbose && npm run audit",
+    "audit": "npm audit fix --verbose",
+    "prepublishOnly": "npm run safe-install && npm run build",
+    "safe-install": "npm install --ignore-scripts --allow-git=none --min-release-age=7",
+    "safe-install:ci": "npm ci --ignore-scripts --allow-git=none --min-release-age=7",
+    "lint": "eslint --fix --cache --cache-location node_modules/.cache/.eslint_cache --report-unused-disable-directives --ignore-pattern .gitignore src/",
     "typecheck": "tsc --noEmit",
-    "format": "prettier --write src/ --log-level warn",
+    "format": "prettier --write --log-level warn --cache --cache-location node_modules/.cache/.prettier_cache src/",
     "clean": "npm run lint && npm run typecheck && npm run format",
     "test": "node --env-file=.env.test node_modules/.bin/jest --coverage",
     "build": "tsoa spec-and-routes && tsc",
     "start": "node build/server.js",
-    "go": "rm -rf build && npm install && npm run build && npm run clean && npm run test && npm run start"
+    "go": "rm -rf build && npm run safe-install && npm run build && npm run clean && npm run test && npm run start"
   },
   "dependencies": {
     "@tsoa/runtime": "^6.6.0",
     "cors": "^2.8.6",
     "express": "^5.2.1",
-    "express-rate-limit": "^8.3.1",
+    "express-rate-limit": "^8.3.2",
     "http-status-codes": "^2.3.0",
-    "joi": "^18.1.1",
+    "joi": "^18.1.2",
     "tsoa": "^6.6.0",
     "winston": "^3.19.0",
     "winston-daily-rotate-file": "^5.0.0"
@@ -64,19 +68,18 @@
     "@types/cors": "^2.8.19",
     "@types/express": "^5.0.6",
     "@types/jest": "^30.0.0",
-    "@types/node": "^25.5.0",
+    "@types/node": "^25.5.2",
     "@types/supertest": "^7.2.0",
-    "eslint": "^10.1.0",
+    "eslint": "^10.2.0",
     "globals": "^17.4.0",
     "jest": "^30.3.0",
     "jest-util": "^30.3.0",
-    "knip": "^6.1.0",
-    "npm-check-updates": "^19.6.6",
+    "npm-check-updates": "^20.0.0",
     "prettier": "3.8.1",
     "supertest": "^7.2.2",
-    "ts-jest": "^29.4.6",
-    "typescript": "^5.9.3",
-    "typescript-eslint": "^8.57.2"
+    "ts-jest": "^29.4.9",
+    "typescript": "^6.0.2",
+    "typescript-eslint": "^8.58.0"
   },
   "engines": {
     "node": ">=20.12.0"