koa-classic-server 3.0.1 → 3.1.0

package/__tests__/ejs.test.js

@@ -1,299 +0,0 @@
-const Koa = require('koa');
-const koaClassicServer = require('../index.cjs');
-const supertest = require('supertest');
-const path = require('path');
-const fs = require('fs');
-const ejs = require('ejs');
-
-describe('EJS Template Engine Integration Tests', () => {
-    let app;
-    let server;
-    let request;
-
-    beforeAll(() => {
-        app = new Koa();
-
-        const rootDir = path.join(__dirname, 'publicWwwTest');
-
-        // Configure koaClassicServer with EJS template support
-        app.use(
-            koaClassicServer(rootDir, {
-                method: ['GET'],
-                dirListing: { enabled: true },
-                template: {
-                    ext: ['ejs'],
-                    render: async (ctx, next, filePath) => {
-                        // Read the template file
-                        const templateContent = await fs.promises.readFile(filePath, 'utf-8');
-
-                        // Prepare data for different templates
-                        const data = getTemplateData(filePath);
-
-                        // Render with EJS
-                        const html = ejs.render(templateContent, data);
-
-                        ctx.type = 'text/html';
-                        ctx.body = html;
-                    }
-                }
-            })
-        );
-
-        server = app.listen();
-        request = supertest(server);
-    });
-
-    afterAll(() => {
-        if (server) {
-            server.close();
-        }
-    });
-
-    // Helper function to provide data for each template
-    function getTemplateData(filePath) {
-        const basename = path.basename(filePath, '.ejs');
-
-        const dataMap = {
-            'simple': {
-                title: 'Simple EJS Test',
-                heading: 'Hello from EJS',
-                message: 'This is a simple template test',
-                timestamp: '2025-11-18'
-            },
-            'with-loop': {
-                items: [
-                    { name: 'Item 1', value: 100 },
-                    { name: 'Item 2', value: 200 },
-                    { name: 'Item 3', value: 300 }
-                ]
-            },
-            'with-conditional': {
-                isLoggedIn: true,
-                username: 'TestUser',
-                role: 'admin',
-                notifications: 5
-            },
-            'with-escaping': {
-                userInput: '<script>alert("XSS")</script>',
-                htmlContent: '<strong>Bold text</strong>',
-                safeText: 'Plain & safe text',
-                allowedHtml: '<em>Emphasized text</em>'
-            },
-            'complex': {
-                pageTitle: 'E-Commerce Products',
-                user: {
-                    name: 'Mario Rossi'
-                },
-                products: [
-                    {
-                        id: 1,
-                        name: 'Laptop',
-                        description: 'High-performance laptop',
-                        price: 999.99,
-                        discount: 10,
-                        inStock: true
-                    },
-                    {
-                        id: 2,
-                        name: 'Mouse',
-                        description: 'Wireless mouse',
-                        price: 29.99,
-                        discount: 0,
-                        inStock: true
-                    },
-                    {
-                        id: 3,
-                        name: 'Keyboard',
-                        description: 'Mechanical keyboard',
-                        price: 149.99,
-                        discount: 15,
-                        inStock: false
-                    }
-                ]
-            },
-            'testEjs': {
-                // For the existing test file
-            }
-        };
-
-        return dataMap[basename] || {};
-    }
-
-    describe('Simple Template - simple.ejs', () => {
-        test('Should render simple template with variables', async () => {
-            const response = await request.get('/ejs-templates/simple.ejs');
-
-            expect(response.status).toBe(200);
-            expect(response.type).toBe('text/html');
-            expect(response.text).toContain('Simple EJS Test');
-            expect(response.text).toContain('Hello from EJS');
-            expect(response.text).toContain('This is a simple template test');
-            expect(response.text).toContain('2025-11-18');
-        });
-    });
-
-    describe('Loop Template - with-loop.ejs', () => {
-        test('Should render template with forEach loop', async () => {
-            const response = await request.get('/ejs-templates/with-loop.ejs');
-
-            expect(response.status).toBe(200);
-            expect(response.text).toContain('Lista di Items');
-            expect(response.text).toContain('Item 1 - 100');
-            expect(response.text).toContain('Item 2 - 200');
-            expect(response.text).toContain('Item 3 - 300');
-            expect(response.text).toContain('Totale items: 3');
-            expect(response.text).toContain('data-index="0"');
-            expect(response.text).toContain('data-index="1"');
-            expect(response.text).toContain('data-index="2"');
-        });
-    });
-
-    describe('Conditional Template - with-conditional.ejs', () => {
-        test('Should render template with if/else conditionals (logged in)', async () => {
-            const response = await request.get('/ejs-templates/with-conditional.ejs');
-
-            expect(response.status).toBe(200);
-            expect(response.text).toContain('Benvenuto, TestUser!');
-            expect(response.text).toContain('Ruolo: admin');
-            expect(response.text).toContain('Hai 5 nuove notifiche');
-            // Should NOT contain guest panel
-            expect(response.text).not.toContain('Benvenuto, ospite!');
-        });
-    });
-
-    describe('Escaping Template - with-escaping.ejs', () => {
-        test('Should properly escape HTML in <%= %> tags', async () => {
-            const response = await request.get('/ejs-templates/with-escaping.ejs');
-
-            expect(response.status).toBe(200);
-
-            // HTML should be escaped (safe)
-            // Note: EJS uses &#34; instead of &quot; for quotes
-            expect(response.text).toContain('&lt;script&gt;alert(&#34;XSS&#34;)&lt;/script&gt;');
-
-            // HTML should NOT be escaped (unsafe - unescaped output)
-            expect(response.text).toContain('<strong>Bold text</strong>');
-
-            // Safe text with & should be escaped
-            expect(response.text).toContain('Plain &amp; safe text');
-
-            // Allowed HTML should be rendered
-            expect(response.text).toContain('<em>Emphasized text</em>');
-        });
-
-        test('Should protect against XSS attacks', async () => {
-            const response = await request.get('/ejs-templates/with-escaping.ejs');
-
-            // The escaped section should not contain executable script tags
-            const escapedSection = response.text.match(/<div class="escaped">[\s\S]*?<\/div>/)[0];
-            expect(escapedSection).not.toContain('<script>');
-            expect(escapedSection).toContain('&lt;script&gt;');
-        });
-    });
-
-    describe('Complex Template - complex.ejs', () => {
-        test('Should render complex template with all features', async () => {
-            const response = await request.get('/ejs-templates/complex.ejs');
-
-            expect(response.status).toBe(200);
-
-            // Page title
-            expect(response.text).toContain('E-Commerce Products');
-
-            // User greeting
-            expect(response.text).toContain('Ciao, Mario Rossi!');
-
-            // Products list
-            expect(response.text).toContain('Laptop');
-            expect(response.text).toContain('High-performance laptop');
-            expect(response.text).toContain('€999.99');
-
-            // Discount calculation
-            expect(response.text).toContain('Sconto: 10%');
-            expect(response.text).toContain('€899.99'); // 999.99 - 10%
-
-            // Mouse without discount
-            expect(response.text).toContain('Mouse');
-            expect(response.text).toContain('€29.99');
-
-            // Keyboard out of stock
-            expect(response.text).toContain('Keyboard');
-            expect(response.text).toContain('Non disponibile');
-
-            // Total count
-            expect(response.text).toContain('Totale prodotti: 3');
-        });
-
-        test('Should have correct product data attributes', async () => {
-            const response = await request.get('/ejs-templates/complex.ejs');
-
-            expect(response.text).toContain('data-id="1"');
-            expect(response.text).toContain('data-id="2"');
-            expect(response.text).toContain('data-id="3"');
-        });
-
-        test('Should show "Add to cart" button only for in-stock items', async () => {
-            const response = await request.get('/ejs-templates/complex.ejs');
-
-            // Count "Aggiungi al carrello" buttons - should be 2 (Laptop and Mouse)
-            const buttonMatches = response.text.match(/Aggiungi al carrello/g);
-            expect(buttonMatches).toHaveLength(2);
-
-            // Count "Non disponibile" - should be 1 (Keyboard)
-            const outOfStockMatches = response.text.match(/Non disponibile/g);
-            expect(outOfStockMatches).toHaveLength(1);
-        });
-    });
-
-    describe('Index Template - index.ejs', () => {
-        test('Should render index page with links', async () => {
-            const response = await request.get('/ejs-templates/index.ejs');
-
-            expect(response.status).toBe(200);
-            expect(response.text).toContain('Test Templates EJS');
-            expect(response.text).toContain('simple.ejs');
-            expect(response.text).toContain('with-loop.ejs');
-            expect(response.text).toContain('with-conditional.ejs');
-            expect(response.text).toContain('with-escaping.ejs');
-            expect(response.text).toContain('complex.ejs');
-        });
-    });
-
-    describe('Existing EJS file - testEjs.ejs', () => {
-        test('Should render existing testEjs.ejs file', async () => {
-            const response = await request.get('/cartella/sottocartella/provaEjs/testEjs.ejs');
-
-            expect(response.status).toBe(200);
-            expect(response.type).toBe('text/html');
-            expect(response.text).toContain('<h1>hello world</h1>');
-        });
-    });
-
-    describe('Error Handling', () => {
-        test('Should return 404 for non-existent .ejs file', async () => {
-            const response = await request.get('/ejs-templates/non-existent.ejs');
-
-            expect(response.status).toBe(404);
-        });
-    });
-
-    describe('Performance', () => {
-        test('Should render complex template in reasonable time', async () => {
-            const start = Date.now();
-            const response = await request.get('/ejs-templates/complex.ejs');
-            const duration = Date.now() - start;
-
-            expect(response.status).toBe(200);
-            expect(duration).toBeLessThan(100); // Should render in less than 100ms
-        });
-
-        test('Should render simple template very quickly', async () => {
-            const start = Date.now();
-            const response = await request.get('/ejs-templates/simple.ejs');
-            const duration = Date.now() - start;
-
-            expect(response.status).toBe(200);
-            expect(duration).toBeLessThan(50); // Should render in less than 50ms
-        });
-    });
-});

package/__tests__/head-method.test.js

@@ -1,160 +0,0 @@
-const Koa = require('koa');
-const koaClassicServer = require('../index.cjs');
-const supertest = require('supertest');
-const path = require('path');
-const fs = require('fs');
-const ejs = require('ejs');
-
-// Regression tests for the HEAD-method HTTP-conformance bug.
-//
-// RFC 9110 §9.3.2: a HEAD response must be identical to the GET response for the
-// same resource, minus the message body — same status code, same headers
-// (notably Content-Type and Content-Length).
-//
-// Before the fix, a route served by the template engine returned 200 on GET but
-// 404 on HEAD whenever the operator's render function did not itself handle HEAD
-// (e.g. it returned early on non-GET requests). The static-file branch already
-// handled HEAD correctly, and directory listings happened to work because Koa
-// strips the string body for HEAD — only the template branch was broken.
-
-const ROOT = path.join(__dirname, 'publicWwwTest');
-
-// Minimal data for the templates exercised here. ejs-templates/index.ejs needs no
-// variables; simple.ejs needs these four. Anything else renders with no locals.
-function templateData(filePath) {
-    if (path.basename(filePath, '.ejs') === 'simple') {
-        return {
-            title: 'Simple EJS Test',
-            heading: 'Hello from EJS',
-            message: 'This is a simple template test',
-            timestamp: '2025-11-18',
-        };
-    }
-    return {};
-}
-
-// A method-AWARE render: it only produces a body on GET. This is a common
-// real-world pattern (operators guard render work behind a GET check) and is
-// exactly what exposed the bug — on HEAD it never set ctx.body, so the status
-// stayed at Koa's default 404. This render is what makes the regression real:
-// with a naive render the test would pass even without the fix, because Koa
-// strips the body of a 200 GET response for HEAD on its own.
-const methodAwareRender = async (ctx, next, filePath) => {
-    if (ctx.method !== 'GET') return;
-    const tpl = await fs.promises.readFile(filePath, 'utf-8');
-    ctx.type = 'text/html';
-    ctx.body = ejs.render(tpl, templateData(filePath));
-};
-
-// A method-AGNOSTIC render: sets the body regardless of method. Proves the fix
-// does not regress renders that already worked.
-const naiveRender = async (ctx, next, filePath) => {
-    const tpl = await fs.promises.readFile(filePath, 'utf-8');
-    ctx.type = 'text/html';
-    ctx.body = ejs.render(tpl, templateData(filePath));
-};
-
-function buildServer(render) {
-    const app = new Koa();
-    app.use(
-        koaClassicServer(ROOT, {
-            method: ['GET', 'HEAD'],
-            index: ['index.html', 'index.ejs'],
-            dirListing: { enabled: true },
-            template: { ext: ['ejs'], render },
-        })
-    );
-    return app.listen();
-}
-
-// Asserts the HEAD response for `urlPath` matches the corresponding GET in status,
-// Content-Type and Content-Length, and that HEAD carries no body.
-async function expectHeadMatchesGet(request, urlPath, expectedStatus) {
-    const get = await request.get(urlPath);
-    const head = await request.head(urlPath);
-
-    expect(get.status).toBe(expectedStatus);
-    expect(head.status).toBe(expectedStatus);
-
-    // Same headers as GET (RFC 9110 §9.3.2)
-    expect(head.headers['content-type']).toBe(get.headers['content-type']);
-    expect(head.headers['content-length']).toBe(get.headers['content-length']);
-    // Content-Length must actually be populated for a body-bearing response
-    expect(head.headers['content-length']).toBeDefined();
-
-    // HEAD must not send a body (supertest surfaces an empty object for HEAD)
-    expect(head.text).toBeFalsy();
-    expect(head.body).toEqual({});
-
-    return { get, head };
-}
-
-describe('HEAD method — template engine routes (method-aware render)', () => {
-    let server;
-    let request;
-    beforeAll(() => { server = buildServer(methodAwareRender); request = supertest(server); });
-    afterAll(() => server.close());
-
-    // The headline bug: a directory whose index is a template (index.ejs as the
-    // index of /ejs-templates/). GET 200, HEAD must also be 200 — not 404.
-    test('HEAD on a directory whose index is a template → 200, matches GET', async () => {
-        const { get } = await expectHeadMatchesGet(request, '/ejs-templates/', 200);
-        // sanity: GET really did render the template
-        expect(get.text).toContain('Test Templates EJS');
-        expect(get.headers['content-type']).toMatch(/text\/html/);
-    });
-
-    test('HEAD on a directly-requested template file → 200, matches GET', async () => {
-        const { get } = await expectHeadMatchesGet(request, '/ejs-templates/simple.ejs', 200);
-        expect(get.text).toContain('Hello from EJS');
-    });
-
-    test('HEAD on a static file → 200, matches GET', async () => {
-        const { head } = await expectHeadMatchesGet(request, '/test.txt', 200);
-        // static branch advertises range support
-        expect(head.headers['accept-ranges']).toBe('bytes');
-    });
-
-    test('HEAD on a listable directory (no index) → 200, matches GET', async () => {
-        const { get } = await expectHeadMatchesGet(request, '/cartella/', 200);
-        expect(get.headers['content-type']).toMatch(/text\/html/);
-    });
-
-    test('HEAD on a non-existent template path → 404, matches GET', async () => {
-        const get = await request.get('/ejs-templates/non-existent.ejs');
-        const head = await request.head('/ejs-templates/non-existent.ejs');
-        expect(get.status).toBe(404);
-        expect(head.status).toBe(404);
-        expect(head.headers['content-type']).toBe(get.headers['content-type']);
-        expect(head.text).toBeFalsy();
-    });
-
-    test('HEAD on a non-existent static path → 404, matches GET', async () => {
-        const get = await request.get('/does-not-exist.txt');
-        const head = await request.head('/does-not-exist.txt');
-        expect(get.status).toBe(404);
-        expect(head.status).toBe(404);
-        expect(head.text).toBeFalsy();
-    });
-});
-
-describe('HEAD method — template engine routes (method-agnostic render, no regression)', () => {
-    let server;
-    let request;
-    beforeAll(() => { server = buildServer(naiveRender); request = supertest(server); });
-    afterAll(() => server.close());
-
-    test('HEAD on template index still matches GET → 200', async () => {
-        await expectHeadMatchesGet(request, '/ejs-templates/', 200);
-    });
-
-    test('HEAD on direct template still matches GET → 200', async () => {
-        await expectHeadMatchesGet(request, '/ejs-templates/simple.ejs', 200);
-    });
-
-    test('HEAD on non-existent template → 404', async () => {
-        const head = await request.head('/ejs-templates/non-existent.ejs');
-        expect(head.status).toBe(404);
-        expect(head.text).toBeFalsy();
-    });
-});

package/__tests__/hidden-fixtures/.dot-dir/inside.txt

@@ -1 +0,0 @@
-dot dir file

package/__tests__/hidden-fixtures/.env

@@ -1,2 +0,0 @@
-SECRET_KEY=mysecretvalue
-DB_PASSWORD=hidden123

package/__tests__/hidden-fixtures/.well-known/acme-challenge.txt

@@ -1 +0,0 @@
-acme

package/__tests__/hidden-fixtures/config/secrets/password.txt

@@ -1 +0,0 @@
-password

package/__tests__/hidden-fixtures/data.key

@@ -1 +0,0 @@
-key data

package/__tests__/hidden-fixtures/file.secret

@@ -1 +0,0 @@
-secret data

package/__tests__/hidden-fixtures/index.html

@@ -1 +0,0 @@
-regular

package/__tests__/hidden-fixtures/normal.txt

@@ -1 +0,0 @@
-normal

package/__tests__/hidden-fixtures/subdir/.env

@@ -1 +0,0 @@
-NESTED_SECRET=nestedvalue

package/__tests__/hidden-fixtures/subdir/regular.txt

@@ -1 +0,0 @@
-regular in subdir