okengine 0.2.6 → 0.3.2

package/src/plugins/compression.ts

@@ -0,0 +1,94 @@
+/**
+ * Official `compression` plugin — gzip response bodies for clients that
+ * accept it. Uses only the public plugin API (unified-theory §14).
+ */
+
+import { plugin, type PluginDef } from "../kernel/plugin.ts";
+import {
+  isConfigSource,
+  pluginConfigSnapshot,
+  resolvePluginOptions,
+  withConfigTable,
+  type ConfigSource,
+} from "./config-source.ts";
+import { appendVary } from "./headers.ts";
+
+/** Options for {@link compression}. */
+export interface CompressionOptions {
+  /**
+   * Minimum body size in bytes before compression is worth it.
+   * Smaller bodies can grow under gzip. Default `1024`.
+   */
+  readonly minSize?: number;
+  /**
+   * Which `Content-Type`s to compress. Default matches JSON (including
+   * `+json`), JavaScript, XML, and every `text/*`.
+   */
+  readonly match?: RegExp;
+}
+
+/** Default compressible types: JSON, JS, XML, and any text/*. */
+const DEFAULT_MATCH = /^(application\/(json|.+\+json|javascript|xml|.+\+xml)|text\/)/i;
+
+/** True when the Accept-Encoding value allows gzip (honoring `q=0`). */
+export function acceptsGzip(header: string | null): boolean {
+  if (!header) return false;
+  for (const part of header.split(",")) {
+    const [token, ...params] = part.trim().split(";");
+    const name = token!.trim().toLowerCase();
+    if (name !== "gzip" && name !== "*") continue;
+    const q = params.map((p) => p.trim()).find((p) => p.toLowerCase().startsWith("q="));
+    if (q !== undefined && Number.parseFloat(q.slice(2)) === 0) continue;
+    return true;
+  }
+  return false;
+}
+
+/**
+ * Compress HTTP response bodies with `Bun.gzipSync` when the client sends
+ * `Accept-Encoding: gzip`. Skips: already-encoded responses, `no-transform`
+ * cache directives, event streams, non-matching content types, and bodies
+ * under `minSize`. Non-HTTP triggers no-op.
+ *
+ * Accepts static options or a {@link ConfigSource} for DB-driven thresholds.
+ *
+ * @param options - Size threshold / content-type matcher, or a config source
+ */
+export function compression(
+  options: CompressionOptions | ConfigSource<CompressionOptions> = {},
+): PluginDef {
+  const def = plugin("compression", {
+    version: "0.0.2",
+    config: pluginConfigSnapshot(options),
+  }).hook("onResponse", async (ctx) => {
+    if (!ctx.response || !ctx.request) return;
+    const resolved = resolvePluginOptions(options);
+    const minSize = resolved.minSize ?? 1024;
+    const match = resolved.match ?? DEFAULT_MATCH;
+    if (!acceptsGzip(ctx.request.headers.get("accept-encoding"))) return;
+
+    const headers = new Headers(ctx.response.headers);
+    if (headers.has("content-encoding")) return;
+    const cacheControl = headers.get("cache-control");
+    if (cacheControl !== null && /\bno-transform\b/i.test(cacheControl)) return;
+
+    const contentType = headers.get("content-type") ?? "";
+    if (!match.test(contentType)) return;
+
+    const body = await ctx.response.arrayBuffer();
+    if (body.byteLength < minSize) return;
+
+    const compressed = Bun.gzipSync(new Uint8Array(body));
+    headers.set("content-encoding", "gzip");
+    headers.delete("content-length");
+    appendVary(headers, "accept-encoding");
+
+    ctx.response = new Response(compressed, {
+      status: ctx.response.status,
+      statusText: ctx.response.statusText,
+      headers,
+    });
+  });
+
+  return isConfigSource(options) ? withConfigTable(def, options) : def;
+}

package/src/plugins/config-source.test.ts

@@ -0,0 +1,204 @@
+/**
+ * `configSource` — code floor, DB overrides, automatic KV read-through,
+ * and the sync flow's declared effects. Also the plugin-side wiring:
+ * hooks follow the box, DB-backed sources contribute their config table.
+ */
+
+import { beforeEach, describe, expect, test } from "bun:test";
+import { memoryKvDriver } from "../drivers/memory.ts";
+import { sqliteDriver } from "../drivers/sqlite.ts";
+import { store } from "../elements/store/declare.ts";
+import { createStoreRuntime } from "../elements/store/runtime.ts";
+import type { SqlStoreHandle } from "../elements/store/sql-session.ts";
+import { defineTable } from "../elements/store/table.ts";
+import { oke } from "../kernel/app.ts";
+import { flow, resetFlowSeq } from "../kernel/flow.ts";
+import { createFxContext, type Fx } from "../kernel/fx.ts";
+import { on, resetBindings } from "../kernel/on.ts";
+import { createPluginRegistry } from "../kernel/registry.ts";
+import { http } from "../kernel/triggers.ts";
+import { configSource, resolvePluginOptions } from "./config-source.ts";
+import { maintenanceMode } from "./maintenance-mode.ts";
+import { securityHeaders } from "./security-headers.ts";
+
+beforeEach(() => {
+  resetBindings();
+  resetFlowSeq();
+});
+
+/** A KV-only source against the in-memory stub. */
+function kvFx(kvRef: string, seed: Record<string, unknown>): Fx {
+  return createFxContext({
+    flow: "x.config-sync",
+    effects: { reads: [kvRef as `kv:${string}`], writes: [kvRef as `kv:${string}`] },
+    storeData: { [kvRef]: seed },
+  }).fx;
+}
+
+describe("configSource — box semantics", () => {
+  test("current() is the code config before any sync", () => {
+    const source = configSource({ plugin: "maintenance-mode", code: { enabled: false } });
+    expect(source.current()).toEqual({ enabled: false });
+    expect(resolvePluginOptions(source)).toEqual({ enabled: false });
+  });
+
+  test("sync reads the KV cache and merges it over code", async () => {
+    const cfg = store.kv("cfg");
+    const source = configSource({
+      plugin: "maintenance-mode",
+      code: { enabled: false, retryAfter: 60 },
+      kv: cfg,
+    });
+
+    const fx = kvFx("kv:cfg", { "oke:plugin-config:maintenance-mode": { enabled: true } });
+    const outcome = await source.sync().do(undefined, fx);
+
+    expect(outcome).toEqual({ source: "kv" });
+    expect(source.current()).toEqual({ enabled: true, retryAfter: 60 });
+  });
+
+  test("DB is the source of truth; KV write-back makes the next tick KV-served", async () => {
+    const db = store.sql("cfgdb");
+    const cfg = store.kv("cfg");
+    const runtime = createStoreRuntime({
+      drivers: { sql: sqliteDriver, kv: memoryKvDriver },
+      sql: { cfgdb: { name: "cfgdb", primary: { url: ":memory:" } } },
+      kv: { cfg: {} },
+    });
+    runtime.register(db);
+    runtime.register(cfg);
+
+    const effects = {
+      reads: ["sql:cfgdb" as const, "kv:cfg" as const],
+      writes: ["sql:cfgdb" as const, "kv:cfg" as const],
+    };
+    const fx = createFxContext({ flow: "x.config-sync", effects, storeRuntime: runtime }).fx;
+
+    const table = defineTable("security_headers_config", { key: true, value: true });
+    const sql = fx.store(db) as SqlStoreHandle;
+    await sql.ensureTable(table);
+    await sql
+      .insert(table)
+      .values({ key: "config", value: JSON.stringify({ hsts: true }) })
+      .execute();
+
+    const source = configSource({
+      plugin: "security-headers",
+      code: { hsts: false },
+      db: { store: db },
+      kv: cfg,
+    });
+
+    const first = await source.sync().do(undefined, fx);
+    expect(first).toEqual({ source: "db" });
+    expect(source.current()).toEqual({ hsts: true });
+
+    // Remove the DB row — a fresh invocation must still be served from KV.
+    await sql.delete(table, "config");
+    const second = await source.sync().do(undefined, fx);
+    expect(second).toEqual({ source: "kv" });
+    expect(source.current()).toEqual({ hsts: true });
+  });
+
+  test("an empty DB reverts to the code config", async () => {
+    const db = store.sql("cfgdb");
+    const runtime = createStoreRuntime({
+      drivers: { sql: sqliteDriver },
+      sql: { cfgdb: { name: "cfgdb", primary: { url: ":memory:" } } },
+    });
+    runtime.register(db);
+
+    const effects = { reads: ["sql:cfgdb" as const], writes: ["sql:cfgdb" as const] };
+    const fx = createFxContext({ flow: "x.config-sync", effects, storeRuntime: runtime }).fx;
+    const table = defineTable("security_headers_config", { key: true, value: true });
+    await (fx.store(db) as SqlStoreHandle).ensureTable(table);
+
+    const source = configSource({
+      plugin: "security-headers",
+      code: { frameOptions: "DENY" as const },
+      db: { store: db },
+    });
+    expect(await source.sync().do(undefined, fx)).toEqual({ source: "code" });
+    expect(source.current()).toEqual({ frameOptions: "DENY" });
+  });
+
+  test("a corrupt JSON row fails the sync loudly", async () => {
+    const db = store.sql("cfgdb");
+    const runtime = createStoreRuntime({
+      drivers: { sql: sqliteDriver },
+      sql: { cfgdb: { name: "cfgdb", primary: { url: ":memory:" } } },
+    });
+    runtime.register(db);
+
+    const effects = { reads: ["sql:cfgdb" as const], writes: ["sql:cfgdb" as const] };
+    const fx = createFxContext({ flow: "x.config-sync", effects, storeRuntime: runtime }).fx;
+    const table = defineTable("security_headers_config", { key: true, value: true });
+    const sql = fx.store(db) as SqlStoreHandle;
+    await sql.ensureTable(table);
+    await sql.insert(table).values({ key: "config", value: "{not json" }).execute();
+
+    const source = configSource({
+      plugin: "security-headers",
+      code: {},
+      db: { store: db },
+    });
+    await expect(source.sync().do(undefined, fx)).rejects.toThrow(/not valid JSON/);
+  });
+});
+
+describe("configSource — plugin wiring", () => {
+  test("the maintenanceMode hook follows the box after a sync", async () => {
+    const cfg = store.kv("cfg");
+    const source = configSource({
+      plugin: "maintenance-mode",
+      code: { enabled: false },
+      kv: cfg,
+    });
+
+    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    const app = oke({ name: "cfg-live" }).plug(maintenanceMode(source));
+
+    expect((await app.fetch(new Request("http://localhost/x"))).status).toBe(200);
+
+    await source.sync().do(undefined, kvFx("kv:cfg", {}));
+    expect((await app.fetch(new Request("http://localhost/x"))).status).toBe(200);
+
+    const seeded = kvFx("kv:cfg", { "oke:plugin-config:maintenance-mode": { enabled: true } });
+    await source.sync().do(undefined, seeded);
+    expect((await app.fetch(new Request("http://localhost/x"))).status).toBe(503);
+  });
+
+  test("DB-backed sources contribute their config table; static options do not", () => {
+    const db = store.sql("cfgdb");
+    const source = configSource({
+      plugin: "security-headers",
+      code: {},
+      db: { store: db },
+    });
+
+    const registry = createPluginRegistry();
+    const registration = registry.plug(securityHeaders(source), { kind: "app" });
+    expect(registration?.tables.map((t) => t.name)).toEqual(["security_headers_config"]);
+
+    const staticRegistry = createPluginRegistry();
+    const staticRegistration = staticRegistry.plug(securityHeaders({}), { kind: "app" });
+    expect(staticRegistration?.tables).toEqual([]);
+  });
+
+  test("the identity snapshot is the code config, not the live box", async () => {
+    const cfg = store.kv("cfg");
+    const source = configSource({
+      plugin: "maintenance-mode",
+      code: { enabled: false },
+      kv: cfg,
+    });
+    await source
+      .sync()
+      .do(undefined, kvFx("kv:cfg", { "oke:plugin-config:maintenance-mode": { enabled: true } }));
+
+    const registry = createPluginRegistry();
+    registry.plug(maintenanceMode(source), { kind: "app" });
+    // Double-plug with the same source is a no-op (snapshot still equals code).
+    expect(registry.plug(maintenanceMode(source), { kind: "app" })).toBeUndefined();
+  });
+});

package/src/plugins/config-source.ts

@@ -0,0 +1,209 @@
+/**
+ * `configSource()` — runtime-mutable plugin configuration: code as the
+ * floor, DB as the source of truth, KV as the automatic read-through cache.
+ *
+ * Hooks cannot touch stores (fx is capability-gated per flow), so plugins
+ * resolve config synchronously from an in-memory box. A real flow — bound
+ * by the app on a clock trigger, with declared effects — refreshes that
+ * box: KV hit → box; miss → DB row → box + KV write-back. Every world
+ * access stays inside a flow, per the fx rule.
+ */
+
+import type { KvStoreDecl, SqlStoreDecl } from "../elements/store/declare.ts";
+import type { KvStoreFxHandle } from "../elements/store/runtime.ts";
+import { field } from "../elements/store/schema-decl.ts";
+import type { SqlStoreHandle } from "../elements/store/sql-session.ts";
+import { flow, type AnyFlowDef } from "../kernel/flow.ts";
+import type { PluginDef } from "../kernel/plugin.ts";
+
+/** Resource refs a config sync flow may touch. */
+type StoreRef = `kv:${string}` | `sql:${string}`;
+
+const configSourceBrand: unique symbol = Symbol("oke.configSource");
+
+/** DB side of a {@link ConfigSource}. */
+export interface ConfigSourceDb {
+  /** `store.sql` binding owned by the app. */
+  readonly store: SqlStoreDecl;
+  /**
+   * Config table name. Default `<plugin-id>_config` (kebab → snake). The
+   * owning plugin contributes this table (`oke db push` creates it).
+   */
+  readonly table?: string;
+}
+
+/** Options for {@link configSource}. */
+export interface ConfigSourceOptions<T extends object> {
+  /**
+   * Plugin id this config belongs to (e.g. `"security-headers"`) — derives
+   * the DB row key, the KV key, and the default table name.
+   */
+  readonly plugin: string;
+  /**
+   * Base config in code — always present, always the floor. DB values are
+   * shallow-merged over it; a missing DB row means exactly this.
+   */
+  readonly code: T;
+  /** DB source of truth (optional). Values override `code`. */
+  readonly db?: ConfigSourceDb;
+  /**
+   * KV binding for the automatic read-through cache (optional). When set,
+   * DB values are cached with `ttl` so steady-state sync ticks never touch
+   * the database.
+   */
+  readonly kv?: KvStoreDecl;
+  /** KV TTL for cached DB values. Default `"30s"`. */
+  readonly ttl?: string;
+}
+
+/**
+ * A live config box for one plugin. `current()` is synchronous and never
+ * throws — safe to read from any hook. `sync()` is the refresh flow the
+ * app binds once: `on(every("30s"), source.sync())`.
+ */
+export interface ConfigSource<T extends object> {
+  readonly [configSourceBrand]: true;
+  /** Plugin id. */
+  readonly plugin: string;
+  /** The static `code` config — used as the plugin identity snapshot. */
+  readonly codeConfig: T;
+  /** Config table name when DB-backed (the owning plugin contributes it). */
+  readonly table?: string;
+  /** Current merged config (code ← DB overrides). */
+  current(): T;
+  /** Refresh flow — bind once on a clock trigger. */
+  sync(): AnyFlowDef;
+}
+
+/** Row key of the single config row inside a plugin's config table. */
+const ROW_KEY = "config";
+
+/** kebab-case plugin id → snake_case default table name. */
+function defaultTable(plugin: string): string {
+  return `${plugin.replace(/-/g, "_")}_config`;
+}
+
+/** Shallow merge — DB partial wins over code, key by key. */
+function mergeConfig<T extends object>(code: T, partial: unknown): T {
+  if (typeof partial !== "object" || partial === null || Array.isArray(partial)) return code;
+  return { ...code, ...(partial as Partial<T>) };
+}
+
+/**
+ * Create a code-or-DB config source for a plugin.
+ *
+ * @param options - Plugin id, code floor, optional DB + KV
+ */
+export function configSource<T extends object>(options: ConfigSourceOptions<T>): ConfigSource<T> {
+  const table =
+    options.db === undefined ? undefined : (options.db.table ?? defaultTable(options.plugin));
+  const kvKey = `oke:plugin-config:${options.plugin}`;
+  const ttl = options.ttl ?? "30s";
+  let box: T = options.code;
+
+  const source: ConfigSource<T> = {
+    [configSourceBrand]: true,
+    plugin: options.plugin,
+    codeConfig: options.code,
+    ...(table !== undefined ? { table } : {}),
+    current: () => box,
+    sync() {
+      const reads: StoreRef[] = [];
+      const writes: StoreRef[] = [];
+      if (options.kv !== undefined) {
+        reads.push(options.kv.ref);
+        writes.push(options.kv.ref);
+      }
+      if (options.db !== undefined) reads.push(options.db.store.ref);
+
+      return flow({
+        name: `${options.plugin}.config-sync`,
+        effects: { reads, writes },
+        do: async (_input, fx) => {
+          if (options.kv !== undefined) {
+            const kv = fx.store(options.kv) as KvStoreFxHandle;
+            const cached = await kv.get(kvKey);
+            if (cached !== undefined && cached !== null) {
+              box = mergeConfig(options.code, cached);
+              return { source: "kv" };
+            }
+          }
+
+          if (options.db !== undefined && table !== undefined) {
+            const db = fx.store(options.db.store) as SqlStoreHandle;
+            const rows = await db.raw(`SELECT "value" FROM "${table}" WHERE "key" = ?`, [ROW_KEY]);
+            const raw = rows[0]?.["value"];
+            let partial: unknown = undefined;
+            if (raw !== undefined && raw !== null) {
+              if (typeof raw !== "string") {
+                throw new Error(
+                  `configSource(${options.plugin}): row "value" must be JSON text, got ${typeof raw}`,
+                );
+              }
+              try {
+                partial = JSON.parse(raw);
+              } catch (cause) {
+                throw new Error(
+                  `configSource(${options.plugin}): config row is not valid JSON — ${String(cause)}`,
+                );
+              }
+            }
+            box = mergeConfig(options.code, partial);
+            if (options.kv !== undefined) {
+              const kv = fx.store(options.kv) as KvStoreFxHandle;
+              await kv.set(kvKey, partial ?? {}, ttl);
+            }
+            return { source: partial === undefined ? "code" : "db" };
+          }
+
+          box = options.code;
+          return { source: "code" };
+        },
+      });
+    },
+  };
+
+  return source;
+}
+
+/** Type guard for {@link ConfigSource}. */
+export function isConfigSource<T extends object>(value: unknown): value is ConfigSource<T> {
+  return typeof value === "object" && value !== null && configSourceBrand in value;
+}
+
+/**
+ * Resolve plugin options at request time — static options as-is, a
+ * ConfigSource through its current merged value.
+ *
+ * @param value - Options or source
+ */
+export function resolvePluginOptions<T extends object>(value: T | ConfigSource<T>): T {
+  return isConfigSource<T>(value) ? value.current() : value;
+}
+
+/**
+ * Identity snapshot for `plugin(name, { config })` — always the static
+ * code config, so DB edits never trigger false conflict errors.
+ *
+ * @param value - Options or source
+ */
+export function pluginConfigSnapshot<T extends object>(value: T | ConfigSource<T>): T {
+  return isConfigSource<T>(value) ? value.codeConfig : value;
+}
+
+/**
+ * Contribute the plugin's config table when its options are a DB-backed
+ * ConfigSource. Chain last on the builder.
+ *
+ * @param def - Plugin builder
+ * @param value - Options or source passed to the factory
+ */
+export function withConfigTable<D extends PluginDef>(def: D, value: unknown): D {
+  if (isConfigSource(value) && value.table !== undefined) {
+    def.table(value.table, {
+      key: field.text().primaryKey(),
+      value: field.text().notNull(),
+    });
+  }
+  return def;
+}

package/src/plugins/cors.test.ts

@@ -0,0 +1,138 @@
+/**
+ * `cors` plugin — preflight at the edge, CORS headers on matched
+ * responses, closed-by-default origin rule.
+ */
+
+import { beforeEach, describe, expect, test } from "bun:test";
+import { oke } from "../kernel/app.ts";
+import { flow, resetFlowSeq } from "../kernel/flow.ts";
+import { on, resetBindings } from "../kernel/on.ts";
+import { http } from "../kernel/triggers.ts";
+import { cors, originAllowed } from "./cors.ts";
+
+beforeEach(() => {
+  resetBindings();
+  resetFlowSeq();
+});
+
+function preflight(path = "/x", headers: Record<string, string> = {}): Request {
+  return new Request(`http://localhost${path}`, {
+    method: "OPTIONS",
+    headers: {
+      origin: "https://app.example.com",
+      "access-control-request-method": "POST",
+      ...headers,
+    },
+  });
+}
+
+describe("cors plugin — preflight", () => {
+  test("answers preflight for a path bound to another method (edge)", async () => {
+    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    const app = oke({ name: "cors-pre" }).plug(cors({ origin: "https://app.example.com" }));
+
+    const res = await app.fetch(preflight());
+
+    expect(res.status).toBe(204);
+    expect(res.headers.get("access-control-allow-origin")).toBe("https://app.example.com");
+    expect(res.headers.get("access-control-allow-methods")).toContain("POST");
+    expect(res.headers.get("vary")).toContain("origin");
+  });
+
+  test("denied origins get a 204 without CORS headers — the browser blocks quietly", async () => {
+    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    const app = oke({ name: "cors-deny" }).plug(cors({ origin: "https://other.example.com" }));
+
+    const res = await app.fetch(preflight());
+
+    expect(res.status).toBe(204);
+    expect(res.headers.get("access-control-allow-origin")).toBeNull();
+  });
+
+  test("no origin configured answers nothing — cross-origin closed by default", async () => {
+    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    const app = oke({ name: "cors-closed" }).plug(cors());
+
+    const res = await app.fetch(preflight());
+    expect(res.headers.get("access-control-allow-origin")).toBeNull();
+  });
+
+  test("a plain unmatched OPTIONS without preflight headers still 404s", async () => {
+    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    const app = oke({ name: "cors-404" }).plug(cors({ origin: "*" }));
+
+    const res = await app.fetch(new Request("http://localhost/x", { method: "OPTIONS" }));
+    expect(res.status).toBe(404);
+  });
+
+  test("reflects request headers by default, honors configured lists and maxAge", async () => {
+    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    const app = oke({ name: "cors-hdr" }).plug(
+      cors({ origin: "*", maxAge: 600, allowedHeaders: ["x-custom"] }),
+    );
+
+    const reflected = await app.fetch(
+      preflight("/x", { "access-control-request-headers": "authorization, content-type" }),
+    );
+    // Configured list wins over reflection.
+    expect(reflected.headers.get("access-control-allow-headers")).toBe("x-custom");
+    expect(reflected.headers.get("access-control-max-age")).toBe("600");
+    expect(reflected.headers.get("access-control-allow-origin")).toBe("*");
+  });
+
+  test("credentials reflect the origin instead of stamping *", async () => {
+    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    const app = oke({ name: "cors-cred" }).plug(cors({ origin: "*", credentials: true }));
+
+    const res = await app.fetch(preflight());
+    expect(res.headers.get("access-control-allow-origin")).toBe("https://app.example.com");
+    expect(res.headers.get("access-control-allow-credentials")).toBe("true");
+  });
+});
+
+describe("cors plugin — actual requests", () => {
+  test("allowed origins get allow-origin (+ exposed headers) on matched responses", async () => {
+    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    const app = oke({ name: "cors-actual" }).plug(
+      cors({ origin: ["https://app.example.com"], exposedHeaders: ["x-total"] }),
+    );
+
+    const res = await app.fetch(
+      new Request("http://localhost/x", { headers: { origin: "https://app.example.com" } }),
+    );
+
+    expect(res.status).toBe(200);
+    expect(res.headers.get("access-control-allow-origin")).toBe("https://app.example.com");
+    expect(res.headers.get("access-control-expose-headers")).toBe("x-total");
+  });
+
+  test("denied origins get no CORS headers on matched responses", async () => {
+    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    const app = oke({ name: "cors-actual-deny" }).plug(cors({ origin: "https://ok.example.com" }));
+
+    const res = await app.fetch(
+      new Request("http://localhost/x", { headers: { origin: "https://evil.example.com" } }),
+    );
+
+    expect(res.status).toBe(200);
+    expect(res.headers.get("access-control-allow-origin")).toBeNull();
+  });
+
+  test("requests without an Origin header are untouched", async () => {
+    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    const app = oke({ name: "cors-no-origin" }).plug(cors({ origin: "*" }));
+
+    const res = await app.fetch(new Request("http://localhost/x"));
+    expect(res.headers.get("access-control-allow-origin")).toBeNull();
+  });
+});
+
+describe("originAllowed", () => {
+  test("undefined / * / string / list", () => {
+    expect(originAllowed("https://a.com", undefined)).toBe(false);
+    expect(originAllowed("https://a.com", "*")).toBe(true);
+    expect(originAllowed("https://a.com", "https://a.com")).toBe(true);
+    expect(originAllowed("https://b.com", "https://a.com")).toBe(false);
+    expect(originAllowed("https://b.com", ["https://a.com", "https://b.com"])).toBe(true);
+  });
+});