slicetest 0.6.0 → 0.6.1

package/README.md

@@ -179,7 +179,7 @@ const admin = http.with({ headers: { authorization: `Bearer ${token}` } }); // s
 http.cookies.get("session");                                     // cookies persist within a scenario
 ```
 
-Requests may only go to the app under test; absolute URLs to other hosts are rejected. Defaults for every request can be set with `http: { headers }` in the plugin config. With `follow`, cookies set by each redirect are kept (a login answering `302` with `Set-Cookie`), `303` and `301`/`302` turn into a `GET` as in browsers, and a redirect to another host is returned instead of followed.
+Requests may only go to the app under test; absolute URLs to other hosts are rejected. Defaults for every request can be set with `http: { headers }` in the plugin config. With `follow`, cookies set by each redirect are kept (a login answering `302` with `Set-Cookie`), `303` and `301`/`302` turn into a `GET` as in browsers, and a redirect to another host is returned instead of followed. Cookies follow their `Path` as in browsers.
 
 #### Forms: `http.submit()`
 

package/dist/app.js

@@ -66,6 +66,19 @@ export class App {
      * `service.<name>` for a service (its port is then `{{service.<name>.port}}`).
      */
     static async start(opts, root, vars, key = "app", fixedPort) {
+        // A free port can be taken by someone else before the app binds it (another worker, another
+        // program). When that is why the app died, try again on a fresh port.
+        for (let attempt = 1;; attempt++) {
+            try {
+                return await App.#start(opts, root, vars, key, fixedPort);
+            }
+            catch (e) {
+                if (fixedPort !== undefined || attempt >= PORT_ATTEMPTS || !(e instanceof PortInUse))
+                    throw e;
+            }
+        }
+    }
+    static async #start(opts, root, vars, key, fixedPort) {
         // A restarted service keeps its port, so URLs already handed to other processes stay valid.
         const port = fixedPort ?? (await freePort());
         vars = { ...vars, [`${key}.port`]: String(port) };
@@ -87,6 +100,8 @@ export class App {
         }
         catch (e) {
             await app.stop();
+            if (app.#exit && ADDRESS_IN_USE.test(app.logs()))
+                throw new PortInUse(e.message);
             throw e;
         }
         return app;
@@ -266,14 +281,27 @@ function escapeRegExp(s) {
 function mapValues(obj, fn) {
     return Object.fromEntries(Object.entries(obj).map(([k, v]) => [k, fn(v)]));
 }
-function freePort() {
-    return new Promise((resolve, reject) => {
-        const srv = createServer();
-        srv.unref();
-        srv.on("error", reject);
-        srv.listen(0, "127.0.0.1", () => {
-            const { port } = srv.address();
-            srv.close(() => resolve(port));
+const PORT_ATTEMPTS = 3;
+/** How Node, Python, Go, Ruby, the JVM and others report a port that is taken. */
+const ADDRESS_IN_USE = /EADDRINUSE|address already in use|Address in use|BindException/i;
+class PortInUse extends Error {
+}
+/** Ports this process has handed out; the OS may offer one again before the app has bound it. */
+const handedOut = new Set();
+async function freePort() {
+    for (;;) {
+        const port = await new Promise((resolve, reject) => {
+            const srv = createServer();
+            srv.unref();
+            srv.on("error", reject);
+            srv.listen(0, "127.0.0.1", () => {
+                const { port } = srv.address();
+                srv.close(() => resolve(port));
+            });
         });
-    });
+        if (!handedOut.has(port)) {
+            handedOut.add(port);
+            return port;
+        }
+    }
 }

package/dist/http.d.ts

@@ -22,6 +22,8 @@ declare class Session {
     /** Stub base URLs of intercepted hosts, which redirects may lead to (an OAuth provider's login page). */
     external: Map<string, string>;
     cookies: Map<string, string>;
+    /** The Path each cookie was set for; a cookie without one (added by hand) goes everywhere. */
+    cookiePaths: Map<string, string>;
     history: HttpResponse[];
     listeners: ((res: HttpResponse) => void)[];
 }

package/dist/http.js

@@ -6,6 +6,8 @@ class Session {
     /** Stub base URLs of intercepted hosts, which redirects may lead to (an OAuth provider's login page). */
     external = new Map();
     cookies = new Map();
+    /** The Path each cookie was set for; a cookie without one (added by hand) goes everywhere. */
+    cookiePaths = new Map();
     history = [];
     listeners = [];
 }
@@ -136,8 +138,10 @@ export class HttpClient {
         const stub = url.origin === new URL(this.baseUrl).origin ? undefined : lookupHost(this.#session.external, url.hostname);
         // The app's cookies stay with the app; the stub is reached at its own address.
         const target = stub ? new URL(url.pathname + url.search, stub) : url;
-        if (!stub && this.#session.cookies.size > 0 && !headers.has("cookie")) {
-            headers.set("cookie", [...this.#session.cookies].map(([k, v]) => `${k}=${v}`).join("; "));
+        if (!stub && !headers.has("cookie")) {
+            const cookie = this.#cookieHeader(url.pathname);
+            if (cookie)
+                headers.set("cookie", cookie);
         }
         let payload;
         if (body === undefined ||
@@ -165,7 +169,7 @@ export class HttpClient {
         }
         if (!stub)
             for (const cookie of res.headers.getSetCookie())
-                this.#storeCookie(cookie);
+                this.#storeCookie(cookie, url.pathname);
         const text = await res.text();
         let json;
         try {
@@ -207,6 +211,7 @@ export class HttpClient {
     }
     clearCookies() {
         this.#session.cookies.clear();
+        this.#session.cookiePaths.clear();
     }
     /** Requests made during the current scenario, oldest first (last 20). */
     get history() {
@@ -214,29 +219,65 @@ export class HttpClient {
     }
     /** Start a new scenario: forget cookies and history. */
     reset() {
-        this.#session.cookies.clear();
+        this.clearCookies();
         this.#session.history = [];
     }
-    #storeCookie(header) {
+    /** Cookies whose Path covers `requestPath`, longest Path first as browsers send them (RFC 6265 5.4). */
+    #cookieHeader(requestPath) {
+        const { cookies, cookiePaths } = this.#session;
+        return [...cookies]
+            .map(([name, value]) => ({ name, value, path: cookiePaths.get(name) ?? "/" }))
+            .filter((c) => pathMatches(requestPath, c.path))
+            .sort((a, b) => b.path.length - a.path.length)
+            .map((c) => `${c.name}=${c.value}`)
+            .join("; ");
+    }
+    #storeCookie(header, requestPath) {
         const [pair, ...attrs] = header.split(";");
         const eq = pair.indexOf("=");
         if (eq <= 0)
             return;
         const name = pair.slice(0, eq).trim();
-        const expired = attrs.some((a) => {
-            const [k, v = ""] = a.split("=").map((s) => s.trim());
-            if (k.toLowerCase() === "max-age")
-                return Number(v) <= 0;
-            if (k.toLowerCase() === "expires")
-                return Date.parse(v) <= Date.now();
-            return false;
-        });
-        if (expired)
+        let maxAge;
+        let expires;
+        let cookiePath;
+        for (const a of attrs) {
+            const i = a.indexOf("=");
+            const k = (i < 0 ? a : a.slice(0, i)).trim().toLowerCase();
+            const v = i < 0 ? "" : a.slice(i + 1).trim();
+            if (k === "max-age")
+                maxAge = Number(v);
+            else if (k === "expires")
+                expires = Date.parse(v);
+            else if (k === "path" && v.startsWith("/"))
+                cookiePath = v;
+        }
+        // Max-Age wins over Expires whichever comes first.
+        const expired = maxAge !== undefined && !Number.isNaN(maxAge) ? maxAge <= 0 : expires !== undefined && expires <= Date.now();
+        // Keyed by name alone: a second cookie of the same name under another Path replaces the first.
+        if (expired) {
             this.#session.cookies.delete(name);
-        else
+            this.#session.cookiePaths.delete(name);
+        }
+        else {
             this.#session.cookies.set(name, pair.slice(eq + 1).trim());
+            this.#session.cookiePaths.set(name, cookiePath ?? defaultCookiePath(requestPath));
+        }
     }
 }
+/** RFC 6265 5.1.4: the request path's directory, e.g. "/auth" for "/auth/login". */
+function defaultCookiePath(requestPath) {
+    const slash = requestPath.lastIndexOf("/");
+    return slash <= 0 ? "/" : requestPath.slice(0, slash);
+}
+/** RFC 6265 5.1.4: "/api" covers "/api" and "/api/x" but not "/apix". */
+function pathMatches(requestPath, cookiePath) {
+    if (requestPath === cookiePath)
+        return true;
+    if (!requestPath.startsWith(cookiePath))
+        return false;
+    return cookiePath.endsWith("/") || requestPath[cookiePath.length] === "/";
+}
 function merge(a, b) {
     return {
         ...a,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "slicetest",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Framework-agnostic slice tests: drive a real app process over HTTP with a real Postgres, MySQL or SQLite and stubbed outbound APIs, checked against OpenAPI contracts.",
   "keywords": [
     "testing",