|
| 1 | +import { test } from 'node:test'; |
| 2 | +import assert from 'node:assert/strict'; |
| 3 | +import { HttpActionClient, type FetchLike, type FetchResponse } from './client.ts'; |
| 4 | +import { readConfig, type HttpAction, type HttpActionConfig } from './config.ts'; |
| 5 | + |
| 6 | +interface Captured { |
| 7 | + url?: string; |
| 8 | + init?: { method?: string; headers?: Record<string, string>; body?: string; timeoutMs?: number }; |
| 9 | +} |
| 10 | + |
| 11 | +// A recording fake mirroring PluginNetCapability.fetch(url, init). Returns a canned response, captures the call. |
| 12 | +function fakeFetch(capture: Captured, res: { ok?: boolean; status?: number; body: string }): FetchLike { |
| 13 | + return async (url: string, init?: Captured['init']): Promise<FetchResponse> => { |
| 14 | + capture.url = url; |
| 15 | + capture.init = init; |
| 16 | + return { ok: res.ok ?? true, status: res.status ?? 200, statusText: 'OK', headers: {}, body: res.body }; |
| 17 | + }; |
| 18 | +} |
| 19 | + |
| 20 | +function cfgWith(over: Record<string, unknown> = {}): { config: HttpActionConfig; action: HttpAction } { |
| 21 | + const config = readConfig({ |
| 22 | + baseUrl: 'https://api.example.com', |
| 23 | + actions: JSON.stringify([{ |
| 24 | + id: 'check', match: { type: 'prefix', value: 'cek ' }, |
| 25 | + request: { method: 'GET', path: '/orders/{{args.0}}', query: { zone: '{{args.1}}' }, headers: { 'X-Trace': '{{message.id}}' } }, |
| 26 | + replyTemplate: '{{response.status}}', |
| 27 | + }, { |
| 28 | + id: 'create', match: { type: 'prefix', value: 'buat ' }, |
| 29 | + request: { method: 'POST', path: '/tickets', bodyTemplate: '{"desc":"{{args.0}}"}' }, |
| 30 | + replyTemplate: '{{response.id}}', |
| 31 | + }]), |
| 32 | + ...over, |
| 33 | + }); |
| 34 | + return { config, action: config.actions[0] }; |
| 35 | +} |
| 36 | + |
| 37 | +test('GET builds the URL from baseUrl + rendered (encoded) path', async () => { |
| 38 | + const { config, action } = cfgWith(); |
| 39 | + const cap: Captured = {}; |
| 40 | + await new HttpActionClient(fakeFetch(cap, { body: '{}' }), config).run(action, { args: ['INV 001'] }); |
| 41 | + assert.equal(cap.url, 'https://api.example.com/orders/INV%20001'); |
| 42 | +}); |
| 43 | + |
| 44 | +test('GET has no body', async () => { |
| 45 | + const { config, action } = cfgWith(); |
| 46 | + const cap: Captured = {}; |
| 47 | + await new HttpActionClient(fakeFetch(cap, { body: '{}' }), config).run(action, { args: ['X'] }); |
| 48 | + assert.equal(cap.init?.body, undefined); |
| 49 | +}); |
| 50 | + |
| 51 | +test('GET appends an encoded query string from a templated value', async () => { |
| 52 | + const { config, action } = cfgWith(); |
| 53 | + const cap: Captured = {}; |
| 54 | + await new HttpActionClient(fakeFetch(cap, { body: '{}' }), config).run(action, { args: ['X', 'jakarta barat'] }); |
| 55 | + assert.match(cap.url ?? '', /\?zone=jakarta%20barat$/); |
| 56 | +}); |
| 57 | + |
| 58 | +test('action header values are rendered', async () => { |
| 59 | + const { config, action } = cfgWith(); |
| 60 | + const cap: Captured = {}; |
| 61 | + await new HttpActionClient(fakeFetch(cap, { body: '{}' }), config).run(action, { args: ['X'], message: { id: 'm1' } }); |
| 62 | + assert.equal(cap.init?.headers?.['X-Trace'], 'm1'); |
| 63 | +}); |
| 64 | + |
| 65 | +test('a header value with CR/LF (via an attacker-controlled arg) is rejected, never sent', async () => { |
| 66 | + const { config, action } = cfgWith(); |
| 67 | + const cap: Captured = {}; |
| 68 | + // action.request.headers = { 'X-Trace': '{{message.id}}' }; send a body whose id carries a newline |
| 69 | + await assert.rejects( |
| 70 | + () => new HttpActionClient(fakeFetch(cap, { body: '{}' }), config).run(action, { args: ['X'], message: { id: 'm1\nInjected: evil' } }), |
| 71 | + /CR\/LF|header/i, |
| 72 | + ); |
| 73 | + assert.equal(cap.url, undefined); // fetch was never called |
| 74 | +}); |
| 75 | + |
| 76 | +test('bearer auth adds Authorization: Bearer <token>', async () => { |
| 77 | + const { config, action } = cfgWith({ authType: 'bearer', authToken: 'tok123' }); |
| 78 | + const cap: Captured = {}; |
| 79 | + await new HttpActionClient(fakeFetch(cap, { body: '{}' }), config).run(action, { args: ['X'] }); |
| 80 | + assert.equal(cap.init?.headers?.['Authorization'], 'Bearer tok123'); |
| 81 | +}); |
| 82 | + |
| 83 | +test('apikey auth adds the configured header name', async () => { |
| 84 | + const { config, action } = cfgWith({ authType: 'apikey', authToken: 'key123', apiKeyHeader: 'X-Api-Key' }); |
| 85 | + const cap: Captured = {}; |
| 86 | + await new HttpActionClient(fakeFetch(cap, { body: '{}' }), config).run(action, { args: ['X'] }); |
| 87 | + assert.equal(cap.init?.headers?.['X-Api-Key'], 'key123'); |
| 88 | + assert.equal(cap.init?.headers?.['Authorization'], undefined); |
| 89 | +}); |
| 90 | + |
| 91 | +test('none auth adds no auth header', async () => { |
| 92 | + const { config, action } = cfgWith(); |
| 93 | + const cap: Captured = {}; |
| 94 | + await new HttpActionClient(fakeFetch(cap, { body: '{}' }), config).run(action, { args: ['X'] }); |
| 95 | + assert.equal(cap.init?.headers?.['Authorization'], undefined); |
| 96 | +}); |
| 97 | + |
| 98 | +test('POST sends a rendered, re-parsed JSON body with application/json content type', async () => { |
| 99 | + const { config } = cfgWith(); |
| 100 | + const action = config.actions[1]; // 'create' POST |
| 101 | + const cap: Captured = {}; |
| 102 | + await new HttpActionClient(fakeFetch(cap, { body: '{}' }), config).run(action, { args: ['internet mati'] }); |
| 103 | + assert.equal(cap.init?.method, 'POST'); |
| 104 | + assert.equal(cap.init?.headers?.['Content-Type'], 'application/json'); |
| 105 | + assert.deepEqual(JSON.parse(cap.init?.body ?? '{}'), { desc: 'internet mati' }); |
| 106 | +}); |
| 107 | + |
| 108 | +test('parses a JSON response body into data', async () => { |
| 109 | + const { config, action } = cfgWith(); |
| 110 | + const client = new HttpActionClient(fakeFetch({}, { body: JSON.stringify({ status: 'shipped' }) }), config); |
| 111 | + const out = await client.run(action, { args: ['X'] }); |
| 112 | + assert.deepEqual(out.data, { status: 'shipped' }); |
| 113 | + assert.equal(out.status, 200); |
| 114 | +}); |
| 115 | + |
| 116 | +test('a response body over the 256 KiB cap is rejected', async () => { |
| 117 | + const { config, action } = cfgWith(); |
| 118 | + const big = 'x'.repeat(256 * 1024 + 1); |
| 119 | + const client = new HttpActionClient(fakeFetch({}, { body: big }), config); |
| 120 | + await assert.rejects(() => client.run(action, { args: ['X'] }), /too large|RESPONSE_TOO_LARGE/i); |
| 121 | +}); |
| 122 | + |
| 123 | +test('a non-JSON body on a 2xx response throws (UPSTREAM_INVALID_JSON)', async () => { |
| 124 | + const { config, action } = cfgWith(); |
| 125 | + const client = new HttpActionClient(fakeFetch({}, { ok: true, status: 200, body: 'not json' }), config); |
| 126 | + await assert.rejects(() => client.run(action, { args: ['X'] }), /invalid json|UPSTREAM_INVALID_JSON/i); |
| 127 | +}); |
| 128 | + |
| 129 | +test('a non-ok status (404) is returned, not thrown, with the status', async () => { |
| 130 | + const { config, action } = cfgWith(); |
| 131 | + const client = new HttpActionClient(fakeFetch({}, { ok: false, status: 404, body: '{"error":"none"}' }), config); |
| 132 | + const out = await client.run(action, { args: ['X'] }); |
| 133 | + assert.equal(out.status, 404); |
| 134 | + assert.deepEqual(out.data, { error: 'none' }); |
| 135 | +}); |
| 136 | + |
| 137 | +test('timeoutMs from config is passed to fetch init', async () => { |
| 138 | + const { config, action } = cfgWith({ timeoutMs: 2500 }); |
| 139 | + const cap: Captured = {}; |
| 140 | + await new HttpActionClient(fakeFetch(cap, { body: '{}' }), config).run(action, { args: ['X'] }); |
| 141 | + assert.equal(cap.init?.timeoutMs, 2500); |
| 142 | +}); |
0 commit comments