ClintchizandClaude Opus 5
e01915823a
Brings the uncommitted body of work under version control so it cannot be
lost. Gates are green: 152 tests pass across rpc/router/dev-server,
typecheck, lint, format and check:public-api all clean.
NOT YET REVIEWED. None of Tasks 5-11 has had an independent task review, and
Task 4's second fix round was never re-reviewed either.
Known gaps against the plan, recorded here rather than discovered later:
- packages/rpc/test/{transport,server,client}.test.ts are ABSENT. The plan
required a test file for each. server.ts holds the fail-closed identity and
permission checks and currently has no direct coverage at all.
- rpc-endpoint.test.ts has 3 tests where the plan specified 9. Missing:
unknown service, non-POST, malformed body, non-rpc passthrough, and the
isInternalCaller sweep. This is the task where a reachable
/__wrnexus/rpc/* makes every permission check in the workspace bypassable.
- http.test.ts has 3 of 7; integration.test.ts 2 of 3;
services-discovery.test.ts 1 of 4.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
77 lines
2.7 KiB
TypeScript
77 lines
2.7 KiB
TypeScript
import { expect, test } from "bun:test";
|
|
import { HealthRegistry } from "@wrnexus/core";
|
|
import type { Router } from "@wrnexus/router";
|
|
import { createHandlers, type RuntimeDeps } from "../src/runtime.ts";
|
|
|
|
function runtime(health: HealthRegistry, trustProxy = false) {
|
|
const router: Router = {
|
|
pages: [],
|
|
api: [],
|
|
realtime: [],
|
|
middlewareFiles: [],
|
|
components: [],
|
|
layouts: [],
|
|
stores: [],
|
|
schemas: [],
|
|
authz: [],
|
|
services: [],
|
|
matchPage: () => null,
|
|
matchApi: () => null,
|
|
matchRealtime: () => null,
|
|
};
|
|
return createHandlers({
|
|
mode: "production",
|
|
hmr: false,
|
|
router,
|
|
loadModule: async () => ({}),
|
|
getMiddleware: async () => [],
|
|
assets: { serve: async () => null },
|
|
health,
|
|
security: { trustProxy },
|
|
observability: { enabled: true, webVitals: true, sampleRate: 1, exporter: "none" },
|
|
} satisfies RuntimeDeps);
|
|
}
|
|
|
|
const server = { upgrade: () => false };
|
|
|
|
test("runtime exposes separate liveness and dependency readiness probes", async () => {
|
|
const health = new HealthRegistry();
|
|
health.register("database", () => ({ status: "down", message: "offline" }));
|
|
const handlers = runtime(health);
|
|
|
|
const live = await handlers.fetch(new Request("https://example.test/healthz"), server);
|
|
const ready = await handlers.fetch(new Request("https://example.test/readyz"), server);
|
|
|
|
expect(live?.status).toBe(200);
|
|
expect(await live?.json()).toEqual({ status: "up" });
|
|
expect(ready?.status).toBe(503);
|
|
expect(await ready?.json()).toEqual({ status: "down" });
|
|
});
|
|
|
|
test("accepts same-origin vitals behind a trusted HTTPS proxy", async () => {
|
|
const handlers = runtime(new HealthRegistry(), true);
|
|
const response = await handlers.fetch(
|
|
new Request("http://internal:3000/__wrnexus/metrics/vitals", {
|
|
method: "POST",
|
|
headers: {
|
|
origin: "https://wrnexusjs.dev",
|
|
"x-forwarded-host": "wrnexusjs.dev",
|
|
"x-forwarded-proto": "https",
|
|
"content-type": "application/json",
|
|
},
|
|
body: JSON.stringify({ name: "LCP", value: 1200, route: "/packages" }),
|
|
}),
|
|
server,
|
|
);
|
|
expect(response?.status).toBe(204);
|
|
});
|
|
|
|
test("built production responses carry the framework security-header baseline", async () => {
|
|
const handlers = runtime(new HealthRegistry());
|
|
const response = await handlers.fetch(new Request("https://example.test/healthz"), server);
|
|
expect(response?.headers.get("strict-transport-security")).toContain("max-age=");
|
|
expect(response?.headers.get("content-security-policy")).toContain("default-src 'self'");
|
|
expect(response?.headers.get("x-content-type-options")).toBe("nosniff");
|
|
expect(response?.headers.get("referrer-policy")).toBeTruthy();
|
|
});
|