104 lines
4.4 KiB
TypeScript
104 lines
4.4 KiB
TypeScript
import { expect, test } from "bun:test";
|
|
import {
|
|
encodeControlTemplate,
|
|
resolveControlTemplate,
|
|
renderControlTemplates,
|
|
} from "../src/control-templates.ts";
|
|
import { runWithRequestContext } from "../src/request-context.ts";
|
|
import { createContext } from "../src/context.ts";
|
|
import { resolveRequestUrl } from "../src/headers.ts";
|
|
|
|
test("registry templates omit duplicated SSR ranges but preserve source and foreign controls", () => {
|
|
runWithRequestContext({} as never, () => {
|
|
const leaf = `<p>${"Large leaf".repeat(400)}</p>`;
|
|
let body = leaf;
|
|
for (let depth = 0; depth < 12; depth++) {
|
|
const reference = encodeControlTemplate([{ cond: "open", body }]);
|
|
body = `<template data-wrn-if="${reference}"></template>${body}<template data-wrn-control-end></template>`;
|
|
}
|
|
const html = renderControlTemplates();
|
|
expect(html.length).toBeLessThan(10000);
|
|
const compacted = JSON.parse(/data-wrn-controls[^>]*>(.*?)<\/script>/s.exec(html)![1]!);
|
|
expect(
|
|
compacted.filter((branches: Array<{ body: string }>) => branches[0]!.body.includes(leaf)),
|
|
).toHaveLength(1);
|
|
expect(html).toContain("data-wrn-control-client");
|
|
expect(body).toContain(leaf);
|
|
const foreign =
|
|
'<template data-wrn-if="@foreign:0"></template><b>Keep</b><template data-wrn-control-end></template>';
|
|
const incomplete = body.replace(/<template data-wrn-control-end><\/template>$/, "");
|
|
encodeControlTemplate([
|
|
{ cond: null, body: foreign },
|
|
{ cond: null, body: incomplete },
|
|
]);
|
|
const definitions = JSON.parse(
|
|
/data-wrn-controls[^>]*>(.*?)<\/script>/s.exec(renderControlTemplates())![1]!,
|
|
);
|
|
expect(definitions[12][0].body).toBe(foreign);
|
|
expect(definitions[12][1].body).toBe(incomplete);
|
|
});
|
|
});
|
|
|
|
test("nested controls use short references and HTML-safe isolated registries", async () => {
|
|
const results = await Promise.all(
|
|
["first", "second"].map((name) =>
|
|
runWithRequestContext({} as never, async () => {
|
|
let body = `</script><p>${name}</p>`;
|
|
for (let i = 0; i < 30; i++) {
|
|
body = `<template data-wrn-if="${encodeControlTemplate([{ cond: null, body }])}"></template>`;
|
|
}
|
|
await Promise.resolve();
|
|
const html = renderControlTemplates();
|
|
expect(html.length).toBeLessThan(7000);
|
|
expect(html.match(/<\/script>/g)).toHaveLength(1);
|
|
return html;
|
|
}),
|
|
),
|
|
);
|
|
expect(results[0]).toContain("first");
|
|
expect(results[0]).not.toContain("second");
|
|
expect(results[1]).not.toContain("first");
|
|
expect(renderControlTemplates()).toBe("");
|
|
});
|
|
|
|
test("standalone rendering keeps the base64 format", () => {
|
|
expect(JSON.parse(Buffer.from(encodeControlTemplate([1]), "base64").toString())).toEqual([1]);
|
|
});
|
|
|
|
test("SSR control resolution accepts only the owning request and exact registry index", async () => {
|
|
let reference = "";
|
|
await runWithRequestContext({} as never, async () => {
|
|
const definition = [{ cond: "review", body: "<p>Review</p>" }];
|
|
reference = encodeControlTemplate(definition);
|
|
expect(resolveControlTemplate(reference)).toBe(definition);
|
|
expect(resolveControlTemplate(reference + "0")).toBeUndefined();
|
|
expect(resolveControlTemplate(reference.replace(/:0$/, ":-1"))).toBeUndefined();
|
|
expect(resolveControlTemplate(reference.replace(/:0$/, ":1"))).toBeUndefined();
|
|
await runWithRequestContext({} as never, async () => {
|
|
encodeControlTemplate([{ body: "Other request" }]);
|
|
expect(resolveControlTemplate(reference)).toBeUndefined();
|
|
});
|
|
expect(resolveControlTemplate(reference)).toBe(definition);
|
|
});
|
|
expect(resolveControlTemplate(reference)).toBeUndefined();
|
|
});
|
|
|
|
test("trusted proxy request URL and body agree with context; untrusted headers are ignored", async () => {
|
|
for (const trust of [true, false]) {
|
|
const request = new Request("http://internal:3000/api/captcha/challenge", {
|
|
method: "POST",
|
|
body: '{"test":1}',
|
|
headers: {
|
|
"x-forwarded-proto": "https",
|
|
"x-forwarded-host": "wrnexus.com",
|
|
origin: "https://evil.example",
|
|
},
|
|
});
|
|
const context = createContext(request, resolveRequestUrl(request, trust));
|
|
expect(context.req.url).toBe(context.url.href);
|
|
expect(context.url.origin).toBe(trust ? "https://wrnexus.com" : "http://internal:3000");
|
|
expect(context.req.headers.get("origin")).toBe("https://evil.example");
|
|
expect(await context.req.json()).toEqual({ test: 1 });
|
|
}
|
|
});
|