Clintchiz
e7743cdbb5
Scan app/authz/<name>.{ts,js} the same way app/schemas is scanned,
exposing Router.authz: ComponentRef[]. Also update the two other
literal Router construction sites (prod runtime, dev-server test
fixture) that now need the new required field.
scanDir gains an optional extraExtensions parameter (default []) so
the authz scan can accept .js files without widening the extension
allow-list used by route scanning (app/pages, app/api, app/realtime),
which would otherwise leak .js into generated route URLs via
fileToRoute.
76 lines
2.6 KiB
TypeScript
76 lines
2.6 KiB
TypeScript
import { expect, test } from "bun:test";
|
|
import { HealthRegistry } from "@wrnexus/core";
|
|
import type { Router } from "@wrnexus/router";
|
|
import { createHandlers, type RuntimeDeps } from "../src/runtime.ts";
|
|
|
|
function runtime(health: HealthRegistry, trustProxy = false) {
|
|
const router: Router = {
|
|
pages: [],
|
|
api: [],
|
|
realtime: [],
|
|
middlewareFiles: [],
|
|
components: [],
|
|
layouts: [],
|
|
stores: [],
|
|
schemas: [],
|
|
authz: [],
|
|
matchPage: () => null,
|
|
matchApi: () => null,
|
|
matchRealtime: () => null,
|
|
};
|
|
return createHandlers({
|
|
mode: "production",
|
|
hmr: false,
|
|
router,
|
|
loadModule: async () => ({}),
|
|
getMiddleware: async () => [],
|
|
assets: { serve: async () => null },
|
|
health,
|
|
security: { trustProxy },
|
|
observability: { enabled: true, webVitals: true, sampleRate: 1, exporter: "none" },
|
|
} satisfies RuntimeDeps);
|
|
}
|
|
|
|
const server = { upgrade: () => false };
|
|
|
|
test("runtime exposes separate liveness and dependency readiness probes", async () => {
|
|
const health = new HealthRegistry();
|
|
health.register("database", () => ({ status: "down", message: "offline" }));
|
|
const handlers = runtime(health);
|
|
|
|
const live = await handlers.fetch(new Request("https://example.test/healthz"), server);
|
|
const ready = await handlers.fetch(new Request("https://example.test/readyz"), server);
|
|
|
|
expect(live?.status).toBe(200);
|
|
expect(await live?.json()).toEqual({ status: "up" });
|
|
expect(ready?.status).toBe(503);
|
|
expect(await ready?.json()).toEqual({ status: "down" });
|
|
});
|
|
|
|
test("accepts same-origin vitals behind a trusted HTTPS proxy", async () => {
|
|
const handlers = runtime(new HealthRegistry(), true);
|
|
const response = await handlers.fetch(
|
|
new Request("http://internal:3000/__wrnexus/metrics/vitals", {
|
|
method: "POST",
|
|
headers: {
|
|
origin: "https://wrnexusjs.dev",
|
|
"x-forwarded-host": "wrnexusjs.dev",
|
|
"x-forwarded-proto": "https",
|
|
"content-type": "application/json",
|
|
},
|
|
body: JSON.stringify({ name: "LCP", value: 1200, route: "/packages" }),
|
|
}),
|
|
server,
|
|
);
|
|
expect(response?.status).toBe(204);
|
|
});
|
|
|
|
test("built production responses carry the framework security-header baseline", async () => {
|
|
const handlers = runtime(new HealthRegistry());
|
|
const response = await handlers.fetch(new Request("https://example.test/healthz"), server);
|
|
expect(response?.headers.get("strict-transport-security")).toContain("max-age=");
|
|
expect(response?.headers.get("content-security-policy")).toContain("default-src 'self'");
|
|
expect(response?.headers.get("x-content-type-options")).toBe("nosniff");
|
|
expect(response?.headers.get("referrer-policy")).toBeTruthy();
|
|
});
|