Something went wrong. Try again.
Monorepo for Tangled tangled.org
Something went wrong. Try again.
TypeScript
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";import { handle } from "./hooks.server";
const config = vi.hoisted(() => ({ sitemapUrl: "" }));vi.mock("#lib/server/config.ts", () => ({ getConfig: () => config }));
const run = (path: string, binding?: (request: Request) => Promise<Response>) => { const resolve = vi.fn(async () => new Response("page")); const url = new URL(`https://next.tangled.org${path}`); const event = { url, request: new Request(url), platform: binding ? { env: { SITEMAP: { fetch: binding } } } : undefined }; return { res: handle({ event, resolve } as unknown as Parameters<typeof handle>[0]), resolve };};
beforeEach(() => { config.sitemapUrl = ""; vi.spyOn(console, "warn").mockImplementation(() => {});});afterEach(() => vi.unstubAllGlobals());
describe("handle: sitemaps", () => { it("prefers the worker binding", async () => { config.sitemapUrl = "https://sitemap.test"; const binding = vi.fn(async () => new Response("bound")); const network = vi.fn(); vi.stubGlobal("fetch", network); const { res } = run("/sitemap.xml", binding); await expect((await res).text()).resolves.toBe("bound"); expect(network).not.toHaveBeenCalled(); });
it.each(["/sitemap.xml", "/sitemaps/repos-3.xml?v=2"])( "fetches %s from SITEMAP_URL without a binding, dropping the decoded encoding", async (path) => { config.sitemapUrl = "https://sitemap.test"; const network = vi.fn( async (_: string) => new Response("<urlset/>", { headers: { "content-type": "application/xml", "content-encoding": "gzip", "content-length": "9" } }) ); vi.stubGlobal("fetch", network); const { res, resolve } = run(path); const out = await res; expect(network).toHaveBeenCalledWith(`https://sitemap.test${path}`); expect(resolve).not.toHaveBeenCalled(); await expect(out.text()).resolves.toBe("<urlset/>"); expect(out.headers.get("content-type")).toBe("application/xml"); expect(out.headers.get("content-encoding")).toBeNull(); expect(out.headers.get("content-length")).toBeNull(); } );
it("falls through to the app with neither", async () => { const network = vi.fn(); vi.stubGlobal("fetch", network); const { res, resolve } = run("/sitemap.xml"); await expect((await res).text()).resolves.toBe("page"); expect(resolve).toHaveBeenCalledOnce(); expect(network).not.toHaveBeenCalled(); });});
describe("handle: security headers", () => { const page = async (response: Response) => { const url = new URL("https://next.tangled.org/someone/repo"); const event = { url, request: new Request(url), platform: undefined }; const resolve = vi.fn(async () => response); return handle({ event, resolve } as unknown as Parameters<typeof handle>[0]); };
it("adds them to a rendered response", async () => { const res = await page(new Response("page")); expect(Object.fromEntries(res.headers)).toMatchObject({ "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin", "x-frame-options": "DENY", "content-security-policy": "frame-ancestors 'none'" }); await expect(res.text()).resolves.toBe("page"); });
it("keeps a header the route set itself", async () => { const own = "sandbox; default-src 'none'"; const res = await page( new Response("raw", { headers: { "content-security-policy": own } }) ); expect(res.headers.get("content-security-policy")).toBe(own); expect(res.headers.get("x-frame-options")).toBe("DENY"); });
it("copies a response whose headers can't be changed", async () => { const res = await page(Response.redirect("https://cdn.example.com/a", 302)); expect(res.status).toBe(302); expect(res.headers.get("location")).toBe("https://cdn.example.com/a"); expect(res.headers.get("x-content-type-options")).toBe("nosniff"); });});