Spaces:

YOGESHJIO5770
/

ai_api

Runtime error

File size: 14,470 Bytes

cd8bd0a

/**
 * T-07 — embed proxy route handler tests.
 *
 * Tests GET/POST/PUT/PATCH/DELETE handlers in
 * /dashboard/providers/services/[name]/embed/[...path]/route.ts.
 *
 * Uses registerSupervisor to inject fake supervisors (ESM live bindings
 * can't be reassigned, so direct module patching is not possible).
 */

import { describe, it, afterEach } from "node:test";
import assert from "node:assert/strict";

import { registerSupervisor, unregisterSupervisor } from "../../../src/lib/services/registry.ts";
import type { ServiceSupervisor } from "../../../src/lib/services/ServiceSupervisor.ts";
import {
  GET,
  POST,
  PUT,
  PATCH,
  DELETE,
  HEAD,
  OPTIONS,
} from "../../../src/app/(dashboard)/dashboard/providers/services/[name]/embed/[...path]/route.ts";

const originalFetch = globalThis.fetch;

afterEach(() => {
  globalThis.fetch = originalFetch;
  unregisterSupervisor("9router");
});

// ─── helpers ────────────────────────────────────────────────────────────────

function makeFakeParams(
  name: string,
  path: string[]
): { params: Promise<{ name: string; path: string[] }> } {
  return { params: Promise.resolve({ name, path }) };
}

function registerFake(state: string, port: number): void {
  const fake = {
    getStatus: () => ({
      tool: "9router",
      state,
      port,
      pid: null,
      health: "unknown" as const,
      startedAt: null,
      lastError: null,
    }),
  };
  registerSupervisor(fake as unknown as ServiceSupervisor);
}

// ─── tests ───────────────────────────────────────────────────────────────────

describe("embed proxy route", () => {
  it("returns 404 for unknown service", async () => {
    // No supervisor registered — getSupervisor returns null.
    const req = new Request("http://localhost/dashboard/providers/services/unknown/embed/");
    const resp = await GET(req, makeFakeParams("unknown", []));
    assert.equal(resp.status, 404);
  });

  it("returns 503 when service exists but is not running", async () => {
    registerFake("stopped", 20130);
    const req = new Request("http://localhost/dashboard/providers/services/9router/embed/");
    const resp = await GET(req, makeFakeParams("9router", []));
    assert.equal(resp.status, 503);
  });

  it("proxies GET to the upstream service", async () => {
    registerFake("running", 20130);
    let capturedUrl = "";
    globalThis.fetch = async (input: string | URL | Request) => {
      capturedUrl = String(input);
      return new Response("<html>9router UI</html>", {
        status: 200,
        headers: { "content-type": "text/html" },
      });
    };

    const req = new Request(
      "http://localhost/dashboard/providers/services/9router/embed/ui/index.html"
    );
    const resp = await GET(req, makeFakeParams("9router", ["ui", "index.html"]));

    assert.equal(resp.status, 200);
    assert.ok(capturedUrl.startsWith("http://127.0.0.1:20130/ui/index.html"));
    assert.ok((await resp.text()).includes("9router UI"));
  });

  it("forwards query string to upstream", async () => {
    registerFake("running", 20130);
    let capturedUrl = "";
    globalThis.fetch = async (input: string | URL | Request) => {
      capturedUrl = String(input);
      return new Response("{}", { status: 200 });
    };

    const req = new Request(
      "http://localhost/dashboard/providers/services/9router/embed/api/models?page=2"
    );
    await GET(req, makeFakeParams("9router", ["api", "models"]));
    assert.ok(capturedUrl.includes("?page=2"));
  });

  it("proxies POST and forwards body", async () => {
    registerFake("running", 20130);
    let capturedMethod = "";
    globalThis.fetch = async (_input: string | URL | Request, init?: RequestInit) => {
      capturedMethod = init?.method ?? "UNKNOWN";
      return new Response('{"ok":true}', { status: 200 });
    };

    const req = new Request("http://localhost/dashboard/providers/services/9router/embed/api/v1", {
      method: "POST",
      body: JSON.stringify({ test: 1 }),
      headers: { "content-type": "application/json" },
    });
    const resp = await POST(req, makeFakeParams("9router", ["api", "v1"]));
    assert.equal(resp.status, 200);
    assert.equal(capturedMethod, "POST");
  });

  it("strips hop-by-hop headers from the upstream response", async () => {
    registerFake("running", 20130);
    globalThis.fetch = async () =>
      new Response("body", {
        status: 200,
        headers: {
          "content-type": "text/plain",
          "transfer-encoding": "chunked",
          connection: "keep-alive",
          "x-custom": "kept",
        },
      });

    const req = new Request("http://localhost/dashboard/providers/services/9router/embed/");
    const resp = await GET(req, makeFakeParams("9router", []));
    assert.equal(resp.headers.get("x-custom"), "kept");
    assert.equal(resp.headers.get("transfer-encoding"), null);
    assert.equal(resp.headers.get("connection"), null);
  });

  it("returns 502 on upstream network error", async () => {
    registerFake("running", 20130);
    globalThis.fetch = async () => {
      throw new Error("ECONNREFUSED");
    };

    const req = new Request("http://localhost/dashboard/providers/services/9router/embed/");
    const resp = await GET(req, makeFakeParams("9router", []));
    assert.equal(resp.status, 502);
  });

  it("PUT, PATCH, DELETE are handled", async () => {
    registerFake("running", 20130);
    globalThis.fetch = async (_input: string | URL | Request, init?: RequestInit) =>
      new Response(null, { status: 204 });

    const params = makeFakeParams("9router", ["resource", "1"]);
    const reqUrl = "http://localhost/dashboard/providers/services/9router/embed/resource/1";

    assert.equal((await PUT(new Request(reqUrl, { method: "PUT" }), params)).status, 204);
    assert.equal((await PATCH(new Request(reqUrl, { method: "PATCH" }), params)).status, 204);
    assert.equal((await DELETE(new Request(reqUrl, { method: "DELETE" }), params)).status, 204);
  });

  // ─── G-05: cookie/auth strip + response header strip + HTML rewrite ──────────

  it("G-05: strips cookie header before forwarding to upstream", async () => {
    registerFake("running", 20130);
    let capturedHeaders: Record<string, string> = {};
    globalThis.fetch = async (_input: string | URL | Request, init?: RequestInit) => {
      for (const [k, v] of new Headers(init?.headers as HeadersInit).entries()) {
        capturedHeaders[k.toLowerCase()] = v;
      }
      return new Response("ok", { status: 200 });
    };

    const req = new Request("http://localhost/dashboard/providers/services/9router/embed/", {
      headers: { cookie: "session=abc123; jwt=secret" },
    });
    await GET(req, makeFakeParams("9router", []));
    assert.equal(capturedHeaders["cookie"], undefined, "cookie must not be forwarded upstream");
  });

  it("G-05: sets Authorization: Bearer on upstream request", async () => {
    registerFake("running", 20130);
    let capturedAuth: string | undefined;
    globalThis.fetch = async (_input: string | URL | Request, init?: RequestInit) => {
      capturedAuth = new Headers(init?.headers as HeadersInit).get("authorization") ?? undefined;
      return new Response("ok", { status: 200 });
    };

    const req = new Request("http://localhost/dashboard/providers/services/9router/embed/");
    await GET(req, makeFakeParams("9router", []));
    assert.ok(capturedAuth, "authorization header must be present");
    assert.ok(capturedAuth!.startsWith("Bearer "), "authorization must be a Bearer token");
  });

  it("G-05: strips client Authorization before forwarding, injects service key instead", async () => {
    registerFake("running", 20130);
    let capturedAuth: string | undefined;
    globalThis.fetch = async (_input: string | URL | Request, init?: RequestInit) => {
      capturedAuth = new Headers(init?.headers as HeadersInit).get("authorization") ?? undefined;
      return new Response("ok", { status: 200 });
    };

    const req = new Request("http://localhost/dashboard/providers/services/9router/embed/", {
      headers: { authorization: "Bearer client-token-should-not-leak" },
    });
    await GET(req, makeFakeParams("9router", []));
    assert.ok(capturedAuth, "authorization header must be set");
    assert.notEqual(
      capturedAuth,
      "Bearer client-token-should-not-leak",
      "client authorization must not be forwarded as-is"
    );
  });

  it("G-05: strips set-cookie from upstream response", async () => {
    registerFake("running", 20130);
    globalThis.fetch = async () =>
      new Response("ok", {
        status: 200,
        headers: { "set-cookie": "session=upstream; Path=/", "content-type": "text/plain" },
      });

    const resp = await GET(
      new Request("http://localhost/dashboard/providers/services/9router/embed/"),
      makeFakeParams("9router", [])
    );
    assert.equal(resp.headers.get("set-cookie"), null, "set-cookie must be stripped from response");
  });

  it("G-05: strips x-frame-options from upstream response", async () => {
    registerFake("running", 20130);
    globalThis.fetch = async () =>
      new Response("ok", {
        status: 200,
        headers: { "x-frame-options": "DENY", "content-type": "text/plain" },
      });

    const resp = await GET(
      new Request("http://localhost/dashboard/providers/services/9router/embed/"),
      makeFakeParams("9router", [])
    );
    assert.equal(resp.headers.get("x-frame-options"), null, "x-frame-options must be stripped");
  });

  it("G-05: strips content-security-policy from upstream response", async () => {
    registerFake("running", 20130);
    globalThis.fetch = async () =>
      new Response("ok", {
        status: 200,
        headers: {
          "content-security-policy": "default-src 'none'",
          "content-type": "text/plain",
        },
      });

    const resp = await GET(
      new Request("http://localhost/dashboard/providers/services/9router/embed/"),
      makeFakeParams("9router", [])
    );
    assert.equal(
      resp.headers.get("content-security-policy"),
      null,
      "content-security-policy must be stripped"
    );
  });

  it("G-05: strips cross-origin-* headers from upstream response", async () => {
    registerFake("running", 20130);
    globalThis.fetch = async () =>
      new Response("ok", {
        status: 200,
        headers: {
          "cross-origin-embedder-policy": "require-corp",
          "cross-origin-opener-policy": "same-origin",
          "cross-origin-resource-policy": "same-site",
          "content-type": "text/plain",
        },
      });

    const resp = await GET(
      new Request("http://localhost/dashboard/providers/services/9router/embed/"),
      makeFakeParams("9router", [])
    );
    assert.equal(
      resp.headers.get("cross-origin-embedder-policy"),
      null,
      "cross-origin-embedder-policy must be stripped"
    );
    assert.equal(
      resp.headers.get("cross-origin-opener-policy"),
      null,
      "cross-origin-opener-policy must be stripped"
    );
    assert.equal(
      resp.headers.get("cross-origin-resource-policy"),
      null,
      "cross-origin-resource-policy must be stripped"
    );
  });

  it("G-05: HTML response is rewritten — contains injected <base href>", async () => {
    registerFake("running", 20130);
    globalThis.fetch = async () =>
      new Response('<html><head></head><body><a href="/dashboard">link</a></body></html>', {
        status: 200,
        headers: { "content-type": "text/html; charset=utf-8" },
      });

    const resp = await GET(
      new Request("http://localhost/dashboard/providers/services/9router/embed/"),
      makeFakeParams("9router", [])
    );
    const body = await resp.text();
    assert.ok(
      body.includes('<base href="/dashboard/providers/services/9router/embed/">'),
      `Expected <base href> in rewritten HTML. Got: ${body.substring(0, 200)}`
    );
  });

  it("G-05: HTML response rewrites path-absolute links to go through proxy", async () => {
    registerFake("running", 20130);
    globalThis.fetch = async () =>
      new Response('<html><head></head><body><a href="/ui/page">x</a></body></html>', {
        status: 200,
        headers: { "content-type": "text/html" },
      });

    const resp = await GET(
      new Request("http://localhost/dashboard/providers/services/9router/embed/"),
      makeFakeParams("9router", [])
    );
    const body = await resp.text();
    assert.ok(
      body.includes('href="/dashboard/providers/services/9router/embed/ui/page"'),
      `Expected rewritten href. Got: ${body.substring(0, 300)}`
    );
  });

  it("G-05: JSON response is NOT rewritten (streaming pass-through)", async () => {
    registerFake("running", 20130);
    const jsonPayload = '{"models":["gpt-4","claude-3"]}';
    globalThis.fetch = async () =>
      new Response(jsonPayload, {
        status: 200,
        headers: { "content-type": "application/json" },
      });

    const resp = await GET(
      new Request("http://localhost/dashboard/providers/services/9router/embed/api/models"),
      makeFakeParams("9router", ["api", "models"])
    );
    const body = await resp.text();
    assert.equal(body, jsonPayload, "JSON response must pass through unchanged");
  });

  it("G-05: HEAD method is handled", async () => {
    registerFake("running", 20130);
    globalThis.fetch = async () =>
      new Response(null, { status: 200, headers: { "content-type": "text/html" } });

    const req = new Request("http://localhost/dashboard/providers/services/9router/embed/", {
      method: "HEAD",
    });
    const resp = await HEAD(req, makeFakeParams("9router", []));
    assert.equal(resp.status, 200);
  });

  it("G-05: OPTIONS method is handled", async () => {
    registerFake("running", 20130);
    globalThis.fetch = async () =>
      new Response(null, {
        status: 204,
        headers: { allow: "GET, HEAD, POST, OPTIONS" },
      });

    const req = new Request("http://localhost/dashboard/providers/services/9router/embed/", {
      method: "OPTIONS",
    });
    const resp = await OPTIONS(req, makeFakeParams("9router", []));
    assert.equal(resp.status, 204);
  });
});