auth-portal/apps/api/test/http-layer.test.ts

import { mkdirSync, mkdtempSync, writeFileSync } from 'node:fs'
import { tmpdir } from 'node:os'
import { join } from 'node:path'
import { afterEach, describe, expect, it } from 'vitest'
import { createOriginChecker } from '../src/lib/cors.js'
import { loadConfig } from '../src/config.js'
import { buildTestApp } from './helpers.js'

let app: Awaited<ReturnType<typeof buildTestApp>> | undefined
afterEach(async () => {
  await app?.close()
  app = undefined
})

function staticDir(): string {
  const dir = mkdtempSync(join(tmpdir(), 'ap-static-'))
  mkdirSync(join(dir, 'assets'))
  writeFileSync(join(dir, 'index.html'), '<html>spa</html>')
  writeFileSync(join(dir, 'assets', 'app-abc123.js'), 'console.log(1)')
  return dir
}

describe('статика', () => {
  it('hashed-ассеты immutable, index.html no-cache', async () => {
    app = await buildTestApp({ STATIC_DIR: staticDir() })
    const asset = await app.inject({ method: 'GET', url: '/assets/app-abc123.js' })
    expect(asset.statusCode).toBe(200)
    expect(asset.headers['cache-control']).toBe(
      'public, max-age=31536000, immutable',
    )
    const index = await app.inject({ method: 'GET', url: '/index.html' })
    expect(index.headers['cache-control']).toBe('no-cache')
    const spa = await app.inject({ method: 'GET', url: '/users/42' })
    expect(spa.statusCode).toBe(200)
    expect(spa.headers['cache-control']).toBe('no-cache')
  })

  it('отсутствующий ассет → не отдаёт index.html как JS (404 JSON или html, но не 200 js)', async () => {
    app = await buildTestApp({ STATIC_DIR: staticDir() })
    const res = await app.inject({ method: 'GET', url: '/assets/missing.js' })
    // SPA-fallback допустим только как html; кэшироваться как immutable он не должен
    expect(res.headers['cache-control']).not.toContain('immutable')
  })

  it('отдаёт предсжатый .br по Accept-Encoding', async () => {
    const dir = staticDir()
    writeFileSync(join(dir, 'assets', 'app-abc123.js.br'), 'BR-BYTES')
    app = await buildTestApp({ STATIC_DIR: dir })
    const res = await app.inject({
      method: 'GET',
      url: '/assets/app-abc123.js',
      headers: { 'accept-encoding': 'br' },
    })
    expect(res.headers['content-encoding']).toBe('br')
    expect(res.body).toBe('BR-BYTES')
  })
})

describe('кэш-заголовки API', () => {
  it('app-switcher и auth/config кэшируются коротко', async () => {
    app = await buildTestApp()
    const sw = await app.inject({ method: 'GET', url: '/api/v1/app-switcher' })
    expect(sw.headers['cache-control']).toBe('public, max-age=30')
    const cfg = await app.inject({ method: 'GET', url: '/api/v1/auth/config' })
    expect(cfg.headers['cache-control']).toBe('public, max-age=60')
  })
})

describe('health / ready', () => {
  it('/health не трогает БД и живёт после закрытия БД', async () => {
    app = await buildTestApp()
    app.sqlite.close()
    const res = await app.inject({ method: 'GET', url: '/health' })
    expect(res.statusCode).toBe(200)
  })

  it('/ready 200 в норме и 503 при недоступной БД', async () => {
    app = await buildTestApp()
    const ok = await app.inject({ method: 'GET', url: '/ready' })
    expect(ok.statusCode).toBe(200)
    app.sqlite.close()
    const bad = await app.inject({ method: 'GET', url: '/ready' })
    expect(bad.statusCode).toBe(503)
    expect(bad.json()).toEqual({ ok: false, reason: 'db' })
  })
})

describe('CORS', () => {
  const origin = (url: string) => ({ origin: url })

  it('разрешает issuer/allowlist, блокирует чужие', async () => {
    app = await buildTestApp({ RETURN_TO_ALLOWLIST: '.test.local,localhost' })
    const allowed = await app.inject({
      method: 'GET',
      url: '/api/v1/auth/config',
      headers: origin('https://auth.test.local'),
    })
    expect(allowed.headers['access-control-allow-origin']).toBe(
      'https://auth.test.local',
    )
    expect(allowed.headers['access-control-allow-credentials']).toBe('true')

    const foreign = await app.inject({
      method: 'GET',
      url: '/api/v1/auth/config',
      headers: origin('https://evil.example'),
    })
    expect(foreign.headers['access-control-allow-origin']).toBeUndefined()
  })

  it('CORS_ORIGINS добавляет origin; запрос без Origin проходит', async () => {
    app = await buildTestApp({ CORS_ORIGINS: 'https://extra.example' })
    const res = await app.inject({
      method: 'GET',
      url: '/api/v1/auth/config',
      headers: origin('https://extra.example'),
    })
    expect(res.headers['access-control-allow-origin']).toBe(
      'https://extra.example',
    )
    const none = await app.inject({ method: 'GET', url: '/api/v1/auth/config' })
    expect(none.statusCode).toBe(200)
  })

  it('createOriginChecker: суффикс, localhost, switcher, *', () => {
    const base = {
      JWT_SECRET: 'test-secret-at-least-8',
      ISSUER: 'https://auth.test.local',
      RETURN_TO_ALLOWLIST: '.shnt.top,localhost,private',
    }
    const check = createOriginChecker(loadConfig(base), () => [
      'https://dns.custom.io/path',
    ])
    expect(check('https://cfdm.shnt.top')).toBe(true)
    expect(check('http://localhost:5173')).toBe(true)
    expect(check('https://dns.custom.io')).toBe(true)
    expect(check('https://evilshnt.top')).toBe(false)
    expect(check('not a url')).toBe(false)
    const all = createOriginChecker(
      loadConfig({ ...base, CORS_ORIGINS: '*' }),
      () => [],
    )
    expect(all('https://anything.example')).toBe(true)
  })
})