Janady13/thatstupidcomputer / tests/api/api.test.ts

1import test, { type TestContext } from 'node:test'; 2import assert from 'node:assert/strict'; 3import { mkdtemp, mkdir, writeFile, rm, symlink } from 'node:fs/promises'; 4import { join, resolve } from 'node:path'; 5import { tmpdir } from 'node:os'; 6import { randomUUID } from 'node:crypto'; 7import { createApp, type AppOptions } from '../../apps/api/src/app.js'; 8import { loadConfig } from '../../apps/api/src/config.js'; 9import { htmlRoutes, animationJsonPaths } from '../../apps/api/src/static.js'; 10import type { MailMessage, MailTransport } from '../../apps/api/src/mail.js'; 11 12const origin = 'https://thatstupidcomputer.com'; 13const configured = { NODE_ENV: 'production', PUBLIC_ORIGIN: origin, SMTP_HOST: 'smtp.example.test', SMTP_PORT: '587', SMTP_SECURE: 'false', SMTP_USER: 'protected-user', SMTP_PASS: 'synthetic-secret-not-real', SMTP_FROM: 'sender@example.test', SMTP_TO: 'owner@example.test' }; 14const input = () => ({ name: 'Synthetic Visitor', email: 'visitor@example.test', business: 'Synthetic Business', website: 'https://example.test', projectType: 'design', message: 'A synthetic request for a website demo.', consent: true, companyWebsite: '', submissionId: randomUUID() }); 15const headers = { origin, 'content-type': 'application/json', accept: 'application/json' }; 16const accepted: MailTransport = { async sendMail() { return { accepted: [configured.SMTP_TO], rejected: [] }; } }; 17async function appFor(t: TestContext, options: AppOptions = {}) { 18 const app = await createApp({ env: configured, mailTransport: accepted, logger: false, ...options }); 19 t.after(() => app.close()); 20 return app; 21} 22async function fixture(t: TestContext) { 23 const root = await mkdtemp(join(tmpdir(), 'tsc-api-test-')); 24 t.after(() => rm(root, { recursive: true, force: true })); 25 for (const route of htmlRoutes) { 26 const path = join(root, route, 'index.html'); 27 await mkdir(join(root, route), { recursive: true }); 28 await writeFile(path, `<!doctype html><html lang="en"><title>${route}</title><h1>${route}</h1></html>`); 29 } 30 await mkdir(join(root, 'assets')); 31 await writeFile(join(root, 'assets', 'main-AbCd1234.js'), 'export const safe = true;'); 32 await writeFile(join(root, 'assets', 'renderer.wasm'), Buffer.from([0, 97, 115, 109, 1, 0, 0, 0])); 33 await writeFile(join(root, 'robots.txt'), 'User-agent: *\nAllow: /\n'); 34 await writeFile(join(root, 'assets', 'private.json'), '{"secret":"DO_NOT_SERVE"}'); 35 await writeFile(join(root, 'assets', 'bundle.js.map'), 'DO_NOT_SERVE'); 36 await writeFile(join(root, '.env'), 'DO_NOT_SERVE'); 37 return root; 38} 39 40test('mail acceptance is truthful, goes to the single configured recipient, and returns a generated ID', async t => { 41 const messages: MailMessage[] = []; 42 const app = await appFor(t, { mailTransport: { async sendMail(message) { messages.push(message); return { accepted: [configured.SMTP_TO], rejected: [] }; } } }); 43 const res = await app.inject({ method: 'POST', url: '/api/demo', headers: { ...headers, 'x-request-id': 'visitor-controlled' }, payload: input() }); 44 assert.equal(res.statusCode, 200); 45 assert.equal(res.json().status, 'accepted'); 46 assert.equal(res.json().ok, true); 47 assert.match(res.json().requestId, /^[\da-f-]{36}$/); 48 assert.notEqual(res.json().requestId, 'visitor-controlled'); 49 assert.equal(messages.length, 1); 50 assert.deepEqual(messages[0].envelope, { from: configured.SMTP_FROM, to: [configured.SMTP_TO] }); 51 assert.equal(messages[0].from, configured.SMTP_FROM); 52 assert.equal(messages[0].replyTo.address, 'visitor@example.test'); 53 assert.equal(messages[0].disableFileAccess, true); 54 assert.equal(messages[0].disableUrlAccess, true); 55 assert.equal(res.headers['cache-control'], 'no-store'); 56 assert.doesNotMatch(res.body, /delivered|received|synthetic-secret|owner@example/); 57}); 58 59test('unconfigured SMTP never sends or reports success and readiness is separate from liveness', async t => { 60 let sent = 0; 61 const app = await appFor(t, { env: { NODE_ENV: 'production', PUBLIC_ORIGIN: origin }, mailTransport: { async sendMail() { sent++; return { accepted: [] }; } } }); 62 const res = await app.inject({ method: 'POST', url: '/api/demo', headers, payload: input() }); 63 assert.equal(res.statusCode, 503); 64 assert.equal(res.json().code, 'service_unavailable'); 65 assert.match(res.json().message, /not been sent/); 66 assert.equal(sent, 0); 67 assert.equal((await app.inject('/api/health')).statusCode, 200); 68 const ready = await app.inject('/api/ready'); 69 assert.equal(ready.statusCode, 503); 70 assert.equal(ready.json().checks.mail, 'unconfigured'); 71 assert.equal(ready.json().delivery, 'not_checked'); 72}); 73 74test('complete runtime and static configuration reports ready without calling mail', async t => { 75 const root = await fixture(t); 76 let sent = 0; 77 const app = await appFor(t, { staticRoot: root, mailTransport: { async sendMail() { sent++; return { accepted: [] }; } } }); 78 const ready = await app.inject('/api/ready'); 79 assert.equal(ready.statusCode, 200); 80 assert.deepEqual(ready.json(), { ok: true, status: 'ready', checks: { mail: 'configured', site: 'available' }, delivery: 'not_checked' }); 81 assert.equal(sent, 0); 82 assert.doesNotMatch(ready.body, /protected-user|synthetic-secret|smtp.example|owner@example/); 83}); 84 85test('Origin enforcement rejects cross-site, null, suffix spoof, missing metadata, and contradictory fetch metadata', async t => { 86 let sent = 0; 87 const app = await appFor(t, { mailTransport: { async sendMail() { sent++; return { accepted: [] }; } } }); 88 for (const extra of [{ origin: 'https://evil.test' }, { origin: 'null' }, { origin: `${origin}.evil.test` }, { origin, 'sec-fetch-site': 'cross-site' }, { origin: undefined }]) { 89 const requestHeaders = Object.fromEntries(Object.entries({ ...headers, ...extra }).filter(([, value]) => value !== undefined)) as Record<string, string>; 90 const res = await app.inject({ method: 'POST', url: '/api/demo', headers: requestHeaders, payload: input() }); 91 assert.equal(res.statusCode, 403); 92 assert.equal(res.json().code, 'invalid_origin'); 93 } 94 assert.equal(sent, 0); 95}); 96 97test('authoritative validation rejects abusive and malformed fields without invoking SMTP', async t => { 98 let sent = 0; 99 const app = await appFor(t, { limits: { demoMax: 50 }, mailTransport: { async sendMail() { sent++; return { accepted: [] }; } } }); 100 const invalid = [ 101 { name: 'A' }, { name: 'X\r\nBcc: injected@example.test' }, { email: 'a@example.test\nBcc: bad@example.test' }, 102 { consent: false }, { consent: 'true' }, { companyWebsite: 'https://bot.example.test' }, 103 { message: 'short' }, { message: 'a'.repeat(4001) }, { business: 'x'.repeat(161) }, 104 { website: 'javascript:alert(1)' }, { website: 'https://[credentials removed]@example.test/' }, 105 { to: 'injected@example.test' }, { submissionId: 'fake-id' }, { name: ['A', 'B'] }, { projectType: 'invented' }, 106 ]; 107 for (const payload of invalid) { 108 const res = await app.inject({ method: 'POST', url: '/api/demo', headers, payload: { ...input(), ...payload } }); 109 assert.equal(res.statusCode, 400, JSON.stringify(payload)); 110 assert.equal(res.json().code, 'invalid_request'); 111 } 112 assert.equal(sent, 0); 113}); 114 115test('parsing, body size and method failures retain actual HTTP status and safe bodies', async t => { 116 const app = await appFor(t, { limits: { demoMax: 50 } }); 117 const malformed = await app.inject({ method: 'POST', url: '/api/demo', headers, payload: '{"name":' }); 118 assert.equal(malformed.statusCode, 400); 119 const oversized = await app.inject({ method: 'POST', url: '/api/demo', headers, payload: { ...input(), message: 'x'.repeat(18000) } }); 120 assert.equal(oversized.statusCode, 413); 121 assert.equal(oversized.json().code, 'body_too_large'); 122 const wrongType = await app.inject({ method: 'POST', url: '/api/demo', headers: { ...headers, 'content-type': 'text/plain' }, payload: 'private message' }); 123 assert.equal(wrongType.statusCode, 415); 124 const unsupported = await app.inject({ method: 'POST', url: '/api/demo', headers: { ...headers, 'content-type': 'application/xml' }, payload: '<data>private</data>' }); 125 assert.equal(unsupported.statusCode, 415); 126 const method = await app.inject('/api/demo'); 127 assert.equal(method.statusCode, 405); 128 assert.equal(method.headers.allow, 'POST'); 129}); 130 131test('native HTML form works without JS and reflects no submitted content into error pages', async t => { 132 const app = await appFor(t); 133 const payload = new URLSearchParams({ ...input(), consent: 'on', submissionId: '' }); 134 const res = await app.inject({ method: 'POST', url: '/api/demo', headers: { origin, accept: 'text/html', 'content-type': 'application/x-www-form-urlencoded' }, payload: payload.toString() }); 135 assert.equal(res.statusCode, 200); 136 assert.match(res.headers['content-type'] || '', /text\/html/); 137 assert.match(res.body, /role="status"/); 138 assert.match(res.body, /accepted for sending/); 139 payload.set('name', '<script>alert(1)</script>'); 140 payload.set('email', 'not-an-email'); 141 const invalid = await app.inject({ method: 'POST', url: '/api/demo', headers: { origin, accept: 'text/html', 'content-type': 'application/x-www-form-urlencoded' }, payload: payload.toString() }); 142 assert.equal(invalid.statusCode, 400); 143 assert.match(invalid.body, /role="alert"/); 144 assert.doesNotMatch(invalid.body, /<script>|alert\(1\)|not-an-email/); 145 assert.match(invalid.body, /Enter a valid email address/); 146}); 147 148test('same-origin Referer provides a bounded fallback for native forms without Origin', async t => { 149 const app = await appFor(t); 150 const payload = new URLSearchParams({ ...input(), consent: 'true', submissionId: '' }); 151 const res = await app.inject({ method: 'POST', url: '/api/demo', headers: { referer: `${origin}/contact/`, accept: 'text/html', 'content-type': 'application/x-www-form-urlencoded' }, payload: payload.toString() }); 152 assert.equal(res.statusCode, 200); 153}); 154 155test('same content with a changed submission ID is sent once, while different content is separate', async t => { 156 let sent = 0; 157 const app = await appFor(t, { mailTransport: { async sendMail() { sent++; return { accepted: [configured.SMTP_TO] }; } } }); 158 const payload = input(); 159 const first = await app.inject({ method: 'POST', url: '/api/demo', headers, payload }); 160 const duplicate = await app.inject({ method: 'POST', url: '/api/demo', headers, payload: { ...payload, submissionId: randomUUID() } }); 161 assert.equal(first.statusCode, 200); 162 assert.deepEqual(duplicate.json(), first.json()); 163 assert.equal(sent, 1); 164 const other = await app.inject({ method: 'POST', url: '/api/demo', headers, payload: { ...payload, message: 'A materially different synthetic inquiry.' } }); 165 assert.equal(other.statusCode, 200); 166 assert.equal(sent, 2); 167}); 168 169test('mail rejection and partial/unexpected acceptance cannot produce success', async t => { 170 const outcomes = [ 171 { accepted: [], rejected: [configured.SMTP_TO] }, 172 { accepted: ['wrong@example.test'] }, 173 { accepted: [configured.SMTP_TO, 'extra@example.test'] }, 174 { accepted: [configured.SMTP_TO], pending: ['pending'] }, 175 ]; 176 for (const outcome of outcomes) { 177 const app = await appFor(t, { mailTransport: { async sendMail() { return outcome; } } }); 178 const res = await app.inject({ method: 'POST', url: '/api/demo', headers, payload: input() }); 179 assert.equal(res.statusCode, 502); 180 assert.equal(res.json().ok, false); 181 assert.equal(res.json().code, 'mail_rejected'); 182 assert.doesNotMatch(res.body, /owner@example|extra@example|wrong@example/); 183 } 184}); 185 186test('provider errors are redacted and authentication rejection is accurately reported', async t => { 187 const app = await appFor(t, { mailTransport: { async sendMail() { throw Object.assign(new Error('secret SMTP_PASS=synthetic-secret-not-real visitor@example.test'), { code: 'EAUTH', responseCode: 535 }); } } }); 188 const res = await app.inject({ method: 'POST', url: '/api/demo', headers, payload: input() }); 189 assert.equal(res.statusCode, 502); 190 assert.equal(res.json().code, 'mail_rejected'); 191 // A generated UUID may contain the digits 535; only a standalone SMTP code is a leak. 192 assert.doesNotMatch(res.body, /synthetic-secret|SMTP_PASS|visitor@example|EAUTH|\b535\b/); 193}); 194 195test('timeout stays uncertain, keeps concurrency bounded, and never retries the same content', async t => { 196 let resolveSend!: (value: { accepted: string[] }) => void; 197 let sent = 0; 198 const app = await appFor(t, { limits: { mailDeadlineMs: 20, concurrentSends: 1 }, mailTransport: { sendMail() { sent++; return new Promise(resolve => { resolveSend = resolve; }); } } }); 199 const payload = input(); 200 const first = await app.inject({ method: 'POST', url: '/api/demo', headers, payload }); 201 assert.equal(first.statusCode, 504); 202 assert.equal(first.json().code, 'delivery_unknown'); 203 const duplicate = await app.inject({ method: 'POST', url: '/api/demo', headers, payload }); 204 assert.equal(duplicate.statusCode, 504); 205 assert.deepEqual(duplicate.json(), first.json()); 206 const concurrent = await app.inject({ method: 'POST', url: '/api/demo', headers, payload: { ...input(), message: 'A second different synthetic request.' } }); 207 assert.equal(concurrent.statusCode, 503); 208 assert.equal(sent, 1); 209 resolveSend({ accepted: [configured.SMTP_TO] }); 210}); 211 212test('in-flight duplicate receives conflict and global mail concurrency is enforced', async t => { 213 let resolveSend!: (value: { accepted: string[] }) => void; 214 let started!: () => void; 215 const begun = new Promise<void>(resolve => { started = resolve; }); 216 const app = await appFor(t, { limits: { concurrentSends: 1 }, mailTransport: { sendMail() { started(); return new Promise(resolve => { resolveSend = resolve; }); } } }); 217 const payload = input(); 218 const first = app.inject({ method: 'POST', url: '/api/demo', headers, payload }); 219 await begun; 220 const duplicate = await app.inject({ method: 'POST', url: '/api/demo', headers, payload }); 221 assert.equal(duplicate.statusCode, 409); 222 assert.equal(duplicate.json().code, 'request_in_progress'); 223 const other = await app.inject({ method: 'POST', url: '/api/demo', headers, payload: { ...input(), name: 'Another Synthetic Visitor' } }); 224 assert.equal(other.statusCode, 503); 225 resolveSend({ accepted: [configured.SMTP_TO] }); 226 assert.equal((await first).statusCode, 200); 227}); 228 229test('rate limiting returns 429 with Retry-After and cannot be bypassed by untrusted forwarding headers', async t => { 230 const app = await appFor(t, { limits: { demoMax: 1 } }); 231 const first = await app.inject({ method: 'POST', url: '/api/demo', headers: { ...headers, 'x-forwarded-for': '192.0.2.1' }, payload: input() }); 232 assert.equal(first.statusCode, 200); 233 const second = await app.inject({ method: 'POST', url: '/api/demo', headers: { ...headers, 'x-forwarded-for': '192.0.2.2' }, payload: input() }); 234 assert.equal(second.statusCode, 429); 235 assert.ok(second.headers['retry-after']); 236 assert.equal(second.json().code, 'rate_limited'); 237}); 238 239test('global rate limiting also bounds early origin rejections and unknown resources', async t => { 240 const app = await appFor(t, { limits: { globalMax: 2 } }); 241 const first = await app.inject({ method: 'POST', url: '/api/demo', headers: { ...headers, origin: 'https://evil.test' }, payload: input() }); 242 assert.equal(first.statusCode, 403); 243 assert.equal((await app.inject('/unknown-resource')).statusCode, 404); 244 const limited = await app.inject('/api/health'); 245 assert.equal(limited.statusCode, 429); 246 assert.ok(limited.headers['retry-after']); 247}); 248 249test('HTML routes, canonical redirects, asset MIME/cache and genuine 404s are preserved', async t => { 250 const root = await fixture(t); 251 const app = await appFor(t, { staticRoot: root }); 252 for (const route of htmlRoutes) { 253 const res = await app.inject(route); 254 assert.equal(res.statusCode, 200, route); 255 assert.match(res.headers['content-type'] || '', /text\/html/); 256 assert.equal(res.headers['cache-control'], 'public, max-age=0, must-revalidate'); 257 } 258 const redirect = await app.inject('/services?email=never-reflected@example.test'); 259 assert.equal(redirect.statusCode, 308); 260 assert.equal(redirect.headers.location, '/services/'); 261 const js = await app.inject('/assets/main-AbCd1234.js'); 262 assert.equal(js.statusCode, 200); 263 assert.match(js.headers['content-type'] || '', /javascript/); 264 assert.equal(js.headers['cache-control'], 'public, max-age=31536000, immutable'); 265 const wasm = await app.inject('/assets/renderer.wasm'); 266 assert.equal(wasm.headers['content-type'], 'application/wasm'); 267 const missing = await app.inject({ url: '/unknown-page/', headers: { accept: 'text/html' } }); 268 assert.equal(missing.statusCode, 404); 269 assert.match(missing.body, /Page not found/); 270 assert.equal((await app.inject('/assets/missing.js')).statusCode, 404); 271}); 272 273test('source maps, private files, encoded traversal, source folders and escaping symlinks are blocked', async t => { 274 const root = await fixture(t); 275 const outside = await mkdtemp(join(tmpdir(), 'tsc-api-outside-')); 276 t.after(() => rm(outside, { recursive: true, force: true })); 277 await writeFile(join(outside, 'secret.js'), 'DO_NOT_SERVE'); 278 await symlink(join(outside, 'secret.js'), join(root, 'assets', 'secret.js')); 279 const app = await appFor(t, { staticRoot: root }); 280 for (const url of ['/.env', '/%2eenv', '/%61bout/', '/services/%77ebsite-design/', '/assets/bundle.js.map', '/assets/private.json', '/private/standards/document-001.txt', '/src/app.ts', '/assets/secret.js', '/assets/%2e%2e/.env', '/assets/%252e%252e/.env', '/assets/%5csecret.js', '/services/index.html', '/index.html']) { 281 const res = await app.inject(url); 282 assert.equal(res.statusCode, 404, url); 283 assert.doesNotMatch(res.body, /DO_NOT_SERVE/, url); 284 } 285}); 286 287test('canonical redirects preserve only one exact approved attribution source and strip PII/duplicates', async t => { 288 const root = await fixture(t); 289 const app = await appFor(t, { staticRoot: root }); 290 for (const source of ['chatgpt.com', 'perplexity.ai', 'claude.ai', 'copilot.microsoft.com', 'gemini.google.com']) { 291 const res = await app.inject(`/services?utm_source=${source}&email=visitor%40example.test&utm_campaign=private-details&gclid=private-token`); 292 assert.equal(res.statusCode, 308); 293 assert.equal(res.headers.location, `/services/?utm_source=${source}`); 294 assert.doesNotMatch(res.headers.location || '', /private|visitor|email|gclid|campaign/); 295 } 296 for (const query of ['utm_source=visitor%40example.test', 'utm_source=chatgpt.com.evil.test', 'utm_source=chatgpt.com&utm_source=claude.ai', 'utm_source=chatgpt.com&utm_source=chatgpt.com', 'utm_source=%00chatgpt.com', 'utm_source=CHATGPT.COM', 'utm_source=%3Cscript%3E', 'utm_campaign=chatgpt.com']) { 297 const res = await app.inject(`/services?${query}`); 298 assert.equal(res.statusCode, 308); 299 assert.equal(res.headers.location, '/services/'); 300 } 301}); 302 303test('contact redirects retain finite computer project context while dropping unrelated query content', async t => { 304 const root = await fixture(t); 305 const app = await appFor(t, { staticRoot: root }); 306 for (const project of ['design', 'rescue', 'search', 'care', 'unsure']) { 307 const res = await app.inject(`/contact?project=${project}&from=computer&email=visitor%40example.test&message=private-details`); 308 assert.equal(res.statusCode, 308); 309 assert.equal(res.headers.location, `/contact/?project=${project}&from=computer`); 310 assert.equal((await app.inject(res.headers.location!)).statusCode, 200); 311 } 312 const attributed = await app.inject('/contact?project=rescue&from=computer&utm_source=chatgpt.com&gclid=private-token'); 313 assert.equal(attributed.statusCode, 308); 314 const location = new URL(attributed.headers.location!, origin); 315 assert.equal(location.pathname, '/contact/'); 316 assert.deepEqual([...location.searchParams].sort(), [['from', 'computer'], ['project', 'rescue'], ['utm_source', 'chatgpt.com']]); 317 const otherRoute = await app.inject('/services?project=rescue&from=computer&utm_source=chatgpt.com'); 318 assert.equal(otherRoute.headers.location, '/services/?utm_source=chatgpt.com'); 319}); 320 321test('contact redirects discard invalid or duplicate inquiry fields without losing approved attribution', async t => { 322 const root = await fixture(t); 323 const app = await appFor(t, { staticRoot: root }); 324 for (const query of [ 325 'project=rescue', 'from=computer', 'project=rescue&from=elsewhere', 326 'project=rescue&from=computer&project=design', 'project=rescue&from=computer&project=rescue', 327 'project=rescue&from=computer&from=computer', 'project=rescue&from=computer&%66rom=elsewhere', 328 'project=&from=computer', 'project=RESCUE&from=computer', 'project=__proto__&from=computer', 329 'project=visitor%40example.test&from=computer', 'project=%3Cscript%3E&from=computer', 330 'project=rescue&from=%00computer', 'project=rescue&from=computer%3Fprivate', 331 `project=rescue&from=computer&message=${'x'.repeat(2048)}`, 332 ]) { 333 const res = await app.inject(`/contact?${query}&utm_source=claude.ai`); 334 assert.equal(res.statusCode, 308, query); 335 assert.equal(res.headers.location, '/contact/?utm_source=claude.ai', query); 336 } 337}); 338 339test('invalid or duplicate attribution cannot erase an otherwise valid contact project', async t => { 340 const root = await fixture(t); 341 const app = await appFor(t, { staticRoot: root }); 342 for (const query of ['utm_source=private%40example.test', 'utm_source=chatgpt.com&utm_source=claude.ai', 'utm_source=chatgpt.com&utm_source=chatgpt.com']) { 343 const res = await app.inject(`/contact?project=search&from=computer&${query}`); 344 assert.equal(res.statusCode, 308); 345 assert.equal(res.headers.location, '/contact/?project=search&from=computer'); 346 } 347}); 348 349test('the actual public animation manifests, mobile motion/scene JSON, poster and WASM remain available', async t => { 350 const app = await appFor(t, { staticRoot: resolve('apps/web/public') }); 351 for (const path of animationJsonPaths) { 352 const response = await app.inject(path); 353 assert.equal(response.statusCode, 200, path); 354 assert.match(response.headers['content-type'] || '', /application\/json/, path); 355 assert.doesNotThrow(() => JSON.parse(response.body), path); 356 } 357 const poster = await app.inject('/animation/mobile/smartphone/poster.svg'); 358 assert.equal(poster.statusCode, 200); 359 assert.match(poster.headers['content-type'] || '', /image\/svg\+xml/); 360 const wasm = await app.inject('/animation/runtime/rive.wasm'); 361 assert.equal(wasm.statusCode, 200); 362 assert.equal(wasm.headers['content-type'], 'application/wasm'); 363 assert.equal((await app.inject('/animation/mobile/smartphone/private.json')).statusCode, 404); 364}); 365 366test('a built styled 404 page is used while preserving the 404 status', async t => { 367 const root = await fixture(t); 368 await writeFile(join(root, '404.html'), '<!doctype html><html lang="en"><title>Missing page</title><main><h1>Styled missing page</h1></main></html>'); 369 const app = await appFor(t, { staticRoot: root }); 370 const res = await app.inject({ url: '/not-a-page/', headers: { accept: 'text/html' } }); 371 assert.equal(res.statusCode, 404); 372 assert.match(res.body, /Styled missing page/); 373 assert.equal(res.headers['cache-control'], 'no-store'); 374}); 375 376test('security headers enforce local script and WASM policy without unsafe-eval and expose no server identity', async t => { 377 const app = await appFor(t); 378 const res = await app.inject('/api/health'); 379 assert.equal(res.headers['x-content-type-options'], 'nosniff'); 380 assert.equal(res.headers['x-frame-options'], 'SAMEORIGIN'); 381 assert.match(res.headers['content-security-policy'] || '', /frame-ancestors 'none'/); 382 assert.match(res.headers['content-security-policy'] || '', /form-action 'self'/); 383 assert.match(res.headers['content-security-policy'] || '', /'wasm-unsafe-eval'/); 384 assert.doesNotMatch(res.headers['content-security-policy'] || '', /(?:^|\s)'unsafe-eval'(?:\s|;|$)/); 385 assert.ok(res.headers['strict-transport-security']); 386 assert.equal(res.headers['x-powered-by'], undefined); 387 assert.equal(res.headers.server, undefined); 388}); 389 390test('runtime config validates exact origins, single mailbox, TLS mode and safe public measurement ID', async t => { 391 for (const change of [{ SMTP_TO: 'one@example.test,two@example.test' }, { SMTP_FROM: 'x@example.test\r\nBcc: y@example.test' }, { SMTP_SECURE: '' }, { SMTP_PORT: '465', SMTP_SECURE: 'false' }, { PUBLIC_ORIGIN: 'http://thatstupidcomputer.com' }]) { 392 assert.equal(loadConfig({ ...configured, ...change }).smtp, null); 393 } 394 assert.throws(() => loadConfig({ ...configured, ALLOWED_ORIGINS: `${origin}/path` })); 395 assert.throws(() => loadConfig({ ...configured, TRUST_PROXY: 'true' })); 396 assert.equal(loadConfig({}).host, '127.0.0.1'); 397 const app = await appFor(t, { env: { ...configured, GA4_MEASUREMENT_ID: 'G-ABC1234567' } }); 398 const res = await app.inject('/api/config'); 399 assert.deepEqual(res.json(), { analytics: { measurementId: 'G-ABC1234567' } }); 400 assert.doesNotMatch(res.body, /SMTP|smtp|secret|recipient|protected-user|owner@example/); 401}); 402 403test('request and provider logs never contain form content, query strings, headers, IP addresses or secrets', async t => { 404 let logs = ''; 405 const app = await appFor(t, { logger: { stream: { write(chunk: string) { logs += chunk; } } }, mailTransport: { async sendMail() { throw new Error('Synthetic Visitor visitor@example.test protected-user synthetic-secret-not-real'); } } }); 406 await app.inject({ method: 'POST', url: '/api/demo?email=visitor@example.test', headers: { ...headers, authorization: 'Bearer private-token', 'x-request-id': 'private-token' }, payload: input() }); 407 await app.inject('/unknown?message=synthetic-secret-not-real'); 408 assert.match(logs, /request_completed/); 409 assert.match(logs, /delivery_unknown/); 410 assert.doesNotMatch(logs, /Synthetic Visitor|Synthetic Business|visitor@example|synthetic-secret|protected-user|private-token|127\.0\.0\.1|SMTP_PASS/); 411}); 412 413test('graceful app close invokes transport close without sending mail', async () => { 414 let closed = 0; 415 const app = await createApp({ env: configured, logger: false, mailTransport: { async sendMail() { throw new Error('Must not send'); }, close() { closed++; } } }); 416 await app.ready(); 417 await app.close(); 418 assert.equal(closed, 1); 419}); 420 421test('crawler evidence verifies the connection IP and never logs raw addresses or visitor headers', async t => { 422 let logs = ''; 423 const app = await appFor(t, { 424 logger: { stream: { write(chunk: string) { logs += chunk; } } }, 425 crawlerVerification: { fetch: async () => new Response(JSON.stringify({ creationTime: '2026-09-01T00:00:00Z', prefixes: [{ ipv4Prefix: '203.0.113.0/24' }] }), { headers: { 'content-type': 'application/json' } }) }, 426 }); 427 const response = await app.inject({ url: '/api/health?token=private-query', remoteAddress: '203.0.113.7', headers: { 'user-agent': 'Mozilla/5.0 (compatible; OAI-SearchBot/1.4; visitor-private-value)', authorization: 'Bearer private-token' } }); 428 assert.equal(response.statusCode, 200); 429 await app.close(); 430 assert.match(logs, /"event":"crawler_observed"/); 431 assert.match(logs, /"agent":"OAI-SearchBot"/); 432 assert.match(logs, /"verification":"verified"/); 433 assert.doesNotMatch(logs, /203\.0\.113|private-query|visitor-private-value|private-token|prefixes/); 434}); 435 436test('a claimed bot cannot use a forwarding header to authenticate or bypass private routes', async t => { 437 let logs = ''; 438 const app = await appFor(t, { 439 logger: { stream: { write(chunk: string) { logs += chunk; } } }, 440 crawlerVerification: { fetch: async () => new Response(JSON.stringify({ creationTime: '2026-09-01T00:00:00Z', prefixes: [{ ipv4Prefix: '203.0.113.0/24' }] }), { headers: { 'content-type': 'application/json' } }) }, 441 }); 442 const response = await app.inject({ url: '/private/standards/SEO-AIO-Library.txt', remoteAddress: '198.51.100.2', headers: { 'user-agent': 'OAI-SearchBot/1.4', 'x-forwarded-for': '203.0.113.7' } }); 443 assert.equal(response.statusCode, 404); 444 await app.close(); 445 assert.match(logs, /"verification":"ip_mismatch"/); 446 assert.doesNotMatch(logs, /198\.51\.100|203\.0\.113|SEO-AIO-Library/); 447}); 448 449test('verified crawler traffic still obeys the normal request limits', async t => { 450 const app = await appFor(t, { 451 logger: { stream: { write() {} } }, limits: { globalMax: 1 }, 452 crawlerVerification: { fetch: async () => new Response(JSON.stringify({ creationTime: '2026-09-01T00:00:00Z', prefixes: [{ ipv4Prefix: '203.0.113.0/24' }] }), { headers: { 'content-type': 'application/json' } }) }, 453 }); 454 const request = { url: '/api/health', remoteAddress: '203.0.113.7', headers: { 'user-agent': 'OAI-SearchBot/1.4' } }; 455 assert.equal((await app.inject(request)).statusCode, 200); 456 assert.equal((await app.inject(request)).statusCode, 429); 457}); 458 459test('deployed loopback proxy trust authenticates only the nearest untrusted connection', async t => { 460 for (const [remoteAddress, forwardedFor, expected] of [ 461 ['127.0.0.1', '203.0.113.7', 'verified'], 462 ['198.51.100.2', '203.0.113.7', 'ip_mismatch'], 463 ['127.0.0.1', '203.0.113.7, 198.51.100.2', 'ip_mismatch'], 464 ]) { 465 let logs = ''; 466 const app = await appFor(t, { 467 env: { ...configured, TRUST_PROXY: '127.0.0.1' }, 468 logger: { stream: { write(chunk: string) { logs += chunk; } } }, 469 crawlerVerification: { fetch: async () => new Response(JSON.stringify({ creationTime: '2026-09-01T00:00:00Z', prefixes: [{ ipv4Prefix: '203.0.113.0/24' }] }), { headers: { 'content-type': 'application/json' } }) }, 470 }); 471 assert.equal((await app.inject({ url: '/api/health', remoteAddress, headers: { 'user-agent': 'OAI-SearchBot/1.4', 'x-forwarded-for': forwardedFor! } })).statusCode, 200); 472 await app.close(); 473 const observation = logs.split('\n').filter(Boolean).map(line => JSON.parse(line)).find(row => row.event === 'crawler_observed'); 474 assert.equal(observation.verification, expected); 475 assert.doesNotMatch(logs, /198\.51\.100|203\.0\.113|127\.0\.0\.1/); 476 } 477}); 478