ConusAI vendor v0.1.0-beta.114

test/contract-refusal.test.ts

@@ -0,0 +1,45 @@
+// SPDX-License-Identifier: LicenseRef-ConusAI-Template-1.0
+// A deployment the contract refuses says why: `/api/ready` names what to set, every other route is a 503 and no route
+// a 500, and a message that quotes a value stays in the log. And signing out can reach the identity provider.
+
+import { describe, expect, it } from "vitest"
+import { issuerOrigins, refusalOf, refusalResponse } from "../apps/web/src/server/contract"
+
+const refusal = refusalOf(new Error("OIDC_ISSUER is required in production"))
+const request = (path: string): Request => new Request(`https://app.example.test${path}`)
+
+describe("a process the deployment contract refused", () => {
+  it("names what to set on /api/ready", async () => {
+    const response = refusalResponse(request("/api/ready"), refusal)
+    expect(response.status).toBe(503)
+    expect(await response.json()).toEqual({
+      ready: false,
+      checks: { contract: false },
+      reason: "OIDC_ISSUER is required in production",
+    })
+  })
+
+  it("answers every other route 503, and says nothing more there", async () => {
+    const response = refusalResponse(request("/acme"), refusal)
+    expect(response.status).toBe(503)
+    expect(response.headers.get("retry-after")).toBe("30")
+    expect(await response.json()).toEqual({ status: 503, code: "not_configured" })
+  })
+
+  it("keeps a value out of what the public can read", async () => {
+    const quoted = refusalOf(new Error('CONUSAI_API_URL is "https://secret.example.test"'))
+    expect(quoted.message).toContain("secret.example.test")
+    expect(JSON.stringify(await refusalResponse(request("/api/ready"), quoted).json())).not.toContain("secret")
+  })
+})
+
+describe("the form-action of the content security policy", () => {
+  it("adds the issuer's origin, without its path", () => {
+    expect(issuerOrigins("https://id.example.test/oauth/v2")).toEqual(["https://id.example.test"])
+  })
+
+  it("adds nothing with no issuer", () => {
+    expect(issuerOrigins(undefined)).toEqual([])
+    expect(issuerOrigins(" ")).toEqual([])
+  })
+})