46 lines
2.0 KiB
TypeScript
46 lines
2.0 KiB
TypeScript
// SPDX-License-Identifier: LicenseRef-ConusAI-Template-1.0
|
|
// A deployment the contract refuses says why: `/api/ready` names what to set, every other route is a 503 and no route
|
|
// a 500, and a message that quotes a value stays in the log. And signing out can reach the identity provider.
|
|
|
|
import { describe, expect, it } from "vitest"
|
|
import { issuerOrigins, refusalOf, refusalResponse } from "../apps/web/src/server/contract"
|
|
|
|
const refusal = refusalOf(new Error("OIDC_ISSUER is required in production"))
|
|
const request = (path: string): Request => new Request(`https://app.example.test${path}`)
|
|
|
|
describe("a process the deployment contract refused", () => {
|
|
it("names what to set on /api/ready", async () => {
|
|
const response = refusalResponse(request("/api/ready"), refusal)
|
|
expect(response.status).toBe(503)
|
|
expect(await response.json()).toEqual({
|
|
ready: false,
|
|
checks: { contract: false },
|
|
reason: "OIDC_ISSUER is required in production",
|
|
})
|
|
})
|
|
|
|
it("answers every other route 503, and says nothing more there", async () => {
|
|
const response = refusalResponse(request("/acme"), refusal)
|
|
expect(response.status).toBe(503)
|
|
expect(response.headers.get("retry-after")).toBe("30")
|
|
expect(await response.json()).toEqual({ status: 503, code: "not_configured" })
|
|
})
|
|
|
|
it("keeps a value out of what the public can read", async () => {
|
|
const quoted = refusalOf(new Error('CONUSAI_API_URL is "https://secret.example.test"'))
|
|
expect(quoted.message).toContain("secret.example.test")
|
|
expect(JSON.stringify(await refusalResponse(request("/api/ready"), quoted).json())).not.toContain("secret")
|
|
})
|
|
})
|
|
|
|
describe("the form-action of the content security policy", () => {
|
|
it("adds the issuer's origin, without its path", () => {
|
|
expect(issuerOrigins("https://id.example.test/oauth/v2")).toEqual(["https://id.example.test"])
|
|
})
|
|
|
|
it("adds nothing with no issuer", () => {
|
|
expect(issuerOrigins(undefined)).toEqual([])
|
|
expect(issuerOrigins(" ")).toEqual([])
|
|
})
|
|
})
|