feat: refactor AI inference request detection and Docker authentication handling

test/unit/cors-and-proxy-options.test.js

@@ -0,0 +1,138 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import worker from '../../src/index.js';
+
+/** @type {ExecutionContext} */
+const executionContext = {
+  waitUntil() {},
+  passThroughOnException() {}
+};
+
+describe('CORS and Proxy Request Options', () => {
+  beforeEach(() => {
+    vi.stubGlobal('caches', {
+      default: {
+        match: vi.fn(async () => null),
+        put: vi.fn(async () => undefined)
+      }
+    });
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    vi.restoreAllMocks();
+  });
+
+  it('does not send a synthetic Origin header upstream', async () => {
+    const fetchSpy = vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+      new Response('ok', {
+        status: 200,
+        headers: { 'Content-Type': 'text/plain' }
+      })
+    );
+
+    const response = await worker.fetch(
+      new Request('https://example.com/gh/test/repo/index.html'),
+      {},
+      executionContext
+    );
+
+    expect(response.status).toBe(200);
+    const upstreamHeaders = new Headers(fetchSpy.mock.calls[0][1]?.headers);
+    expect(upstreamHeaders.has('Origin')).toBe(false);
+  });
+
+  it('does not enable Cloudflare minification for proxied responses', async () => {
+    const fetchSpy = vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+      new Response('<html>ok</html>', {
+        status: 200,
+        headers: { 'Content-Type': 'text/html' }
+      })
+    );
+
+    await worker.fetch(
+      new Request('https://example.com/gh/test/repo/index.html'),
+      {},
+      executionContext
+    );
+
+    const fetchOptions = /** @type {RequestInit & { cf?: Record<string, unknown> }} */ (
+      fetchSpy.mock.calls[0][1] || {}
+    );
+
+    expect(fetchOptions.cf).toEqual(
+      expect.objectContaining({
+        http3: true,
+        cacheEverything: true,
+        preconnect: true
+      })
+    );
+    expect(fetchOptions.cf).not.toHaveProperty('minify');
+  });
+
+  it('responds to preflight requests for allowed origins', async () => {
+    const response = await worker.fetch(
+      new Request('https://example.com/gh/test/repo', {
+        method: 'OPTIONS',
+        headers: {
+          Origin: 'https://app.example.com',
+          'Access-Control-Request-Method': 'GET',
+          'Access-Control-Request-Headers': 'X-Custom-Header'
+        }
+      }),
+      {
+        ALLOWED_ORIGINS: 'https://app.example.com'
+      },
+      executionContext
+    );
+
+    expect(response.status).toBe(204);
+    expect(response.headers.get('Access-Control-Allow-Origin')).toBe('https://app.example.com');
+    expect(response.headers.get('Access-Control-Allow-Methods')).toContain('GET');
+    expect(response.headers.get('Access-Control-Allow-Headers')).toBe('X-Custom-Header');
+  });
+
+  it('rejects preflight requests for disallowed origins', async () => {
+    const response = await worker.fetch(
+      new Request('https://example.com/gh/test/repo', {
+        method: 'OPTIONS',
+        headers: {
+          Origin: 'https://evil.example.com',
+          'Access-Control-Request-Method': 'GET'
+        }
+      }),
+      {
+        ALLOWED_ORIGINS: 'https://app.example.com'
+      },
+      executionContext
+    );
+
+    expect(response.status).toBe(403);
+    expect(response.headers.get('Access-Control-Allow-Origin')).toBeNull();
+  });
+
+  it('adds CORS headers to normal responses for allowed origins', async () => {
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+      new Response('ok', {
+        status: 200,
+        headers: { 'Content-Type': 'text/plain' }
+      })
+    );
+
+    const response = await worker.fetch(
+      new Request('https://example.com/gh/test/repo/file.txt', {
+        headers: {
+          Origin: 'https://app.example.com'
+        }
+      }),
+      {
+        ALLOWED_ORIGINS: 'https://app.example.com'
+      },
+      executionContext
+    );
+
+    expect(response.status).toBe(200);
+    expect(response.headers.get('Access-Control-Allow-Origin')).toBe('https://app.example.com');
+    expect(response.headers.get('Vary')).toContain('Origin');
+  });
+});

test/unit/package-manifest.test.js

@@ -0,0 +1,15 @@
+import { createRequire } from 'node:module';
+
+import { describe, expect, it } from 'vitest';
+
+describe('Package manifest', () => {
+  it('does not depend on itself', () => {
+    const require = createRequire(import.meta.url);
+    const packageJson = require('../../package.json');
+    const { dependencies } = packageJson;
+    const typedDependencies = /** @type {Record<string, string> | undefined} */ (dependencies);
+
+    expect(packageJson.name).toBe('xget');
+    expect(typedDependencies?.xget).toBeUndefined();
+  });
+});

test/unit/platforms.test.js

@@ -330,6 +330,10 @@ describe('Platform Configuration', () => {
       });
     });
 
+    it('should use the correct Amazon ECR Public base URL', () => {
+      expect(PLATFORMS['cr-ecr']).toBe('https://public.ecr.aws');
+    });
+
     it('should transform all container registry paths correctly', () => {
       const containerRegistries = [
         'cr-quay',

test/unit/protocols.test.js

@@ -0,0 +1,269 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import worker from '../../src/index.js';
+import { CONFIG } from '../../src/config/index.js';
+import { isAIInferenceRequest } from '../../src/protocols/ai.js';
+import { getScopeFromUrl, handleDockerAuth } from '../../src/protocols/docker.js';
+import { isDockerRequest } from '../../src/utils/validation.js';
+
+/** @type {ExecutionContext} */
+const executionContext = {
+  waitUntil() {},
+  passThroughOnException() {}
+};
+
+describe('Protocol Detection', () => {
+  it('only treats /ip-prefixed paths as AI inference requests', () => {
+    const request = new Request('https://example.com/gh/user/repo/v1/chat/completions', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: '{}'
+    });
+    const url = new URL(request.url);
+
+    expect(isAIInferenceRequest(request, url)).toBe(false);
+  });
+
+  it('does not treat nested /v2/ segments in regular paths as Docker requests', () => {
+    const request = new Request(
+      'https://example.com/gh/user/repo/releases/download/v2/file.tar.gz'
+    );
+    const url = new URL(request.url);
+
+    expect(isDockerRequest(request, url)).toBe(false);
+  });
+});
+
+describe('Docker Authentication', () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it('derives scoped pull access from /cr-prefixed registry requests', () => {
+    const url = new URL('https://example.com/cr/docker/v2/nginx/manifests/latest');
+
+    expect(getScopeFromUrl(url, url.pathname, 'cr-docker')).toBe('repository:library/nginx:pull');
+  });
+
+  it('normalizes Docker Hub official image scopes during auth proxying', async () => {
+    const fetchSpy = vi.spyOn(globalThis, 'fetch').mockImplementation(async input => {
+      const url = String(input);
+
+      if (url === 'https://registry-1.docker.io/v2/') {
+        return new Response('', {
+          status: 401,
+          headers: {
+            'WWW-Authenticate':
+              'Bearer realm="https://auth.docker.io/token",service="registry.docker.io"'
+          }
+        });
+      }
+
+      return new Response(JSON.stringify({ token: 'token' }), {
+        status: 200,
+        headers: { 'Content-Type': 'application/json' }
+      });
+    });
+
+    const request = new Request(
+      'https://example.com/cr/docker/v2/auth?scope=repository:cr/docker/nginx:pull&service=Xget'
+    );
+    const response = await handleDockerAuth(request, new URL(request.url), CONFIG);
+
+    expect(response.status).toBe(200);
+    expect(String(fetchSpy.mock.calls[1][0])).toContain(
+      'scope=repository%3Alibrary%2Fnginx%3Apull'
+    );
+  });
+
+  it('routes platform-prefixed auth endpoints without duplicating /v2', async () => {
+    /** @type {string[]} */
+    const upstreamCalls = [];
+    vi.spyOn(globalThis, 'fetch').mockImplementation(async input => {
+      upstreamCalls.push(String(input));
+
+      if (String(input) === 'https://ghcr.io/v2/') {
+        return new Response('', {
+          status: 401,
+          headers: {
+            'WWW-Authenticate': 'Bearer realm="https://ghcr.io/token",service="ghcr.io"'
+          }
+        });
+      }
+
+      return new Response(JSON.stringify({ token: 'token' }), {
+        status: 200,
+        headers: { 'Content-Type': 'application/json' }
+      });
+    });
+
+    const request = new Request('https://example.com/cr/ghcr/v2/auth?service=Xget');
+    const response = await worker.fetch(request, {}, executionContext);
+
+    expect(response.status).toBe(200);
+    expect(upstreamCalls[0]).toBe('https://ghcr.io/v2/');
+  });
+
+  it('routes registry manifests without duplicating /v2', async () => {
+    const fetchSpy = vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+      new Response('', {
+        status: 200,
+        headers: { 'Content-Length': '0' }
+      })
+    );
+
+    const request = new Request(
+      'https://example.com/cr/ghcr/v2/nginxinc/nginx-unprivileged/manifests/latest',
+      {
+        method: 'HEAD'
+      }
+    );
+    const response = await worker.fetch(request, {}, executionContext);
+
+    expect(response.status).toBe(200);
+    expect(String(fetchSpy.mock.calls[0][0])).toBe(
+      'https://ghcr.io/v2/nginxinc/nginx-unprivileged/manifests/latest'
+    );
+  });
+
+  it('normalizes Docker Hub official image paths during proxying', async () => {
+    const fetchSpy = vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+      new Response('', {
+        status: 200,
+        headers: { 'Content-Length': '0' }
+      })
+    );
+
+    const request = new Request('https://example.com/cr/docker/v2/nginx/manifests/latest', {
+      headers: { Accept: 'application/vnd.docker.distribution.manifest.v2+json' }
+    });
+    const response = await worker.fetch(request, {}, executionContext);
+
+    expect(response.status).toBe(200);
+    expect(String(fetchSpy.mock.calls[0][0])).toBe(
+      'https://registry-1.docker.io/v2/library/nginx/manifests/latest'
+    );
+  });
+
+  it('preserves platform-specific Docker auth challenges', async () => {
+    let callCount = 0;
+    vi.spyOn(globalThis, 'fetch').mockImplementation(async () => {
+      callCount++;
+
+      if (callCount === 1) {
+        return new Response('', {
+          status: 401,
+          headers: {
+            'WWW-Authenticate': 'Bearer realm="https://ghcr.io/token",service="ghcr.io"'
+          }
+        });
+      }
+
+      return new Response('denied', { status: 401 });
+    });
+
+    const request = new Request('https://example.com/cr/ghcr/v2/private/repo/manifests/latest', {
+      headers: { Accept: 'application/vnd.docker.distribution.manifest.v2+json' }
+    });
+    const response = await worker.fetch(request, {}, executionContext);
+
+    expect(response.status).toBe(401);
+    expect(response.headers.get('WWW-Authenticate')).toBe(
+      'Bearer realm="https://example.com/cr/ghcr/v2/auth",service="Xget"'
+    );
+    expect(await response.text()).toContain('UNAUTHORIZED');
+  });
+
+  it('accepts standard repository scopes on platform-prefixed auth endpoints', async () => {
+    const fetchSpy = vi.spyOn(globalThis, 'fetch').mockImplementation(async input => {
+      const url = String(input);
+
+      if (url === 'https://ghcr.io/v2/') {
+        return new Response('', {
+          status: 401,
+          headers: {
+            'WWW-Authenticate': 'Bearer realm="https://ghcr.io/token",service="ghcr.io"'
+          }
+        });
+      }
+
+      return new Response(JSON.stringify({ token: 'token' }), {
+        status: 200,
+        headers: { 'Content-Type': 'application/json' }
+      });
+    });
+
+    const request = new Request(
+      'https://example.com/cr/ghcr/v2/auth?scope=repository:private/repo:pull&service=Xget'
+    );
+    const response = await worker.fetch(request, {}, executionContext);
+
+    expect(response.status).toBe(200);
+    expect(String(fetchSpy.mock.calls[1][0])).toContain('scope=repository%3Aprivate%2Frepo%3Apull');
+  });
+});
+
+describe('Protocol Header Configuration', () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it('does not send Git user-agent for AI inference requests', async () => {
+    /** @type {{ url: string, userAgent: string | null }[]} */
+    const observed = [];
+    vi.spyOn(globalThis, 'fetch').mockImplementation(async (input, init) => {
+      const headers = new Headers(init?.headers);
+      observed.push({
+        url: String(input),
+        userAgent: headers.get('User-Agent')
+      });
+
+      return new Response('{}', {
+        status: 200,
+        headers: { 'Content-Type': 'application/json' }
+      });
+    });
+
+    const request = new Request('https://example.com/ip/openai/v1/chat/completions', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: '{}'
+    });
+    const response = await worker.fetch(request, {}, executionContext);
+
+    expect(response.status).toBe(200);
+    expect(observed[0]).toEqual({
+      url: 'https://api.openai.com/v1/chat/completions',
+      userAgent: 'Xget-AI-Proxy/1.0'
+    });
+  });
+
+  it('updates Content-Length after rewriting npm metadata', async () => {
+    const upstreamBody = JSON.stringify({
+      dist: {
+        tarball: 'https://registry.npmjs.org/pkg/-/pkg-1.0.0.tgz'
+      }
+    });
+
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+      new Response(upstreamBody, {
+        status: 200,
+        headers: {
+          'Content-Type': 'application/json',
+          'Content-Length': String(upstreamBody.length)
+        }
+      })
+    );
+
+    const response = await worker.fetch(
+      new Request('https://example.com/npm/pkg'),
+      {},
+      executionContext
+    );
+    const body = await response.text();
+
+    expect(body).toContain('https://example.com/npm/pkg/-/pkg-1.0.0.tgz');
+    expect(response.headers.get('Content-Length')).toBe(
+      String(new TextEncoder().encode(body).byteLength)
+    );
+  });
+});