xixu-me
81e810ec9a
Introduces src/types.d.ts and test/types.d.ts for Cloudflare Workers and test utilities. Enhances JSDoc comments and type annotations across test files for better type safety and clarity. Updates tsconfig.json to use bundler module resolution and include additional type sources. Minor test logic and assertion improvements for robustness.
475 lines
15 KiB
JavaScript
475 lines
15 KiB
JavaScript
import { describe, expect, it } from 'vitest';
|
|
|
|
// Mock utility functions for testing
|
|
// These would normally be imported from actual utility modules
|
|
|
|
/**
|
|
* Check if request is a Git request
|
|
* @param {Request} request - Request object
|
|
* @param {URL} url - URL object
|
|
* @returns {boolean} True if Git request
|
|
*/
|
|
function isGitRequest(request, url) {
|
|
// Check for Git-specific endpoints
|
|
if (url.pathname.endsWith('/info/refs')) {
|
|
return true;
|
|
}
|
|
|
|
if (url.pathname.endsWith('/git-upload-pack') || url.pathname.endsWith('/git-receive-pack')) {
|
|
return true;
|
|
}
|
|
|
|
// Check for Git user agents
|
|
const userAgent = request.headers.get('User-Agent') || '';
|
|
if (userAgent.includes('git/') || userAgent.startsWith('git/')) {
|
|
return true;
|
|
}
|
|
|
|
// Check for Git-specific query parameters
|
|
if (url.searchParams.has('service')) {
|
|
const service = url.searchParams.get('service');
|
|
return service === 'git-upload-pack' || service === 'git-receive-pack';
|
|
}
|
|
|
|
// Check for Git-specific content types
|
|
const contentType = request.headers.get('Content-Type') || '';
|
|
if (contentType.includes('git-upload-pack') || contentType.includes('git-receive-pack')) {
|
|
return true;
|
|
}
|
|
|
|
return false;
|
|
}
|
|
|
|
/**
|
|
* Check if request is a Git LFS request
|
|
* @param {Request} request - Request object
|
|
* @param {URL} url - URL object
|
|
* @returns {boolean} True if Git LFS request
|
|
*/
|
|
function isGitLFSRequest(request, url) {
|
|
// Check for LFS-specific endpoints
|
|
if (url.pathname.includes('/info/lfs')) {
|
|
return true;
|
|
}
|
|
|
|
if (url.pathname.includes('/objects/batch')) {
|
|
return true;
|
|
}
|
|
|
|
// Check for LFS object storage endpoints (SHA-256 hash is 64 hex characters)
|
|
if (url.pathname.match(/\/objects\/[a-fA-F0-9]{64}$/)) {
|
|
return true;
|
|
}
|
|
|
|
// Check for LFS-specific headers
|
|
const accept = request.headers.get('Accept') || '';
|
|
const contentType = request.headers.get('Content-Type') || '';
|
|
|
|
if (
|
|
accept.includes('application/vnd.git-lfs') ||
|
|
contentType.includes('application/vnd.git-lfs')
|
|
) {
|
|
return true;
|
|
}
|
|
|
|
// Check for LFS user agent
|
|
const userAgent = request.headers.get('User-Agent') || '';
|
|
if (userAgent.includes('git-lfs')) {
|
|
return true;
|
|
}
|
|
|
|
return false;
|
|
}
|
|
|
|
/**
|
|
* Validate request method and path
|
|
* @param {Request} request - Request object
|
|
* @param {URL} url - URL object
|
|
* @returns {{valid: boolean, error?: string, status?: number}} Validation result
|
|
*/
|
|
function validateRequest(request, url) {
|
|
const CONFIG = {
|
|
SECURITY: {
|
|
ALLOWED_METHODS: ['GET', 'HEAD'],
|
|
MAX_PATH_LENGTH: 2048
|
|
}
|
|
};
|
|
|
|
// Allow POST method for Git operations
|
|
const allowedMethods = isGitRequest(request, url)
|
|
? ['GET', 'HEAD', 'POST']
|
|
: CONFIG.SECURITY.ALLOWED_METHODS;
|
|
|
|
if (!allowedMethods.includes(request.method)) {
|
|
return { valid: false, error: 'Method not allowed', status: 405 };
|
|
}
|
|
|
|
if (url.pathname.length > CONFIG.SECURITY.MAX_PATH_LENGTH) {
|
|
return { valid: false, error: 'Path too long', status: 414 };
|
|
}
|
|
|
|
return { valid: true };
|
|
}
|
|
|
|
/**
|
|
* Add security headers to response headers
|
|
* @param {Headers} headers - Response headers
|
|
* @returns {Headers} Headers with security headers added
|
|
*/
|
|
function addSecurityHeaders(headers) {
|
|
headers.set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains; preload');
|
|
headers.set('X-Frame-Options', 'DENY');
|
|
headers.set('X-XSS-Protection', '1; mode=block');
|
|
headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
|
|
headers.set('Content-Security-Policy', "default-src 'none'; img-src 'self'; script-src 'none'");
|
|
headers.set('Permissions-Policy', 'interest-cohort=()');
|
|
return headers;
|
|
}
|
|
|
|
describe('Utility Functions', () => {
|
|
describe('isGitRequest', () => {
|
|
it('should identify Git info/refs requests', () => {
|
|
const request = new Request('https://example.com/repo.git/info/refs');
|
|
const url = new URL(request.url);
|
|
|
|
expect(isGitRequest(request, url)).toBe(true);
|
|
});
|
|
|
|
it('should identify Git upload-pack requests', () => {
|
|
const request = new Request('https://example.com/repo.git/git-upload-pack');
|
|
const url = new URL(request.url);
|
|
|
|
expect(isGitRequest(request, url)).toBe(true);
|
|
});
|
|
|
|
it('should identify Git receive-pack requests', () => {
|
|
const request = new Request('https://example.com/repo.git/git-receive-pack');
|
|
const url = new URL(request.url);
|
|
|
|
expect(isGitRequest(request, url)).toBe(true);
|
|
});
|
|
|
|
it('should identify Git requests by User-Agent', () => {
|
|
const request = new Request('https://example.com/repo.git', {
|
|
headers: { 'User-Agent': 'git/2.34.1' }
|
|
});
|
|
const url = new URL(request.url);
|
|
|
|
expect(isGitRequest(request, url)).toBe(true);
|
|
});
|
|
|
|
it('should identify Git requests by service parameter', () => {
|
|
const request = new Request('https://example.com/repo.git/info/refs?service=git-upload-pack');
|
|
const url = new URL(request.url);
|
|
|
|
expect(isGitRequest(request, url)).toBe(true);
|
|
});
|
|
|
|
it('should identify Git requests by content type', () => {
|
|
const request = new Request('https://example.com/repo.git/git-upload-pack', {
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'application/x-git-upload-pack-request' }
|
|
});
|
|
const url = new URL(request.url);
|
|
|
|
expect(isGitRequest(request, url)).toBe(true);
|
|
});
|
|
|
|
it('should not identify regular file requests as Git', () => {
|
|
const request = new Request('https://example.com/repo/file.txt');
|
|
const url = new URL(request.url);
|
|
|
|
expect(isGitRequest(request, url)).toBe(false);
|
|
});
|
|
|
|
it('should handle edge cases gracefully', () => {
|
|
const request = new Request('https://example.com/');
|
|
const url = new URL(request.url);
|
|
|
|
expect(isGitRequest(request, url)).toBe(false);
|
|
});
|
|
});
|
|
|
|
describe('isGitLFSRequest', () => {
|
|
it('should identify LFS info/lfs requests', () => {
|
|
const request = new Request('https://example.com/repo.git/info/lfs');
|
|
const url = new URL(request.url);
|
|
|
|
expect(isGitLFSRequest(request, url)).toBe(true);
|
|
});
|
|
|
|
it('should identify LFS batch API requests', () => {
|
|
const request = new Request('https://example.com/repo.git/objects/batch', {
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'application/vnd.git-lfs+json' }
|
|
});
|
|
const url = new URL(request.url);
|
|
|
|
expect(isGitLFSRequest(request, url)).toBe(true);
|
|
});
|
|
|
|
it('should identify LFS object storage requests by path', () => {
|
|
const request = new Request(
|
|
'https://example.com/repo.git/objects/a1b2c3d4e5f6789012345678901234567890123456789012345678901234abcd'
|
|
);
|
|
const url = new URL(request.url);
|
|
|
|
expect(isGitLFSRequest(request, url)).toBe(true);
|
|
});
|
|
|
|
it('should identify LFS requests by Accept header', () => {
|
|
const request = new Request('https://example.com/repo.git/objects/batch', {
|
|
headers: { Accept: 'application/vnd.git-lfs+json' }
|
|
});
|
|
const url = new URL(request.url);
|
|
|
|
expect(isGitLFSRequest(request, url)).toBe(true);
|
|
});
|
|
|
|
it('should identify LFS requests by Content-Type header', () => {
|
|
const request = new Request('https://example.com/repo.git/objects/batch', {
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'application/vnd.git-lfs+json' }
|
|
});
|
|
const url = new URL(request.url);
|
|
|
|
expect(isGitLFSRequest(request, url)).toBe(true);
|
|
});
|
|
|
|
it('should identify LFS requests by User-Agent', () => {
|
|
const request = new Request('https://example.com/repo.git', {
|
|
headers: { 'User-Agent': 'git-lfs/3.0.0 (GitHub; darwin amd64; go 1.17.2)' }
|
|
});
|
|
const url = new URL(request.url);
|
|
|
|
expect(isGitLFSRequest(request, url)).toBe(true);
|
|
});
|
|
|
|
it('should not identify regular file requests as LFS', () => {
|
|
const request = new Request('https://example.com/repo/file.txt');
|
|
const url = new URL(request.url);
|
|
|
|
expect(isGitLFSRequest(request, url)).toBe(false);
|
|
});
|
|
|
|
it('should not identify standard Git requests as LFS', () => {
|
|
const request = new Request('https://example.com/repo.git/info/refs');
|
|
const url = new URL(request.url);
|
|
|
|
expect(isGitLFSRequest(request, url)).toBe(false);
|
|
});
|
|
|
|
it('should handle edge cases gracefully', () => {
|
|
const request = new Request('https://example.com/');
|
|
const url = new URL(request.url);
|
|
|
|
expect(isGitLFSRequest(request, url)).toBe(false);
|
|
});
|
|
});
|
|
|
|
describe('validateRequest', () => {
|
|
it('should allow GET requests', () => {
|
|
const request = new Request('https://example.com/test', { method: 'GET' });
|
|
const url = new URL(request.url);
|
|
|
|
const result = validateRequest(request, url);
|
|
expect(result.valid).toBe(true);
|
|
});
|
|
|
|
it('should allow HEAD requests', () => {
|
|
const request = new Request('https://example.com/test', { method: 'HEAD' });
|
|
const url = new URL(request.url);
|
|
|
|
const result = validateRequest(request, url);
|
|
expect(result.valid).toBe(true);
|
|
});
|
|
|
|
it('should reject PUT requests for non-Git operations', () => {
|
|
const request = new Request('https://example.com/test', { method: 'PUT' });
|
|
const url = new URL(request.url);
|
|
|
|
const result = validateRequest(request, url);
|
|
expect(result.valid).toBe(false);
|
|
expect(result.status).toBe(405);
|
|
});
|
|
|
|
it('should allow POST requests for Git operations', () => {
|
|
const request = new Request('https://example.com/repo.git/git-upload-pack', {
|
|
method: 'POST',
|
|
headers: { 'User-Agent': 'git/2.34.1' }
|
|
});
|
|
const url = new URL(request.url);
|
|
|
|
const result = validateRequest(request, url);
|
|
expect(result.valid).toBe(true);
|
|
});
|
|
|
|
it('should reject extremely long paths', () => {
|
|
const longPath = `/${'a'.repeat(3000)}`;
|
|
const request = new Request(`https://example.com${longPath}`);
|
|
const url = new URL(request.url);
|
|
|
|
const result = validateRequest(request, url);
|
|
expect(result.valid).toBe(false);
|
|
expect(result.status).toBe(414);
|
|
});
|
|
|
|
it('should accept normal length paths', () => {
|
|
const normalPath = '/gh/microsoft/vscode/archive/refs/heads/main.zip';
|
|
const request = new Request(`https://example.com${normalPath}`);
|
|
const url = new URL(request.url);
|
|
|
|
const result = validateRequest(request, url);
|
|
expect(result.valid).toBe(true);
|
|
});
|
|
});
|
|
|
|
describe('addSecurityHeaders', () => {
|
|
it('should add all required security headers', () => {
|
|
const headers = new Headers();
|
|
const result = addSecurityHeaders(headers);
|
|
|
|
expect(result.get('Strict-Transport-Security')).toBeTruthy();
|
|
expect(result.get('X-Frame-Options')).toBe('DENY');
|
|
expect(result.get('X-XSS-Protection')).toBe('1; mode=block');
|
|
expect(result.get('Referrer-Policy')).toBe('strict-origin-when-cross-origin');
|
|
expect(result.get('Content-Security-Policy')).toBeTruthy();
|
|
expect(result.get('Permissions-Policy')).toBeTruthy();
|
|
});
|
|
|
|
it('should set HSTS with proper directives', () => {
|
|
const headers = new Headers();
|
|
const result = addSecurityHeaders(headers);
|
|
|
|
const hsts = result.get('Strict-Transport-Security');
|
|
expect(hsts).toContain('max-age=31536000');
|
|
expect(hsts).toContain('includeSubDomains');
|
|
expect(hsts).toContain('preload');
|
|
});
|
|
|
|
it('should set CSP with restrictive policy', () => {
|
|
const headers = new Headers();
|
|
const result = addSecurityHeaders(headers);
|
|
|
|
const csp = result.get('Content-Security-Policy');
|
|
expect(csp).toContain("default-src 'none'");
|
|
expect(csp).toContain("script-src 'none'");
|
|
});
|
|
|
|
it('should not overwrite existing headers', () => {
|
|
const headers = new Headers();
|
|
headers.set('X-Custom-Header', 'custom-value');
|
|
|
|
const result = addSecurityHeaders(headers);
|
|
|
|
expect(result.get('X-Custom-Header')).toBe('custom-value');
|
|
expect(result.get('X-Frame-Options')).toBe('DENY');
|
|
});
|
|
|
|
it('should return the same Headers object', () => {
|
|
const headers = new Headers();
|
|
const result = addSecurityHeaders(headers);
|
|
|
|
expect(result).toBe(headers);
|
|
});
|
|
});
|
|
|
|
describe('URL and Path Utilities', () => {
|
|
it('should handle URL parsing correctly', () => {
|
|
const testUrls = [
|
|
'https://example.com/gh/user/repo/file.txt',
|
|
'https://example.com/gl/group/project/-/blob/main/README.md',
|
|
'https://example.com/hf/microsoft/model/resolve/main/config.json'
|
|
];
|
|
|
|
testUrls.forEach(urlString => {
|
|
expect(() => new URL(urlString)).not.toThrow();
|
|
|
|
const url = new URL(urlString);
|
|
expect(url.protocol).toBe('https:');
|
|
expect(url.hostname).toBe('example.com');
|
|
expect(url.pathname).toBeTruthy();
|
|
});
|
|
});
|
|
|
|
it('should handle query parameters correctly', () => {
|
|
const url = new URL('https://example.com/gh/repo?ref=main&path=src');
|
|
|
|
expect(url.searchParams.get('ref')).toBe('main');
|
|
expect(url.searchParams.get('path')).toBe('src');
|
|
expect(url.searchParams.has('nonexistent')).toBe(false);
|
|
});
|
|
|
|
it('should handle URL fragments correctly', () => {
|
|
const url = new URL('https://example.com/gh/repo/README.md#section');
|
|
|
|
expect(url.hash).toBe('#section');
|
|
expect(url.pathname).toBe('/gh/repo/README.md');
|
|
});
|
|
});
|
|
|
|
describe('Request and Response Utilities', () => {
|
|
it('should create requests with proper headers', () => {
|
|
const request = new Request('https://example.com/test', {
|
|
method: 'GET',
|
|
headers: {
|
|
'User-Agent': 'Xget/1.0',
|
|
Accept: 'application/json'
|
|
}
|
|
});
|
|
|
|
expect(request.method).toBe('GET');
|
|
expect(request.headers.get('User-Agent')).toBe('Xget/1.0');
|
|
expect(request.headers.get('Accept')).toBe('application/json');
|
|
});
|
|
|
|
it('should handle request cloning', () => {
|
|
const originalRequest = new Request('https://example.com/test', {
|
|
method: 'POST',
|
|
body: 'test data',
|
|
headers: { 'Content-Type': 'text/plain' }
|
|
});
|
|
|
|
const clonedRequest = originalRequest.clone();
|
|
|
|
expect(clonedRequest.method).toBe(originalRequest.method);
|
|
expect(clonedRequest.url).toBe(originalRequest.url);
|
|
expect(clonedRequest.headers.get('Content-Type')).toBe('text/plain');
|
|
});
|
|
|
|
it('should create responses with proper status codes', () => {
|
|
const responses = [
|
|
new Response('OK', { status: 200 }),
|
|
new Response('Not Found', { status: 404 }),
|
|
new Response('Server Error', { status: 500 })
|
|
];
|
|
|
|
expect(responses[0].status).toBe(200);
|
|
expect(responses[1].status).toBe(404);
|
|
expect(responses[2].status).toBe(500);
|
|
});
|
|
});
|
|
|
|
describe('Error Handling Utilities', () => {
|
|
it('should create proper error responses', () => {
|
|
const errorResponse = new Response('Bad Request', {
|
|
status: 400,
|
|
statusText: 'Bad Request',
|
|
headers: { 'Content-Type': 'text/plain' }
|
|
});
|
|
|
|
expect(errorResponse.status).toBe(400);
|
|
expect(errorResponse.statusText).toBe('Bad Request');
|
|
expect(errorResponse.headers.get('Content-Type')).toBe('text/plain');
|
|
});
|
|
|
|
it('should handle async error scenarios', async () => {
|
|
const asyncFunction = async () => {
|
|
throw new Error('Test error');
|
|
};
|
|
|
|
await expect(asyncFunction()).rejects.toThrow('Test error');
|
|
});
|
|
});
|
|
});
|