app.ts · Source

app.tstests/security/helpers/app.tsraw ← helpers3,252 B← Back to the app
1/**
2 * Shared live-app helper for the TASK-0134 security suites.
3 *
4 * The live-app suites (auth-paths, headers, upload-abuse, rate-limits) probe
5 * a RUNNING API + web app. They resolve:
6 *   - `SEC_API_URL` — the API base (default http://localhost:4000, matching
7 *     the dev stack and the CI e2e services block).
8 *   - `SEC_WEB_URL` — the web base (default http://localhost:3000).
9 *   - `SEC_REQUIRE_LIVE=1` — a down API FAILS the suite instead of skipping
10 *     (the CI security stage sets this, so a missing stack is a red build,
11 *     not a silently-green suite).
12 *
13 * Usage (top of a live-app suite file):
14 *   beforeAll(async () => { live = await checkLiveApp(); }, 30_000);
15 *   const itLive = live ? it : it.skip;   // every `it` becomes itLive
16 */
17export const SEC_API_URL = (process.env.SEC_API_URL ?? "http://localhost:4000").replace(/\/$/, "");
18export const SEC_WEB_URL = (process.env.SEC_WEB_URL ?? "http://localhost:3000").replace(/\/$/, "");
19export const SEC_REQUIRE_LIVE = process.env.SEC_REQUIRE_LIVE === "1";
20 
21/**
22 * Probe the API health endpoint. Returns true when the API is up (any real
23 * HTTP response < 500, incl. 404 — it answered); a connection-refused/timeout
24 * is false. 10 s timeout so a half-up API doesn't hang the suite.
25 */
26export async function apiReachable(base: string = SEC_API_URL): Promise<boolean> {
27  try {
28    const res = await fetch(`${base}/api/v1/health`, { signal: AbortSignal.timeout(10_000) });
29    return res.status < 500;
30  } catch {
31    return false;
32  }
33}
34 
35let _liveOk: boolean | null = null;
36 
37/**
38 * Run in `beforeAll`. Resolves true when the API is reachable; false (and the
39 * suites skip) when it is not — UNLESS `SEC_REQUIRE_LIVE=1`, in which case a
40 * down API throws and the build goes red.
41 */
42export async function checkLiveApp(): Promise<boolean> {
43  if (_liveOk === null) _liveOk = await apiReachable();
44  if (!_liveOk && SEC_REQUIRE_LIVE) {
45    throw new Error(
46      `SEC_REQUIRE_LIVE=1 but the API at ${SEC_API_URL} is unreachable — the stack is not up (CI should have booted it).`
47    );
48  }
49  return _liveOk;
50}
51 
52/**
53 * A fetch bound to the API base, JSON by default, with a per-call timeout.
54 * Paths are relative to the API: the global prefix `api/v1` is added
55 * automatically (callers pass `/auth/login`, not `/api/v1/auth/login`).
56 * `/internal/…` and already-prefixed paths are passed through verbatim.
57 */
58export function apiFetch(
59  path: string,
60  init: RequestInit = {},
61  opts: { timeoutMs?: number } = {}
62): Promise<Response> {
63  const normalized =
64    path.startsWith("/api/v1/") || path.startsWith("/internal/")
65      ? path
66      : `/api/v1${path.startsWith("/") ? path : `/${path}`}`;
67  const headers = new Headers(init.headers);
68  if (init.body && !headers.has("content-type")) headers.set("content-type", "application/json");
69  return fetch(`${SEC_API_URL}${normalized}`, {
70    ...init,
71    headers,
72    signal: AbortSignal.timeout(opts.timeoutMs ?? 30_000)
73  });
74}
75 
76/** A fetch bound to the web base. */
77export function webFetch(
78  path: string,
79  init: RequestInit = {},
80  opts: { timeoutMs?: number } = {}
81): Promise<Response> {
82  return fetch(`${SEC_WEB_URL}${path}`, { ...init, signal: AbortSignal.timeout(opts.timeoutMs ?? 15_000) });
83}
84