+314

packages/api/src/middleware/auth.test.ts

reviewed

··· 1 1 + /** 2 2 + * Auth Middleware Tests 3 3 + * Tests for authentication middleware error handling 4 4 + */ 5 5 + 6 6 + import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest'; 7 7 + import { Hono } from 'hono'; 8 8 + import { authMiddleware, extractSessionId } from './auth'; 9 9 + import { createTestSession, deleteTestSession } from '../../__tests__/fixtures'; 10 10 + 11 11 + describe('Auth Middleware', () => { 12 12 + let app: Hono; 13 13 + 14 14 + beforeEach(() => { 15 15 + app = new Hono(); 16 16 + app.use('/protected/*', authMiddleware); 17 17 + app.get('/protected/test', (c) => { 18 18 + // Access context variables added by authMiddleware 19 19 + const did = (c.get as (key: string) => unknown)('did'); 20 20 + return c.json({ success: true, did: did as string }); 21 21 + }); 22 22 + }); 23 23 + 24 24 + describe('Missing Auth Headers', () => { 25 25 + it('rejects requests without session cookie', async () => { 26 26 + const res = await app.request('/protected/test'); 27 27 + 28 28 + expect(res.status).toBe(401); 29 29 + const body = await res.json() as { success: boolean; error?: string }; 30 30 + expect(body.success).toBe(false); 31 31 + expect(body.error).toContain('session'); 32 32 + }); 33 33 + 34 34 + it('rejects requests with empty cookie header', async () => { 35 35 + const res = await app.request('/protected/test', { 36 36 + headers: { 37 37 + Cookie: '', 38 38 + }, 39 39 + }); 40 40 + 41 41 + expect(res.status).toBe(401); 42 42 + }); 43 43 + 44 44 + it('rejects requests with malformed cookie header', async () => { 45 45 + const res = await app.request('/protected/test', { 46 46 + headers: { 47 47 + Cookie: 'malformed cookie string without equals', 48 48 + }, 49 49 + }); 50 50 + 51 51 + expect(res.status).toBe(401); 52 52 + }); 53 53 + }); 54 54 + 55 55 + describe('Invalid Session Tokens', () => { 56 56 + it('rejects expired sessions', async () => { 57 57 + const expiredSession = 'expired-session-id'; 58 58 + 59 59 + const res = await app.request('/protected/test', { 60 60 + headers: { 61 61 + Cookie: `atlast_session_dev=${expiredSession}`, 62 62 + }, 63 63 + }); 64 64 + 65 65 + expect(res.status).toBe(401); 66 66 + const body = await res.json() as { success: boolean }; 67 67 + }); 68 68 + 69 69 + it('rejects malformed session IDs', async () => { 70 70 + const malformedSession = 'not-a-valid-session-format'; 71 71 + 72 72 + const res = await app.request('/protected/test', { 73 73 + headers: { 74 74 + Cookie: `atlast_session_dev=${malformedSession}`, 75 75 + }, 76 76 + }); 77 77 + 78 78 + expect(res.status).toBe(401); 79 79 + }); 80 80 + 81 81 + it('rejects non-existent sessions', async () => { 82 82 + const nonExistentSession = 'session-that-does-not-exist'; 83 83 + 84 84 + const res = await app.request('/protected/test', { 85 85 + headers: { 86 86 + Cookie: `atlast_session_dev=${nonExistentSession}`, 87 87 + }, 88 88 + }); 89 89 + 90 90 + expect(res.status).toBe(401); 91 91 + }); 92 92 + 93 93 + it('rejects sessions with invalid characters', async () => { 94 94 + const invalidSession = 'session-with-<script>alert("xss")</script>'; 95 95 + 96 96 + const res = await app.request('/protected/test', { 97 97 + headers: { 98 98 + Cookie: `atlast_session_dev=${invalidSession}`, 99 99 + }, 100 100 + }); 101 101 + 102 102 + expect(res.status).toBe(401); 103 103 + }); 104 104 + }); 105 105 + 106 106 + describe('Valid Session Handling', () => { 107 107 + let validSession: string; 108 108 + 109 109 + beforeEach(async () => { 110 110 + validSession = await createTestSession('standard'); 111 111 + }); 112 112 + 113 113 + afterEach(async () => { 114 114 + await deleteTestSession(validSession); 115 115 + }); 116 116 + 117 117 + it('allows requests with valid session', async () => { 118 118 + const res = await app.request('/protected/test', { 119 119 + headers: { 120 120 + Cookie: `atlast_session_dev=${validSession}`, 121 121 + }, 122 122 + }); 123 123 + 124 124 + expect(res.status).toBe(200); 125 125 + const body = await res.json() as { success: boolean; did: string }; 126 126 + expect(body.success).toBe(true); 127 127 + expect(body.did).toBeDefined(); 128 128 + }); 129 129 + 130 130 + it('accepts both dev and production cookie names', async () => { 131 131 + // Test dev cookie 132 132 + const devRes = await app.request('/protected/test', { 133 133 + headers: { 134 134 + Cookie: `atlast_session_dev=${validSession}`, 135 135 + }, 136 136 + }); 137 137 + expect(devRes.status).toBe(200); 138 138 + 139 139 + // Test prod cookie 140 140 + const prodRes = await app.request('/protected/test', { 141 141 + headers: { 142 142 + Cookie: `atlast_session=${validSession}`, 143 143 + }, 144 144 + }); 145 145 + expect(prodRes.status).toBe(200); 146 146 + }); 147 147 + 148 148 + it('prioritizes correct cookie when multiple cookies present', async () => { 149 149 + const res = await app.request('/protected/test', { 150 150 + headers: { 151 151 + Cookie: `other_cookie=value; atlast_session_dev=${validSession}; another=value`, 152 152 + }, 153 153 + }); 154 154 + 155 155 + expect(res.status).toBe(200); 156 156 + }); 157 157 + }); 158 158 + 159 159 + describe('Session Context', () => { 160 160 + let validSession: string; 161 161 + 162 162 + beforeEach(async () => { 163 163 + validSession = await createTestSession('standard'); 164 164 + }); 165 165 + 166 166 + afterEach(async () => { 167 167 + await deleteTestSession(validSession); 168 168 + }); 169 169 + 170 170 + it('adds sessionId to context', async () => { 171 171 + const testApp = new Hono(); 172 172 + testApp.use('*', authMiddleware); 173 173 + testApp.get('/test', (c) => { 174 174 + const sessionId = (c.get as (key: string) => unknown)('sessionId'); 175 175 + return c.json({ sessionId: sessionId as string }); 176 176 + }); 177 177 + 178 178 + const res = await testApp.request('/test', { 179 179 + headers: { 180 180 + Cookie: `atlast_session_dev=${validSession}`, 181 181 + }, 182 182 + }); 183 183 + 184 184 + expect(res.status).toBe(200); 185 185 + const body = await res.json() as { sessionId: string }; 186 186 + expect(body.sessionId).toBe(validSession); 187 187 + }); 188 188 + 189 189 + it('adds did to context', async () => { 190 190 + const testApp = new Hono(); 191 191 + testApp.use('*', authMiddleware); 192 192 + testApp.get('/test', (c) => { 193 193 + const did = (c.get as (key: string) => unknown)('did'); 194 194 + return c.json({ did: did as string }); 195 195 + }); 196 196 + 197 197 + const res = await testApp.request('/test', { 198 198 + headers: { 199 199 + Cookie: `atlast_session_dev=${validSession}`, 200 200 + }, 201 201 + }); 202 202 + 203 203 + expect(res.status).toBe(200); 204 204 + const body = await res.json() as { did: string }; 205 205 + expect(body.did).toMatch(/^did:plc:/); 206 206 + }); 207 207 + }); 208 208 + 209 209 + describe('extractSessionId Helper', () => { 210 210 + it('extracts session from cookie header', () => { 211 211 + const mockContext = { 212 212 + req: { 213 213 + header: (name: string) => { 214 214 + if (name === 'cookie') { 215 215 + return 'atlast_session_dev=test-session-id'; 216 216 + } 217 217 + return undefined; 218 218 + }, 219 219 + }, 220 220 + }; 221 221 + 222 222 + const sessionId = extractSessionId(mockContext); 223 223 + expect(sessionId).toBe('test-session-id'); 224 224 + }); 225 225 + 226 226 + it('returns null when no cookie header', () => { 227 227 + const mockContext = { 228 228 + req: { 229 229 + header: () => undefined, 230 230 + }, 231 231 + }; 232 232 + 233 233 + const sessionId = extractSessionId(mockContext); 234 234 + expect(sessionId).toBeNull(); 235 235 + }); 236 236 + 237 237 + it('handles multiple cookies', () => { 238 238 + const mockContext = { 239 239 + req: { 240 240 + header: (name: string) => { 241 241 + if (name === 'cookie') { 242 242 + return 'other=value; atlast_session_dev=test-session; another=value'; 243 243 + } 244 244 + return undefined; 245 245 + }, 246 246 + }, 247 247 + }; 248 248 + 249 249 + const sessionId = extractSessionId(mockContext); 250 250 + expect(sessionId).toBe('test-session'); 251 251 + }); 252 252 + 253 253 + it('prefers production cookie over dev cookie', () => { 254 254 + const mockContext = { 255 255 + req: { 256 256 + header: (name: string) => { 257 257 + if (name === 'cookie') { 258 258 + return 'atlast_session=prod-session; atlast_session_dev=dev-session'; 259 259 + } 260 260 + return undefined; 261 261 + }, 262 262 + }, 263 263 + }; 264 264 + 265 265 + const sessionId = extractSessionId(mockContext); 266 266 + expect(sessionId).toBe('prod-session'); 267 267 + }); 268 268 + }); 269 269 + 270 270 + describe('Database Error Scenarios', () => { 271 271 + it('handles database connection failures during session lookup', async () => { 272 272 + // If database is down, session validation will fail 273 273 + // This should result in 401 (cannot authenticate) 274 274 + 275 275 + const res = await app.request('/protected/test', { 276 276 + headers: { 277 277 + Cookie: 'atlast_session_dev=any-session', 278 278 + }, 279 279 + }); 280 280 + 281 281 + // Will return 401 because session lookup will fail 282 282 + expect([401, 500]).toContain(res.status); 283 283 + }); 284 284 + }); 285 285 + 286 286 + describe('Concurrent Request Handling', () => { 287 287 + let validSession: string; 288 288 + 289 289 + beforeEach(async () => { 290 290 + validSession = await createTestSession('standard'); 291 291 + }); 292 292 + 293 293 + afterEach(async () => { 294 294 + await deleteTestSession(validSession); 295 295 + }); 296 296 + 297 297 + it('handles multiple concurrent requests with same session', async () => { 298 298 + const requests = Array.from({ length: 5 }, () => 299 299 + app.request('/protected/test', { 300 300 + headers: { 301 301 + Cookie: `atlast_session_dev=${validSession}`, 302 302 + }, 303 303 + }) 304 304 + ); 305 305 + 306 306 + const results = await Promise.all(requests); 307 307 + 308 308 + // All should succeed 309 309 + results.forEach((res) => { 310 310 + expect(res.status).toBe(200); 311 311 + }); 312 312 + }); 313 313 + }); 314 314 + });

+431

packages/api/src/middleware/error.test.ts

reviewed

··· 1 1 + /** 2 2 + * Error Handler Middleware Tests 3 3 + * Tests for error handler middleware 4 4 + */ 5 5 + 6 6 + import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest'; 7 7 + import { Hono, Context } from 'hono'; 8 8 + import { ZodError, z } from 'zod'; 9 9 + import { errorHandler } from './error'; 10 10 + import { 11 11 + ApiError, 12 12 + AuthenticationError, 13 13 + ValidationError, 14 14 + NotFoundError, 15 15 + DatabaseError, 16 16 + } from '../errors'; 17 17 + 18 18 + describe('Error Handler Middleware', () => { 19 19 + let app: Hono; 20 20 + let consoleErrorSpy: ReturnType<typeof vi.spyOn>; 21 21 + 22 22 + beforeEach(() => { 23 23 + app = new Hono(); 24 24 + app.onError(errorHandler); 25 25 + 26 26 + // Spy on console.error to verify logging 27 27 + consoleErrorSpy = vi.spyOn(console, 'error').mockImplementation(() => {}); 28 28 + }); 29 29 + 30 30 + afterEach(() => { 31 31 + consoleErrorSpy.mockRestore(); 32 32 + }); 33 33 + 34 34 + describe('Validation Errors', () => { 35 35 + it('returns 400 for ValidationError', async () => { 36 36 + app.get('/test', () => { 37 37 + throw new ValidationError('Invalid input data'); 38 38 + }); 39 39 + 40 40 + const res = await app.request('/test'); 41 41 + 42 42 + expect(res.status).toBe(400); 43 43 + const body = await res.json() as { success: boolean; error: string }; 44 44 + expect(body.success).toBe(false); 45 45 + expect(body.error).toBe('Invalid input data'); 46 46 + }); 47 47 + 48 48 + it('returns 400 for ZodError with formatted message', async () => { 49 49 + app.get('/test', () => { 50 50 + const schema = z.object({ 51 51 + email: z.string().email(), 52 52 + age: z.number().min(18), 53 53 + }); 54 54 + 55 55 + // This will throw ZodError 56 56 + schema.parse({ email: 'invalid', age: 10 }); 57 57 + return null as never; // Unreachable 58 58 + }); 59 59 + 60 60 + const res = await app.request('/test'); 61 61 + 62 62 + expect(res.status).toBe(400); 63 63 + const body = await res.json() as { success: boolean; error: string; details: unknown[] }; 64 64 + expect(body.success).toBe(false); 65 65 + expect(body.error).toBeDefined(); 66 66 + expect(body.details).toBeDefined(); 67 67 + }); 68 68 + 69 69 + it('includes Zod error details', async () => { 70 70 + app.get('/test', () => { 71 71 + const schema = z.object({ 72 72 + username: z.string().min(3), 73 73 + }); 74 74 + 75 75 + schema.parse({ username: 'ab' }); 76 76 + return null as never; // Unreachable 77 77 + }); 78 78 + 79 79 + const res = await app.request('/test'); 80 80 + 81 81 + expect(res.status).toBe(400); 82 82 + const body = await res.json() as { details: unknown[] }; 83 83 + expect(body.details).toBeDefined(); 84 84 + expect(Array.isArray(body.details)).toBe(true); 85 85 + }); 86 86 + }); 87 87 + 88 88 + describe('Authentication Errors', () => { 89 89 + it('returns 401 for AuthenticationError', async () => { 90 90 + app.get('/test', () => { 91 91 + throw new AuthenticationError('Invalid session'); 92 92 + }); 93 93 + 94 94 + const res = await app.request('/test'); 95 95 + 96 96 + expect(res.status).toBe(401); 97 97 + const body = await res.json() as { success: boolean; error: string }; 98 98 + expect(body.success).toBe(false); 99 99 + expect(body.error).toContain('session has expired'); 100 100 + }); 101 101 + 102 102 + it('provides user-friendly message for authentication errors', async () => { 103 103 + app.get('/test', () => { 104 104 + throw new AuthenticationError('Technical auth error'); 105 105 + }); 106 106 + 107 107 + const res = await app.request('/test'); 108 108 + 109 109 + const body = await res.json() as { error: string }; 110 110 + // Should not expose technical details 111 111 + expect(body.error).not.toContain('Technical'); 112 112 + expect(body.error).toContain('log in again'); 113 113 + }); 114 114 + }); 115 115 + 116 116 + describe('Not Found Errors', () => { 117 117 + it('returns 404 for NotFoundError', async () => { 118 118 + app.get('/test', () => { 119 119 + throw new NotFoundError('Resource not found'); 120 120 + }); 121 121 + 122 122 + const res = await app.request('/test'); 123 123 + 124 124 + expect(res.status).toBe(404); 125 125 + const body = await res.json() as { success: boolean; error: string }; 126 126 + expect(body.success).toBe(false); 127 127 + expect(body.error).toBe('Resource not found'); 128 128 + }); 129 129 + }); 130 130 + 131 131 + describe('Database Errors', () => { 132 132 + it('returns 500 for DatabaseError', async () => { 133 133 + app.get('/test', () => { 134 134 + throw new DatabaseError('Connection failed'); 135 135 + }); 136 136 + 137 137 + const res = await app.request('/test'); 138 138 + 139 139 + expect(res.status).toBe(500); 140 140 + const body = await res.json() as { success: boolean; error: string }; 141 141 + expect(body.success).toBe(false); 142 142 + expect(body.error).toContain('Database operation failed'); 143 143 + }); 144 144 + 145 145 + it('provides generic message for database errors', async () => { 146 146 + app.get('/test', () => { 147 147 + throw new DatabaseError('SELECT * FROM users WHERE id = $1 -- sensitive query'); 148 148 + }); 149 149 + 150 150 + const res = await app.request('/test'); 151 151 + 152 152 + const body = await res.json() as { error: string }; 153 153 + // Should not expose database details 154 154 + expect(body.error).not.toContain('SELECT'); 155 155 + expect(body.error).toContain('try again later'); 156 156 + }); 157 157 + }); 158 158 + 159 159 + describe('API Errors', () => { 160 160 + it('returns correct status code for ApiError', async () => { 161 161 + app.get('/test', () => { 162 162 + throw new ApiError('Bad Request', 400); 163 163 + }); 164 164 + 165 165 + const res = await app.request('/test'); 166 166 + 167 167 + expect(res.status).toBe(400); 168 168 + const body = await res.json() as { success: boolean; error: string }; 169 169 + expect(body.success).toBe(false); 170 170 + expect(body.error).toBe('Bad Request'); 171 171 + }); 172 172 + 173 173 + it('includes details when provided', async () => { 174 174 + app.get('/test', () => { 175 175 + const details = JSON.stringify({ fields: ['email', 'username'] }); 176 176 + throw new ApiError('Validation failed', 400, details); 177 177 + }); 178 178 + 179 179 + const res = await app.request('/test'); 180 180 + 181 181 + const body = await res.json() as { details: string }; 182 182 + expect(body.details).toBeDefined(); 183 183 + const parsedDetails = JSON.parse(body.details); 184 184 + expect(parsedDetails.fields).toEqual(['email', 'username']); 185 185 + }); 186 186 + 187 187 + it('defaults to 500 for invalid status codes', async () => { 188 188 + app.get('/test', () => { 189 189 + throw new ApiError('Error', 999); // Invalid status code 190 190 + }); 191 191 + 192 192 + const res = await app.request('/test'); 193 193 + 194 194 + expect(res.status).toBe(500); 195 195 + }); 196 196 + 197 197 + it('handles various valid status codes', async () => { 198 198 + const statusCodes = [400, 401, 403, 404, 500, 503]; 199 199 + 200 200 + for (const code of statusCodes) { 201 201 + const testApp = new Hono(); 202 202 + testApp.onError(errorHandler); 203 203 + testApp.get('/test', () => { 204 204 + throw new ApiError(`Error ${code}`, code); 205 205 + }); 206 206 + 207 207 + const res = await testApp.request('/test'); 208 208 + expect(res.status).toBe(code); 209 209 + } 210 210 + }); 211 211 + }); 212 212 + 213 213 + describe('Generic Errors', () => { 214 214 + it('returns 500 for generic Error', async () => { 215 215 + app.get('/test', () => { 216 216 + throw new Error('Something went wrong'); 217 217 + }); 218 218 + 219 219 + const res = await app.request('/test'); 220 220 + 221 221 + expect(res.status).toBe(500); 222 222 + const body = await res.json() as { success: boolean; error: string }; 223 223 + expect(body.success).toBe(false); 224 224 + expect(body.error).toContain('try again later'); 225 225 + }); 226 226 + 227 227 + it('provides generic message for unknown errors', async () => { 228 228 + app.get('/test', () => { 229 229 + throw new Error('Internal server error with sensitive data'); 230 230 + }); 231 231 + 232 232 + const res = await app.request('/test'); 233 233 + 234 234 + const body = await res.json() as { error: string }; 235 235 + // Should not expose error details 236 236 + expect(body.error).not.toContain('sensitive data'); 237 237 + }); 238 238 + 239 239 + it('handles errors without message', async () => { 240 240 + app.get('/test', () => { 241 241 + throw new Error(); 242 242 + }); 243 243 + 244 244 + const res = await app.request('/test'); 245 245 + 246 246 + expect(res.status).toBe(500); 247 247 + const body = await res.json() as { success: boolean; error: string }; 248 248 + expect(body.success).toBe(false); 249 249 + expect(body.error).toBeDefined(); 250 250 + }); 251 251 + }); 252 252 + 253 253 + describe('Error Logging', () => { 254 254 + it('logs error details', async () => { 255 255 + app.get('/test', () => { 256 256 + throw new Error('Test error'); 257 257 + }); 258 258 + 259 259 + await app.request('/test'); 260 260 + 261 261 + expect(consoleErrorSpy).toHaveBeenCalled(); 262 262 + const logCall = consoleErrorSpy.mock.calls[0]; 263 263 + expect(logCall[0]).toBe('[ERROR]'); 264 264 + }); 265 265 + 266 266 + it('includes request metadata in logs', async () => { 267 267 + app.get('/test-path', () => { 268 268 + throw new Error('Test error'); 269 269 + }); 270 270 + 271 271 + await app.request('/test-path'); 272 272 + 273 273 + const logCall = consoleErrorSpy.mock.calls[0]; 274 274 + const logData = logCall[1] as Record<string, unknown>; 275 275 + 276 276 + expect(logData).toHaveProperty('timestamp'); 277 277 + expect(logData).toHaveProperty('path'); 278 278 + expect(logData.path).toBe('/test-path'); 279 279 + expect(logData).toHaveProperty('method'); 280 280 + expect(logData.method).toBe('GET'); 281 281 + }); 282 282 + 283 283 + it('includes user DID when authenticated', async () => { 284 284 + app.use('*', async (c, next) => { 285 285 + (c.set as (key: string, value: unknown) => void)('did', 'did:plc:test123'); 286 286 + await next(); 287 287 + }); 288 288 + 289 289 + app.get('/test', () => { 290 290 + throw new Error('Test error'); 291 291 + }); 292 292 + 293 293 + await app.request('/test'); 294 294 + 295 295 + const logCall = consoleErrorSpy.mock.calls[0]; 296 296 + const logData = logCall[1] as Record<string, unknown>; 297 297 + 298 298 + expect(logData.userDid).toBe('did:plc:test123'); 299 299 + }); 300 300 + 301 301 + it('logs "unauthenticated" when no user DID', async () => { 302 302 + app.get('/test', () => { 303 303 + throw new Error('Test error'); 304 304 + }); 305 305 + 306 306 + await app.request('/test'); 307 307 + 308 308 + const logCall = consoleErrorSpy.mock.calls[0]; 309 309 + const logData = logCall[1] as Record<string, unknown>; 310 310 + 311 311 + expect(logData.userDid).toBe('unauthenticated'); 312 312 + }); 313 313 + 314 314 + it('includes error stack trace', async () => { 315 315 + app.get('/test', () => { 316 316 + throw new Error('Test error'); 317 317 + }); 318 318 + 319 319 + await app.request('/test'); 320 320 + 321 321 + const logCall = consoleErrorSpy.mock.calls[0]; 322 322 + const logData = logCall[1] as Record<string, unknown>; 323 323 + 324 324 + expect(logData.stack).toBeDefined(); 325 325 + expect(typeof logData.stack).toBe('string'); 326 326 + }); 327 327 + }); 328 328 + 329 329 + describe('Error Response Format', () => { 330 330 + it('always includes success: false', async () => { 331 331 + app.get('/validation', () => { 332 332 + throw new ValidationError('Test'); 333 333 + }); 334 334 + app.get('/auth', () => { 335 335 + throw new AuthenticationError('Test'); 336 336 + }); 337 337 + app.get('/generic', () => { 338 338 + throw new Error('Test'); 339 339 + }); 340 340 + 341 341 + const endpoints = ['/validation', '/auth', '/generic']; 342 342 + 343 343 + for (const endpoint of endpoints) { 344 344 + const res = await app.request(endpoint); 345 345 + const body = await res.json() as { success: boolean }; 346 346 + expect(body.success).toBe(false); 347 347 + } 348 348 + }); 349 349 + 350 350 + it('always includes error message', async () => { 351 351 + app.get('/test', () => { 352 352 + throw new Error('Test error'); 353 353 + }); 354 354 + 355 355 + const res = await app.request('/test'); 356 356 + const body = await res.json() as { error: string }; 357 357 + 358 358 + expect(body.error).toBeDefined(); 359 359 + expect(typeof body.error).toBe('string'); 360 360 + expect(body.error.length).toBeGreaterThan(0); 361 361 + }); 362 362 + 363 363 + it('returns valid JSON even for malformed errors', async () => { 364 364 + app.get('/test', () => { 365 365 + const err = new Error('Test'); 366 366 + // @ts-expect-error - Testing malformed error 367 367 + err.statusCode = 'not-a-number'; 368 368 + throw err; 369 369 + }); 370 370 + 371 371 + const res = await app.request('/test'); 372 372 + 373 373 + expect(res.headers.get('content-type')).toContain('application/json'); 374 374 + const body = await res.json() as Record<string, unknown>; 375 375 + expect(body).toBeDefined(); 376 376 + }); 377 377 + }); 378 378 + 379 379 + describe('Edge Cases', () => { 380 380 + it('handles null errors', async () => { 381 381 + app.get('/test', () => { 382 382 + // Testing null throw 383 383 + throw null; // eslint-disable-line @typescript-eslint/no-throw-literal 384 384 + }); 385 385 + 386 386 + const res = await app.request('/test'); 387 387 + 388 388 + expect(res.status).toBe(500); 389 389 + }); 390 390 + 391 391 + it('handles errors thrown during error handling', async () => { 392 392 + // This is a meta-test: what if error handler itself throws? 393 393 + // The framework should catch it 394 394 + 395 395 + const badErrorHandler = (err: Error, c: Context) => { 396 396 + throw new Error('Error handler error'); 397 397 + }; 398 398 + 399 399 + const testApp = new Hono(); 400 400 + testApp.onError(badErrorHandler); 401 401 + testApp.get('/test', () => { 402 402 + throw new Error('Original error'); 403 403 + }); 404 404 + 405 405 + // This should not hang or crash 406 406 + await expect(testApp.request('/test')).resolves.toBeDefined(); 407 407 + }); 408 408 + 409 409 + it('handles circular references in error details', async () => { 410 410 + app.get('/test', () => { 411 411 + // Try to create a circular JSON string (will throw, which is expected) 412 412 + try { 413 413 + const circular: Record<string, unknown> = {}; 414 414 + circular.self = circular; 415 415 + JSON.stringify(circular); // This will throw 416 416 + } catch { 417 417 + // If stringify fails, pass a string instead 418 418 + throw new ApiError('Circular error', 500, 'details-with-circular-ref'); 419 419 + } 420 420 + return null as never; // Unreachable 421 421 + }); 422 422 + 423 423 + const res = await app.request('/test'); 424 424 + 425 425 + expect(res.status).toBe(500); 426 426 + // Should not throw during JSON serialization 427 427 + const body = await res.json() as Record<string, unknown>; 428 428 + expect(body).toBeDefined(); 429 429 + }); 430 430 + }); 431 431 + });

+553

packages/api/src/middleware/rateLimit.test.ts

reviewed

··· 1 1 + /** 2 2 + * Rate Limit Middleware Tests 3 3 + * Tests for rate limiting logic and error handling 4 4 + */ 5 5 + 6 6 + import { describe, it, expect, beforeEach } from 'vitest'; 7 7 + import { Hono } from 'hono'; 8 8 + import { rateLimiter, apiRateLimit, searchRateLimit, followRateLimit } from './rateLimit'; 9 9 + 10 10 + describe('Rate Limit Middleware', () => { 11 11 + let app: Hono; 12 12 + 13 13 + beforeEach(() => { 14 14 + app = new Hono(); 15 15 + }); 16 16 + 17 17 + describe('Basic Rate Limiting', () => { 18 18 + it('allows requests under the limit', async () => { 19 19 + const limiter = rateLimiter({ 20 20 + maxRequests: 5, 21 21 + windowMs: 60000, 22 22 + }); 23 23 + 24 24 + app.use('/test', limiter); 25 25 + app.get('/test', (c) => c.json({ success: true })); 26 26 + 27 27 + // Send 5 requests (within limit) 28 28 + for (let i = 0; i < 5; i++) { 29 29 + const res = await app.request('/test', { 30 30 + headers: { 'x-forwarded-for': '127.0.0.1' }, 31 31 + }); 32 32 + expect(res.status).toBe(200); 33 33 + } 34 34 + }); 35 35 + 36 36 + it('blocks requests over the limit', async () => { 37 37 + const limiter = rateLimiter({ 38 38 + maxRequests: 3, 39 39 + windowMs: 60000, 40 40 + }); 41 41 + 42 42 + app.use('/test', limiter); 43 43 + app.get('/test', (c) => c.json({ success: true })); 44 44 + 45 45 + const ip = '192.168.1.1'; 46 46 + 47 47 + // Send 3 requests (at limit) 48 48 + for (let i = 0; i < 3; i++) { 49 49 + const res = await app.request('/test', { 50 50 + headers: { 'x-forwarded-for': ip }, 51 51 + }); 52 52 + expect(res.status).toBe(200); 53 53 + } 54 54 + 55 55 + // 4th request should be blocked 56 56 + const res = await app.request('/test', { 57 57 + headers: { 'x-forwarded-for': ip }, 58 58 + }); 59 59 + 60 60 + expect(res.status).toBe(429); 61 61 + const body = await res.json() as { success: boolean; error: string }; 62 62 + expect(body.success).toBe(false); 63 63 + expect(body.error).toBeDefined(); 64 64 + }); 65 65 + 66 66 + it('returns custom error message', async () => { 67 67 + const limiter = rateLimiter({ 68 68 + maxRequests: 1, 69 69 + windowMs: 60000, 70 70 + message: 'Custom rate limit message', 71 71 + }); 72 72 + 73 73 + app.use('/test', limiter); 74 74 + app.get('/test', (c) => c.json({ success: true })); 75 75 + 76 76 + const ip = '192.168.1.2'; 77 77 + 78 78 + // First request succeeds 79 79 + await app.request('/test', { 80 80 + headers: { 'x-forwarded-for': ip }, 81 81 + }); 82 82 + 83 83 + // Second request blocked with custom message 84 84 + const res = await app.request('/test', { 85 85 + headers: { 'x-forwarded-for': ip }, 86 86 + }); 87 87 + 88 88 + expect(res.status).toBe(429); 89 89 + const body = await res.json() as { error: string }; 90 90 + expect(body.error).toBe('Custom rate limit message'); 91 91 + }); 92 92 + }); 93 93 + 94 94 + describe('Rate Limit Headers', () => { 95 95 + it('includes X-RateLimit-Limit header', async () => { 96 96 + const limiter = rateLimiter({ 97 97 + maxRequests: 10, 98 98 + windowMs: 60000, 99 99 + }); 100 100 + 101 101 + app.use('/test', limiter); 102 102 + app.get('/test', (c) => c.json({ success: true })); 103 103 + 104 104 + const res = await app.request('/test', { 105 105 + headers: { 'x-forwarded-for': '10.0.0.1' }, 106 106 + }); 107 107 + 108 108 + expect(res.headers.get('X-RateLimit-Limit')).toBe('10'); 109 109 + }); 110 110 + 111 111 + it('includes X-RateLimit-Remaining header', async () => { 112 112 + const limiter = rateLimiter({ 113 113 + maxRequests: 5, 114 114 + windowMs: 60000, 115 115 + }); 116 116 + 117 117 + app.use('/test', limiter); 118 118 + app.get('/test', (c) => c.json({ success: true })); 119 119 + 120 120 + const ip = '10.0.0.2'; 121 121 + 122 122 + // First request 123 123 + const res1 = await app.request('/test', { 124 124 + headers: { 'x-forwarded-for': ip }, 125 125 + }); 126 126 + expect(res1.headers.get('X-RateLimit-Remaining')).toBe('4'); 127 127 + 128 128 + // Second request 129 129 + const res2 = await app.request('/test', { 130 130 + headers: { 'x-forwarded-for': ip }, 131 131 + }); 132 132 + expect(res2.headers.get('X-RateLimit-Remaining')).toBe('3'); 133 133 + }); 134 134 + 135 135 + it('includes X-RateLimit-Reset header', async () => { 136 136 + const limiter = rateLimiter({ 137 137 + maxRequests: 5, 138 138 + windowMs: 60000, 139 139 + }); 140 140 + 141 141 + app.use('/test', limiter); 142 142 + app.get('/test', (c) => c.json({ success: true })); 143 143 + 144 144 + const res = await app.request('/test', { 145 145 + headers: { 'x-forwarded-for': '10.0.0.3' }, 146 146 + }); 147 147 + 148 148 + const resetHeader = res.headers.get('X-RateLimit-Reset'); 149 149 + expect(resetHeader).toBeDefined(); 150 150 + 151 151 + const resetTime = parseInt(resetHeader!, 10); 152 152 + expect(resetTime).toBeGreaterThan(Date.now() / 1000); 153 153 + }); 154 154 + 155 155 + it('includes Retry-After header when rate limited', async () => { 156 156 + const limiter = rateLimiter({ 157 157 + maxRequests: 1, 158 158 + windowMs: 60000, 159 159 + }); 160 160 + 161 161 + app.use('/test', limiter); 162 162 + app.get('/test', (c) => c.json({ success: true })); 163 163 + 164 164 + const ip = '10.0.0.4'; 165 165 + 166 166 + // First request 167 167 + await app.request('/test', { 168 168 + headers: { 'x-forwarded-for': ip }, 169 169 + }); 170 170 + 171 171 + // Second request (rate limited) 172 172 + const res = await app.request('/test', { 173 173 + headers: { 'x-forwarded-for': ip }, 174 174 + }); 175 175 + 176 176 + expect(res.status).toBe(429); 177 177 + const retryAfter = res.headers.get('Retry-After'); 178 178 + expect(retryAfter).toBeDefined(); 179 179 + expect(parseInt(retryAfter!, 10)).toBeGreaterThan(0); 180 180 + }); 181 181 + 182 182 + it('includes retryAfter in response body', async () => { 183 183 + const limiter = rateLimiter({ 184 184 + maxRequests: 1, 185 185 + windowMs: 60000, 186 186 + }); 187 187 + 188 188 + app.use('/test', limiter); 189 189 + app.get('/test', (c) => c.json({ success: true })); 190 190 + 191 191 + const ip = '10.0.0.5'; 192 192 + 193 193 + await app.request('/test', { 194 194 + headers: { 'x-forwarded-for': ip }, 195 195 + }); 196 196 + 197 197 + const res = await app.request('/test', { 198 198 + headers: { 'x-forwarded-for': ip }, 199 199 + }); 200 200 + 201 201 + const body = await res.json() as { retryAfter: number }; 202 202 + expect(body.retryAfter).toBeDefined(); 203 203 + expect(typeof body.retryAfter).toBe('number'); 204 204 + expect(body.retryAfter).toBeGreaterThan(0); 205 205 + }); 206 206 + }); 207 207 + 208 208 + describe('Key Generation', () => { 209 209 + it('uses IP address by default', async () => { 210 210 + const limiter = rateLimiter({ 211 211 + maxRequests: 2, 212 212 + windowMs: 60000, 213 213 + }); 214 214 + 215 215 + app.use('/test', limiter); 216 216 + app.get('/test', (c) => c.json({ success: true })); 217 217 + 218 218 + // IP 1 - 2 requests 219 219 + await app.request('/test', { 220 220 + headers: { 'x-forwarded-for': '1.1.1.1' }, 221 221 + }); 222 222 + await app.request('/test', { 223 223 + headers: { 'x-forwarded-for': '1.1.1.1' }, 224 224 + }); 225 225 + 226 226 + // IP 2 - should still work (different key) 227 227 + const res = await app.request('/test', { 228 228 + headers: { 'x-forwarded-for': '2.2.2.2' }, 229 229 + }); 230 230 + 231 231 + expect(res.status).toBe(200); 232 232 + }); 233 233 + 234 234 + it('uses session ID when available', async () => { 235 235 + const limiter = rateLimiter({ 236 236 + maxRequests: 2, 237 237 + windowMs: 60000, 238 238 + }); 239 239 + 240 240 + app.use('*', (c, next) => { 241 241 + (c.set as (key: string, value: unknown) => void)('sessionId', 'session-123'); 242 242 + return next(); 243 243 + }); 244 244 + 245 245 + app.use('/test', limiter); 246 246 + app.get('/test', (c) => c.json({ success: true })); 247 247 + 248 248 + // Two requests with same session 249 249 + await app.request('/test', { 250 250 + headers: { 'x-forwarded-for': '3.3.3.3' }, 251 251 + }); 252 252 + const res = await app.request('/test', { 253 253 + headers: { 'x-forwarded-for': '3.3.3.3' }, 254 254 + }); 255 255 + 256 256 + // Both should count against same session 257 257 + expect(res.status).toBe(200); 258 258 + }); 259 259 + 260 260 + it('uses custom key generator', async () => { 261 261 + const limiter = rateLimiter({ 262 262 + maxRequests: 2, 263 263 + windowMs: 60000, 264 264 + keyGenerator: (c) => { 265 265 + return c.req.header('x-api-key') || 'default'; 266 266 + }, 267 267 + }); 268 268 + 269 269 + app.use('/test', limiter); 270 270 + app.get('/test', (c) => c.json({ success: true })); 271 271 + 272 272 + // Two requests with same API key 273 273 + await app.request('/test', { 274 274 + headers: { 'x-api-key': 'key-abc' }, 275 275 + }); 276 276 + await app.request('/test', { 277 277 + headers: { 'x-api-key': 'key-abc' }, 278 278 + }); 279 279 + 280 280 + // Third request should be blocked 281 281 + const res = await app.request('/test', { 282 282 + headers: { 'x-api-key': 'key-abc' }, 283 283 + }); 284 284 + 285 285 + expect(res.status).toBe(429); 286 286 + }); 287 287 + 288 288 + it('handles x-real-ip header', async () => { 289 289 + const limiter = rateLimiter({ 290 290 + maxRequests: 1, 291 291 + windowMs: 60000, 292 292 + }); 293 293 + 294 294 + app.use('/test', limiter); 295 295 + app.get('/test', (c) => c.json({ success: true })); 296 296 + 297 297 + const ip = '5.5.5.5'; 298 298 + 299 299 + // First request 300 300 + await app.request('/test', { 301 301 + headers: { 'x-real-ip': ip }, 302 302 + }); 303 303 + 304 304 + // Second request should be blocked (same IP) 305 305 + const res = await app.request('/test', { 306 306 + headers: { 'x-real-ip': ip }, 307 307 + }); 308 308 + 309 309 + expect(res.status).toBe(429); 310 310 + }); 311 311 + 312 312 + it('falls back to "unknown" when no IP or session', async () => { 313 313 + const limiter = rateLimiter({ 314 314 + maxRequests: 2, 315 315 + windowMs: 60000, 316 316 + }); 317 317 + 318 318 + app.use('/test', limiter); 319 319 + app.get('/test', (c) => c.json({ success: true })); 320 320 + 321 321 + // Requests without IP headers will share "unknown" key 322 322 + await app.request('/test'); 323 323 + await app.request('/test'); 324 324 + 325 325 + const res = await app.request('/test'); 326 326 + expect(res.status).toBe(429); 327 327 + }); 328 328 + }); 329 329 + 330 330 + describe('Window Management', () => { 331 331 + it('resets count after window expires', async () => { 332 332 + const limiter = rateLimiter({ 333 333 + maxRequests: 1, 334 334 + windowMs: 100, // Very short window for testing 335 335 + }); 336 336 + 337 337 + app.use('/test', limiter); 338 338 + app.get('/test', (c) => c.json({ success: true })); 339 339 + 340 340 + const ip = '6.6.6.6'; 341 341 + 342 342 + // First request 343 343 + const res1 = await app.request('/test', { 344 344 + headers: { 'x-forwarded-for': ip }, 345 345 + }); 346 346 + expect(res1.status).toBe(200); 347 347 + 348 348 + // Second request (immediately) should be blocked 349 349 + const res2 = await app.request('/test', { 350 350 + headers: { 'x-forwarded-for': ip }, 351 351 + }); 352 352 + expect(res2.status).toBe(429); 353 353 + 354 354 + // Wait for window to expire 355 355 + await new Promise((resolve) => setTimeout(resolve, 150)); 356 356 + 357 357 + // Third request should succeed (new window) 358 358 + const res3 = await app.request('/test', { 359 359 + headers: { 'x-forwarded-for': ip }, 360 360 + }); 361 361 + expect(res3.status).toBe(200); 362 362 + }); 363 363 + 364 364 + it('handles multiple windows for different keys', async () => { 365 365 + const limiter = rateLimiter({ 366 366 + maxRequests: 1, 367 367 + windowMs: 60000, 368 368 + }); 369 369 + 370 370 + app.use('/test', limiter); 371 371 + app.get('/test', (c) => c.json({ success: true })); 372 372 + 373 373 + // Different IPs should have independent windows 374 374 + const res1 = await app.request('/test', { 375 375 + headers: { 'x-forwarded-for': '7.7.7.7' }, 376 376 + }); 377 377 + const res2 = await app.request('/test', { 378 378 + headers: { 'x-forwarded-for': '8.8.8.8' }, 379 379 + }); 380 380 + const res3 = await app.request('/test', { 381 381 + headers: { 'x-forwarded-for': '9.9.9.9' }, 382 382 + }); 383 383 + 384 384 + expect(res1.status).toBe(200); 385 385 + expect(res2.status).toBe(200); 386 386 + expect(res3.status).toBe(200); 387 387 + }); 388 388 + }); 389 389 + 390 390 + describe('Predefined Rate Limiters', () => { 391 391 + it('apiRateLimit: 60 requests per minute', async () => { 392 392 + app.use('/api/*', apiRateLimit); 393 393 + app.get('/api/test', (c) => c.json({ success: true })); 394 394 + 395 395 + const res = await app.request('/api/test', { 396 396 + headers: { 'x-forwarded-for': '10.10.10.10' }, 397 397 + }); 398 398 + 399 399 + expect(res.status).toBe(200); 400 400 + expect(res.headers.get('X-RateLimit-Limit')).toBe('60'); 401 401 + }); 402 402 + 403 403 + it('searchRateLimit: 10 requests per minute', async () => { 404 404 + app.use('/search', searchRateLimit); 405 405 + app.post('/search', (c) => c.json({ success: true })); 406 406 + 407 407 + const res = await app.request('/search', { 408 408 + method: 'POST', 409 409 + headers: { 'x-forwarded-for': '10.10.10.11' }, 410 410 + }); 411 411 + 412 412 + expect(res.status).toBe(200); 413 413 + expect(res.headers.get('X-RateLimit-Limit')).toBe('10'); 414 414 + }); 415 415 + 416 416 + it('followRateLimit: 100 requests per hour', async () => { 417 417 + app.use('/follow', followRateLimit); 418 418 + app.post('/follow', (c) => c.json({ success: true })); 419 419 + 420 420 + const res = await app.request('/follow', { 421 421 + method: 'POST', 422 422 + headers: { 'x-forwarded-for': '10.10.10.12' }, 423 423 + }); 424 424 + 425 425 + expect(res.status).toBe(200); 426 426 + expect(res.headers.get('X-RateLimit-Limit')).toBe('100'); 427 427 + }); 428 428 + }); 429 429 + 430 430 + describe('Edge Cases', () => { 431 431 + it('handles concurrent requests from same key', async () => { 432 432 + const limiter = rateLimiter({ 433 433 + maxRequests: 5, 434 434 + windowMs: 60000, 435 435 + }); 436 436 + 437 437 + app.use('/test', limiter); 438 438 + app.get('/test', (c) => c.json({ success: true })); 439 439 + 440 440 + const ip = '11.11.11.11'; 441 441 + 442 442 + // Send 10 concurrent requests 443 443 + const requests = Array.from({ length: 10 }, () => 444 444 + app.request('/test', { 445 445 + headers: { 'x-forwarded-for': ip }, 446 446 + }) 447 447 + ); 448 448 + 449 449 + const results = await Promise.all(requests); 450 450 + 451 451 + const successCount = results.filter((r) => r.status === 200).length; 452 452 + const blockedCount = results.filter((r) => r.status === 429).length; 453 453 + 454 454 + // Some should succeed, some should be blocked 455 455 + expect(successCount).toBeLessThanOrEqual(5); 456 456 + expect(blockedCount).toBeGreaterThan(0); 457 457 + expect(successCount + blockedCount).toBe(10); 458 458 + }); 459 459 + 460 460 + it('handles zero maxRequests gracefully', async () => { 461 461 + const limiter = rateLimiter({ 462 462 + maxRequests: 0, 463 463 + windowMs: 60000, 464 464 + }); 465 465 + 466 466 + app.use('/test', limiter); 467 467 + app.get('/test', (c) => c.json({ success: true })); 468 468 + 469 469 + const res = await app.request('/test', { 470 470 + headers: { 'x-forwarded-for': '12.12.12.12' }, 471 471 + }); 472 472 + 473 473 + // Should immediately rate limit 474 474 + expect(res.status).toBe(429); 475 475 + }); 476 476 + 477 477 + it('handles very short window (1ms)', async () => { 478 478 + const limiter = rateLimiter({ 479 479 + maxRequests: 1, 480 480 + windowMs: 1, 481 481 + }); 482 482 + 483 483 + app.use('/test', limiter); 484 484 + app.get('/test', (c) => c.json({ success: true })); 485 485 + 486 486 + const ip = '13.13.13.13'; 487 487 + 488 488 + const res1 = await app.request('/test', { 489 489 + headers: { 'x-forwarded-for': ip }, 490 490 + }); 491 491 + expect(res1.status).toBe(200); 492 492 + 493 493 + // Wait 2ms 494 494 + await new Promise((resolve) => setTimeout(resolve, 2)); 495 495 + 496 496 + const res2 = await app.request('/test', { 497 497 + headers: { 'x-forwarded-for': ip }, 498 498 + }); 499 499 + // Should be allowed (new window) 500 500 + expect(res2.status).toBe(200); 501 501 + }); 502 502 + 503 503 + it('handles very large maxRequests', async () => { 504 504 + const limiter = rateLimiter({ 505 505 + maxRequests: 1000000, 506 506 + windowMs: 60000, 507 507 + }); 508 508 + 509 509 + app.use('/test', limiter); 510 510 + app.get('/test', (c) => c.json({ success: true })); 511 511 + 512 512 + const res = await app.request('/test', { 513 513 + headers: { 'x-forwarded-for': '14.14.14.14' }, 514 514 + }); 515 515 + 516 516 + expect(res.status).toBe(200); 517 517 + expect(res.headers.get('X-RateLimit-Remaining')).toBe('999999'); 518 518 + }); 519 519 + }); 520 520 + 521 521 + describe('Store Cleanup', () => { 522 522 + it('periodically cleans up expired entries', async () => { 523 523 + const limiter = rateLimiter({ 524 524 + maxRequests: 1, 525 525 + windowMs: 50, // Short window 526 526 + }); 527 527 + 528 528 + app.use('/test', limiter); 529 529 + app.get('/test', (c) => c.json({ success: true })); 530 530 + 531 531 + // Create many entries that will expire 532 532 + for (let i = 0; i < 100; i++) { 533 533 + await app.request('/test', { 534 534 + headers: { 'x-forwarded-for': `${i}.0.0.1` }, 535 535 + }); 536 536 + } 537 537 + 538 538 + // Wait for entries to expire 539 539 + await new Promise((resolve) => setTimeout(resolve, 100)); 540 540 + 541 541 + // Trigger cleanup by making more requests 542 542 + // (cleanup happens randomly with 1% probability, so we make many requests) 543 543 + for (let i = 0; i < 100; i++) { 544 544 + await app.request('/test', { 545 545 + headers: { 'x-forwarded-for': `${i}.0.0.1` }, 546 546 + }); 547 547 + } 548 548 + 549 549 + // If cleanup didn't crash, test passes 550 550 + expect(true).toBe(true); 551 551 + }); 552 552 + }); 553 553 + });