mirror of
https://github.com/hanzoai/gateway.git
synced 2026-10-30 15:04:44 +00:00
zeekayandHanzo Dev
ba630564b0
These seven specs described a product this repo is not. They were inherited from
upstream and never rewritten, so they could only have passed on a build that
still had upstream's cors service plugin wired and upstream's health endpoint —
which is why they were still failing the moment the suite was made to run at all.
Each now asserts what this gateway actually promises, and each says why in
@comment so the next reader does not have to re-derive it.
cors_1..5 — routes.go owns the ONE CORS policy (corsPreflightMiddleware +
newCORSOriginAllower), and it is an ALLOWLIST that echoes the origin and grants
credentials. Upstream's plugin answered every preflight 204 with `*`. The rewrite
keeps a positive case and STRENGTHENS the negative ones rather than converting
them away:
cors_1 allowlisted preflight -> 204, origin echoed (never `*`), Vary: Origin
cors_2 foreign preflight -> NO Access-Control-Allow-* at all
cors_3 suffix look-alike -> hanzo.ai.attacker.example gets nothing,
pinning the dot-boundary in isAllowedOrigin
cors_4 allowlisted simple GET -> grant is on the real response too
cors_5 foreign simple GET -> 200 with no grant, and no X-Powered-By /
X-Krakend: the framework is never disclosed
An expected header of [""] asserts ABSENCE (assertResponse), so those are real
assertions, not omissions.
integration_jsonschema — required lura's `agents` and `now` fields against
/healthz, which is OUR endpoint (legacy_engine.go), not lura's /__health. The
spec was retargeted from /__health to /healthz in efa9cd78 and the schema was
never rewritten with it, so no build of this gateway has ever satisfied it. Now:
exactly {"status":"ok"}, additionalProperties:false — a probe body must not grow
fields that leak internal state.
negotitate_plain — both values moved with gin and the CURRENT ones are correct:
gin >=1.10 emits the RFC 9512 media type application/yaml (application/x-yaml was
the pre-RFC name) and gin 1.12 marshals via goccy/go-yaml, whose indent is 2
where gopkg.in/yaml.v3's was 4.
Co-authored-by: Hanzo Dev <[email protected]>
23 lines
1.0 KiB
JSON
23 lines
1.0 KiB
JSON
{
|
|
"@comment": "Preflight from a NON-allowlisted origin. The property under test is the ABSENCE of every Access-Control-Allow-* header: an arbitrary site must never be granted a credentialed cross-origin read. The preflight middleware declines to answer, so gin's HandleMethodNotAllowed replies 405 + Allow for a method this endpoint does not serve — the correct HTTP answer, and equally unusable to the browser. (Upstream KrakenD's cors service plugin answered 204 with a wildcard here; that plugin is deliberately not wired — routes.go owns the ONE CORS policy.)",
|
|
"in": {
|
|
"method": "OPTIONS",
|
|
"url": "http://localhost:8080/param_forwarding/some/foo/bar?a=1&b=2",
|
|
"header": {
|
|
"User-Agent": "some",
|
|
"Origin": "http://foo.example.tld",
|
|
"Access-Control-Request-Method": "PUT"
|
|
}
|
|
},
|
|
"out": {
|
|
"status_code": 405,
|
|
"header": {
|
|
"Access-Control-Allow-Origin": [""],
|
|
"Access-Control-Allow-Credentials": [""],
|
|
"Access-Control-Allow-Methods": [""],
|
|
"Access-Control-Allow-Headers": [""],
|
|
"Allow": ["GET, POST"]
|
|
}
|
|
}
|
|
}
|