mirror of
https://github.com/hanzoai/gateway.git
synced 2026-10-30 15:04:44 +00:00
zeekayandHanzo Dev
ba630564b0
These seven specs described a product this repo is not. They were inherited from
upstream and never rewritten, so they could only have passed on a build that
still had upstream's cors service plugin wired and upstream's health endpoint —
which is why they were still failing the moment the suite was made to run at all.
Each now asserts what this gateway actually promises, and each says why in
@comment so the next reader does not have to re-derive it.
cors_1..5 — routes.go owns the ONE CORS policy (corsPreflightMiddleware +
newCORSOriginAllower), and it is an ALLOWLIST that echoes the origin and grants
credentials. Upstream's plugin answered every preflight 204 with `*`. The rewrite
keeps a positive case and STRENGTHENS the negative ones rather than converting
them away:
cors_1 allowlisted preflight -> 204, origin echoed (never `*`), Vary: Origin
cors_2 foreign preflight -> NO Access-Control-Allow-* at all
cors_3 suffix look-alike -> hanzo.ai.attacker.example gets nothing,
pinning the dot-boundary in isAllowedOrigin
cors_4 allowlisted simple GET -> grant is on the real response too
cors_5 foreign simple GET -> 200 with no grant, and no X-Powered-By /
X-Krakend: the framework is never disclosed
An expected header of [""] asserts ABSENCE (assertResponse), so those are real
assertions, not omissions.
integration_jsonschema — required lura's `agents` and `now` fields against
/healthz, which is OUR endpoint (legacy_engine.go), not lura's /__health. The
spec was retargeted from /__health to /healthz in efa9cd78 and the schema was
never rewritten with it, so no build of this gateway has ever satisfied it. Now:
exactly {"status":"ok"}, additionalProperties:false — a probe body must not grow
fields that leak internal state.
negotitate_plain — both values moved with gin and the CURRENT ones are correct:
gin >=1.10 emits the RFC 9512 media type application/yaml (application/x-yaml was
the pre-RFC name) and gin 1.12 marshals via goccy/go-yaml, whose indent is 2
where gopkg.in/yaml.v3's was 4.
Co-authored-by: Hanzo Dev <[email protected]>
25 lines
1014 B
JSON
25 lines
1014 B
JSON
{
|
|
"@comment": "The platform health contract: /healthz answers 200 with exactly {\"status\":\"ok\"} and nothing else. This gateway registers its own /healthz (legacy_engine.go) and forces disable_health so lura's /__health cannot also claim a route; the schema below is that endpoint's, not lura's. It used to require lura's agents/now fields — inherited when the spec was retargeted from /__health to /healthz in 5b250d9a and never rewritten — which no build of this gateway has ever satisfied. additionalProperties:false is the point: a probe body must not grow fields that leak internal state.",
|
|
"in": {
|
|
"url": "http://localhost:8080/healthz"
|
|
},
|
|
"out": {
|
|
"status_code": 200,
|
|
"header": {
|
|
"content-type": ["application/json; charset=utf-8"]
|
|
},
|
|
"schema": {
|
|
"$schema": "http://json-schema.org/draft-07/schema#",
|
|
"type": "object",
|
|
"required": ["status"],
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"status": {
|
|
"type": "string",
|
|
"enum": ["ok"]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|