mirror of
https://github.com/hanzoai/gateway.git
synced 2026-10-30 15:04:44 +00:00
zeekayandHanzo Dev
ba630564b0
These seven specs described a product this repo is not. They were inherited from
upstream and never rewritten, so they could only have passed on a build that
still had upstream's cors service plugin wired and upstream's health endpoint —
which is why they were still failing the moment the suite was made to run at all.
Each now asserts what this gateway actually promises, and each says why in
@comment so the next reader does not have to re-derive it.
cors_1..5 — routes.go owns the ONE CORS policy (corsPreflightMiddleware +
newCORSOriginAllower), and it is an ALLOWLIST that echoes the origin and grants
credentials. Upstream's plugin answered every preflight 204 with `*`. The rewrite
keeps a positive case and STRENGTHENS the negative ones rather than converting
them away:
cors_1 allowlisted preflight -> 204, origin echoed (never `*`), Vary: Origin
cors_2 foreign preflight -> NO Access-Control-Allow-* at all
cors_3 suffix look-alike -> hanzo.ai.attacker.example gets nothing,
pinning the dot-boundary in isAllowedOrigin
cors_4 allowlisted simple GET -> grant is on the real response too
cors_5 foreign simple GET -> 200 with no grant, and no X-Powered-By /
X-Krakend: the framework is never disclosed
An expected header of [""] asserts ABSENCE (assertResponse), so those are real
assertions, not omissions.
integration_jsonschema — required lura's `agents` and `now` fields against
/healthz, which is OUR endpoint (legacy_engine.go), not lura's /__health. The
spec was retargeted from /__health to /healthz in efa9cd78 and the schema was
never rewritten with it, so no build of this gateway has ever satisfied it. Now:
exactly {"status":"ok"}, additionalProperties:false — a probe body must not grow
fields that leak internal state.
negotitate_plain — both values moved with gin and the CURRENT ones are correct:
gin >=1.10 emits the RFC 9512 media type application/yaml (application/x-yaml was
the pre-RFC name) and gin 1.12 marshals via goccy/go-yaml, whose indent is 2
where gopkg.in/yaml.v3's was 4.
Co-authored-by: Hanzo Dev <[email protected]>
20 lines
857 B
JSON
20 lines
857 B
JSON
{
|
|
"@comment": "output_encoding=negotiate with Accept: text/plain resolves to the YAML renderer. Both values below moved with gin and are the CURRENT correct ones, not a regression: gin >=1.10 emits the RFC 9512 media type application/yaml (application/x-yaml was the pre-RFC name), and gin 1.12 marshals with goccy/go-yaml, whose indent is 2 where gopkg.in/yaml.v3's was 4.",
|
|
"in": {
|
|
"method": "GET",
|
|
"url": "http://localhost:8080/negotiate",
|
|
"header": {
|
|
"accept": "text/plain"
|
|
}
|
|
},
|
|
"out": {
|
|
"status_code": 200,
|
|
"body": "user:\n -type: admin\n name: Elliot\n social:\n facebook: https://facebook.com\n twitter: https://twitter.com\n youtube: https://youtube.com\n",
|
|
"header": {
|
|
"content-type": ["application/yaml; charset=utf-8"],
|
|
"Cache-Control": ["public, max-age=3600"],
|
|
"X-Gateway-Completed": ["true"]
|
|
}
|
|
}
|
|
}
|