mirror of
https://github.com/zap-proto/zip.git
synced 2026-10-19 15:38:57 +00:00
zeekayandHanzo Dev
5f71d2496b
App, Group, Operation. A group is a prefix and what holds under it, an operation
is one typed route declared there, and the verb methods are generic methods —
which Go 1.27 allows on a concrete type and still refuses on an interface. So In
and Out come from the handler and the caller writes no type arguments:
users := app.Group("/v1/users")
users.Post("/", api.Create)
mint := users.Group("/mint").With(middleware.Mint(gate))
mint.Post("/deposit", api.Deposit)
A Group is a CLOSED HANDLE: two unexported fields, and no method that hands back
the app, the parent or the fiber underneath. A subsystem given the group at its
own prefix cannot reach above it, so confinement is a property of the type
instead of a rule something has to police — which is what a host needs in order
to hand out a bounded surface and know what comes back.
That is bought by giving up the router interface, deliberately. Router and
OpTarget are gone, and with them the ability to implement a route table outside
this package: a decorator is no longer a router, a gate is middleware on a group,
and a bound is a path. The five package-level verb functions go the same way —
a registration is a method on the thing it registers into.
Raw carries what is not a typed operation: a stream, an upgrade, a probe, a
foreign subtree. It names its method, and it is the longer spelling because
opting out of the typed model is the exception and should read like one.
Co-authored-by: Hanzo Dev <[email protected]>
84 lines
3.1 KiB
Go
84 lines
3.1 KiB
Go
package middleware_test
|
|
|
|
import (
|
|
"io"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"github.com/zap-proto/zip"
|
|
"github.com/zap-proto/zip/middleware"
|
|
)
|
|
|
|
// ACCESS-CONTROL-ALLOW-ORIGIN NAMES EXACTLY ONE ORIGIN. An allowlist is checked
|
|
// against the request's Origin and the match is echoed; joining the list into
|
|
// one header is a value a browser rejects, and it publishes the whole allowlist
|
|
// to every caller besides.
|
|
func TestCORS_EchoesTheMatchingOrigin(t *testing.T) {
|
|
h := middleware.CORS(middleware.CORSConfig{
|
|
AllowOrigins: []string{"http://a.test", "http://b.test"},
|
|
})
|
|
for _, c := range []struct{ send, want, vary string }{
|
|
{"http://a.test", "http://a.test", "Origin"},
|
|
{"http://b.test", "http://b.test", "Origin"},
|
|
{"http://evil.test", "", ""}, // unlisted: no header beats a wrong one
|
|
} {
|
|
resp := ride(t, h, c.send)
|
|
if got := resp.Header.Get("Access-Control-Allow-Origin"); got != c.want {
|
|
t.Errorf("Origin %q -> allow-origin %q, want %q", c.send, got, c.want)
|
|
}
|
|
if got := resp.Header.Get("Vary"); got != c.vary {
|
|
t.Errorf("Origin %q -> Vary %q, want %q", c.send, got, c.vary)
|
|
}
|
|
}
|
|
}
|
|
|
|
// The wildcard stays the wildcard — but not beside credentials, where the spec
|
|
// forbids "*" and the echo is the only answer a browser will accept.
|
|
func TestCORS_WildcardAndCredentials(t *testing.T) {
|
|
open := ride(t, middleware.CORS(middleware.CORSConfig{}), "http://x.test")
|
|
if got := open.Header.Get("Access-Control-Allow-Origin"); got != "*" {
|
|
t.Errorf("default allow-origin %q, want *", got)
|
|
}
|
|
creds := ride(t, middleware.CORS(middleware.CORSConfig{AllowCreds: true}), "http://x.test")
|
|
if got := creds.Header.Get("Access-Control-Allow-Origin"); got != "http://x.test" {
|
|
t.Errorf("with credentials allow-origin %q, want the echoed origin", got)
|
|
}
|
|
}
|
|
|
|
// Max-Age is a COUNT OF SECONDS. It was rendered through time.Duration, whose
|
|
// String() reads nanoseconds — 3600 went out as "3.6µs", which is not a number
|
|
// and caches nothing.
|
|
func TestCORS_MaxAgeIsSeconds(t *testing.T) {
|
|
resp := ride(t, middleware.CORS(middleware.CORSConfig{MaxAge: 3600}), "http://x.test")
|
|
if got := resp.Header.Get("Access-Control-Max-Age"); got != "3600" {
|
|
t.Errorf("max-age %q, want 3600", got)
|
|
}
|
|
}
|
|
|
|
// ride drives one GET through h and returns the response.
|
|
//
|
|
// It asserts the ROUTE was reached, not merely that headers appeared. A
|
|
// middleware that answered instead of chaining would set every header this file
|
|
// checks and still be broken, and every assertion here would pass.
|
|
func ride(t *testing.T, h zip.Handler, origin string) *http.Response {
|
|
t.Helper()
|
|
a := zip.New(zip.Config{AppName: "cors", DisableStartupMessage: true})
|
|
a.Use(h)
|
|
a.Raw("GET", "/x", func(c *zip.Ctx) error { return c.String(http.StatusOK, "ok") })
|
|
if err := a.Build(); err != nil {
|
|
t.Fatalf("build: %v", err)
|
|
}
|
|
req := httptest.NewRequest("GET", "/x", nil)
|
|
req.Header.Set("Origin", origin)
|
|
resp, err := a.Fiber().Test(req)
|
|
if err != nil {
|
|
t.Fatalf("GET /x: %v", err)
|
|
}
|
|
body, _ := io.ReadAll(resp.Body)
|
|
if string(body) != "ok" {
|
|
t.Fatalf("the route was not reached: body %q, status %d", body, resp.StatusCode)
|
|
}
|
|
return resp
|
|
}
|