74afb7b726
- gerber-demo/boot.js honors the base/cdn/tag script-source overrides only on a loopback hostname, so a shipped page ignores them. - /api/waitlist gains a best-effort per-IP/per-address rate limit and masks the submitter address in the no-key log line. Adds vitest to the site: test/boot-overrides.test.ts (happy-dom) and test/waitlist.test.ts. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
65 lines
2.6 KiB
TypeScript
65 lines
2.6 KiB
TypeScript
// @vitest-environment happy-dom
|
|
import * as fs from "node:fs";
|
|
import * as path from "node:path";
|
|
import { fileURLToPath } from "node:url";
|
|
import { afterEach, describe, expect, it, vi } from "vitest";
|
|
|
|
/**
|
|
* boot.js honors the ?base= / ?cdn= / ?tag= script-source overrides only on a
|
|
* loopback hostname; a shipped page must ignore them. Black-box test: run the
|
|
* REAL boot.js in a DOM at a given URL and check whether an external-origin
|
|
* <script> gets injected.
|
|
*/
|
|
const bootSrc = fs.readFileSync(
|
|
path.join(path.dirname(fileURLToPath(import.meta.url)), "../public/gerber-demo/boot.js"),
|
|
"utf8",
|
|
);
|
|
|
|
const EXTERNAL = "https://external.example/x";
|
|
|
|
async function runBootAt(url: string): Promise<void> {
|
|
const hd = (window as unknown as {
|
|
happyDOM: { setURL(u: string): void; settings: { disableJavaScriptFileLoading: boolean } };
|
|
}).happyDOM;
|
|
// We assert on the injected <script src>, not on it actually loading — keep
|
|
// happy-dom from fetching the URL over the network.
|
|
hd.settings.disableJavaScriptFileLoading = true;
|
|
hd.setURL(url);
|
|
// The status scaffold boot.js's helpers look up (all null-guarded anyway).
|
|
document.body.innerHTML =
|
|
'<div id="status"><span id="status-text"></span><div id="progress-bar"></div></div>' +
|
|
'<div id="main-window"></div>';
|
|
// The default path fetches a CDN manifest — let it fail; we only assert on
|
|
// script injection, never on a successful boot.
|
|
vi.stubGlobal("fetch", vi.fn().mockRejectedValue(new Error("no network in test")));
|
|
(0, eval)(bootSrc);
|
|
await new Promise((r) => setTimeout(r, 20)); // let resolveBase().then(boot) settle
|
|
}
|
|
|
|
function externalScriptsInjected(): string[] {
|
|
return Array.from(document.querySelectorAll("script[src]"))
|
|
.map((s) => s.getAttribute("src") || "")
|
|
.filter((src) => /^https?:\/\//i.test(src));
|
|
}
|
|
|
|
describe("gerber-demo boot.js override gate", () => {
|
|
afterEach(() => {
|
|
vi.unstubAllGlobals();
|
|
document.body.innerHTML = "";
|
|
document.querySelectorAll("script[src]").forEach((s) => s.remove());
|
|
});
|
|
|
|
it("ignores ?base= on a production origin — no external script injected", async () => {
|
|
await runBootAt(
|
|
"https://www.pcbjam.com/gerber-demo/index.html?base=" + encodeURIComponent(EXTERNAL),
|
|
);
|
|
expect(externalScriptsInjected().some((s) => s.includes("external.example"))).toBe(false);
|
|
});
|
|
|
|
it("still honors ?base= on localhost — the dev override is preserved", async () => {
|
|
await runBootAt(
|
|
"http://localhost:4321/gerber-demo/index.html?base=" + encodeURIComponent(EXTERNAL),
|
|
);
|
|
expect(externalScriptsInjected().some((s) => s.includes("external.example"))).toBe(true);
|
|
});
|
|
});
|