benjivers/notes Public Public: anyone can read this; nobody can change it.

import { afterAll, expect, test } from "bun:test";

import { mkdtempSync } from "node:fs";

import { tmpdir } from "node:os";

import { join } from "node:path";

import { env } from "./env.ts";

import { serve } from "./server.ts";

import { sign } from "./who.ts";

const KEY = "a-key-only-the-forge-holds";

const server = serve({

  port: 0,

  dataDir: mkdtempSync(join(tmpdir(), "app-")),

  identityKey: KEY,

});

const base = `http://${server.hostname}:${server.port}`;

afterAll(() => server.stop(true));

/** The headers the forge sends for a signed-in person. */

const as = (

  id: string,

  name: string,

  role: "user" | "admin" = "user",

): Record<string, string> => {

  const identity = `${id}|${name}|${role}|${Date.now() + 60_000}`;

  return {

    "x-forge-identity": identity,

    "x-forge-signature": sign(identity, KEY),

  };

};

const alice = as("u1", "alice");

const bob = as("u2", "bob");

const root = as("u0", "root", "admin");

const jsonBody = (body: unknown): RequestInit => ({

  headers: { "content-type": "application/json" },

  body: JSON.stringify(body),

});

const api = (

  path: string,

  init: RequestInit = {},

  who: Record<string, string> = {},

) =>

  fetch(base + path, {

    ...init,

    headers: { ...(init.headers as Record<string, string>), ...who },

  });

const rpc = (message: unknown, who: Record<string, string> = {}) =>

  api("/mcp", { method: "POST", ...jsonBody(message) }, who).then(

    (r) => r.json() as Promise<any>,

  );

test("the page knows who you are and offers the right door", async () => {

  const guest = await (await fetch(base + "/")).text();

  expect(guest).toContain("<h1>");

  expect(guest).toContain("/__forge/signin?to=/");

  expect(guest).not.toContain('action="/notes"');

  const signed = await (await api("/", {}, alice)).text();

  expect(signed).toContain("<b>alice</b>");

  expect(signed).toContain("/__forge/signout");

  expect(signed).toContain('action="/notes"');

});

test("a form post adds as the person; a guest is sent to sign in", async () => {

  const form = new FormData();

  form.set("body", "hello from a form");

  const refused = await api("/notes", {

    method: "POST",

    body: form,

    redirect: "manual",

  });

  expect(refused.status).toBe(303);

  expect(refused.headers.get("set-cookie")).toContain("notice=");

  expect(refused.headers.get("set-cookie")).toContain("SameSite=Lax");

  expect(await (await fetch(base + "/")).text()).not.toContain(

    "hello from a form",

  );

  const posted = await api(

    "/notes",

    { method: "POST", body: form, redirect: "manual" },

    alice,

  );

  expect(posted.status).toBe(303);

  expect(posted.headers.get("set-cookie")).toBeNull();

  const page = await (await api("/", {}, alice)).text();

  expect(page).toContain("hello from a form");

  expect(page).toContain("alice ·");

});

test("the JSON API is the same actions with the same identity", async () => {

  const created = await api(

    "/api/notes",

    { method: "POST", ...jsonBody({ body: "over the api" }) },

    alice,

  );

  expect(created.status).toBe(201);

  const note = (await created.json()) as { id: number; author_name: string };

  expect(note.author_name).toBe("alice");

  const listed = (await (await fetch(base + "/api/notes")).json()) as {

    id: number;

  }[];

  expect(listed.map((n) => n.id)).toContain(note.id);

  expect(

    (await api("/api/notes", { method: "POST", ...jsonBody({ body: "anon" }) }))

      .status,

  ).toBe(401);

  expect(

    (await api(`/api/notes/${note.id}`, { method: "DELETE" }, bob)).status,

  ).toBe(403);

  expect(

    (await api(`/api/notes/${note.id}`, { method: "DELETE" }, alice)).status,

  ).toBe(200);

  expect(

    (await api(`/api/notes/${note.id}`, { method: "DELETE" }, alice)).status,

  ).toBe(404);

  expect(

    (

      await api(

        "/api/notes",

        { method: "POST", ...jsonBody({ body: "" }) },

        alice,

      )

    ).status,

  ).toBe(422);

});

test("the MCP server lists the tools and calls them as the caller", async () => {

  const hello = await rpc({

    jsonrpc: "2.0",

    id: 1,

    method: "initialize",

    params: {},

  });

  expect(hello.result.capabilities).toEqual({ tools: {} });

  const listed = await rpc({ jsonrpc: "2.0", id: 2, method: "tools/list" });

  expect(listed.result.tools.map((t: { name: string }) => t.name)).toEqual([

    "list_notes",

    "add_note",

    "delete_note",

  ]);

  const call = (name: string, args: unknown, who = {}) =>

    rpc(

      {

        jsonrpc: "2.0",

        id: 3,

        method: "tools/call",

        params: { name, arguments: args },

      },

      who,

    );

  const refused = await call("add_note", { body: "as nobody" });

  expect(refused.result.isError).toBe(true);

  const added = await call("add_note", { body: "over mcp" }, root);

  expect(added.result.isError).toBeUndefined();

  const note = JSON.parse(added.result.content[0].text);

  expect(note.author_name).toBe("root");

  const notes = JSON.parse(

    (await call("list_notes", {})).result.content[0].text,

  );

  expect(notes.map((n: { id: number }) => n.id)).toContain(note.id);

  expect(

    (await call("delete_note", { id: note.id }, root)).result.isError,

  ).toBeUndefined();

  expect(

    (await rpc({ jsonrpc: "2.0", id: 4, method: "nothing" })).error.code,

  ).toBe(-32601);

  const notified = await api("/mcp", {

    method: "POST",

    ...jsonBody({ jsonrpc: "2.0", method: "notifications/initialized" }),

  });

  expect(notified.status).toBe(202);

});

test("a change is on the event stream, and a late client hears what it missed", async () => {

  const stream = await fetch(base + "/events");

  expect(stream.headers.get("content-type")).toBe("text/event-stream");

  const reader = stream.body!.getReader();

  const next = async (): Promise<{ id: string; type: string }> => {

    let buffer = "";

    for (;;) {

      const { value } = await reader.read();

      buffer += new TextDecoder().decode(value);

      const frame = /id: (\d+)\ndata: (.*)\n\n/.exec(buffer);

      if (frame) return { id: frame[1]!, type: JSON.parse(frame[2]!).type };

    }

  };

  await api(

    "/api/notes",

    { method: "POST", ...jsonBody({ body: "live" }) },

    alice,

  );

  const heard = await next();

  expect(heard.type).toBe("note.added");

  await reader.cancel();

  const late = await fetch(base + "/events", {

    headers: { "last-event-id": String(Number(heard.id) - 1) },

  });

  const replay = new TextDecoder().decode(

    (await late.body!.getReader().read()).value,

  );

  expect(replay).toContain(`id: ${heard.id}\n`);

  expect(replay).toContain("note.added");

});

test("writes are rationed per person", async () => {

  const flood = as("u9", "flood");

  const answers = await Promise.all(

    Array.from({ length: 40 }, () =>

      api(

        "/api/notes",

        { method: "POST", ...jsonBody({ body: "again" }) },

        flood,

      ),

    ),

  );

  const codes = answers.map((r) => r.status);

  expect(codes).toContain(201);

  expect(codes).toContain(429);

});

test("stands on the security floor", async () => {

  const response = await fetch(base + "/");

  expect(response.headers.get("content-security-policy")).toContain(

    "default-src 'self'",

  );

  expect(response.headers.get("x-content-type-options")).toBe("nosniff");

  expect(

    (await fetch(base + "/api/notes")).headers.get("content-security-policy"),

  ).toContain("default-src");

});

test("a body is capped by the bytes read, whatever it claims", async () => {

  const response = await api(

    "/notes",

    {

      method: "POST",

      headers: { "content-type": "application/x-www-form-urlencoded" },

      body: "body=" + "x".repeat(1024 * 1024),

    },

    alice,

  );

  expect(response.status).toBe(413);

});

test("HEAD sees the app up", async () => {

  const response = await fetch(base + "/", { method: "HEAD" });

  expect(response.status).toBe(200);

  expect(await response.text()).toBe("");

});

test("refuses a cross-site post", async () => {

  const form = new FormData();

  form.set("body", "from another site");

  const posted = await api(

    "/notes",

    {

      method: "POST",

      body: form,

      redirect: "manual",

      headers: {

        origin: "https://evil.example",

        "sec-fetch-site": "cross-site",

      },

    },

    alice,

  );

  expect(posted.status).toBe(403);

});

test("static files are cached for a year when linked by content", async () => {

  const page = await (await fetch(base + "/")).text();

  const href = /href="(\/static\/app\.css\?v=[0-9a-f]{8})"/.exec(page)?.[1];

  expect(href).toBeDefined();

  const css = await fetch(base + href!);

  expect(css.headers.get("cache-control")).toContain("immutable");

  expect(

    (await fetch(base + "/static/app.css")).headers.get("cache-control"),

  ).toBe("no-cache");

  expect((await fetch(base + "/static/..%2Fpackage.json")).status).toBe(404);

});

test("/healthz says up, apart from the page", async () => {

  const response = await fetch(base + "/healthz");

  expect(response.status).toBe(200);

  expect(response.headers.get("cache-control")).toBe("no-store");

  const health = (await response.json()) as Record<string, unknown>;

  expect(health.ok).toBe(true);

  expect(health.version).toMatch(/^\d+\.\d+\.\d+/);

  expect(Number.isInteger(health.uptime)).toBe(true);

  expect((await fetch(base + "/healthz", { method: "HEAD" })).status).toBe(200);

});

test("a link to the page unfurls: description, Open Graph, a card", async () => {

  const page = await (await fetch(base + "/")).text();

  for (const meta of [

    'name="description"',

    'property="og:title"',

    'property="og:description"',

    'property="og:url"',

    'property="og:type" content="website"',

    'name="twitter:card" content="summary"',

    'name="theme-color"',

  ])

    expect([meta, page.includes(meta)]).toEqual([meta, true]);

});

test("the look is the tokens: /tokens.css is linked by content and cached for a year", async () => {

  const page = await (await fetch(base + "/")).text();

  const href = /href="(\/tokens\.css\?v=[0-9a-f]{8})"/.exec(page)?.[1];

  expect(href).toBeDefined();

  const css = await fetch(base + href!);

  expect(css.headers.get("content-type")).toContain("text/css");

  expect(css.headers.get("cache-control")).toContain("immutable");

  expect(await css.text()).toContain("--color-bg:");

  // The tokens come first, so every rule after them can use them.

  expect(page.indexOf("/tokens.css")).toBeLessThan(

    page.indexOf("/static/app.css"),

  );

});

test("what the web expects: robots.txt, and security.txt from the forge that runs us", async () => {

  // Production is read by crawlers, the API is not; anything else is a

  // draft and asks not to be indexed at all.

  const robots = await (await fetch(base + "/robots.txt")).text();

  const noindex = (await fetch(base + "/")).headers.get("x-robots-tag");

  if (env === "production") {

    expect(robots).toContain("Disallow: /api/\n");

    expect(noindex).toBeNull();

  } else {

    expect(robots).toBe("User-agent: *\nDisallow: /\n");

    expect(noindex).toBe("noindex");

  }

  const security = await fetch(base + "/.well-known/security.txt", {

    redirect: "manual",

  });

  if (process.env.FORGE_URL === undefined) expect(security.status).toBe(404);

  else {

    expect(security.status).toBe(302);

    expect(security.headers.get("location")).toBe(

      new URL("/.well-known/security.txt", process.env.FORGE_URL).toString(),

    );

  }

});