quill/oracle Public Public: anyone can read this; nobody can change it.

import { expect, test } from "bun:test";

import { mkdtempSync } from "node:fs";

import { tmpdir } from "node:os";

import { join } from "node:path";

process.env.FORGE_APP_DATA = mkdtempSync(join(tmpdir(), "oracle-"));

process.env.PORT = "0";

const { server } = await import("./server.ts");

const base = `http://${server.hostname}:${server.port}`;

const ask = async (question: string): Promise<Response> => {

  const form = new FormData();

  form.set("question", question);

  return fetch(`${base}/ask`, { method: "POST", body: form, redirect: "manual" });

};

test("serves the door", async () => {

  const response = await fetch(`${base}/`);

  expect(response.status).toBe(200);

  const text = await response.text();

  expect(text).toContain("the oracle");

  expect(text).toContain("Ask once");

});

test("asking lands on the verdict's own page", async () => {

  const posted = await ask("Should I ship it on Friday?");

  expect(posted.status).toBe(303);

  const location = posted.headers.get("location") ?? "";

  expect(location).toMatch(/^\/v\/\d+$/);

  const page = await (await fetch(base + location)).text();

  expect(page).toContain("Should I ship it on Friday?");

  expect(page).toContain("% sure");

  expect(page).toContain("the sign it read");

});

test("asking the same thing twice does not get a second opinion", async () => {

  const first = (await ask("Is the milk still good")).headers.get("location");

  const second = (await ask("is the MILK still good?")).headers.get("location");

  expect(second).toBe(first);

  const page = await (await fetch(base + first)).text();

  expect(page).toContain("asked 2×");

});

test("an empty question is not a question", async () => {

  const posted = await ask("   ");

  expect(posted.status).toBe(303);

  expect(posted.headers.get("location")).toBe("/");

});

test("a judged verdict moves the oracle's record", async () => {

  const location = (await ask("Will the deploy hold overnight?")).headers.get("location") ?? "";

  const id = location.split("/").pop();

  const form = new FormData();

  form.set("outcome", "right");

  const judged = await fetch(`${base}/v/${id}/judge`, {

    method: "POST",

    body: form,

    redirect: "manual",

  });

  expect(judged.status).toBe(303);

  const page = await (await fetch(base + location)).text();

  expect(page).toContain("judged right");

  expect(await (await fetch(`${base}/`)).text()).toContain("right of");

  expect(await (await fetch(`${base}/ledger?show=right`)).text()).toContain(

    "Will the deploy hold overnight?",

  );

});

test("the ledger only holds the three words it knows", async () => {

  const location = (await ask("Is this outcome inventable?")).headers.get("location") ?? "";

  const id = location.split("/").pop();

  const form = new FormData();

  form.set("outcome", "brilliant");

  const judged = await fetch(`${base}/v/${id}/judge`, { method: "POST", body: form });

  expect(judged.status).toBe(404);

  expect(await (await fetch(base + location)).text()).toContain("unjudged");

});

test("a verdict that was never asked for is not found", async () => {

  const response = await fetch(`${base}/v/999999`);

  expect(response.status).toBe(404);

  expect(await response.text()).toContain("no such verdict");

});

test("stands on the security floor", async () => {

  const response = await fetch(`${base}/`);

  expect(response.headers.get("content-security-policy")).toContain("default-src 'self'");

  expect(response.headers.get("x-content-type-options")).toBe("nosniff");

});

test("a bug answers with the floor, not the runtime's page", async () => {

  const response = await fetch(`${base}/ask`, {

    method: "POST",

    headers: { "content-type": "application/x-www-form-urlencoded" },

    body: "question=%E0%A4%A",

  });

  expect(response.headers.get("content-security-policy")).toContain("default-src 'self'");

});

test("a body is capped by the bytes read, whatever it claims", async () => {

  const response = await fetch(`${base}/ask`, {

    method: "POST",

    headers: { "content-type": "application/x-www-form-urlencoded" },

    body: "question=" + "x".repeat(1024 * 1024),

  });

  expect(response.status).toBe(413);

});

test("HEAD sees the app up", async () => {

  const response = await server.fetch(new Request(`${base}/`, { method: "HEAD" }));

  expect(response.status).toBe(200);

  expect(await response.text()).toBe("");

});

test("refuses a cross-site ask", async () => {

  const form = new FormData();

  form.set("question", "did this come from another site?");

  const posted = await fetch(`${base}/ask`, {

    method: "POST",

    body: form,

    redirect: "manual",

    headers: { origin: "https://evil.example", "sec-fetch-site": "cross-site" },

  });

  expect(posted.status).toBe(403);

  expect(await (await fetch(`${base}/ledger`)).text()).not.toContain("another site");

});

test("a question is escaped on the way out", async () => {

  const location = (await ask('<img src=x onerror="alert(1)">')).headers.get("location") ?? "";

  const page = await (await fetch(base + location)).text();

  expect(page).toContain("<img");

  expect(page).not.toContain("<img src=x");

});