Rename src to source

test/services/broadcaster.test.ts

@@ -0,0 +1,199 @@
+import { describe, expect, it, vi } from "vitest";
+
+import { ApplicationError } from "../../source/errors/index.js";
+import { Broadcaster } from "../../source/services/broadcaster.js";
+import { ApplicationRouteStream } from "../../source/services/route-stream.js";
+import { Logger } from "../../source/utils/logger.js";
+import { TestConnection } from "../helpers/test-connection.js";
+
+function createBroadcaster(): Broadcaster {
+  return new Broadcaster(new Logger("broadcaster-test"));
+}
+
+function routeStream(connection: TestConnection): ApplicationRouteStream {
+  return new ApplicationRouteStream(connection, undefined);
+}
+
+async function expectPending(promise: Promise<void>): Promise<void> {
+  const settled = vi.fn();
+  void promise.then(settled);
+  await Promise.resolve();
+  expect(settled).not.toHaveBeenCalled();
+}
+
+describe("Broadcaster subscriptions", () => {
+  it("delivers events and resolves after a later request removes the topic", async () => {
+    const broadcaster = createBroadcaster();
+    const connection = new TestConnection(true, true);
+    const subscribed = broadcaster.subscribe(routeStream(connection), [
+      "items",
+    ]);
+
+    await expectPending(subscribed);
+    await broadcaster.publish("items", {
+      type: "item-changed",
+      data: { id: "a" },
+    });
+
+    expect(connection.messages).toEqual([
+      expect.objectContaining({
+        type: "item-changed",
+        data: { id: "a" },
+      }),
+    ]);
+
+    // A different request-scoped facade still resolves the connection's
+    // original subscription.
+    await broadcaster.unsubscribe(routeStream(connection), ["items"]);
+    await expect(subscribed).resolves.toBeUndefined();
+  });
+
+  it("resolves fully duplicate subscriptions immediately", async () => {
+    const broadcaster = createBroadcaster();
+    const connection = new TestConnection(true, true);
+    const first = broadcaster.subscribe(routeStream(connection), [
+      "items",
+      "items",
+    ]);
+    const duplicate = broadcaster.subscribe(routeStream(connection), ["items"]);
+
+    await expect(duplicate).resolves.toBeUndefined();
+    await expectPending(first);
+    expect(connection.closeCallbacks).toHaveLength(1);
+
+    await broadcaster.unsubscribe(routeStream(connection), ["items"]);
+    await first;
+  });
+
+  it("waits only for topics newly added by a partially overlapping call", async () => {
+    const broadcaster = createBroadcaster();
+    const connection = new TestConnection(true, true);
+    const first = broadcaster.subscribe(routeStream(connection), ["a"]);
+    const second = broadcaster.subscribe(routeStream(connection), ["a", "b"]);
+
+    await broadcaster.unsubscribe(routeStream(connection), ["a"]);
+    await expect(first).resolves.toBeUndefined();
+    await expectPending(second);
+
+    await broadcaster.unsubscribe(routeStream(connection), ["b"]);
+    await expect(second).resolves.toBeUndefined();
+  });
+
+  it("resolves every pending subscription and removes topics on close", async () => {
+    const broadcaster = createBroadcaster();
+    const connection = new TestConnection(true, false);
+    const first = broadcaster.subscribe(routeStream(connection), ["a"]);
+    const second = broadcaster.subscribe(routeStream(connection), ["b"]);
+
+    connection.close();
+    await Promise.all([first, second]);
+    await broadcaster.publish("a", { type: "changed", data: null });
+    await broadcaster.publish("b", { type: "changed", data: null });
+
+    expect(connection.messages).toEqual([]);
+  });
+
+  it("immediately resolves registration against an already-closed connection", async () => {
+    const broadcaster = createBroadcaster();
+    const connection = new TestConnection(true, false);
+    connection.close();
+
+    await expect(
+      broadcaster.subscribe(routeStream(connection), ["items"]),
+    ).resolves.toBeUndefined();
+  });
+
+  it("rejects subscriptions on a non-streaming connection", () => {
+    const broadcaster = createBroadcaster();
+    const connection = new TestConnection(false, false);
+
+    expect(() =>
+      broadcaster.subscribe(routeStream(connection), ["items"]),
+    ).toThrowError(
+      expect.objectContaining({ statusCode: 406 }),
+    );
+  });
+
+  it("treats an empty subscription and repeated unsubscribe as no-ops", async () => {
+    const broadcaster = createBroadcaster();
+    const connection = new TestConnection(true, true);
+
+    await expect(
+      broadcaster.subscribe(routeStream(connection), []),
+    ).resolves.toBeUndefined();
+    await broadcaster.unsubscribe(routeStream(connection), ["missing"]);
+    await broadcaster.unsubscribe(routeStream(connection));
+
+    expect(connection.closeCallbacks).toHaveLength(0);
+  });
+
+  it("fans out concurrently to independent connections", async () => {
+    const broadcaster = createBroadcaster();
+    const first = new TestConnection(true, false);
+    const second = new TestConnection(true, false);
+    const originalFirstSend = first.send.bind(first);
+    let releaseFirst: () => void = () => undefined;
+    const firstReleased = new Promise<void>((resolve) => {
+      releaseFirst = resolve;
+    });
+    let markSecondSent: () => void = () => undefined;
+    const secondSent = new Promise<void>((resolve) => {
+      markSecondSent = resolve;
+    });
+
+    first.send = async (message) => {
+      await firstReleased;
+      await originalFirstSend(message);
+    };
+    second.send = async (message) => {
+      await TestConnection.prototype.send.call(second, message);
+      markSecondSent();
+    };
+
+    const firstSubscription = broadcaster.subscribe(routeStream(first), [
+      "items",
+    ]);
+    const secondSubscription = broadcaster.subscribe(routeStream(second), [
+      "items",
+    ]);
+    const publication = broadcaster.publish("items", {
+      type: "item-changed",
+      data: {},
+    });
+
+    await secondSent;
+    releaseFirst();
+    await publication;
+
+    expect(first.messages).toHaveLength(1);
+    expect(second.messages).toHaveLength(1);
+
+    first.close();
+    second.close();
+    await Promise.all([firstSubscription, secondSubscription]);
+  });
+
+  it("closes and removes a connection whose event delivery fails", async () => {
+    const broadcaster = createBroadcaster();
+    const connection = new TestConnection(true, true);
+    connection.send = vi.fn().mockRejectedValue(new Error("socket failed"));
+    const subscribed = broadcaster.subscribe(routeStream(connection), [
+      "items",
+    ]);
+
+    await broadcaster.publish("items", {
+      type: "item-changed",
+      data: {},
+    });
+    await subscribed;
+
+    expect(connection.closed).toBe(true);
+    expect(connection.send).toHaveBeenCalledOnce();
+
+    await broadcaster.publish("items", {
+      type: "item-changed",
+      data: {},
+    });
+    expect(connection.send).toHaveBeenCalledOnce();
+  });
+});

test/services/config.test.ts

@@ -0,0 +1,120 @@
+import { describe, expect, test, vi } from 'vitest';
+
+import { Config } from '../../source/services/config.ts';
+
+/**
+ * Tests that the config defaults to a 1 MiB request body limit.
+ */
+const testConfigDefaultsTo1MiBRequestBodyLimit = (): void => {
+    const config = Config.from({
+        database: {},
+        server: {},
+        auth: {},
+    });
+
+    expect(config.server.maxRequestBodyBytes).toBe(1024 * 1024);
+    expect(config.database.path).toBe('data.db');
+    expect(config.server.port).toBe(3000);
+    expect(config.server.host).toBe('0.0.0.0');
+    expect(config.server.cors.origin).toBe('*');
+    expect(config.server.cors.methods).toEqual([ 'GET', 'POST', 'PUT', 'DELETE', 'OPTIONS' ]);
+    expect(config.server.cors.allowedHeaders).toEqual([ 'Content-Type', 'cache-control', 'X-Timestamp', 'X-PublicKey', 'X-Signature' ]);
+    expect(config.auth.timestampWindowMs).toBe(300000);
+};
+
+/**
+ * Tests that the config loads the request body limit from the environment.
+ */
+const testConfigLoadsRequestBodyLimitFromEnvironment = (): void => {
+    vi.stubEnv('SERVER_MAX_REQUEST_BODY_BYTES', '2048');
+
+    expect(Config.fromEnv().server.maxRequestBodyBytes).toBe(2048);
+};
+
+/**
+ * Tests that the config rejects an invalid request body limit.
+ */
+const testConfigRejectsInvalidRequestBodyLimit = (): void => {
+    expect(() =>
+        Config.from({
+            database: {},
+            server: { maxRequestBodyBytes: '0' },
+            auth: {},
+        })).toThrow();
+};
+
+/**
+ * tests that the config loads the database path from the environment.
+ */
+const testConfigLoadsDatabasePathFromEnvironment = (): void => {
+    vi.stubEnv('DATABASE_PATH', 'test.db');
+
+    expect(Config.fromEnv().database.path).toBe('test.db');
+};
+
+/**
+ * tests that the config loads the server port from the environment.
+ */
+const testConfigLoadsServerPortFromEnvironment = (): void => {
+    vi.stubEnv('SERVER_PORT', '3000');
+
+    expect(Config.fromEnv().server.port).toBe(3000);
+};
+
+/**
+ * tests that the config loads the server host from the environment.
+ */
+const testConfigLoadsServerHostFromEnvironment = (): void => {
+    vi.stubEnv('SERVER_HOST', '0.0.0.0');
+
+    expect(Config.fromEnv().server.host).toBe('0.0.0.0');
+};
+
+/**
+ * tests that the config loads the cors configuration from the environment.
+ */
+const testConfigLoadsCorsConfigurationFromEnvironment = (): void => {
+    vi.stubEnv('CORS_ORIGIN', '*');
+
+    expect(Config.fromEnv().server.cors.origin).toBe('*');
+};
+
+/**
+ * tests that the config loads the cors methods from the environment.
+ */
+const testConfigLoadsCorsMethodsFromEnvironment = (): void => {
+    vi.stubEnv('CORS_METHODS', 'GET,POST,PUT,DELETE,OPTIONS');
+
+    expect(Config.fromEnv().server.cors.methods).toEqual([ 'GET', 'POST', 'PUT', 'DELETE', 'OPTIONS' ]);
+};
+
+/**
+ * tests that the config loads the cors allowed headers from the environment.
+ */
+const testConfigLoadsCorsAllowedHeadersFromEnvironment = (): void => {
+    vi.stubEnv('CORS_ALLOWED_HEADERS', 'Content-Type,cache-control,X-Timestamp');
+
+    expect(Config.fromEnv().server.cors.allowedHeaders).toEqual([ 'Content-Type', 'cache-control', 'X-Timestamp' ]);
+};
+
+/**
+ * tests that the config loads the auth configuration from the environment.
+ */
+const testConfigLoadsAuthConfigurationFromEnvironment = (): void => {
+    vi.stubEnv('AUTH_TIMESTAMP_WINDOW_MS', '1000');
+
+    expect(Config.fromEnv().auth.timestampWindowMs).toBe(1000);
+};
+
+describe('Config', () => {
+    test('defaults to a 1 MiB request body limit', testConfigDefaultsTo1MiBRequestBodyLimit);
+    test('loads the request body limit from the environment', testConfigLoadsRequestBodyLimitFromEnvironment);
+    test('rejects the invalid request body limit', testConfigRejectsInvalidRequestBodyLimit);
+    test('loads the database path from the environment', testConfigLoadsDatabasePathFromEnvironment);
+    test('loads the server port from the environment', testConfigLoadsServerPortFromEnvironment);
+    test('loads the server host from the environment', testConfigLoadsServerHostFromEnvironment);
+    test('loads the cors configuration from the environment', testConfigLoadsCorsConfigurationFromEnvironment);
+    test('loads the cors methods from the environment', testConfigLoadsCorsMethodsFromEnvironment);
+    test('loads the cors allowed headers from the environment', testConfigLoadsCorsAllowedHeadersFromEnvironment);
+    test('loads the auth configuration from the environment', testConfigLoadsAuthConfigurationFromEnvironment);
+});

test/services/router.test.ts

@@ -0,0 +1,134 @@
+import { describe, expect, it } from "vitest";
+
+import type { RouteDefinition, RouteModule } from "../../source/routes/types.js";
+import { ApplicationError } from "../../source/errors/index.js";
+import { ApplicationRouter } from "../../source/services/router.js";
+import { TestConnection } from "../helpers/test-connection.js";
+
+function moduleWith(routes: RouteDefinition[]): RouteModule {
+  return {
+    async getRoutes() {
+      return routes;
+    },
+  };
+}
+
+describe("ApplicationRouter initialization", () => {
+  it("rejects duplicate exact paths during startup", async () => {
+    const route = { url: "/echo", handler: () => undefined };
+
+    await expect(
+      ApplicationRouter.create([moduleWith([route]), moduleWith([route])]),
+    ).rejects.toThrow("Duplicate application route: /echo");
+  });
+
+  it.each(["echo", "/", "/items/:id", "/items?active=true", "/items#active"])(
+    "rejects the invalid route path %s",
+    async (url) => {
+      await expect(
+        ApplicationRouter.create([
+          moduleWith([{ url, handler: () => undefined }]),
+        ]),
+      ).rejects.toThrow("Invalid application route");
+    },
+  );
+});
+
+describe("ApplicationRouter dispatch", () => {
+  it("binds the connection, body, and request ID to one route stream", async () => {
+    const connection = new TestConnection(false, false);
+    const router = await ApplicationRouter.create([
+      moduleWith([
+        {
+          url: "/echo",
+          handler: async (stream) => {
+            expect(stream.connection).toBe(connection);
+            await stream.send(stream.body);
+          },
+        },
+      ]),
+    ]);
+
+    await router.dispatch(
+      { path: "/echo", body: { value: 1 }, requestId: "request-1" },
+      connection,
+    );
+
+    expect(connection.messages).toEqual([
+      {
+        id: "request-1",
+        type: "response",
+        statusCode: 200,
+        body: { value: 1 },
+      },
+    ]);
+
+    await expect(
+      router.dispatch({ path: "/echo/other", body: {} }, connection),
+    ).rejects.toMatchObject({ statusCode: 404 });
+  });
+
+  it("preserves correlation when concurrent requests finish out of order", async () => {
+    const completions = new Map<string, () => void>();
+    const router = await ApplicationRouter.create([
+      moduleWith([
+        {
+          url: "/delayed",
+          handler: async (stream) => {
+            const key = (stream.body as { key: string }).key;
+            await new Promise<void>((resolve) => completions.set(key, resolve));
+            await stream.send({ key });
+          },
+        },
+      ]),
+    ]);
+    const connection = new TestConnection(true, true);
+
+    const first = router.dispatch(
+      { path: "/delayed", body: { key: "A" }, requestId: "A" },
+      connection,
+    );
+    const second = router.dispatch(
+      { path: "/delayed", body: { key: "B" }, requestId: "B" },
+      connection,
+    );
+
+    completions.get("B")?.();
+    await second;
+    completions.get("A")?.();
+    await first;
+
+    expect(connection.messages).toEqual([
+      {
+        id: "B",
+        type: "response",
+        statusCode: 200,
+        body: { key: "B" },
+      },
+      {
+        id: "A",
+        type: "response",
+        statusCode: 200,
+        body: { key: "A" },
+      },
+    ]);
+  });
+
+  it("propagates route failures without infrastructure-specific cleanup", async () => {
+    const error = new Error("route failed");
+    const router = await ApplicationRouter.create([
+      moduleWith([
+        {
+          url: "/failure",
+          handler: () => {
+            throw error;
+          },
+        },
+      ]),
+    ]);
+
+    await expect(
+      router.dispatch({ path: "/failure" }, new TestConnection(false, false)),
+    ).rejects.toBe(error);
+  });
+});

test/services/transports/http-transport.test.ts

@@ -0,0 +1,242 @@
+import { Hono } from "hono";
+import { describe, expect, it, vi } from "vitest";
+
+import type { RouteDefinition } from "../../../source/routes/types.js";
+import { ApplicationError } from "../../../source/errors/index.js";
+import { ApplicationRouter } from "../../../source/services/router.js";
+import { Broadcaster } from "../../../source/services/broadcaster.js";
+import { HttpTransportRouter } from "../../../source/services/transport/http-transport.js";
+import type { AppEnv } from "../../../source/services/transport/transport-router.js";
+import { fromExtendedJson, toExtendedJson } from "@xo-cash/utils";
+import { Logger } from "../../../source/utils/logger.js";
+import { ServerHost } from "../../../source/services/server-host.js";
+
+async function createApp(
+  routes: RouteDefinition[] | ((broadcaster: Broadcaster) => RouteDefinition[]),
+  maxRequestBodyBytes = 1024 * 1024,
+): Promise<Hono<AppEnv>> {
+  const debug = new Logger("http-transport-test");
+  const broadcaster = new Broadcaster(debug);
+  const resolvedRoutes =
+    typeof routes === "function" ? routes(broadcaster) : routes;
+  const router = await ApplicationRouter.create([
+    {
+      async getRoutes() {
+        return resolvedRoutes;
+      },
+    },
+  ]);
+  const transport = new HttpTransportRouter(router, debug);
+  const app = new Hono<AppEnv>();
+
+  app.onError(HttpTransportRouter.createErrorHandler(debug));
+  app.use("*", ServerHost.limitBodySizeMiddleware(maxRequestBodyBytes, debug));
+  app.use("*", HttpTransportRouter.createExtJsonMiddleware(debug));
+  transport.register(app);
+  return app;
+}
+
+describe("HttpTransportRouter", () => {
+  it("runs normal HTTP through a non-streaming route stream", async () => {
+    const app = await createApp([
+      {
+        url: "/echo",
+        handler: async (stream) => stream.send(stream.body),
+      },
+    ]);
+    const value = new Uint8Array([1, 2, 3]);
+
+    const response = await app.request("/echo", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: toExtendedJson({ value }),
+    });
+
+    expect(response.status).toBe(200);
+    expect(fromExtendedJson(await response.text())).toEqual({ value });
+  });
+
+  it("returns 204 when a normal HTTP route sends nothing", async () => {
+    const app = await createApp([
+      {
+        url: "/nothing",
+        handler: () => undefined,
+      },
+    ]);
+
+    const response = await app.request("/nothing", { method: "POST" });
+
+    expect(response.status).toBe(204);
+    expect(await response.text()).toBe("");
+  });
+
+  it("returns normalized errors for non-streaming requests", async () => {
+    const app = await createApp([]);
+
+    const missing = await app.request("/missing", { method: "POST" });
+    expect(missing.status).toBe(404);
+    expect(await missing.json()).toEqual({
+      statusCode: 404,
+      error: "No route found for /missing",
+    });
+
+    const invalid = await app.request("/missing", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: "{",
+    });
+    expect(invalid.status).toBe(400);
+    expect(await invalid.json()).toEqual({
+      statusCode: 400,
+      error: "Invalid JSON in request body",
+    });
+  });
+
+  it("rejects subscribe when normal HTTP has no streaming capability", async () => {
+    const app = await createApp((broadcaster) => [
+      {
+        url: "/items/subscribe",
+        handler: async (stream) => {
+          await broadcaster.subscribe(stream, ["items"]);
+        },
+      },
+    ]);
+
+    const response = await app.request("/items/subscribe", { method: "POST" });
+
+    expect(response.status).toBe(406);
+    expect(await response.json()).toMatchObject({ statusCode: 406 });
+  });
+
+  it("sends SSE route errors as events and closes only that stream", async () => {
+    const app = await createApp([
+      {
+        url: "/items/subscribe",
+        handler: () => {
+          throw new Error("private storage failure");
+        },
+      },
+    ]);
+
+    const response = await app.request("/items/subscribe", {
+      method: "POST",
+      headers: { accept: "text/event-stream" },
+    });
+    const events = await response.text();
+
+    expect(response.status).toBe(200);
+    expect(events).toContain("event: error");
+    expect(events).toContain(
+      'data: {"statusCode":500,"error":"Internal Server Error"}',
+    );
+    expect(events).not.toContain("private storage failure");
+  });
+
+  it("sends a normal route as one SSE response event and then closes", async () => {
+    const app = await createApp([
+      {
+        url: "/echo",
+        handler: (stream) => stream.send({ ok: true }),
+      },
+    ]);
+
+    const response = await app.request("/echo", {
+      method: "POST",
+      headers: { accept: "text/event-stream" },
+    });
+    const events = await response.text();
+
+    expect(response.status).toBe(200);
+    expect(events).toContain("event: response");
+    expect(events).toContain('data: {"ok":true}');
+  });
+
+  it("keeps SSE open until the route's subscription promise resolves", async () => {
+    let removeSubscription: () => Promise<void> = async () => undefined;
+    let markSubscribed: () => void = () => undefined;
+    const subscribed = new Promise<void>((resolve) => {
+      markSubscribed = resolve;
+    });
+    const app = await createApp((broadcaster) => [
+      {
+        url: "/items/subscribe",
+        handler: async (stream) => {
+          const topics = ["items"];
+          removeSubscription = () => broadcaster.unsubscribe(stream, topics);
+
+          const removed = broadcaster.subscribe(stream, topics);
+          markSubscribed();
+          await removed;
+        },
+      },
+    ]);
+
+    const response = await app.request("/items/subscribe", {
+      method: "POST",
+      headers: { accept: "text/event-stream" },
+    });
+    const body = response.text();
+    const completed = vi.fn();
+    void body.then(completed);
+
+    await subscribed;
+    await Promise.resolve();
+    expect(completed).not.toHaveBeenCalled();
+
+    await removeSubscription();
+
+    expect(await body).toBe("");
+    expect(completed).toHaveBeenCalledOnce();
+  });
+
+  it("rejects unsubscribe over non-bidirectional SSE", async () => {
+    const app = await createApp((broadcaster) => [
+      {
+        url: "/items/unsubscribe",
+        handler: async (stream) => {
+          if (!stream.bidirectional) {
+            throw new ApplicationError(
+              400,
+              "This route requires an existing bidirectional stream",
+            );
+          }
+
+          await broadcaster.unsubscribe(stream, ["items"]);
+        },
+      },
+    ]);
+
+    const response = await app.request("/items/unsubscribe", {
+      method: "POST",
+      headers: { accept: "text/event-stream" },
+    });
+    const events = await response.text();
+
+    expect(response.status).toBe(200);
+    expect(events).toContain("event: error");
+    expect(events).toContain('"statusCode":400');
+  });
+  it("rejects HTTP bodies larger than the configured byte limit", async () => {
+    const app = await createApp(
+      [
+        {
+          url: "/echo",
+          handler: async (stream) => stream.send(stream.body),
+        },
+      ],
+      32,
+    );
+
+    const response = await app.request("/echo", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ value: "x".repeat(64) }),
+    });
+
+    expect(response.status).toBe(413);
+    expect(await response.json()).toEqual({
+      statusCode: 413,
+      error: "Request body exceeds the 32 byte limit",
+    });
+  });
+});