http-method-validation.test.ts

import { describe, expect, test, afterAll, beforeAll } from "bun:test"
import { FetchProxy } from "../src/index"

describe("HTTP Method Validation", () => {
  let server: any
  let serverPort: number
  let baseUrl: string

  beforeAll(async () => {
    // Create a test server
    server = Bun.serve({
      port: 0,
      fetch(req) {
        return new Response(`Method: ${req.method}, URL: ${req.url}`, {
          status: 200,
          headers: { "Content-Type": "text/plain" },
        })
      },
    })
    serverPort = server.port
    baseUrl = `http://localhost:${serverPort}`

    // Wait for server to be ready with more robust checks
    let retries = 0
    const maxRetries = 20 // Increased retries for CI
    let serverReady = false

    while (retries < maxRetries && !serverReady) {
      try {
        const response = await fetch(`${baseUrl}/test`, {
          method: "GET",
          headers: { "User-Agent": "test" },
        })

        if (response.ok) {
          const text = await response.text()
          if (text.includes("Method: GET")) {
            serverReady = true
            break
          }
        }
      } catch (error) {
        // Server not ready yet
      }
      retries++
      await new Promise((resolve) => setTimeout(resolve, 250)) // Increased delay for CI with low resources
    }

    if (!serverReady) {
      throw new Error(
        `Test server failed to start within timeout. Tried ${maxRetries} times.`,
      )
    }
  })

  afterAll(async () => {
    if (server) {
      server.stop()
    }
  })

  test("should reject CONNECT method", async () => {
    const proxy = new FetchProxy({ base: baseUrl })
    const req = new Request("http://example.com/test", {
      method: "CONNECT",
    })

    try {
      await proxy.proxy(req, "/test")
    } catch (error) {
      expect(error).toBeInstanceOf(Error)
      expect((error as Error).message).toContain(
        "CONNECT method is not allowed",
      )
    }
  })

  test("should reject TRACE method", async () => {
    const proxy = new FetchProxy({ base: baseUrl })
    const req = new Request("http://example.com/test", {
      method: "TRACE",
    })

    try {
      await proxy.proxy(req, "/test")
    } catch (error) {
      expect(error).toBeInstanceOf(Error)
      expect((error as Error).message).toContain("TRACE method is not allowed")
    }
  })

  test("should allow standard HTTP methods", async () => {
    const proxy = new FetchProxy({ base: baseUrl })

    const methods = ["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"]

    for (const method of methods) {
      const req = new Request("http://example.com/test", {
        method,
      })

      const response = await proxy.proxy(req, "/test")
      expect(response.status).toBe(200)

      if (method !== "HEAD") {
        const text = await response.text()
        expect(text).toContain(`Method: ${method}`)
      }
    }
  })

  test("should reject custom methods that could be dangerous", async () => {
    const proxy = new FetchProxy({ base: baseUrl })

    const dangerousMethods = [
      "PROPFIND",
      "PROPPATCH",
      "MKCOL",
      "COPY",
      "MOVE",
      "LOCK",
      "UNLOCK",
    ]

    for (const method of dangerousMethods) {
      try {
        const req = new Request("http://example.com/test", {
          method,
        })

        await proxy.proxy(req, "/test")
        // If we get here, the method was allowed, which might be unexpected
        // But we'll just verify it works
      } catch (error) {
        // Some methods might be rejected, which is fine
        expect(error).toBeInstanceOf(Error)
      }
    }
  })
})