refactor how Content-Type headers are checked

Author: thehabes

rest.js

@@ -109,7 +109,7 @@ const eitherContent = function (req, res, next) {
     if (mimeType === "text/plain" || mimeType === "application/json" || mimeType === "application/ld+json") return next()
     return next(createExpressError({
         statusCode: 415,
-        statusMessage: `Unsupported Content-Type: ${contentType}. This endpoint requires text/plain.`
+        statusMessage: `Unsupported Content-Type: ${contentType}. This endpoint requires application/json, application/ld+json, or text/plain.`
     }))
 }
 
@@ -205,4 +205,4 @@ It may not have completed at all, and most likely did not complete successfully.
     res.status(error.status).send(error.message)
 }
 
-export default { checkPatchOverrideSupport, jsonContent, textContent, messenger }
+export default { checkPatchOverrideSupport, jsonContent, textContent, eitherContent, messenger }

routes/__tests__/contentType.test.js

@@ -2,193 +2,262 @@ import express from "express"
 import request from "supertest"
 import rest from '../../rest.js'
 
-// Set up a minimal Express app with the Content-Type validation middleware
+/**
+ * Tests for the Content-Type validation middlewares: jsonContent, textContent, and eitherContent.
+ * Each middleware is applied per-route rather than as a blanket middleware.
+ */
+
+// Set up a minimal Express app mirroring the real app's body parsers
 const routeTester = express()
 routeTester.use(express.json({ type: ["application/json", "application/ld+json"] }))
 routeTester.use(express.text())
 
-
-// Mount the validateContentType middleware on /api just like api-routes.js
-routeTester.use("/api", rest.validateContentType)
-
-// Simple JSON-only endpoint (like /api/create, /api/query, etc.)
-routeTester.post("/api/create", (req, res) => {
+// JSON-only endpoints (like /api/create, /api/query, /api/update, etc.)
+routeTester.post("/json-endpoint", rest.jsonContent, (req, res) => {
     res.status(200).json({ received: req.body })
 })
-
-// Search endpoint that accepts text/plain
-routeTester.post("/api/search", (req, res) => {
+routeTester.put("/json-endpoint", rest.jsonContent, (req, res) => {
     res.status(200).json({ received: req.body })
 })
-
-// GET endpoint should pass through without Content-Type validation
-routeTester.get("/api/info", (req, res) => {
-    res.status(200).json({ info: true })
-})
-
-// DELETE endpoint should pass through without Content-Type validation
-routeTester.delete("/api/delete/:_id", (req, res) => {
-    res.status(200).json({ deleted: req.params._id })
+routeTester.patch("/json-endpoint", rest.jsonContent, (req, res) => {
+    res.status(200).json({ received: req.body })
 })
 
-// PUT endpoint (like /api/update, /api/bulkUpdate)
-routeTester.put("/api/update", (req, res) => {
+// Text-only endpoint
+routeTester.post("/text-endpoint", rest.textContent, (req, res) => {
     res.status(200).json({ received: req.body })
 })
 
-// Release endpoint uses PATCH without a JSON body (uses Slug header)
-routeTester.patch("/api/release/:_id", (req, res) => {
-    res.status(200).json({ released: req.params._id })
+// Either JSON or text endpoint (like /api/search)
+routeTester.post("/either-endpoint", rest.eitherContent, (req, res) => {
+    res.status(200).json({ received: req.body })
 })
 
 // Error handler matching the app's pattern
 routeTester.use(rest.messenger)
 
-describe("Content-Type validation middleware", () => {
+describe("jsonContent middleware", () => {
 
-    it("accepts application/json with valid JSON body", async () => {
+    it("accepts application/json", async () => {
         const response = await request(routeTester)
-            .post("/api/create")
+            .post("/json-endpoint")
             .set("Content-Type", "application/json")
             .send({ test: "data" })
         expect(response.statusCode).toBe(200)
         expect(response.body.received.test).toBe("data")
     })
 
-    it("accepts application/ld+json with valid JSON body", async () => {
+    it("accepts application/ld+json", async () => {
         const response = await request(routeTester)
-            .post("/api/create")
+            .post("/json-endpoint")
             .set("Content-Type", "application/ld+json")
+            // Must stringify manually; supertest's .send(object) would override Content-Type to application/json
             .send(JSON.stringify({ "@context": "http://example.org", test: "ld" }))
         expect(response.statusCode).toBe(200)
         expect(response.body.received["@context"]).toBe("http://example.org")
     })
 
     it("accepts application/json with charset parameter", async () => {
         const response = await request(routeTester)
-            .post("/api/create")
+            .post("/json-endpoint")
             .set("Content-Type", "application/json; charset=utf-8")
             .send({ test: "charset" })
         expect(response.statusCode).toBe(200)
     })
 
     it("accepts application/ld+json with charset parameter", async () => {
         const response = await request(routeTester)
-            .post("/api/create")
+            .post("/json-endpoint")
             .set("Content-Type", "application/ld+json; charset=utf-8")
+            // Must stringify manually; supertest's .send(object) would override Content-Type to application/json
             .send(JSON.stringify({ "@context": "http://example.org", test: "ld-charset" }))
         expect(response.statusCode).toBe(200)
     })
 
-    it("returns 415 for missing Content-Type header", async () => {
+    it("accepts Content-Type with unusual casing", async () => {
+        const response = await request(routeTester)
+            .post("/json-endpoint")
+            .set("Content-Type", "Application/JSON")
+            .send({ test: "casing" })
+        expect(response.statusCode).toBe(200)
+        expect(response.body.received.test).toBe("casing")
+    })
+
+    it("accepts application/json on PUT", async () => {
+        const response = await request(routeTester)
+            .put("/json-endpoint")
+            .set("Content-Type", "application/json")
+            .send({ test: "put-data" })
+        expect(response.statusCode).toBe(200)
+        expect(response.body.received.test).toBe("put-data")
+    })
+
+    it("accepts application/json on PATCH", async () => {
         const response = await request(routeTester)
-            .post("/api/create")
+            .patch("/json-endpoint")
+            .set("Content-Type", "application/json")
+            .send({ test: "patch-data" })
+        expect(response.statusCode).toBe(200)
+        expect(response.body.received.test).toBe("patch-data")
+    })
+
+    it("returns 415 for missing Content-Type", async () => {
+        const response = await request(routeTester)
+            .post("/json-endpoint")
             .unset("Content-Type")
             .send(Buffer.from('{"test":"data"}'))
         expect(response.statusCode).toBe(415)
         expect(response.text).toContain("Missing or empty Content-Type header")
     })
 
-    it("returns 415 for text/plain on JSON-only endpoint", async () => {
+    it("returns 415 for text/plain", async () => {
         const response = await request(routeTester)
-            .post("/api/create")
+            .post("/json-endpoint")
             .set("Content-Type", "text/plain")
             .send("some plain text")
         expect(response.statusCode).toBe(415)
         expect(response.text).toContain("Unsupported Content-Type")
     })
 
+    it("returns 415 for text/plain on PUT", async () => {
+        const response = await request(routeTester)
+            .put("/json-endpoint")
+            .set("Content-Type", "text/plain")
+            .send("some text")
+        expect(response.statusCode).toBe(415)
+        expect(response.text).toContain("Unsupported Content-Type")
+    })
+
     it("returns 415 for application/xml", async () => {
         const response = await request(routeTester)
-            .post("/api/create")
+            .post("/json-endpoint")
             .set("Content-Type", "application/xml")
             .send("<root/>")
         expect(response.statusCode).toBe(415)
         expect(response.text).toContain("Unsupported Content-Type")
     })
 
-    it("allows text/plain on search endpoint", async () => {
+    it("returns 415 for comma-separated multiple Content-Type values", async () => {
         const response = await request(routeTester)
-            .post("/api/search")
+            .post("/json-endpoint")
+            .set("Content-Type", "application/json, text/plain")
+            .send('{"test":"data"}')
+        expect(response.statusCode).toBe(415)
+        expect(response.text).toContain("Multiple Content-Type values are not allowed")
+    })
+
+    it("returns 415 for valid type smuggled via comma after charset", async () => {
+        const response = await request(routeTester)
+            .post("/json-endpoint")
+            .set("Content-Type", "application/json; charset=utf-8, text/plain")
+            .send('{"test":"data"}')
+        expect(response.statusCode).toBe(415)
+        expect(response.text).toContain("Multiple Content-Type values are not allowed")
+    })
+})
+
+describe("textContent middleware", () => {
+
+    it("accepts text/plain", async () => {
+        const response = await request(routeTester)
+            .post("/text-endpoint")
             .set("Content-Type", "text/plain")
-            .send("search terms")
+            .send("hello world")
         expect(response.statusCode).toBe(200)
-        expect(response.body.received).toBe("search terms")
+        expect(response.body.received).toBe("hello world")
     })
 
-    it("allows application/json on search endpoint", async () => {
+    it("accepts text/plain with charset parameter", async () => {
         const response = await request(routeTester)
-            .post("/api/search")
-            .set("Content-Type", "application/json")
-            .send({ searchText: "hello" })
+            .post("/text-endpoint")
+            .set("Content-Type", "text/plain; charset=utf-8")
+            .send("hello charset")
         expect(response.statusCode).toBe(200)
-        expect(response.body.received.searchText).toBe("hello")
     })
 
-    it("accepts Content-Type with unusual casing", async () => {
+    it("returns 415 for missing Content-Type", async () => {
         const response = await request(routeTester)
-            .post("/api/create")
-            .set("Content-Type", "Application/JSON")
-            .send({ test: "casing" })
-        expect(response.statusCode).toBe(200)
-        expect(response.body.received.test).toBe("casing")
+            .post("/text-endpoint")
+            .unset("Content-Type")
+            .send(Buffer.from("hello"))
+        expect(response.statusCode).toBe(415)
+        expect(response.text).toContain("Missing or empty Content-Type header")
     })
 
-    it("skips validation for GET requests", async () => {
+    it("returns 415 for application/json", async () => {
         const response = await request(routeTester)
-            .get("/api/info")
-        expect(response.statusCode).toBe(200)
-        expect(response.body.info).toBe(true)
+            .post("/text-endpoint")
+            .set("Content-Type", "application/json")
+            .send({ test: "data" })
+        expect(response.statusCode).toBe(415)
+        expect(response.text).toContain("Unsupported Content-Type")
+        expect(response.text).toContain("text/plain")
     })
 
-    it("skips validation for DELETE requests", async () => {
+    it("returns 415 for comma-separated multiple Content-Type values", async () => {
         const response = await request(routeTester)
-            .delete("/api/delete/abc123")
-        expect(response.statusCode).toBe(200)
-        expect(response.body.deleted).toBe("abc123")
+            .post("/text-endpoint")
+            .set("Content-Type", "text/plain, application/json")
+            .send("hello")
+        expect(response.statusCode).toBe(415)
+        expect(response.text).toContain("Multiple Content-Type values are not allowed")
     })
+})
+
+describe("eitherContent middleware", () => {
 
-    it("skips validation for PATCH on release endpoint", async () => {
+    it("accepts application/json", async () => {
         const response = await request(routeTester)
-            .patch("/api/release/abc123")
+            .post("/either-endpoint")
+            .set("Content-Type", "application/json")
+            .send({ searchText: "hello" })
         expect(response.statusCode).toBe(200)
-        expect(response.body.released).toBe("abc123")
+        expect(response.body.received.searchText).toBe("hello")
     })
 
-    it("accepts application/json on PUT endpoint", async () => {
+    it("accepts application/ld+json", async () => {
         const response = await request(routeTester)
-            .put("/api/update")
-            .set("Content-Type", "application/json")
-            .send({ test: "put-data" })
+            .post("/either-endpoint")
+            .set("Content-Type", "application/ld+json")
+            // Must stringify manually; supertest's .send(object) would override Content-Type to application/json
+            .send(JSON.stringify({ "@context": "http://example.org" }))
         expect(response.statusCode).toBe(200)
-        expect(response.body.received.test).toBe("put-data")
+        expect(response.body.received["@context"]).toBe("http://example.org")
     })
 
-    it("returns 415 for text/plain on PUT endpoint", async () => {
+    it("accepts text/plain", async () => {
         const response = await request(routeTester)
-            .put("/api/update")
+            .post("/either-endpoint")
             .set("Content-Type", "text/plain")
-            .send("some text")
+            .send("search terms")
+        expect(response.statusCode).toBe(200)
+        expect(response.body.received).toBe("search terms")
+    })
+
+    it("returns 415 for missing Content-Type", async () => {
+        const response = await request(routeTester)
+            .post("/either-endpoint")
+            .unset("Content-Type")
+            .send(Buffer.from("hello"))
         expect(response.statusCode).toBe(415)
-        expect(response.text).toContain("Unsupported Content-Type")
+        expect(response.text).toContain("Missing or empty Content-Type header")
     })
 
-    it("returns 415 for comma-separated multiple Content-Type values", async () => {
+    it("returns 415 for application/xml", async () => {
         const response = await request(routeTester)
-            .post("/api/create")
-            .set("Content-Type", "application/json, text/plain")
-            .send('{"test":"data"}')
+            .post("/either-endpoint")
+            .set("Content-Type", "application/xml")
+            .send("<root/>")
         expect(response.statusCode).toBe(415)
-        expect(response.text).toContain("Multiple Content-Type values are not allowed")
+        expect(response.text).toContain("Unsupported Content-Type")
     })
 
-    it("returns 415 for valid type smuggled via comma after charset", async () => {
+    it("returns 415 for comma-separated multiple Content-Type values", async () => {
         const response = await request(routeTester)
-            .post("/api/create")
-            .set("Content-Type", "application/json; charset=utf-8, text/plain")
+            .post("/either-endpoint")
+            .set("Content-Type", "application/json, text/plain")
             .send('{"test":"data"}')
         expect(response.statusCode).toBe(415)
         expect(response.text).toContain("Multiple Content-Type values are not allowed")
     })
-
 })

routes/bulkCreate.js

@@ -5,10 +5,10 @@ const router = express.Router()
 //This controller will handle all MongoDB interactions.
 import controller from '../db-controller.js'
 import auth from '../auth/index.js'
-import { jsonContent } from '../rest.js'
+import rest from '../rest.js'
 
 router.route('/')
-    .post(auth.checkJwt, jsonContent, controller.bulkCreate)
+    .post(auth.checkJwt, rest.jsonContent, controller.bulkCreate)
     .all((req, res, next) => {
         res.statusMessage = 'Improper request method for creating, please use POST.'
         res.status(405)

routes/bulkUpdate.js

@@ -5,10 +5,10 @@ const router = express.Router()
 //This controller will handle all MongoDB interactions.
 import controller from '../db-controller.js'
 import auth from '../auth/index.js'
-import { jsonContent } from '../rest.js'
+import rest from '../rest.js'
 
 router.route('/')
-    .put(auth.checkJwt, jsonContent, controller.bulkUpdate)
+    .put(auth.checkJwt, rest.jsonContent, controller.bulkUpdate)
     .all((req, res, next) => {
         res.statusMessage = 'Improper request method for creating, please use PUT.'
         res.status(405)

routes/create.js

@@ -4,10 +4,10 @@ const router = express.Router()
 //This controller will handle all MongoDB interactions.
 import controller from '../db-controller.js'
 import auth from '../auth/index.js'
-import { jsonContent } from '../rest.js'
+import rest from '../rest.js'
 
 router.route('/')
-    .post(auth.checkJwt, jsonContent, controller.create)
+    .post(auth.checkJwt, rest.jsonContent, controller.create)
     .all((req, res, next) => {
         res.statusMessage = 'Improper request method for creating, please use POST.'
         res.status(405)