test(error): assert problem+json error responses

NeaByteLab · NeaByteLab · commit 9f0cb9abfbfa · 2026-06-16T22:04:12.000+07:00
- Add Handler problemDetails and safeReasons coverage
- Sort Error and Handler test cases A-Z by name
- Update JSON error assertions to problem+json title, status, instance
diff --git a/tests/core/API.test.ts b/tests/core/API.test.ts
@@ -48,7 +48,7 @@ Deno.test('Handler produces a genuine Response when globalThis.Response is patch
     assertEquals(html.headers.get('content-type'), 'text/html; charset=utf-8')
     assertEquals(json instanceof realResponse, true)
     assertEquals(json.status, 404)
-    assertEquals(json.headers.get('content-type'), 'application/json')
+    assertEquals(json.headers.get('content-type'), 'application/problem+json')
   } finally {
     ;(globalThis as unknown as { Response: unknown }).Response = realResponse
   }
diff --git a/tests/core/Error.test.ts b/tests/core/Error.test.ts
@@ -12,8 +12,8 @@ Deno.test('Error#buildResponse 500 does not leak error message', async () => {
     new globalThis.Error('Connection to ************************ failed'),
     null
   )
-  const body = (await res.json()) as { error: string }
-  assertEquals(body.error, 'Internal Server Error')
+  const body = (await res.json()) as { title: string }
+  assertEquals(body.title, 'Internal Server Error')
   assertEquals(JSON.stringify(body).includes('password'), false)
 })
 
@@ -40,9 +40,9 @@ Deno.test('Error#buildResponse preserves security headers when errorMiddleware r
   )
   assertEquals(res.status, 500)
   assertEquals(res.headers.get('X-Content-Type-Options'), 'nosniff')
-  assertEquals(res.headers.get('Content-Type'), 'application/json')
-  const body = (await res.json()) as { error: string }
-  assertEquals(body.error, 'Internal Server Error')
+  assertEquals(res.headers.get('Content-Type'), 'application/problem+json')
+  const body = (await res.json()) as { title: string }
+  assertEquals(body.title, 'Internal Server Error')
 })
 
 Deno.test('Error#buildResponse uses generic message for unmapped 418 status', async () => {
@@ -56,9 +56,9 @@ Deno.test('Error#buildResponse uses generic message for unmapped 418 status', as
     new globalThis.Error('secret internal detail'),
     null
   )
-  const body = (await res.json()) as { error: string; statusCode: number }
-  assertEquals(body.error, 'Bad Request')
-  assertEquals(body.statusCode, 418)
+  const body = (await res.json()) as { title: string; status: number }
+  assertEquals(body.title, 'Bad Request')
+  assertEquals(body.status, 418)
 })
 
 Deno.test('Error#buildResponse uses generic message for unmapped 599 status', async () => {
@@ -72,8 +72,8 @@ Deno.test('Error#buildResponse uses generic message for unmapped 599 status', as
     new globalThis.Error('db password leaked'),
     null
   )
-  const body = (await res.json()) as { error: string }
-  assertEquals(body.error, 'Internal Server Error')
+  const body = (await res.json()) as { title: string }
+  assertEquals(body.title, 'Internal Server Error')
 })
 
 Deno.test('Error#buildResponse with errorMiddleware receives correct error info', async () => {
@@ -114,8 +114,8 @@ Deno.test('Error#buildResponse with errorMiddleware returning null uses default'
     async () => null
   )
   assertEquals(res.status, 502)
-  const body = (await res.json()) as { error: string }
-  assertEquals(body.error, 'Bad Gateway')
+  const body = (await res.json()) as { title: string }
+  assertEquals(body.title, 'Bad Gateway')
 })
 
 Deno.test('Error#buildResponse with errorMiddleware returning response uses it', async () => {
@@ -147,9 +147,9 @@ Deno.test('Error#buildResponse with errorMiddleware returns non-Response falls t
       async () => ret as never
     )
     assertEquals(res.status, 500)
-    assertEquals(res.headers.get('Content-Type'), 'application/json')
-    const body = (await res.json()) as { error: string }
-    assertEquals(body.error, 'Internal Server Error')
+    assertEquals(res.headers.get('Content-Type'), 'application/problem+json')
+    const body = (await res.json()) as { title: string }
+    assertEquals(body.title, 'Internal Server Error')
   }
 })
 
@@ -175,8 +175,8 @@ Deno.test('Error#buildResponse with sync errorMiddleware returning null', async
   const ctx = new Core.Context(request, new URL('http://localhost/'), {})
   const res = await Core.Handler.buildResponse(ctx, 500, new globalThis.Error('fail'), () => null)
   assertEquals(res.status, 500)
-  const body = (await res.json()) as { error: string }
-  assertEquals(body.error, 'Internal Server Error')
+  const body = (await res.json()) as { title: string }
+  assertEquals(body.title, 'Internal Server Error')
 })
 
 Deno.test('Error#buildResponse without errorMiddleware returns JSON when Accept json', async () => {
@@ -186,11 +186,11 @@ Deno.test('Error#buildResponse without errorMiddleware returns JSON when Accept
   const ctx = new Core.Context(request, new URL('http://localhost/foo'), {})
   const res = await Core.Handler.buildResponse(ctx, 404, new globalThis.Error('gone'), null)
   assertEquals(res.status, 404)
-  assertEquals(res.headers.get('Content-Type'), 'application/json')
-  const body = (await res.json()) as { error: string; path: string; statusCode: number }
-  assertEquals(body.error, 'Not Found')
-  assertEquals(body.path, '/foo')
-  assertEquals(body.statusCode, 404)
+  assertEquals(res.headers.get('Content-Type'), 'application/problem+json')
+  const body = (await res.json()) as { title: string; instance: string; status: number }
+  assertEquals(body.title, 'Not Found')
+  assertEquals(body.instance, '/foo')
+  assertEquals(body.status, 404)
 })
 
 Deno.test('Error#defaultErrorHtml escapes quotes and apostrophes in message', () => {
@@ -229,10 +229,10 @@ Deno.test('Error#errorResponse falls back to a hardened JSON response when heade
   ;(ctx as unknown as { responseHeaders: Record<string, string> }).responseHeaders['Inva lid'] = 'x'
   const res = Core.Handler.errorResponse(ctx, 500)
   assertEquals(res.status, 500)
-  assertEquals(res.headers.get('Content-Type'), 'application/json')
+  assertEquals(res.headers.get('Content-Type'), 'application/problem+json')
   assertEquals(res.headers.get('X-Content-Type-Options'), 'nosniff')
-  const body = (await res.json()) as { error: string }
-  assertEquals(body.error, 'Internal Server Error')
+  const body = (await res.json()) as { title: string }
+  assertEquals(body.title, 'Internal Server Error')
 })
 
 Deno.test('Error#escapeHtml escapes &, <, >, ", \'', () => {
@@ -306,3 +306,42 @@ Deno.test('Error#extractError wraps a non-error value as 500', () => {
   assertEquals(result.error instanceof globalThis.Error, true)
   assertEquals(result.error.message, 'plain string failure')
 })
+
+Deno.test('Error#handleError omits errors when error has no structured cause', async () => {
+  const request = new Request('http://localhost/x', {
+    headers: new Headers({ Accept: 'application/json' })
+  })
+  const ctx = new Core.Context(request, new URL('http://localhost/x'), {})
+  const res = await ctx.handleError(500, new globalThis.Error('boom'))
+  assertEquals(res.status, 500)
+  const body = (await res.json()) as { title: string; errors?: string[] }
+  assertEquals(body.title, 'Internal Server Error')
+  assertEquals('errors' in body, false)
+})
+
+Deno.test('Error#handleError surfaces validation reasons as problem+json errors', async () => {
+  const request = new Request('http://localhost/users', {
+    headers: new Headers({ Accept: 'application/json' })
+  })
+  const ctx = new Core.Context(request, new URL('http://localhost/users'), {})
+  const validationError = Core.Handler.createStatusError(422, 'name must not be empty')
+  Object.defineProperty(validationError, 'cause', {
+    value: ['name must not be empty', 'email must contain @'],
+    enumerable: false
+  })
+  const res = await ctx.handleError(422, validationError)
+  assertEquals(res.status, 422)
+  assertEquals(res.headers.get('Content-Type'), 'application/problem+json')
+  const body = (await res.json()) as {
+    type: string
+    title: string
+    status: number
+    instance: string
+    errors: string[]
+  }
+  assertEquals(body.type, 'about:blank')
+  assertEquals(body.title, 'Unprocessable Entity')
+  assertEquals(body.status, 422)
+  assertEquals(body.instance, '/users')
+  assertEquals(body.errors, ['name must not be empty', 'email must contain @'])
+})
diff --git a/tests/core/Handler.test.ts b/tests/core/Handler.test.ts
@@ -58,6 +58,35 @@ Deno.test('Handler#isDirectory returns true for an existing directory', () => {
   assertEquals(Core.Handler.isDirectory(dirPath), true)
 })
 
+Deno.test('Handler#problemDetails builds an RFC 9457 body with instance', () => {
+  const body = Core.Handler.problemDetails(422, '/users')
+  assertEquals(body.type, 'about:blank')
+  assertEquals(body.title, 'Unprocessable Entity')
+  assertEquals(body.status, 422)
+  assertEquals(body.instance, '/users')
+})
+
+Deno.test('Handler#problemDetails includes errors extension when reasons exist', () => {
+  const body = Core.Handler.problemDetails(422, '/users', undefined, [
+    'name must not be empty',
+    'email must contain @'
+  ])
+  assertEquals(body.status, 422)
+  assertEquals(body.errors, ['name must not be empty', 'email must contain @'])
+})
+
+Deno.test('Handler#problemDetails omits errors when reasons are empty', () => {
+  const body = Core.Handler.problemDetails(422, '/users', undefined, [])
+  assertEquals('errors' in body, false)
+})
+
+Deno.test('Handler#problemDetails omits instance when pathname is undefined', () => {
+  const body = Core.Handler.problemDetails(500)
+  assertEquals(body.title, 'Internal Server Error')
+  assertEquals(body.status, 500)
+  assertEquals('instance' in body, false)
+})
+
 Deno.test('Handler#safeMessage falls back to Bad Request for an unmapped 4xx status', () => {
   assertEquals(Core.Handler.safeMessage(418), 'Bad Request')
 })
@@ -71,6 +100,31 @@ Deno.test('Handler#safeMessage returns the known message for a mapped status', (
   assertEquals(Core.Handler.safeMessage(500), 'Internal Server Error')
 })
 
+Deno.test('Handler#safeReasons does not leak cause from non-validation errors', () => {
+  const leaky = new Error('db failed', { cause: ['SECRET host=10.0.0.5', 'password'] })
+  assertEquals(Core.Handler.safeReasons(leaky), undefined)
+})
+
+Deno.test('Handler#safeReasons extracts string-array cause from a 422 status error', () => {
+  const error = Core.Handler.createStatusError(422, 'invalid')
+  Object.defineProperty(error, 'cause', { value: ['a', 'b'], enumerable: false })
+  assertEquals(Core.Handler.safeReasons(error), ['a', 'b'])
+})
+
+Deno.test('Handler#safeReasons ignores cause on non-422 status errors', () => {
+  const error = Core.Handler.createStatusError(400, 'bad')
+  Object.defineProperty(error, 'cause', { value: ['leak'], enumerable: false })
+  assertEquals(Core.Handler.safeReasons(error), undefined)
+})
+
+Deno.test('Handler#safeReasons returns undefined for null or non-array cause', () => {
+  assertEquals(Core.Handler.safeReasons(null), undefined)
+  assertEquals(Core.Handler.safeReasons(new Error('x')), undefined)
+  const plain = Core.Handler.createStatusError(422, 'x')
+  Object.defineProperty(plain, 'cause', { value: 'plain', enumerable: false })
+  assertEquals(Core.Handler.safeReasons(plain), undefined)
+})
+
 Deno.test('Handler#stateKey returns the raw key value', () => {
   const key: Types.StateKey<number> = Core.Handler.stateKey<number>('custom')
   assertEquals(key, 'custom')
@@ -97,3 +151,8 @@ Deno.test('Handler#wantsJson is true when Accept includes application/json', ()
   const headers = new Headers({ Accept: 'application/json, text/plain' })
   assertEquals(Core.Handler.wantsJson(headers), true)
 })
+
+Deno.test('Handler#wantsJson is true when Accept includes application/problem+json', () => {
+  const headers = new Headers({ Accept: 'application/problem+json' })
+  assertEquals(Core.Handler.wantsJson(headers), true)
+})
diff --git a/tests/routing/Handler.test.ts b/tests/routing/Handler.test.ts
@@ -29,9 +29,9 @@ Deno.test('Handler 404 for unmatched route returns JSON when Accept json', async
     })
   )
   assertEquals(res.status, 404)
-  assertEquals(res.headers.get('Content-Type'), 'application/json')
-  const body = (await res.json()) as { error: string }
-  assertEquals(body.error, 'Not Found')
+  assertEquals(res.headers.get('Content-Type'), 'application/problem+json')
+  const body = (await res.json()) as { title: string }
+  assertEquals(body.title, 'Not Found')
 })
 
 Deno.test('Handler 405 Allow advertises HEAD for a GET-only route (RFC 7231 §4.3.2)', async () => {
@@ -448,9 +448,9 @@ Deno.test('Handler masks a non-Response return as JSON Internal Server Error', a
   })
   const res = await handler.createHandler()(req)
   assertEquals(res.status, 500)
-  assertEquals(res.headers.get('Content-Type'), 'application/json')
-  const body = (await res.json()) as { error: string }
-  assertEquals(body.error, 'Internal Server Error')
+  assertEquals(res.headers.get('Content-Type'), 'application/problem+json')
+  const body = (await res.json()) as { title: string }
+  assertEquals(body.title, 'Internal Server Error')
 })
 
 Deno.test('Handler maxRouteParamLength returns 414 when exceeded', async () => {
@@ -526,8 +526,8 @@ Deno.test('Handler maxUrlLength 414 returns JSON when Accept json', async () =>
     })
   )
   assertEquals(res.status, 414)
-  const body = (await res.json()) as { error: string }
-  assertEquals(body.error, 'URI Too Long')
+  const body = (await res.json()) as { title: string }
+  assertEquals(body.title, 'URI Too Long')
 })
 
 Deno.test('Handler maxUrlLength returns 414 when exceeded', async () => {
@@ -1173,9 +1173,9 @@ Deno.test('Handler#handleResponse when errorMiddleware returns non-Response fall
   })
   const res = await handler.handleResponse(ctx, 500, new Error('boom'))
   assertEquals(res.status, 500)
-  const body = (await res.json()) as { error: string; path: string; statusCode: number }
-  assertEquals(body.statusCode, 500)
-  assertEquals(body.path, '/oops')
+  const body = (await res.json()) as { title: string; instance: string; status: number }
+  assertEquals(body.status, 500)
+  assertEquals(body.instance, '/oops')
 })
 
 Deno.test('Handler#handleResponse when errorMiddleware returns null uses default', async () => {
@@ -1186,9 +1186,9 @@ Deno.test('Handler#handleResponse when errorMiddleware returns null uses default
   })
   const res = await handler.handleResponse(ctx, 404, new Error('Not found'))
   assertEquals(res.status, 404)
-  const body = (await res.json()) as { error: string; path: string; statusCode: number }
-  assertEquals(body.statusCode, 404)
-  assertEquals(body.path, '/bar')
+  const body = (await res.json()) as { title: string; instance: string; status: number }
+  assertEquals(body.status, 404)
+  assertEquals(body.instance, '/bar')
 })
 
 Deno.test('Handler#handleResponse with Accept application/json returns JSON', async () => {
@@ -1198,11 +1198,11 @@ Deno.test('Handler#handleResponse with Accept application/json returns JSON', as
   })
   const res = await handler.handleResponse(ctx, 404, new Error('Not found'))
   assertEquals(res.status, 404)
-  assertEquals(res.headers.get('Content-Type'), 'application/json')
-  const responseBody = (await res.json()) as { error: string; path: string; statusCode: number }
-  assertEquals(responseBody.error, 'Not Found')
-  assertEquals(responseBody.path, '/foo')
-  assertEquals(responseBody.statusCode, 404)
+  assertEquals(res.headers.get('Content-Type'), 'application/problem+json')
+  const responseBody = (await res.json()) as { title: string; instance: string; status: number }
+  assertEquals(responseBody.title, 'Not Found')
+  assertEquals(responseBody.instance, '/foo')
+  assertEquals(responseBody.status, 404)
 })
 
 Deno.test('Handler#removeRoute for non-existent pattern does not throw', () => {

Original file line number	Diff line number	Diff line change
`@@ -48,7 +48,7 @@ Deno.test('Handler produces a genuine Response when globalThis.Response is patch`
`48`	`48`	`assertEquals(html.headers.get('content-type'), 'text/html; charset=utf-8')`
`49`	`49`	`assertEquals(json instanceof realResponse, true)`
`50`	`50`	`assertEquals(json.status, 404)`
`51`		`- assertEquals(json.headers.get('content-type'), 'application/json')`
	`51`	`+ assertEquals(json.headers.get('content-type'), 'application/problem+json')`
`52`	`52`	`} finally {`
`53`	`53`	`;(globalThis as unknown as { Response: unknown }).Response = realResponse`
`54`	`54`	`}`