cli/packages/cli-kit/src/public/node/graphiql/utilities.test.ts at 99ac2708f2443d22ff4f4438ece2d00f7d8ba8b0 · Shopify/cli · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
import {filterCustomHeaders} from './utilities.js'
import {describe, expect, test} from 'vitest'

describe('filterCustomHeaders', () => {
  test('allows custom headers that are not blocked', () => {
    const headers = {
      'x-custom-header': 'custom-value',
      'x-another-header': 'another-value',
    }

    const result = filterCustomHeaders(headers)

    expect(result).toEqual({
      'x-custom-header': 'custom-value',
      'x-another-header': 'another-value',
    })
  })

  test('blocks hop-by-hop headers', () => {
    const headers = {
      connection: 'keep-alive',
      'keep-alive': 'timeout=5',
      'transfer-encoding': 'chunked',
      'x-custom-header': 'custom-value',
    }

    const result = filterCustomHeaders(headers)

    expect(result).toEqual({
      'x-custom-header': 'custom-value',
    })
  })

  test('blocks proxy-controlled headers', () => {
    const headers = {
      host: 'localhost:3000',
      'content-type': 'application/json',
      accept: 'application/json',
      'user-agent': 'Mozilla/5.0',
      authorization: 'Bearer token',
      cookie: 'session=abc',
      'x-shopify-access-token': 'secret-token',
      'x-custom-header': 'custom-value',
    }

    const result = filterCustomHeaders(headers)

    expect(result).toEqual({
      'x-custom-header': 'custom-value',
    })
  })

  test('blocks headers case-insensitively', () => {
    const headers = {
      Connection: 'keep-alive',
      HOST: 'localhost',
      'Content-Type': 'application/json',
      'X-Custom-Header': 'custom-value',
    }

    const result = filterCustomHeaders(headers)

    expect(result).toEqual({
      'X-Custom-Header': 'custom-value',
    })
  })

  test('filters out non-string header values', () => {
    const headers: {[key: string]: string | string[] | undefined} = {
      'x-custom-header': 'custom-value',
      'x-array-header': ['value1', 'value2'],
      'x-undefined-header': undefined,
    }

    const result = filterCustomHeaders(headers)

    expect(result).toEqual({
      'x-custom-header': 'custom-value',
    })
  })

  test('returns empty object when all headers are blocked', () => {
    const headers = {
      host: 'localhost',
      connection: 'keep-alive',
      'content-type': 'application/json',
    }

    const result = filterCustomHeaders(headers)

    expect(result).toEqual({})
  })

  test('returns empty object for empty input', () => {
    const result = filterCustomHeaders({})

    expect(result).toEqual({})
  })
})