gerbeur/api/test/main.test.ts

import { BASE_URL, get, request, test } from "./helpers.ts";
import { assertEquals } from "@std/assert";

test("CORS: allowed origins get the headers, others don't", async () => {
  const allowed = await get("/api/categories", {
    headers: { Origin: "http://allowed.test" },
  });
  assertEquals(
    allowed.headers.get("access-control-allow-origin"),
    "http://allowed.test",
  );
  // The public URL is always allowed.
  const self = await get("/api/categories", { headers: { Origin: BASE_URL } });
  assertEquals(self.headers.get("access-control-allow-origin"), BASE_URL);
  const evil = await get("/api/categories", {
    headers: { Origin: "http://evil.test" },
  });
  assertEquals(evil.status, 200);
  assertEquals(evil.headers.get("access-control-allow-origin"), null);

  const preflight = await request("OPTIONS", "/api/dumps", {
    headers: {
      Origin: "http://allowed.test",
      "Access-Control-Request-Method": "POST",
      "Access-Control-Request-Headers": "authorization,content-type",
    },
  });
  assertEquals(preflight.status, 204);
  assertEquals(
    preflight.headers.get("access-control-allow-origin"),
    "http://allowed.test",
  );
});