test: cover registry auth scoping and dev server responses

Author: danielroe

packages/nuxt-cli/test/unit/dev/responses.spec.ts

@@ -5,11 +5,13 @@ import { describe, expect, it } from 'vitest'
 import{renderError}from'../../../src/dev/error'
 import{NuxtDevServer}from'../../../src/dev/utils'
 
-interfaceFakeResponseextendsServerResponse{
+interfaceFakeResponse{
 body: string
 statusCode: number
+headersSent: boolean
 headers: Record<string,string>
 finished: Promise<void>
+response: ServerResponse
 }
 
 functioncreateRequest(accept?: string,url='/'): IncomingMessage{
@@ -42,13 +44,17 @@ function createResponse(): FakeResponse {
 done()
 },
 }
-returnresasunknownasFakeResponse
+returnnewProxy(res,{
+get(target,key){
+returnkey==='response' ? target : Reflect.get(target,key)
+},
+})asunknownasFakeResponse
 }
 
 describe('renderError',()=>{
 it('should escape an error message in the html error page',async()=>{
 constres=createResponse()
-awaitrenderError(createRequest('text/html'),res,newError('<script>alert(1)</script>'))
+awaitrenderError(createRequest('text/html'),res.response,newError('<script>alert(1)</script>'))
 
 expect(res.statusCode).toBe(500)
 expect(res.headers['content-type']).toBe('text/html')
@@ -58,22 +64,22 @@ describe('renderError', () => {
 
 it('should escape a reflected request url in the html error page',async()=>{
 constres=createResponse()
-awaitrenderError(createRequest('text/html','/</script><script>alert(1)</script>'),res,newError('boom'))
+awaitrenderError(createRequest('text/html','/</script><script>alert(1)</script>'),res.response,newError('boom'))
 
 expect(res.body).not.toContain('<script>alert(1)</script>')
 })
 
 it('should answer a non-html client with json',async()=>{
 constres=createResponse()
-awaitrenderError(createRequest('application/json'),res,newError('boom'))
+awaitrenderError(createRequest('application/json'),res.response,newError('boom'))
 
 expect(res.headers['content-type']).toBe('application/json')
 expect(JSON.parse(res.body)).toMatchObject({error: true,status: 500,message: 'boom'})
 })
 
 it('should send hardening headers with the error page',async()=>{
 constres=createResponse()
-awaitrenderError(createRequest('text/html'),res,newError('boom'))
+awaitrenderError(createRequest('text/html'),res.response,newError('boom'))
 
 expect(res.headers).toMatchObject({
 'cache-control': 'no-store',
@@ -86,14 +92,14 @@ describe('renderError', () => {
 it('should not write a body once headers have been sent',async()=>{
 constres=createResponse()
 res.headersSent=true
-awaitrenderError(createRequest('text/html'),res,newError('boom'))
+awaitrenderError(createRequest('text/html'),res.response,newError('boom'))
 
 expect(res.body).toBe('')
 })
 
 it('should render a non-error rejection value',async()=>{
 constres=createResponse()
-awaitrenderError(createRequest('application/json'),res,'just a string')
+awaitrenderError(createRequest('application/json'),res.response,'just a string')
 
 expect(JSON.parse(res.body)).toMatchObject({status: 500,message: 'Unknown error'})
 })
@@ -108,7 +114,7 @@ describe('dev server loading screen', () => {
 constserver=createDevServer(({ loading })=>`<p>${loading}</p>`)
 constres=createResponse()
 
-server.handler(createRequest('text/html'),res)
+server.handler(createRequest('text/html'),resasunknownasServerResponse)
 awaitres.finished
 
 expect(res.statusCode).toBe(503)
@@ -120,7 +126,7 @@ describe('dev server loading screen', () => {
 constserver=createDevServer(()=>'<p>ignored</p>')
 constres=createResponse()
 
-server.handler(createRequest('application/json'),res)
+server.handler(createRequest('application/json'),resasunknownasServerResponse)
 awaitres.finished
 
 expect(res.statusCode).toBe(503)
@@ -131,7 +137,7 @@ describe('dev server loading screen', () => {
 constserver=createDevServer(()=>'loading')
 constres=createResponse()
 
-server.handler(createRequest('text/html'),res)
+server.handler(createRequest('text/html'),resasunknownasServerResponse)
 awaitres.finished
 
 expect(res.headers).toMatchObject({'cache-control': 'no-store','refresh': '3'})

packages/nuxt-cli/test/unit/utils/console.spec.ts

@@ -25,7 +25,7 @@ afterEach(() => {
 Object.defineProperty(stdin,key,descriptors[key])
 }
 else{
-delete(stdinasRecord<string,unknown>)[key]
+delete(stdinasunknownasRecord<string,unknown>)[key]
 }
 }
 })

packages/nuxt-cli/test/unit/utils/registry.spec.ts

@@ -83,3 +83,59 @@ describe('detectNpmRegistry', () => {
 expect(process.env.COREPACK_NPM_REGISTRY).toBeUndefined()
 })
 })
+
+describe('auth token scoping',()=>{
+asyncfunctionnpmrc(...lines: string[]): Promise<string>{
+constdirectory=awaitmkdtemp(join(tmpdir(),'nuxt-registry-'))
+directories.push(directory)
+awaitwriteFile(join(directory,'.npmrc'),lines.join('\n'))
+returndirectory
+}
+
+it('should not return a token registered for a different registry',async()=>{
+constdirectory=awaitnpmrc(
+'registry=https://registry.example.com/',
+'//registry.other.com/:_authToken=secret',
+)
+
+awaitexpect(detectNpmRegistry(null,directory)).resolves.toMatchObject({authToken: null})
+})
+
+it('should not return a token for a lookalike host',async()=>{
+constdirectory=awaitnpmrc(
+'registry=https://registry.example.com.evil.test/',
+'//registry.example.com/:_authToken=secret',
+)
+
+awaitexpect(detectNpmRegistry(null,directory)).resolves.toMatchObject({
+registry: 'https://registry.example.com.evil.test',
+authToken: null,
+})
+})
+
+it('should resolve the token of the scoped registry that is actually used',async()=>{
+constdirectory=awaitnpmrc(
+'registry=https://registry.example.com/',
+'@scope:registry=https://scoped.example.com/',
+'//registry.example.com/:_authToken=default-token',
+'//scoped.example.com/:_authToken=scoped-token',
+)
+
+awaitexpect(detectNpmRegistry('@scope',directory)).resolves.toEqual({
+registry: 'https://scoped.example.com',
+authToken: 'scoped-token',
+})
+})
+
+it('should prefer COREPACK_NPM_REGISTRY over the project npmrc',async()=>{
+constdirectory=awaitnpmrc('registry=https://registry.example.com/')
+process.env.COREPACK_NPM_REGISTRY='https://corepack.example.com/'
+
+try{
+awaitexpect(detectNpmRegistry(null,directory)).resolves.toMatchObject({registry: 'https://corepack.example.com'})
+}
+finally{
+deleteprocess.env.COREPACK_NPM_REGISTRY
+}
+})
+})