ekklesiaandClaude Sonnet 5
d3c6bd73d3
Add a single platform-owned request-body policy (hono/body-limit) with small, named limits for Better Auth and Core's grant-mutation endpoint, and a new required maxBodyBytes field on the executable module route contract so every module route makes a conscious no-body-or-bounded-body choice, capped at a platform ceiling. Every oversized request gets one sanitized 413 contract and never reaches business logic, authorization, or a handler. Also configure finite Node header/request/keep-alive timeouts, including the non-obvious connectionsCheckingInterval needed for them to take effect promptly, so a slow-header or slow-body connection cannot hold a socket indefinitely. Co-Authored-By: Claude Sonnet 5 <[email protected]>
71 lines
2.0 KiB
TypeScript
71 lines
2.0 KiB
TypeScript
import { describe, expect, it, vi } from "vitest";
|
|
import {
|
|
defineModuleRuntime,
|
|
isModuleHttpMethod,
|
|
MODULE_HTTP_METHODS,
|
|
type ModuleHttpRouteRegistrar,
|
|
type ModuleRegistrationContext,
|
|
} from "../src/index.js";
|
|
|
|
describe("defineModuleRuntime", () => {
|
|
it("defines a frozen server runtime without duplicating the static manifest", async () => {
|
|
const start = vi.fn();
|
|
const runtime = defineModuleRuntime({
|
|
id: "example",
|
|
start,
|
|
version: "0.1.0",
|
|
});
|
|
|
|
expect(runtime).toEqual({ id: "example", start, version: "0.1.0" });
|
|
expect(Object.isFrozen(runtime)).toBe(true);
|
|
});
|
|
|
|
it("rejects invalid runtime definitions", () => {
|
|
expect(() =>
|
|
defineModuleRuntime({
|
|
id: "Not Valid",
|
|
version: "0.1.0",
|
|
}),
|
|
).toThrow("Invalid Ekklesia module runtime definition.");
|
|
});
|
|
|
|
it("re-exports the module-http contract so a module's register hook can declare routes", async () => {
|
|
expect(MODULE_HTTP_METHODS).toContain("GET");
|
|
expect(isModuleHttpMethod("GET")).toBe(true);
|
|
expect(isModuleHttpMethod("get")).toBe(false);
|
|
|
|
const registeredRoutes: unknown[] = [];
|
|
const http: ModuleHttpRouteRegistrar = {
|
|
route: (definition) => {
|
|
registeredRoutes.push(definition);
|
|
},
|
|
};
|
|
const runtime = defineModuleRuntime({
|
|
id: "example",
|
|
version: "0.1.0",
|
|
register({ http: registrar }) {
|
|
registrar.route({
|
|
method: "GET",
|
|
path: "/records",
|
|
permission: "example.records.read",
|
|
maxBodyBytes: 0,
|
|
handler: () => new Response(null, { status: 204 }),
|
|
});
|
|
},
|
|
});
|
|
|
|
const context: ModuleRegistrationContext = {
|
|
capabilities: {
|
|
provide: () => undefined,
|
|
resolve: () => undefined,
|
|
},
|
|
http,
|
|
moduleId: "example",
|
|
};
|
|
await runtime.register?.(context);
|
|
|
|
expect(registeredRoutes).toHaveLength(1);
|
|
expect(registeredRoutes[0]).toMatchObject({ method: "GET", path: "/records" });
|
|
});
|
|
});
|