|
| 1 | +// Exercise the fixture over real HTTP and save the observed evidence. |
| 2 | +import assert from "node:assert/strict"; |
| 3 | +import { mkdir, writeFile } from "node:fs/promises"; |
| 4 | +import type { AddressInfo } from "node:net"; |
| 5 | +import { dirname } from "node:path"; |
| 6 | +import { parseArgs } from "node:util"; |
| 7 | +import { createServer } from "./app.mjs"; |
| 8 | + |
| 9 | +type HttpResult = { |
| 10 | + status: number; |
| 11 | + body: { id?: string; owner?: string; amount?: number; error?: string }; |
| 12 | +}; |
| 13 | + |
| 14 | +async function main(): Promise<number> { |
| 15 | + let output: string; |
| 16 | + try { |
| 17 | + const { values } = parseArgs({ |
| 18 | + options: { |
| 19 | + output: { type: "string" }, |
| 20 | + help: { type: "boolean", short: "h" }, |
| 21 | + }, |
| 22 | + }); |
| 23 | + if (values.help) { |
| 24 | + console.log("Usage: node validate.mjs --output PATH"); |
| 25 | + return 0; |
| 26 | + } |
| 27 | + if (values.output === undefined) throw new Error("--output is required"); |
| 28 | + output = values.output; |
| 29 | + } catch (error) { |
| 30 | + console.error((error as Error).message); |
| 31 | + return 2; |
| 32 | + } |
| 33 | + |
| 34 | + const server = await createServer(); |
| 35 | + const baseUrl = `http://127.0.0.1:${(server.address() as AddressInfo).port}`; |
| 36 | + async function get(invoice: string, token?: string): Promise<HttpResult> { |
| 37 | + const response = await fetch(`${baseUrl}/invoices/${invoice}`, { |
| 38 | + headers: token === undefined ? {} : { Authorization: `Bearer ${token}` }, |
| 39 | + signal: AbortSignal.timeout(5_000), |
| 40 | + }); |
| 41 | + return { |
| 42 | + status: response.status, |
| 43 | + body: (await response.json()) as HttpResult["body"], |
| 44 | + }; |
| 45 | + } |
| 46 | + |
| 47 | + let evidence: { |
| 48 | + anonymous: HttpResult; |
| 49 | + own_invoice: HttpResult; |
| 50 | + other_invoice: HttpResult; |
| 51 | + cross_account_read: boolean; |
| 52 | + }; |
| 53 | + try { |
| 54 | + const anonymous = await get("1002"); |
| 55 | + const own_invoice = await get("1001", "demo-alice"); |
| 56 | + const other_invoice = await get("1002", "demo-alice"); |
| 57 | + assert.equal(anonymous.status, 401, "Authentication control failed"); |
| 58 | + assert.equal(own_invoice.status, 200, "Own-account control failed"); |
| 59 | + evidence = { |
| 60 | + anonymous, |
| 61 | + own_invoice, |
| 62 | + other_invoice, |
| 63 | + cross_account_read: |
| 64 | + other_invoice.status === 200 && other_invoice.body.owner === "bob", |
| 65 | + }; |
| 66 | + } finally { |
| 67 | + await new Promise<void>((resolve, reject) => { |
| 68 | + server.close((error) => (error ? reject(error) : resolve())); |
| 69 | + }); |
| 70 | + } |
| 71 | + |
| 72 | + const proof = { ...evidence, server_stopped: true }; |
| 73 | + await mkdir(dirname(output), { recursive: true }); |
| 74 | + await writeFile(output, `${JSON.stringify(proof, null, 2)}\n`, "utf8"); |
| 75 | + console.log(JSON.stringify(proof)); |
| 76 | + return 0; |
| 77 | +} |
| 78 | + |
| 79 | +process.exitCode = await main(); |
0 commit comments