691fa09b0f
- POST /api/__site__/cache/purge, its library and the site config plugin moved from vue-journal-layer with the same contract (token rules, 404 for proxied requests unless allowProxied, deprecated siteCache names); the route also clears the resolve cache - server/plugins/seo-cache-purge.ts clears the SEO caches after any 200 purge, so an app whose journal, menu or FAQ layer copy of the route wins keeps fresh SEO answers until those copies are removed - cachePurge and siteCache runtime keys; /api/__site__/** never cached - testing/purge-check.mjs (CMS answer change, plus a redirect added for a route-cached page applying at once) and purge-token-check.mjs
486 lines
25 KiB
TypeScript
486 lines
25 KiB
TypeScript
// Shared site cache purge: route authorization, the route-cache purge, the
|
|
// purge body parsing, the purge settings under their new and deprecated
|
|
// names, the site config stripping plugin, the pinned hashes of the shared
|
|
// files and the clearing of the SEO layer's caches.
|
|
import { test } from 'node:test'
|
|
import assert from 'node:assert/strict'
|
|
import { createHash } from 'node:crypto'
|
|
import { readFileSync } from 'node:fs'
|
|
import {
|
|
MIN_SITE_PURGE_TOKEN_LENGTH,
|
|
SITE_CONFIG_PURGE_KEYS,
|
|
SITE_PURGE_WARNED,
|
|
SITE_ROUTE_CACHE_BASE,
|
|
authorizeSitePurge,
|
|
parseSitePurgeEvent,
|
|
purgeSiteRouteCache,
|
|
redactSiteConfigStack,
|
|
resolveSitePurgeConfig,
|
|
sitePurgeDeprecationMessage,
|
|
} from '../server/lib/siteCachePurge.ts'
|
|
|
|
// The sha256 of the three shared files. The library and the plugin are the
|
|
// bytes vue-journal-layer, vue-menu-layer and vue-faq-layer ship; the route
|
|
// is theirs plus the clearing of the SEO caches (they drop their copies once
|
|
// they extend this layer).
|
|
const SHARED_LIB_SHA256 = 'da5e588b94de6a07f99f203d51cc953f497af886d0fad03709d67064a7b09b2a'
|
|
const SHARED_ROUTE_SHA256 = 'e08f7eee149fed49f3f32ec7d91c19cd25d75938a0ce80f92bdb69ddc7697eba'
|
|
const SHARED_PLUGIN_SHA256 = 'bd4e00888d3121ae9b07cf4f8e130dd54a4fc575ca0b42771d744c36949633a6'
|
|
|
|
const TOKEN = 'a'.repeat(MIN_SITE_PURGE_TOKEN_LENGTH)
|
|
|
|
function sha256(relative: string): string {
|
|
return createHash('sha256').update(readFileSync(new URL(relative, import.meta.url))).digest('hex')
|
|
}
|
|
|
|
test('sitePurge: the shared files match the pinned hashes', () => {
|
|
assert.equal(sha256('../server/lib/siteCachePurge.ts'), SHARED_LIB_SHA256, 'server/lib/siteCachePurge.ts')
|
|
assert.equal(sha256('../server/api/__site__/cache/purge.post.ts'), SHARED_ROUTE_SHA256, 'server/api/__site__/cache/purge.post.ts')
|
|
assert.equal(sha256('../server/plugins/site-cache-purge.ts'), SHARED_PLUGIN_SHA256, 'server/plugins/site-cache-purge.ts')
|
|
})
|
|
|
|
test('sitePurge: a missing or short token disables the route', () => {
|
|
for (const token of [undefined, null, '', 'short', 'b'.repeat(MIN_SITE_PURGE_TOKEN_LENGTH - 1), 12345678901234567890, {}]) {
|
|
assert.equal(authorizeSitePurge({ token, authorization: `Bearer ${String(token)}`, proxied: false }), 'disabled', `token ${JSON.stringify(token)}`)
|
|
}
|
|
assert.equal(authorizeSitePurge({ token: '', authorization: 'Bearer x', proxied: true }), 'disabled')
|
|
assert.equal(MIN_SITE_PURGE_TOKEN_LENGTH, 32)
|
|
})
|
|
|
|
test('sitePurge: a proxied request is refused before the token is checked', () => {
|
|
assert.equal(authorizeSitePurge({ token: TOKEN, authorization: `Bearer ${TOKEN}`, proxied: true }), 'proxied')
|
|
assert.equal(authorizeSitePurge({ token: TOKEN, authorization: null, proxied: true }), 'proxied')
|
|
})
|
|
|
|
test('sitePurge: authorize ok with the token and unauthorized otherwise', () => {
|
|
assert.equal(authorizeSitePurge({ token: TOKEN, authorization: `Bearer ${TOKEN}`, proxied: false }), 'ok')
|
|
assert.equal(authorizeSitePurge({ token: TOKEN, authorization: `bearer ${TOKEN}`, proxied: false }), 'ok')
|
|
for (const authorization of [undefined, null, '', 'Bearer', `Basic ${TOKEN}`, `${TOKEN}`, `Bearer ${TOKEN}x`, `Bearer ${TOKEN.slice(1)}`, `Bearer ${TOKEN} extra`, 'Bearer ' + 'b'.repeat(32)]) {
|
|
assert.equal(authorizeSitePurge({ token: TOKEN, authorization, proxied: false }), 'unauthorized', `authorization ${JSON.stringify(authorization)}`)
|
|
}
|
|
})
|
|
|
|
/** A fake unstorage prefix storage over a plain key list. */
|
|
function fakeStorage(keys: string[]) {
|
|
const live = new Set(keys)
|
|
const removed: string[] = []
|
|
return {
|
|
removed,
|
|
live,
|
|
async getKeys(base?: string) {
|
|
return [...live].filter((k) => !base || k === base || k.startsWith(base + ':'))
|
|
},
|
|
async removeItem(key: string) {
|
|
live.delete(key)
|
|
removed.push(key)
|
|
},
|
|
}
|
|
}
|
|
|
|
test('sitePurge: purge removes only nitro:routes: keys', async () => {
|
|
const routes = [
|
|
`${SITE_ROUTE_CACHE_BASE}:_:faq.abc123.json`,
|
|
`${SITE_ROUTE_CACHE_BASE}:_:faq_payloadjson.def456.json`,
|
|
`${SITE_ROUTE_CACHE_BASE}:_:index.0a1b2c.json`,
|
|
]
|
|
const others = ['nitro:functions:_:faq.1.json', 'nitro:handlers:_:api.2.json', 'nitro:routesx:_:near.3.json', 'other:routes:_:x.json']
|
|
const storage = fakeStorage([...routes, ...others])
|
|
assert.equal(SITE_ROUTE_CACHE_BASE, 'nitro:routes')
|
|
assert.equal(await purgeSiteRouteCache(storage), routes.length)
|
|
assert.deepEqual([...storage.removed].sort(), [...routes].sort())
|
|
assert.deepEqual([...storage.live].sort(), [...others].sort())
|
|
assert.equal(await purgeSiteRouteCache(storage), 0)
|
|
})
|
|
|
|
test('sitePurge: purge event kinds and slugs', () => {
|
|
for (const kind of ['faq', 'menu', 'menu_entry', 'post', 'category']) {
|
|
assert.deepEqual(parseSitePurgeEvent({ kind, slug: 'x' }), { kind, slug: 'x' })
|
|
}
|
|
for (const kind of ['FAQ', 'menu-entry', 'a'.repeat(41), '', 7, null]) {
|
|
assert.deepEqual(parseSitePurgeEvent({ kind, slug: 'x' }), { kind: 'unknown', slug: 'x' }, JSON.stringify(kind))
|
|
}
|
|
assert.deepEqual(parseSitePurgeEvent({ kind: 'faq', slug: 'a\nb\r\tc\u0000d\u007fe\u0085f' }), { kind: 'faq', slug: 'abcdef' })
|
|
assert.equal(parseSitePurgeEvent({ kind: 'faq', slug: 'x'.repeat(500) }).slug.length, 200)
|
|
for (const body of [null, undefined, 'faq', 42, ['faq', 'x']]) {
|
|
assert.deepEqual(parseSitePurgeEvent(body), { kind: 'unknown', slug: '' }, JSON.stringify(body))
|
|
}
|
|
})
|
|
|
|
test('sitePurge: ok in constant time over sha256 digests, whatever the bearer length', () => {
|
|
// timingSafeEqual on raw strings throws on a length mismatch; over digests
|
|
// every length compares in constant time and answers unauthorized.
|
|
for (const length of [1, 31, 33, 64, 4096]) {
|
|
assert.equal(authorizeSitePurge({ token: TOKEN, authorization: `Bearer ${'a'.repeat(length)}`, proxied: false }), 'unauthorized', `length ${length}`)
|
|
}
|
|
const long = 'k'.repeat(200)
|
|
assert.equal(authorizeSitePurge({ token: long, authorization: `Bearer ${long}`, proxied: false }), 'ok')
|
|
assert.equal(authorizeSitePurge({ token: TOKEN, authorization: `Bearer\t${TOKEN}\t`, proxied: false }), 'ok')
|
|
assert.equal(authorizeSitePurge({ token: TOKEN, authorization: `BEARER ${TOKEN} `, proxied: false }), 'ok')
|
|
assert.equal(authorizeSitePurge({ token: TOKEN, authorization: ` Bearer ${TOKEN}`, proxied: false }), 'unauthorized')
|
|
assert.equal(authorizeSitePurge({ token: TOKEN, authorization: `Bearer ${TOKEN}\n`, proxied: false }), 'unauthorized')
|
|
})
|
|
|
|
test('sitePurge: purge works with a synchronous storage and skips the bare base key', async () => {
|
|
const live = new Set([`${SITE_ROUTE_CACHE_BASE}:_:a.json`, SITE_ROUTE_CACHE_BASE, 'nitro:other:_:b.json'])
|
|
const removed: string[] = []
|
|
const storage = {
|
|
getKeys: (base?: string) => [...live].filter((k) => !base || k === base || k.startsWith(base + ':')),
|
|
removeItem: (key: string) => {
|
|
live.delete(key)
|
|
removed.push(key)
|
|
},
|
|
}
|
|
assert.equal(await purgeSiteRouteCache(storage), 1)
|
|
assert.deepEqual(removed, [`${SITE_ROUTE_CACHE_BASE}:_:a.json`])
|
|
assert.ok(live.has(SITE_ROUTE_CACHE_BASE))
|
|
assert.equal(await purgeSiteRouteCache({ getKeys: () => [], removeItem: () => assert.fail('nothing to remove') }), 0)
|
|
})
|
|
|
|
test('sitePurge: purge event edge cases', () => {
|
|
assert.deepEqual(parseSitePurgeEvent({ kind: 'a'.repeat(40), slug: '' }), { kind: 'a'.repeat(40), slug: '' })
|
|
assert.deepEqual(parseSitePurgeEvent({ kind: 'faq' }), { kind: 'faq', slug: '' })
|
|
assert.deepEqual(parseSitePurgeEvent({ kind: 'faq', slug: 42 }), { kind: 'faq', slug: '' })
|
|
assert.deepEqual(parseSitePurgeEvent({ kind: 'post', slug: 'x', extra: 'ignored' }), { kind: 'post', slug: 'x' })
|
|
assert.equal(parseSitePurgeEvent({ kind: 'faq', slug: 'y'.repeat(200) }).slug.length, 200)
|
|
// Control characters are stripped before the cut.
|
|
const slug = '\u0001'.repeat(50) + 'z'.repeat(200)
|
|
assert.equal(parseSitePurgeEvent({ kind: 'faq', slug }).slug, 'z'.repeat(200))
|
|
assert.deepEqual(parseSitePurgeEvent({}), { kind: 'unknown', slug: '' })
|
|
})
|
|
|
|
/** One call of the shared route with Nitro's auto-imports stubbed. */
|
|
async function callRoute(opts: {
|
|
token?: unknown
|
|
allowProxied?: unknown
|
|
cachePurge?: { token?: unknown; allowProxied?: unknown }
|
|
headers?: Record<string, string>
|
|
body?: unknown
|
|
bodyError?: boolean
|
|
keys?: string[]
|
|
}) {
|
|
const responseHeaders: Record<string, string> = {}
|
|
const logs: string[] = []
|
|
const live = new Set(opts.keys ?? [])
|
|
const g = globalThis as Record<string, unknown>
|
|
g.defineEventHandler = (fn: unknown) => fn
|
|
g.setResponseHeader = (_e: unknown, name: string, value: string) => {
|
|
responseHeaders[name] = value
|
|
}
|
|
g.useRuntimeConfig = () => ({
|
|
siteCache: opts.token === undefined ? undefined : { purgeToken: opts.token, allowProxied: opts.allowProxied },
|
|
cachePurge: opts.cachePurge,
|
|
})
|
|
g.getRequestHeader = (_e: unknown, name: string) => opts.headers?.[name]
|
|
g.createError = (input: { statusCode: number; statusMessage: string }) => Object.assign(new Error(input.statusMessage), input)
|
|
g.readBody = async () => {
|
|
if (opts.bodyError) throw new Error('invalid JSON')
|
|
return opts.body
|
|
}
|
|
g.useStorage = (base: string) => {
|
|
assert.equal(base, 'cache')
|
|
return {
|
|
getKeys: async (prefix?: string) => [...live].filter((k) => !prefix || k.startsWith(prefix + ':')),
|
|
removeItem: async (key: string) => {
|
|
live.delete(key)
|
|
},
|
|
}
|
|
}
|
|
const info = console.info
|
|
console.info = (line: string) => {
|
|
logs.push(line)
|
|
}
|
|
try {
|
|
const route = (await import('../server/api/__site__/cache/purge.post.ts')).default as (e: unknown) => Promise<unknown>
|
|
try {
|
|
return { result: await route({}), status: 200, responseHeaders, logs, live }
|
|
} catch (err) {
|
|
return { result: undefined, status: (err as { statusCode?: number }).statusCode, responseHeaders, logs, live }
|
|
}
|
|
} finally {
|
|
console.info = info
|
|
}
|
|
}
|
|
|
|
test('sitePurge: route answers 404 when disabled or proxied and 401 for a wrong bearer', async () => {
|
|
const keys = [`${SITE_ROUTE_CACHE_BASE}:_:index.json`]
|
|
for (const token of [undefined, '', 'short']) {
|
|
const r = await callRoute({ token, headers: { authorization: `Bearer ${String(token)}` }, keys })
|
|
assert.equal(r.status, 404, `token ${JSON.stringify(token)}`)
|
|
assert.equal(r.live.size, 1)
|
|
}
|
|
for (const name of ['x-forwarded-for', 'x-real-ip', 'forwarded']) {
|
|
const r = await callRoute({ token: TOKEN, headers: { authorization: `Bearer ${TOKEN}`, [name]: '203.0.113.9' }, keys })
|
|
assert.equal(r.status, 404, name)
|
|
assert.equal(r.live.size, 1)
|
|
}
|
|
for (const authorization of [undefined, 'Bearer wrong', `Basic ${TOKEN}`]) {
|
|
const r = await callRoute({ token: TOKEN, headers: authorization ? { authorization } : {}, keys })
|
|
assert.equal(r.status, 401, String(authorization))
|
|
assert.equal(r.live.size, 1)
|
|
assert.equal(r.responseHeaders['cache-control'], 'no-store')
|
|
}
|
|
})
|
|
|
|
test('sitePurge: route purges, answers the count and logs kind and slug only', async () => {
|
|
const keys = [`${SITE_ROUTE_CACHE_BASE}:_:index.json`, `${SITE_ROUTE_CACHE_BASE}:_:faq.json`, 'nitro:functions:_:x.json']
|
|
const r = await callRoute({ token: TOKEN, headers: { authorization: `Bearer ${TOKEN}` }, body: { kind: 'faq', slug: 'ship\nping' }, keys })
|
|
assert.equal(r.status, 200)
|
|
assert.deepEqual(r.result, { purged: 2 })
|
|
assert.deepEqual([...r.live], ['nitro:functions:_:x.json'])
|
|
assert.equal(r.responseHeaders['cache-control'], 'no-store')
|
|
assert.deepEqual(r.logs, ['[site-cache] purge: removed 2 route cache entries (faq shipping)'])
|
|
assert.ok(!r.logs.join('').includes(TOKEN))
|
|
|
|
const bad = await callRoute({ token: TOKEN, headers: { authorization: `Bearer ${TOKEN}` }, bodyError: true, keys: [] })
|
|
assert.equal(bad.status, 200)
|
|
assert.deepEqual(bad.result, { purged: 0 })
|
|
assert.deepEqual(bad.logs, ['[site-cache] purge: removed 0 route cache entries (unknown )'])
|
|
})
|
|
|
|
test('sitePurge: allowProxied lets a proxied request reach the token check', () => {
|
|
assert.equal(authorizeSitePurge({ token: TOKEN, authorization: `Bearer ${TOKEN}`, proxied: true, allowProxied: true }), 'ok')
|
|
assert.equal(authorizeSitePurge({ token: TOKEN, authorization: 'Bearer ' + 'b'.repeat(32), proxied: true, allowProxied: true }), 'unauthorized')
|
|
assert.equal(authorizeSitePurge({ token: TOKEN, authorization: null, proxied: true, allowProxied: true }), 'unauthorized')
|
|
assert.equal(authorizeSitePurge({ token: 'short', authorization: 'Bearer short', proxied: true, allowProxied: true }), 'disabled')
|
|
assert.equal(authorizeSitePurge({ token: '', authorization: 'Bearer x', proxied: true, allowProxied: true }), 'disabled')
|
|
// Without the flag, or with anything but true, a proxied request stays refused.
|
|
assert.equal(authorizeSitePurge({ token: TOKEN, authorization: `Bearer ${TOKEN}`, proxied: true, allowProxied: false }), 'proxied')
|
|
assert.equal(authorizeSitePurge({ token: TOKEN, authorization: `Bearer ${TOKEN}`, proxied: true }), 'proxied')
|
|
})
|
|
|
|
test('sitePurge: route accepts a proxied request with allowProxied and the right bearer', async () => {
|
|
const keys = [`${SITE_ROUTE_CACHE_BASE}:_:index.json`, `${SITE_ROUTE_CACHE_BASE}:_:faq.json`]
|
|
const headers = { authorization: `Bearer ${TOKEN}`, 'x-forwarded-for': '203.0.113.9', 'x-real-ip': '203.0.113.9', forwarded: 'for=203.0.113.9;proto=https' }
|
|
for (const allowProxied of [true, 'true']) {
|
|
const r = await callRoute({ token: TOKEN, allowProxied, headers, body: { kind: 'faq', slug: 'shipping' }, keys })
|
|
assert.equal(r.status, 200, `allowProxied ${JSON.stringify(allowProxied)}`)
|
|
assert.deepEqual(r.result, { purged: 2 })
|
|
assert.equal(r.live.size, 0)
|
|
}
|
|
const wrong = await callRoute({ token: TOKEN, allowProxied: true, headers: { ...headers, authorization: 'Bearer wrong' }, keys })
|
|
assert.equal(wrong.status, 401)
|
|
assert.equal(wrong.live.size, 2)
|
|
for (const allowProxied of [false, undefined, 'false', 1]) {
|
|
const r = await callRoute({ token: TOKEN, allowProxied, headers, keys })
|
|
assert.equal(r.status, 404, `allowProxied ${JSON.stringify(allowProxied)}`)
|
|
assert.equal(r.live.size, 2)
|
|
}
|
|
})
|
|
|
|
test('sitePurge: resolve config prefers a non-empty new token over the deprecated one', () => {
|
|
const A = 'n'.repeat(MIN_SITE_PURGE_TOKEN_LENGTH)
|
|
const B = 'o'.repeat(MIN_SITE_PURGE_TOKEN_LENGTH)
|
|
assert.deepEqual(resolveSitePurgeConfig({ cachePurge: { token: A }, siteCache: { purgeToken: B } }), { token: A, allowProxied: false, deprecated: [] })
|
|
assert.deepEqual(resolveSitePurgeConfig({ cachePurge: { token: A, allowProxied: false }, siteCache: { purgeToken: '' } }), { token: A, allowProxied: false, deprecated: [] })
|
|
assert.deepEqual(resolveSitePurgeConfig({ cachePurge: { token: '' }, siteCache: { purgeToken: B } }), { token: B, allowProxied: false, deprecated: ['token'] })
|
|
assert.deepEqual(resolveSitePurgeConfig({ siteCache: { purgeToken: B } }), { token: B, allowProxied: false, deprecated: ['token'] })
|
|
assert.deepEqual(resolveSitePurgeConfig({ cachePurge: null, siteCache: { purgeToken: B } }), { token: B, allowProxied: false, deprecated: ['token'] })
|
|
assert.deepEqual(resolveSitePurgeConfig({ cachePurge: { token: '' }, siteCache: { purgeToken: '' } }), { token: '', allowProxied: false, deprecated: [] })
|
|
})
|
|
|
|
test('sitePurge: resolve config turns allowProxied on for either flag, true or "true" only', () => {
|
|
for (const value of [true, 'true']) {
|
|
assert.deepEqual(resolveSitePurgeConfig({ cachePurge: { allowProxied: value } }).allowProxied, true, `new ${JSON.stringify(value)}`)
|
|
assert.deepEqual(resolveSitePurgeConfig({ cachePurge: { allowProxied: value } }).deprecated, [])
|
|
const old = resolveSitePurgeConfig({ siteCache: { allowProxied: value } })
|
|
assert.equal(old.allowProxied, true, `old ${JSON.stringify(value)}`)
|
|
assert.deepEqual(old.deprecated, ['allowProxied'])
|
|
// The new flag on: the old one is not counted as in use.
|
|
assert.deepEqual(resolveSitePurgeConfig({ cachePurge: { allowProxied: value }, siteCache: { allowProxied: value } }).deprecated, [])
|
|
}
|
|
for (const value of [false, undefined, 'false', 1, null, 'TRUE']) {
|
|
const r = resolveSitePurgeConfig({ cachePurge: { allowProxied: value }, siteCache: { allowProxied: value } })
|
|
assert.equal(r.allowProxied, false, JSON.stringify(value))
|
|
assert.deepEqual(r.deprecated, [])
|
|
}
|
|
const B = 'o'.repeat(MIN_SITE_PURGE_TOKEN_LENGTH)
|
|
assert.deepEqual(resolveSitePurgeConfig({ siteCache: { purgeToken: B, allowProxied: 'true' } }).deprecated, ['token', 'allowProxied'])
|
|
})
|
|
|
|
test('sitePurge: resolve config tolerates a missing or malformed config', () => {
|
|
for (const config of [undefined, null, 'x', 42, {}, { cachePurge: 'x', siteCache: 7 }]) {
|
|
assert.deepEqual(resolveSitePurgeConfig(config), { token: undefined, allowProxied: false, deprecated: [] }, JSON.stringify(config))
|
|
}
|
|
})
|
|
|
|
test('sitePurge: route reads the new token, falls back to the deprecated one, and the new one wins', async () => {
|
|
const keys = [`${SITE_ROUTE_CACHE_BASE}:_:index.json`]
|
|
const NEW = 'n'.repeat(MIN_SITE_PURGE_TOKEN_LENGTH)
|
|
const r = await callRoute({ cachePurge: { token: TOKEN }, headers: { authorization: `Bearer ${TOKEN}` }, keys })
|
|
assert.equal(r.status, 200)
|
|
assert.deepEqual(r.result, { purged: 1 })
|
|
const old = await callRoute({ token: TOKEN, cachePurge: { token: '' }, headers: { authorization: `Bearer ${TOKEN}` }, keys })
|
|
assert.equal(old.status, 200)
|
|
const both = { token: TOKEN, cachePurge: { token: NEW } }
|
|
assert.equal((await callRoute({ ...both, headers: { authorization: `Bearer ${NEW}` }, keys })).status, 200)
|
|
const refused = await callRoute({ ...both, headers: { authorization: `Bearer ${TOKEN}` }, keys })
|
|
assert.equal(refused.status, 401)
|
|
assert.equal(refused.live.size, 1)
|
|
const short = await callRoute({ cachePurge: { token: 'short' }, headers: { authorization: 'Bearer short' }, keys })
|
|
assert.equal(short.status, 404)
|
|
})
|
|
|
|
test('sitePurge: route lets a proxied request reach the token check with cachePurge.allowProxied', async () => {
|
|
const keys = [`${SITE_ROUTE_CACHE_BASE}:_:index.json`]
|
|
const headers = { authorization: `Bearer ${TOKEN}`, 'x-forwarded-for': '203.0.113.9' }
|
|
for (const allowProxied of [true, 'true']) {
|
|
const r = await callRoute({ cachePurge: { token: TOKEN, allowProxied }, headers, keys })
|
|
assert.equal(r.status, 200, `allowProxied ${JSON.stringify(allowProxied)}`)
|
|
const wrong = await callRoute({ cachePurge: { token: TOKEN, allowProxied }, headers: { ...headers, authorization: 'Bearer wrong' }, keys })
|
|
assert.equal(wrong.status, 401)
|
|
}
|
|
// The deprecated flag with the new token still opens it.
|
|
assert.equal((await callRoute({ token: '', allowProxied: true, cachePurge: { token: TOKEN }, headers, keys })).status, 200)
|
|
for (const allowProxied of [false, undefined, 'false', 1]) {
|
|
const r = await callRoute({ cachePurge: { token: TOKEN, allowProxied }, headers, keys })
|
|
assert.equal(r.status, 404, `allowProxied ${JSON.stringify(allowProxied)}`)
|
|
}
|
|
})
|
|
|
|
test('sitePurge: redactSiteConfigStack removes the purge keys from every stack entry', () => {
|
|
assert.deepEqual([...SITE_CONFIG_PURGE_KEYS], ['cachePurgeToken', 'cacheAllowProxied'])
|
|
const stack: Record<string, unknown>[] = [
|
|
{ url: 'https://acme.test', name: 'Acme', cachePurgeToken: TOKEN, cacheAllowProxied: 'true' },
|
|
{ _context: 'x' },
|
|
]
|
|
assert.equal(redactSiteConfigStack(stack), 2)
|
|
assert.deepEqual(stack, [{ url: 'https://acme.test', name: 'Acme' }, { _context: 'x' }])
|
|
assert.equal(redactSiteConfigStack(stack), 0)
|
|
const spread = [{ cachePurgeToken: TOKEN }, { cachePurgeToken: TOKEN, indexable: true }]
|
|
assert.equal(redactSiteConfigStack(spread), 2)
|
|
assert.deepEqual(spread, [{}, { indexable: true }])
|
|
for (const value of [undefined, null, 'stack', 7, {}, { cachePurgeToken: TOKEN }]) {
|
|
assert.equal(redactSiteConfigStack(value), 0, JSON.stringify(value))
|
|
}
|
|
assert.equal(redactSiteConfigStack([null, undefined, 'x', 3]), 0)
|
|
})
|
|
|
|
test('sitePurge: the deprecation message names variables, never a value', () => {
|
|
assert.equal(sitePurgeDeprecationMessage([]), '')
|
|
const token = sitePurgeDeprecationMessage(['token'])
|
|
assert.match(token, /^\[site-cache\] /)
|
|
assert.ok(token.includes('NUXT_SITE_CACHE_PURGE_TOKEN -> NUXT_CACHE_PURGE_TOKEN'))
|
|
assert.ok(!token.includes('NUXT_SITE_CACHE_ALLOW_PROXIED'))
|
|
assert.match(token, /rotate/)
|
|
assert.ok(!token.includes('\n'))
|
|
const both = sitePurgeDeprecationMessage(['token', 'allowProxied'])
|
|
assert.ok(both.includes('NUXT_SITE_CACHE_PURGE_TOKEN -> NUXT_CACHE_PURGE_TOKEN'))
|
|
assert.ok(both.includes('NUXT_SITE_CACHE_ALLOW_PROXIED -> NUXT_CACHE_PURGE_ALLOW_PROXIED'))
|
|
assert.ok(sitePurgeDeprecationMessage(['allowProxied']).includes('NUXT_CACHE_PURGE_ALLOW_PROXIED'))
|
|
})
|
|
|
|
type SiteConfigHook = (ctx: unknown) => void
|
|
|
|
/** Runs the shared Nitro plugin on a fake nitroApp with the given runtime config. */
|
|
async function runPlugin(config: unknown) {
|
|
const g = globalThis as Record<string, unknown>
|
|
g.defineNitroPlugin = (fn: unknown) => fn
|
|
g.useRuntimeConfig = () => config
|
|
const hooks: Record<string, SiteConfigHook[]> = {}
|
|
const nitroApp = {
|
|
hooks: {
|
|
hook(name: string, fn: SiteConfigHook) {
|
|
;(hooks[name] ??= []).push(fn)
|
|
},
|
|
},
|
|
}
|
|
const warnings: string[] = []
|
|
const warn = console.warn
|
|
console.warn = (line: string) => {
|
|
warnings.push(line)
|
|
}
|
|
try {
|
|
const plugin = (await import('../server/plugins/site-cache-purge.ts')).default as (app: unknown) => void
|
|
plugin(nitroApp)
|
|
} finally {
|
|
console.warn = warn
|
|
}
|
|
return { hooks, warnings }
|
|
}
|
|
|
|
function resetWarned() {
|
|
delete (globalThis as Record<symbol, unknown>)[SITE_PURGE_WARNED]
|
|
}
|
|
|
|
test('sitePurge: plugin strips the purge keys on site-config:init', async () => {
|
|
resetWarned()
|
|
const { hooks, warnings } = await runPlugin({ cachePurge: { token: TOKEN } })
|
|
assert.equal(hooks['site-config:init']?.length, 1)
|
|
assert.deepEqual(warnings, [])
|
|
const stack = [{ url: 'https://acme.test', cachePurgeToken: TOKEN, cacheAllowProxied: 'true' }, { _context: 'x' }]
|
|
hooks['site-config:init'][0]({ siteConfig: { stack }, event: {} })
|
|
assert.deepEqual(stack, [{ url: 'https://acme.test' }, { _context: 'x' }])
|
|
for (const ctx of [undefined, null, {}, { siteConfig: {} }, { siteConfig: { stack: 'x' } }]) {
|
|
hooks['site-config:init'][0](ctx)
|
|
}
|
|
resetWarned()
|
|
})
|
|
|
|
test('sitePurge: plugin warns once per process about a deprecated name, without the value', async () => {
|
|
resetWarned()
|
|
const config = { siteCache: { purgeToken: TOKEN, allowProxied: 'true' } }
|
|
const first = await runPlugin(config)
|
|
assert.equal(first.warnings.length, 1)
|
|
assert.ok(first.warnings[0].includes('NUXT_CACHE_PURGE_TOKEN'))
|
|
assert.ok(first.warnings[0].includes('NUXT_SITE_CACHE_PURGE_TOKEN'))
|
|
assert.ok(first.warnings[0].includes('NUXT_CACHE_PURGE_ALLOW_PROXIED'))
|
|
assert.ok(!first.warnings[0].includes(TOKEN))
|
|
// Another layer's copy of the plugin in the same process stays quiet.
|
|
const second = await runPlugin(config)
|
|
assert.deepEqual(second.warnings, [])
|
|
assert.equal(second.hooks['site-config:init']?.length, 1)
|
|
resetWarned()
|
|
|
|
const fresh = await runPlugin({ cachePurge: { token: TOKEN }, siteCache: { purgeToken: 'o'.repeat(MIN_SITE_PURGE_TOKEN_LENGTH) } })
|
|
assert.deepEqual(fresh.warnings, [], 'the new name wins: no warning')
|
|
const none = await runPlugin({})
|
|
assert.deepEqual(none.warnings, [])
|
|
resetWarned()
|
|
})
|
|
|
|
test('sitePurge: an authorized purge clears the resolve cache, a refused one does not', async () => {
|
|
const { resolveCached, seoCacheSizes } = await import('../server/lib/resolve.ts')
|
|
const g = globalThis as Record<string, unknown>
|
|
const fill = async () => {
|
|
g.useRuntimeConfig = () => ({ seo: { apiBase: 'http://backend.test/_seo/api/v1' }, public: { seo: { enabled: true } } })
|
|
g.$fetch = async () => ({ action: 'ok', status: 200, url: 'https://acme.test/x', locale: 'en', staging: false, seo: null })
|
|
const answer = await resolveCached({ context: {} } as never, '/x')
|
|
assert.equal(answer?.action, 'ok')
|
|
assert.equal(seoCacheSizes().resolve, 1)
|
|
}
|
|
await fill()
|
|
const refused = await callRoute({ token: TOKEN, headers: { authorization: 'Bearer wrong' }, keys: [] })
|
|
assert.equal(refused.status, 401)
|
|
assert.equal(seoCacheSizes().resolve, 1)
|
|
await fill()
|
|
const ok = await callRoute({ token: TOKEN, headers: { authorization: `Bearer ${TOKEN}` }, keys: [] })
|
|
assert.equal(ok.status, 200)
|
|
assert.equal(seoCacheSizes().resolve, 0)
|
|
})
|
|
|
|
test('sitePurge: the purge hook clears the SEO caches after a 200 purge answered by any layer', async () => {
|
|
const { resolveCached, seoCacheSizes } = await import('../server/lib/resolve.ts')
|
|
const g = globalThis as Record<string, unknown>
|
|
let hook: ((event: unknown) => void) | undefined
|
|
g.defineNitroPlugin = (fn: unknown) => fn
|
|
const plugin = (await import('../server/plugins/seo-cache-purge.ts')).default as unknown as (app: unknown) => void
|
|
plugin({ hooks: { hook: (_name: string, fn: (event: unknown) => void) => (hook = fn) } })
|
|
assert.ok(hook)
|
|
const fill = async () => {
|
|
g.useRuntimeConfig = () => ({ seo: {}, public: { seo: {} } })
|
|
g.$fetch = async () => ({ action: 'not_found', status: 404, url: '/y', locale: '', staging: false, seo: null })
|
|
await resolveCached({ context: {} } as never, '/y')
|
|
}
|
|
const event = (method: string, path: string, statusCode: number) => ({ method, path, node: { res: { statusCode } } })
|
|
await fill()
|
|
hook(event('POST', '/api/__site__/cache/purge', 401))
|
|
hook(event('GET', '/api/__site__/cache/purge', 200))
|
|
hook(event('POST', '/blog', 200))
|
|
assert.equal(seoCacheSizes().resolve, 1)
|
|
hook(event('POST', '/api/__site__/cache/purge', 200))
|
|
assert.equal(seoCacheSizes().resolve, 0)
|
|
await fill()
|
|
hook(event('POST', '/api/__journal__/cache/purge?x=1', 200))
|
|
assert.equal(seoCacheSizes().resolve, 0)
|
|
})
|