proxy.test.ts

import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
import { NextRequest } from "next/server";

const mocks = vi.hoisted(() => ({
  getUser: vi.fn(),
}));

vi.mock("@supabase/ssr", () => ({
  createServerClient: () => ({
    auth: { getUser: mocks.getUser },
  }),
}));

import { proxy } from "./proxy";

describe("production route controls", () => {
  beforeEach(() => {
    vi.clearAllMocks();
    mocks.getUser.mockResolvedValue({ data: { user: null } });
  });

  afterEach(() => vi.unstubAllEnvs());

  it.each([
    "/api/v1/whatsapp/webhook",
  ])("returns 404 for %s in production", async (pathname) => {
    vi.stubEnv("NODE_ENV", "production");

    const response = await proxy(
      new NextRequest(`https://studybuddy.example${pathname}`)
    );

    expect(response.status).toBe(404);
    expect(response.headers.get("Cache-Control")).toBe("no-store");
    const csp = response.headers.get("Content-Security-Policy");
    expect(csp).toMatch(/script-src [^;]*'nonce-[^']+' [^;]*'strict-dynamic'/);
    expect(csp?.match(/script-src [^;]*/)?.[0]).not.toContain("'unsafe-inline'");
    expect(csp).toMatch(/style-src 'self' 'nonce-[^']+'/);
    expect(csp?.match(/style-src [^;]*/)?.[0]).not.toContain("'unsafe-inline'");
    expect(csp).toContain("style-src-attr 'unsafe-inline'");
  });

  it("rejects declared oversized API requests before authentication", async () => {
    const response = await proxy(
      new NextRequest("https://studybuddy.example/api/v1/contact", {
        method: "POST",
        headers: { "Content-Length": String(31 * 1024 * 1024) },
      })
    );

    expect(response.status).toBe(413);
    expect(response.headers.get("Content-Security-Policy")).toContain(
      "script-src 'self' 'nonce-"
    );
  });

  it("allows the Railway health check without an external auth lookup", async () => {
    vi.stubEnv("NODE_ENV", "production");
    vi.stubEnv("SUPABASE_URL", "");
    vi.stubEnv("NEXT_PUBLIC_SUPABASE_URL", "");
    vi.stubEnv("SUPABASE_PUBLISHABLE_KEY", "");
    vi.stubEnv("NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY", "");

    const response = await proxy(
      new NextRequest("https://healthcheck.railway.app/api/health")
    );

    expect(response.status).toBe(200);
    expect(response.headers.get("x-middleware-next")).toBe("1");
    expect(response.headers.get("Content-Security-Policy")).toContain(
      "default-src 'self'"
    );
  });

  it("limits production image sources to the configured Supabase project", async () => {
    vi.stubEnv("NODE_ENV", "production");
    vi.stubEnv("SUPABASE_URL", "https://staging-project.supabase.co");
    vi.stubEnv("NEXT_PUBLIC_SUPABASE_URL", "https://staging-project.supabase.co");

    const response = await proxy(
      new NextRequest("https://healthcheck.railway.app/api/health")
    );
    const imagePolicy = response.headers
      .get("Content-Security-Policy")
      ?.split("; ")
      .find((directive) => directive.startsWith("img-src "));

    expect(imagePolicy).toBe(
      "img-src 'self' data: blob: https://staging-project.supabase.co"
    );
    expect(imagePolicy?.split(/\s+/)).not.toContain("https:");
  });

  it("does not add an untrusted configured URL to image sources", async () => {
    vi.stubEnv("NODE_ENV", "production");
    vi.stubEnv("SUPABASE_URL", "https://images.attacker.example");
    vi.stubEnv("NEXT_PUBLIC_SUPABASE_URL", "not-a-url");

    const response = await proxy(
      new NextRequest("https://healthcheck.railway.app/api/health")
    );
    const imagePolicy = response.headers
      .get("Content-Security-Policy")
      ?.split("; ")
      .find((directive) => directive.startsWith("img-src "));

    expect(imagePolicy).toBe("img-src 'self' data: blob:");
  });

  it("rejects a cross-origin mutation carrying a Supabase session cookie", async () => {
    vi.stubEnv("NODE_ENV", "production");
    vi.stubEnv("APP_ORIGIN", "https://studybuddy.example");

    const response = await proxy(
      new NextRequest("https://studybuddy.example/api/v1/profile", {
        method: "PATCH",
        headers: {
          cookie: "sb-project-ref-auth-token=encoded-session",
          origin: "https://attacker.example",
        },
      })
    );

    expect(response.status).toBe(403);
    expect(await response.json()).toMatchObject({
      error: "CSRF_VALIDATION_FAILED",
    });
    expect(response.headers.get("Cache-Control")).toBe("no-store");
    expect(response.headers.get("Content-Security-Policy")).toContain(
      "script-src 'self' 'nonce-"
    );
  });

  it("generates a different script nonce for every request", async () => {
    vi.stubEnv("NODE_ENV", "production");

    const first = await proxy(
      new NextRequest("https://studybuddy.example/api/v1/whatsapp/webhook")
    );
    const second = await proxy(
      new NextRequest("https://studybuddy.example/api/v1/whatsapp/webhook")
    );
    const noncePattern = /'nonce-([^']+)'/;
    const firstNonce = first.headers
      .get("Content-Security-Policy")
      ?.match(noncePattern)?.[1];
    const secondNonce = second.headers
      .get("Content-Security-Policy")
      ?.match(noncePattern)?.[1];

    expect(firstNonce).toBeTruthy();
    expect(secondNonce).toBeTruthy();
    expect(firstNonce).not.toBe(secondNonce);
  });

  it.each([
    "/forgot-password",
    "/auth/password-reset?token_hash=secret&type=recovery",
    "/reset-password/update?token_hash=secret&type=recovery",
  ])("redirects an authenticated user away from guest-only route %s", async (path) => {
    vi.stubEnv("NODE_ENV", "production");
    vi.stubEnv("APP_ORIGIN", "https://studybuddy.example");
    vi.stubEnv("SUPABASE_URL", "https://project.supabase.co");
    vi.stubEnv("SUPABASE_PUBLISHABLE_KEY", "public-key");
    mocks.getUser.mockResolvedValue({
      data: {
        user: { user_metadata: { accountStatus: "ACTIVE" } },
      },
    });

    const response = await proxy(
      new NextRequest(`https://localhost:8080${path}`)
    );
    const location = response.headers.get("location");

    expect(location).toBe("https://studybuddy.example/already-logged-in");
    expect(location).not.toContain("secret");
  });
});