// csp-parse doesn't have TypeScript types

import CspParse from 'csp-parse'

import { beforeAll, describe, expect, test, vi } from 'vitest'

import enterpriseServerReleases from '@/versions/lib/enterprise-server-releases'

import { get, getDOM, head, post } from '@/tests/helpers/e2etest'

import { describeViaActionsOnly } from '@/tests/helpers/conditional-runs'

import { loadPages } from '@/frame/lib/page-data'

import {

SURROGATE_ENUMS,

makeLanguageSurrogateKey,

makePageSurrogateKey,

} from '@/frame/middleware/set-fastly-surrogate-key'

interface Category {

name: string

published_articles: string[]

}

describe('server', () => {

vi.setConfig({ testTimeout: 60 * 1000 })

beforeAll(async () => {

// The first page load takes a long time so let's get it out of the way in

// advance to call out that problem specifically rather than misleadingly

// attributing it to the first test

const res = await get('/en')

expect(res.statusCode).toBe(200)

})

test('supports HEAD requests', async () => {

const res = await head('/en')

expect(res.statusCode).toBe(200)

expect(res.headers['content-length']).toBe('0')

expect(res.body).toBe('')

// Because the HEAD requests can't be different no matter what's

// in the request headers (Accept-Language or Cookies)

// it's safe to let it cache. The only key is the URL.

expect(res.headers['cache-control']).toContain('public')

expect(res.headers['cache-control']).toMatch(/max-age=\d+/)

})

test('renders the homepage', async () => {

const res = await get('/en')

expect(res.statusCode).toBe(200)

})

test('sets Content Security Policy (CSP) headers', async () => {

const res = await get('/en')

expect(res.statusCode).toBe(200)

expect('content-security-policy' in res.headers).toBe(true)

const csp = new CspParse(res.headers['content-security-policy'])

expect(csp.get('default-src')).toBe("'none'")

expect(csp.get('font-src').includes("'self'")).toBe(true)

expect(csp.get('connect-src').includes("'self'")).toBe(true)

expect(csp.get('img-src').includes("'self'")).toBe(true)

expect(csp.get('script-src').includes("'self'")).toBe(true)

expect(csp.get('style-src').includes("'self'")).toBe(true)

expect(csp.get('style-src').includes("'unsafe-inline'")).toBe(true)

expect(csp.get('manifest-src').includes("'self'")).toBe(true)

})

test('sets Fastly cache control headers', async () => {

const res = await get('/en')

expect(res.statusCode).toBe(200)

expect(res.headers['cache-control']).toMatch(/public, max-age=/)

const surrogateKeySplit = res.headers['surrogate-key'].split(/\s/g)

expect(surrogateKeySplit.includes(makeLanguageSurrogateKey('en'))).toBeTruthy()

})

test('caches responses with short edge freshness and a week-long stale window', async () => {

const week = 60 * 60 * 24 * 7

for (const path of ['/en/get-started', '/robots.txt']) {

const res = await get(path)

expect(res.statusCode).toBe(200)

const surrogate = res.headers['surrogate-control']

expect(surrogate).toContain(`stale-while-revalidate=${week}`)

expect(surrogate).toContain(`stale-if-error=${week}`)

// Edge freshness is short (well under the week-long stale window).

const maxAge = Number(surrogate.match(/(?:^|[ ,])max-age=(\d+)/)?.[1])

expect(maxAge).toBeGreaterThan(0)

expect(maxAge).toBeLessThan(week)

}

// Browser cache stays short: 60s, unpurgeable.

const res = await get('/en/get-started')

expect(res.headers['cache-control']).toMatch(/(^|[ ,])max-age=60([ ,]|$)/)

})

test('sets fine-grained product and version surrogate keys on content pages', async () => {

const res = await get('/en/get-started')

expect(res.statusCode).toBe(200)

const keys = res.headers['surrogate-key'].split(/\s/g)

expect(keys[0]).toBe(makeLanguageSurrogateKey('en'))

expect(keys).toContain('product:get-started')

expect(keys).toContain('product:get-started,language:en')

expect(keys.some((key: string) => /^version:.+/.test(key))).toBe(true)

// Exact key, not just a pattern, to lock the render side byte-for-byte to what

// the purge job rebuilds from a changed file path (content/get-started/index.md).

expect(keys).toContain('language:en,path:get-started/index.md')

expect(keys).toContain(makePageSurrogateKey('en', 'get-started/index.md'))

expect(keys.length).toBeLessThanOrEqual(6)

})

test('does not render duplicate <html> or <body> tags', async () => {

const $ = await getDOM('/en')

expect($('html').length).toBe(1)

expect($('body').length).toBe(1)

})

test('renders a 404 page', async () => {

// Important to use the prefix /en/ on the failing URL or else

// it will render a very basic plain text 404 response.

const $ = await getDOM('/en/not-a-real-page', { allow404: true })

expect(($ as unknown as { text(): string }).text()).toContain('Page not found.')

expect($.res.statusCode).toBe(404)

})

test('renders a 404 for language prefixed versioned non-existent pages', async () => {

const res = await get('/en/enterprise-cloud@latest/nonexistent-page')

expect(res.statusCode).toBe(404)

})

// When using `got()` to send full end-to-end URLs, you can't use

// URLs like in this test because got will

// throw `RequestError: URI malformed`.

// So for now, this test is skipped.

test.skip('renders a 400 for invalid paths', async () => {

const $ = await getDOM('/en/%7B%')

expect($.res.statusCode).toBe(400)

})

test('renders a 500 page when errors are thrown', async () => {

const $ = await getDOM('/_500', { allow500s: true })

expect($('h1').first().text()).toBe('Ooops!')

// Using type assertion because cheerio v1 types don't include text() on root

expect(

($ as unknown as { text(): string }).text().includes('It looks like something went wrong.'),

).toBe(true)

expect(

($ as unknown as { text(): string })

.text()

.includes(

'We track these errors automatically, but if the problem persists please feel free to contact us.',

),

).toBe(true)

expect($.res.statusCode).toBe(500)

})

test('returns a 400 when POST-ed invalid JSON', async () => {

const res = await post('/', {

body: 'not real JSON',

headers: {

'content-type': 'application/json',

},

})

expect(res.statusCode).toBe(400)

})

// see issue 9678

test('does not use cached intros in subcategories', async () => {

let $ = await getDOM(

'/en/get-started/importing-your-projects-to-github/importing-source-code-to-github/importing-a-git-repository-using-the-command-line',

)

const articleIntro = $('[data-testid="lead"]').text()

$ = await getDOM(

'/en/enterprise/2.16/user/importing-your-projects-to-github/importing-source-code-to-github',

)

const subcategoryIntro = $('.subcategory').first().next().text()

expect(articleIntro).not.toEqual(subcategoryIntro)

})

test('serves /categories.json for support team usage', async () => {

const res = await get('/categories.json')

expect(res.statusCode).toBe(200)

// check for CORS header

expect(res.headers['access-control-allow-origin']).toBe('*')

// Check that it can be cached at the CDN

expect(res.headers['set-cookie']).toBeUndefined()

expect(res.headers['cache-control']).toContain('public')

expect(res.headers['cache-control']).toMatch(/max-age=[1-9]/)

const categories = JSON.parse(res.body)

expect(Array.isArray(categories)).toBe(true)

expect(categories.length).toBeGreaterThan(1)

for (const category of categories as Category[]) {

expect('name' in category).toBe(true)

expect('published_articles' in category).toBe(true)

}

})

describeViaActionsOnly('Early Access articles', () => {

test('have noindex meta tags', async () => {

const allPages = await loadPages()

// This is what the earlyAccessContext middleware does to get a

// list of early-access pages for that TOC it displays when

// viewing /en/early-access in development.

// Here we're using it to get a least 1 page we can end-to-end

// test to look at it's meta tags.

const hiddenPages = allPages.filter(

(page) =>

page.languageCode === 'en' &&

page.hidden &&

page.relativePath.startsWith('early-access') &&

!page.relativePath.endsWith('index.md'),

)

for (const { href } of hiddenPages[0].permalinks) {

const $ = await getDOM(href)

expect($('meta[content="noindex"]').length).toBe(1)

}

})

})

describe('redirects', () => {

test('redirects old articles to their English URL', async () => {

const res = await get('/articles/deleting-a-team', { followRedirects: false })

expect(res.statusCode).toBe(302)

expect(res.headers['set-cookie']).toBeUndefined()

// language specific caching

expect(res.headers['cache-control']).toContain('public')

expect(res.headers['cache-control']).toMatch(/max-age=[1-9]/)

expect(res.headers.vary).toContain('accept-language')

expect(res.headers.vary).toContain('x-user-language')

})

test('redirects / to /en when no language preference is specified', async () => {

const res = await get('/')

expect(res.statusCode).toBe(302)

expect(res.headers.location).toBe('/en')

expect(res.headers['set-cookie']).toBeUndefined()

// language specific caching

expect(res.headers['cache-control']).toContain('public')

expect(res.headers['cache-control']).toMatch(/max-age=[1-9]/)

expect(res.headers.vary).toContain('accept-language')

expect(res.headers.vary).toContain('x-user-language')

})

// This test exists because in a previous life, our NextJS used to

// 500 if the 'Accept-Language' header was malformed.

// We *used* have a custom middleware to cope with this and force a

// fallback redirect.

// See internal issue 19909

test('redirects /en if Accept-Language header is malformed', async () => {

const res = await get('/', {

headers: {

'accept-language': 'ldfir;',

},

followRedirects: false,

})

expect(res.statusCode).toBe(302)

expect(res.headers.location).toBe('/en')

expect(res.headers['set-cookie']).toBeUndefined()

// language specific caching

expect(res.headers['cache-control']).toContain('public')

expect(res.headers['cache-control']).toMatch(/max-age=[1-9]/)

expect(res.headers.vary).toContain('accept-language')

expect(res.headers.vary).toContain('x-user-language')

})

test('redirects / to /en when unsupported language preference is specified', async () => {

const res = await get('/', {

headers: {

// Tagalog: https://www.loc.gov/standards/iso639-2/php/langcodes_name.php?iso_639_1=tl

'accept-language': 'tl',

},

followRedirects: false,

})

expect(res.statusCode).toBe(302)

expect(res.headers.location).toBe('/en')

expect(res.headers['set-cookie']).toBeUndefined()

// language specific caching

expect(res.headers['cache-control']).toContain('public')

expect(res.headers['cache-control']).toMatch(/max-age=[1-9]/)

expect(res.headers.vary).toContain('accept-language')

expect(res.headers.vary).toContain('x-user-language')

})

test('adds English prefix to old article URLs', async () => {

const res = await get('/articles/deleting-a-team')

expect(res.statusCode).toBe(302)

expect(res.headers.location.startsWith('/en/')).toBe(true)

expect(res.headers['set-cookie']).toBeUndefined()

// language specific caching

expect(res.headers['cache-control']).toContain('public')

expect(res.headers['cache-control']).toMatch(/max-age=[1-9]/)

expect(res.headers.vary).toContain('accept-language')

expect(res.headers.vary).toContain('x-user-language')

})

test('redirects that not only injects /en/ should have cache-control', async () => {

const res = await get('/en/articles/deleting-a-team')

expect(res.statusCode).toBe(301)

expect(res.headers['cache-control']).toContain('public')

expect(res.headers['cache-control']).toMatch(/max-age=\d+/)

})

})

describe('Accept: text/markdown content negotiation', () => {

test('returns markdown when Accept header prefers text/markdown', async () => {

const res = await get('/en', {

headers: {

accept: 'text/markdown',

},

})

expect(res.statusCode).toBe(200)

expect(res.headers['content-type']).toContain('text/markdown')

expect(res.headers.vary).toContain('accept')

})

test('returns HTML when Accept header prefers text/html', async () => {

const res = await get('/en', {

headers: {

accept: 'text/html,application/xhtml+xml',

},

})

expect(res.statusCode).toBe(200)

expect(res.headers['content-type']).toContain('text/html')

expect(res.headers.vary).toContain('accept')

})

test('returns HTML when Accept header is */*', async () => {

const res = await get('/en', {

headers: {

accept: '*/*',

},

})

expect(res.statusCode).toBe(200)

expect(res.headers['content-type']).toContain('text/html')

})

test('landing page returns non-empty markdown with title via Accept header', async () => {

const res = await get('/en/get-started', {

headers: {

accept: 'text/markdown',

},

})

expect(res.statusCode).toBe(200)

expect(res.headers['content-type']).toContain('text/markdown')

expect(res.body).toMatch(/^# .+/)

// Verify the landing page has content beyond just the title

expect(res.body).toMatch(/\n\n/)

expect(res.body.split('\n').length).toBeGreaterThan(3)

})

test('.md URL extension returns markdown with correct content type', async () => {

const res = await get('/en/get-started.md')

expect(res.statusCode).toBe(200)

expect(res.headers['content-type']).toContain('text/markdown')

expect(res.body).toMatch(/^# .+/)

})

test('.md URL without language prefix redirects to /en/ equivalent', async () => {

const res = await get('/get-started.md')

expect(res.statusCode).toBe(302)

expect(res.headers.location).toBe('/en/get-started.md')

})

test('/index.md redirects to the page without /index.md', async () => {

const res = await get('/en/get-started/index.md')

expect(res.statusCode).toBe(302)

expect(res.headers.location).toBe('/en/get-started')

})

test('regular article .md URL includes title and intro', async () => {

const res = await get('/en/get-started/using-github/hello-world.md')

expect(res.statusCode).toBe(200)

expect(res.headers['content-type']).toContain('text/markdown')

expect(res.body).toMatch(/^# Hello World/)

})

})

})

describe('static routes', () => {

test('serves content from the /assets directory', async () => {

const res = await get('/assets/images/site/be-social.gif')

expect(res.statusCode).toBe(200)

expect(res.headers['cache-control']).toContain('public')

expect(res.headers['cache-control']).toMatch(/max-age=\d+/)

// Because static assets shouldn't be setting a cookie.

expect(res.headers['set-cookie']).toBeUndefined()

// The "Surrogate-Key" header is set so we can do smart invalidation

// in the Fastly CDN. This needs to be available for static assets too.

expect(res.headers['surrogate-key']).toBeTruthy()

expect(res.headers.etag).toBeUndefined()

expect(res.headers['last-modified']).toBeTruthy()

})

test('rewrites /assets requests from a cache-busting prefix', async () => {

// The rewrite-asset-urls.ts Markdown plugin will do this to img tags.

const res = await get('/assets/cb-123456/images/site/be-social.gif')

expect(res.statusCode).toBe(200)

expect(res.headers['set-cookie']).toBeUndefined()

expect(res.headers['cache-control']).toContain('public')

expect(res.headers['cache-control']).toMatch(/max-age=\d+/)

expect(res.headers['surrogate-key']).toBe(SURROGATE_ENUMS.MANUAL)

})

test('no manual surrogate key for /assets requests without caching-busting prefix', async () => {

const res = await get('/assets/images/site/be-social.gif')

expect(res.statusCode).toBe(200)

expect(res.headers['set-cookie']).toBeUndefined()

expect(res.headers['cache-control']).toContain('public')

expect(res.headers['cache-control']).toMatch(/max-age=\d+/)

const surrogateKeySplit = res.headers['surrogate-key'].split(/\s/g)

expect(surrogateKeySplit.includes(makeLanguageSurrogateKey())).toBeTruthy()

})

test('serves schema files from the /src/graphql/data directory at /public', async () => {

const res = await get('/public/fpt/schema.docs.graphql')

expect(res.statusCode).toBe(200)

expect(res.headers['cache-control']).toContain('public')

expect(res.headers['cache-control']).toMatch(/max-age=\d+/)

// Because static assets shouldn't be setting a cookie.

expect(res.headers['set-cookie']).toBeUndefined()

expect(res.headers.etag).toBeUndefined()

expect(res.headers['last-modified']).toBeTruthy()

expect((await get(`/public/ghec/schema.docs.graphql`)).statusCode).toBe(200)

expect(

(await get(`/public/ghes-${enterpriseServerReleases.latest}/schema.docs-enterprise.graphql`))

.statusCode,

).toBe(200)

expect(

(

await get(

`/public/ghes-${enterpriseServerReleases.oldestSupported}/schema.docs-enterprise.graphql`,

)

).statusCode,

).toBe(200)

})

test('does not serve repo contents that live outside the /assets directory', async () => {

const paths = [

'/package.json',

'/README.md',

'/server.js',

'/.git',

'/.env',

// Also add paths that aren't at the root. But it doesn't matter

// which page this is done for so much.

'/en/billing/.env',

'/en/billing/.env.local',

'/en/pages/.env_sample',

'/en/pages/.env.development.local',

]

for (const path of paths) {

const res = await get(path)

expect(res.statusCode).toBe(404)

expect(res.headers['content-type']).toMatch('text/plain')

expect(res.headers['cache-control']).toMatch(/max-age=[1-9]/)

expect(res.headers['cache-control']).toMatch('public')

}

expect.assertions(4 * paths.length)

})

test('junk requests with or without query strings is 404', async () => {

const paths = ['/env', '/xmlrpc.php', '/wp-login.php']

for (const path of paths) {

const res = await get(`${path}?r=${Math.random()}`)

expect(res.statusCode).toBe(404)

expect(res.headers['content-type']).toMatch('text/plain')

expect(res.headers['cache-control']).toMatch(/max-age=[1-9]/)

expect(res.headers['cache-control']).toMatch('public')

}

expect.assertions(4 * paths.length)

})

})