sami7777/dashcaddy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

test(api): DC-087 hermetic caddy-admin health mirrors + file-level raw-fetch guard [glm-grade=B]

Browse Source 
Two mirrored health-handler test suites (health-endpoints, health-probe-aliases)
probed the Caddy admin API with raw Origin-less native fetch. On the prod host
the adversarial cron runs the full jest suite every 30 min against a live Caddy
admin with enforce_origin: 12 journal 403 lines per run (~700/day of
'client is not allowed to access from origin' spam) while tests stayed green.

- Mirrors now call fetchT (byte-identical to src/app.js:930 probe) with fetchT
  jest.spyOn-mocked at buildApp scope; caddyOk-configurable in both suites
- New guard test in utils-http-caddy-admin-origin.test.js: any __tests__ file
  pairing a raw await-fetch with a Caddy-admin token (:2019|adminUrl|
  CADDY_ADMIN) fails the suite — file-level pairing catches the historical
  cross-line drift shape a call-window regex missed
- DC-087-ALLOW-RAW-FETCH comment escape hatch (raw-text marker, guard file
  never self-exempts, skips logged to jest output)

Judge: GLM-5.3 cold read via delegate_task deleg_4d384dea (round 1 C -> round 2
B, zero blockers, polish folded). Verdict URN: urn:ump:azrv2xp72koiwi5r4yb6ureu4aqqloqq64sgmftsajh6ci2mzj2q
Mutation probes: historical drift reintroduction -> guard red; hatch marker ->
skipped+logged; restore -> 33/33. Full suite 2603/2603.
This commit is contained in:
Hermes
2026-08-22 15:14:25 -07:00
parent 54a1df5ac4
commit f2285a2550
3 changed files with 95 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dashcaddy-api/__tests__/health-probe-aliases.test.js
+13 -2
View File
@@ -33,9 +33,18 @@ jest.mock('dockerode', () => {
// Mirror the canonical handler block from src/app.js — if this drifts from
// the real handler, these tests will start failing and force a sync.
function buildApp({ configOk = true, servicesOk = true, dockerOk = true } = {}) {
function buildApp({ configOk = true, servicesOk = true, dockerOk = true, caddyOk = true } = {}) {
process.env.MOCK_DOCKER_DOWN = dockerOk ? '0' : '1';
// DC-087 — mirror src/app.js: caddy check via fetchT (Origin-injecting),
// mocked here so the suite is hermetic. The old raw-fetch mirror probed the
// LIVE Caddy admin on :2019 whenever the full suite ran on the prod host
// (adversarial cron): Origin-less → 403 → 12 journal error lines per run.
const fetchT = jest.spyOn(require('../src/utils/http'), 'fetchT')
.mockImplementation(async () => (caddyOk
? { ok: true, status: 200 }
: { ok: false, status: 403 }));
const app = express();
const config = {
CONFIG_FILE: '/tmp/dc-test-config.json',
@@ -108,8 +117,10 @@ function buildApp({ configOk = true, servicesOk = true, dockerOk = true } = {})
allOk = false;
}
try {
// DC-087 — mirror src/app.js exactly: fetchT (mocked above), not raw
// fetch. Hermetic: no live request to a real Caddy admin.
const caddyUrl = config.CADDY_ADMIN_URL || 'http://localhost:2019';
const response = await fetch(`${caddyUrl}/config/apps/http/servers/srv0/listen`, { signal: AbortSignal.timeout(10000) });
const response = await fetchT(`${caddyUrl}/config/apps/http/servers/srv0/listen`, {}, 10000);
checks.caddy = { ok: response.ok, status: response.status };
if (!response.ok) allOk = false;
} catch (e) {