carmanagement/apps/dashboard/src/proxy.test.ts

import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'

const nextServer = vi.hoisted(() => {
  const redirect = vi.fn((url: URL) => ({ kind: 'redirect', url: url.toString() }))
  const next = vi.fn(() => ({ kind: 'next' }))
  const MockNextResponse = vi.fn((body?: string, init?: { status?: number }) => ({
    kind: 'response',
    body,
    status: init?.status,
  })) as any
  MockNextResponse.redirect = redirect
  MockNextResponse.next = next
  return { redirect, next, MockNextResponse }
})

vi.mock('next/server', () => ({
  NextResponse: nextServer.MockNextResponse,
}))

function cloneableUrl(input: string): URL {
  const url = new URL(input)
  ;(url as URL & { clone: () => URL }).clone = () => cloneableUrl(url.toString())
  return url
}

function request(input: string, options: { token?: string; headers?: Record<string, string> } = {}) {
  const headers = new Map(Object.entries(options.headers ?? {}).map(([key, value]) => [key.toLowerCase(), value]))
  return {
    nextUrl: cloneableUrl(input),
    cookies: {
      get: vi.fn((name: string) => (name === 'employee_session' && options.token ? { value: options.token } : undefined)),
    },
    headers: {
      get: vi.fn((name: string) => headers.get(name.toLowerCase()) ?? null),
      has: vi.fn((name: string) => headers.has(name.toLowerCase())),
    },
  }
}

async function loadProxy(websiteUrl = 'https://market.example.com') {
  vi.resetModules()
  process.env.NEXT_PUBLIC_WEBSITE_URL = websiteUrl
  return import('./proxy')
}

beforeEach(() => {
  nextServer.redirect.mockClear()
  nextServer.next.mockClear()
})

afterEach(() => {
  delete process.env.NEXT_PUBLIC_WEBSITE_URL
  vi.resetModules()
})

describe('dashboard proxy', () => {
  it('redirects duplicate dashboard prefixes to the clean dashboard URL', async () => {
    const { default: proxy } = await loadProxy()

    const response = proxy(request('https://workspace.example.com/dashboard/dashboard?x=1') as never)

    expect(response).toEqual({ kind: 'redirect', url: 'https://workspace.example.com/dashboard?x=1' })
  })

  it('rejects middleware subrequest headers at the app layer', async () => {
    const { default: proxy } = await loadProxy()

    const response = proxy(request('https://workspace.example.com/dashboard', {
      headers: { 'x-middleware-subrequest': 'middleware:middleware' },
    }) as never)

    expect(response).toEqual({ kind: 'response', body: 'Unsupported internal request header', status: 400 })
  })

  it('redirects unauthenticated protected internal-host requests to homepage sign-in on the website origin', async () => {
    const { default: proxy } = await loadProxy('https://rentaldrivego.example')

    const response = proxy(request('http://dashboard:3001/dashboard/team') as never)

    expect(response).toEqual({ kind: 'redirect', url: 'https://rentaldrivego.example/en/dark/sign-in?redirect=%2Fdashboard%2Fteam' })
  })

  it('redirects unprefixed internal app paths with a public dashboard return path', async () => {
    const { default: proxy } = await loadProxy('https://rentaldrivego.example')

    const response = proxy(request('http://dashboard:3001/reservations') as never)

    expect(response).toEqual({ kind: 'redirect', url: 'https://rentaldrivego.example/en/dark/sign-in?redirect=%2Fdashboard%2Freservations' })
  })

  it('ignores spoofed forwarded host/proto when building the dashboard sign-in redirect', async () => {
    const { default: proxy } = await loadProxy('https://market.example.com')

    const response = proxy(request('http://dashboard:3001/dashboard/billing', {
      headers: {
        'x-forwarded-host': 'workspace.customer.example',
        'x-forwarded-proto': 'https',
      },
    }) as never)

    expect(response).toEqual({ kind: 'redirect', url: 'https://market.example.com/en/dark/sign-in?redirect=%2Fdashboard%2Fbilling' })
  })

  it('ignores internal forwarded hosts when building the dashboard sign-in redirect', async () => {
    const { default: proxy } = await loadProxy('https://market.example.com')

    const response = proxy(request('http://dashboard:3001/dashboard/fleet', {
      headers: {
        'x-forwarded-host': 'api:4000',
        'x-forwarded-proto': 'https',
      },
    }) as never)

    expect(response).toEqual({ kind: 'redirect', url: 'https://market.example.com/en/dark/sign-in?redirect=%2Fdashboard%2Ffleet' })
  })

  it('redirects legacy dashboard sign-in requests to the localized homepage sign-in route', async () => {
    const { default: proxy } = await loadProxy('https://market.example.com')

    const response = proxy(request('https://workspace.example.com/dashboard/sign-in?redirect=/dashboard/fleet&lang=fr&theme=dark') as never)

    expect(response).toEqual({ kind: 'redirect', url: 'https://market.example.com/fr/dark/sign-in?redirect=%2Fdashboard%2Ffleet' })
  })

  it('redirects signed-in users away from the sign-in page', async () => {
    const { default: proxy } = await loadProxy()

    const response = proxy(request('https://workspace.example.com/dashboard/sign-in?redirect=/dashboard/fleet', { token: 'employee-token' }) as never)

    expect(response).toEqual({ kind: 'redirect', url: 'https://market.example.com/dashboard' })
  })

  it('allows public dashboard auth pages without a token', async () => {
    const { default: proxy } = await loadProxy()

    const response = proxy(request('https://workspace.example.com/dashboard/forgot-password') as never)

    expect(response).toEqual({ kind: 'next' })
    expect(nextServer.next).toHaveBeenCalledTimes(1)
  })

  it('allows dashboard API requests through so auth endpoints can set and read cookies', async () => {
    const { default: proxy } = await loadProxy()

    const response = proxy(request('https://workspace.example.com/dashboard/api/v1/auth/employee/login') as never)

    expect(response).toEqual({ kind: 'next' })
    expect(nextServer.redirect).not.toHaveBeenCalled()
  })
})