jimmy/postgrest
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

test: move cors related tests from io tests to spec tests

Browse Source 
Towards #4946.

Signed-off-by: Taimoor Zaeem <taimoorzaeem@gmail.com>
This commit is contained in:
Taimoor Zaeem
2026-06-10 10:27:49 +00:00
committed by Wolfgang Walther
parent 21433d10c2
commit 8bde0ad474
2 changed files with 60 additions and 82 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/spec/Feature/CorsSpec.hs
+60 -2
View File
@@ -4,12 +4,14 @@ import Network.HTTP.Types
import Test.Hspec
import Test.Hspec.Wai
import PostgREST.Config (AppConfig (..))
import Protolude
import SpecHelper
spec :: SpecWithConfig
spec withConfig = withConfig baseCfg $
describe "CORS" $ do
spec withConfig = do
withConfig baseCfg $ describe "CORS" $ do
it "replies naively and permissively to preflight request" $
request methodOptions "/"
[ ("Accept", "*/*")
@@ -66,3 +68,59 @@ spec withConfig = withConfig baseCfg $
`shouldRespondWith`
""
{ matchHeaders = [ "Access-Control-Allow-Origin" <:> "*" ] }
withConfig baseCfg { configServerCorsAllowedOrigins = ["http://example.com", "http://example2.com"] } $
describe "test preflight/non-preflight request and cors server allowed config" $ do
it "OPTIONS preflight request should return Access-Control-Allow-Origin equal to origin" $
request methodOptions "/items"
[ ("Accept", "*/*")
, ("Origin", "http://example.com")
, ("Access-Control-Request-Method", "POST")
, ("Access-Control-Request-Headers", "Content-Type") ]
""
`shouldRespondWith`
ResponseMatcher
{ matchStatus = 200
, matchBody = MatchBody (\_ _ -> Nothing) -- match any body
, matchHeaders = [ "Access-Control-Allow-Origin" <:> "http://example.com"
, "Access-Control-Allow-Credentials" <:> "true" ]
}
it "GET no preflight request should return Access-Control-Allow-Origin equal to origin" $
request methodGet "/items"
[ ("Accept", "*/*")
, ("Origin", "http://example.com") ]
""
`shouldRespondWith`
ResponseMatcher
{ matchStatus = 200
, matchBody = MatchBody (\_ _ -> Nothing) -- match any body
, matchHeaders = [ "Access-Control-Allow-Origin" <:> "http://example.com" ] }
it "GET no preflight request should not return Access-Control-Allow-Origin" $
request methodGet "/items"
[ ("Accept", "*/*")
, ("Origin", "http://invalid.com") ]
""
`shouldRespondWith`
ResponseMatcher
{ matchStatus = 200
, matchBody = MatchBody (\_ _ -> Nothing) -- match any body
, matchHeaders = [ matchHeaderAbsent "Access-Control-Allow-Origin" ] }
withConfig baseCfg { configServerCorsAllowedOrigins = [] } $
describe "test preflight request with empty cors allowed origin config" $
it "OPTIONS preflight request should allow all origins when config is not set or empty" $
request methodOptions "/items"
[ ("Accept", "*/*")
, ("Origin", "http://anyorigin.com")
, ("Access-Control-Request-Method", "POST")
, ("Access-Control-Request-Headers", "Content-Type") ]
""
`shouldRespondWith`
ResponseMatcher
{ matchStatus = 200
, matchBody = MatchBody (\_ _ -> Nothing) -- match any body
, matchHeaders = [ "Access-Control-Allow-Origin" <:> "*"
, matchHeaderValuePresent "Access-Control-Allow-Methods" "POST" ]
}