From 4eee08e45c72cc4042db92e07d98477b402ded8b Mon Sep 17 00:00:00 2001 From: Maurice Date: Sun, 23 Aug 2026 11:42:13 +0200 Subject: [PATCH] test(middleware): cover the branches the forced-HTTPS change added The redirect grew three paths nothing exercised: a malformed APP_URL falling back to the request host, a request the proxy already terminated TLS for, and the health probe, which talks plain HTTP on the loopback and must not be sent to a hostname it cannot resolve. The per-domain coverage ratchet caught the gap - src/middleware sat at 93.44% against its 94% pin. --- .../middleware/globalMiddleware.csp.test.ts | 26 +++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/server/tests/unit/middleware/globalMiddleware.csp.test.ts b/server/tests/unit/middleware/globalMiddleware.csp.test.ts index 09bc6a91e..1f32385a3 100644 --- a/server/tests/unit/middleware/globalMiddleware.csp.test.ts +++ b/server/tests/unit/middleware/globalMiddleware.csp.test.ts @@ -76,4 +76,30 @@ describe('forced-HTTPS redirect', () => { delete process.env.APP_URL; expect(await redirectLocation()).toBe('https://evil.example.com/trips'); }); + + it('falls back to the request host when APP_URL is not a URL', async () => { + // A typo in the env should not take the instance down, and it should not + // produce a redirect to a host built from a half-parsed string either. + process.env.FORCE_HTTPS = 'true'; + process.env.APP_URL = 'not a url'; + expect(await redirectLocation()).toBe('https://evil.example.com/trips'); + }); + + it('leaves an already-secure request alone, and never redirects the health probe', async () => { + process.env.FORCE_HTTPS = 'true'; + process.env.APP_URL = 'https://trip.pakulat.org'; + const app = express(); + applyGlobalMiddleware(app); + app.get('/trips', (_req, res) => res.json({ ok: true })); + app.get('/api/health', (_req, res) => res.json({ ok: true })); + + // The proxy already terminated TLS, so there is nothing to upgrade. + const forwarded = await request(app).get('/trips').set('X-Forwarded-Proto', 'https'); + expect(forwarded.status).toBe(200); + + // The container probe talks plain HTTP on the loopback and must not be + // bounced to a hostname it cannot resolve. + const probe = await request(app).get('/api/health'); + expect(probe.status).toBe(200); + }); });