rsnext/test/unit/web-runtime/next-cookies.test.ts

166 lines
4.8 KiB
TypeScript
Raw Normal View History

/* eslint-env jest */
import { Blob, File, FormData } from 'next/dist/compiled/formdata-node'
import { Crypto } from 'next/dist/server/web/sandbox/polyfills'
import { Response } from 'next/dist/server/web/spec-compliant/response'
import { Headers } from 'next/dist/server/web/spec-compliant/headers'
import * as streams from 'web-streams-polyfill/ponyfill'
beforeAll(() => {
global['Blob'] = Blob
global['crypto'] = new Crypto()
global['File'] = File
global['FormData'] = FormData
global['Headers'] = Headers
global['ReadableStream'] = streams.ReadableStream
global['TransformStream'] = streams.TransformStream
global['Response'] = Response
})
afterAll(() => {
delete global['Blob']
delete global['crypto']
delete global['File']
delete global['Headers']
delete global['FormData']
delete global['ReadableStream']
delete global['TransformStream']
})
it('reflect .set into `set-cookie`', async () => {
const { NextResponse } = await import(
'next/dist/server/web/spec-extension/response'
)
const response = new NextResponse()
expect(response.cookies.get('foo')).toBe(undefined)
expect(response.cookies.getWithOptions('foo')).toEqual({
value: undefined,
options: {},
})
response.cookies
.set('foo', 'bar', { path: '/test' })
.set('fooz', 'barz', { path: '/test2' })
expect(response.cookies.get('foo')).toBe('bar')
expect(response.cookies.get('fooz')).toBe('barz')
expect(response.cookies.getWithOptions('foo')).toEqual({
value: 'bar',
options: { Path: '/test' },
})
expect(response.cookies.getWithOptions('fooz')).toEqual({
value: 'barz',
options: { Path: '/test2' },
})
expect(Object.fromEntries(response.headers.entries())['set-cookie']).toBe(
'foo=bar; Path=/test, fooz=barz; Path=/test2'
)
})
it('reflect .delete into `set-cookie`', async () => {
const { NextResponse } = await import(
'next/dist/server/web/spec-extension/response'
)
const response = new NextResponse()
response.cookies.set('foo', 'bar')
expect(Object.fromEntries(response.headers.entries())['set-cookie']).toBe(
'foo=bar; Path=/'
)
expect(response.cookies.get('foo')).toBe('bar')
expect(response.cookies.getWithOptions('foo')).toEqual({
value: 'bar',
options: { Path: '/' },
})
response.cookies.set('fooz', 'barz')
expect(Object.fromEntries(response.headers.entries())['set-cookie']).toBe(
'foo=bar; Path=/, fooz=barz; Path=/'
)
expect(response.cookies.get('fooz')).toBe('barz')
expect(response.cookies.getWithOptions('fooz')).toEqual({
value: 'barz',
options: { Path: '/' },
})
const firstDelete = response.cookies.delete('foo')
expect(firstDelete).toBe(true)
expect(Object.fromEntries(response.headers.entries())['set-cookie']).toBe(
'foo=; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMT, fooz=barz; Path=/'
)
expect(response.cookies.get('foo')).toBe(undefined)
expect(response.cookies.getWithOptions('foo')).toEqual({
value: undefined,
options: {},
})
const secondDelete = response.cookies.delete('fooz')
expect(secondDelete).toBe(true)
expect(Object.fromEntries(response.headers.entries())['set-cookie']).toBe(
'fooz=; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMT, foo=; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMT'
)
expect(response.cookies.get('fooz')).toBe(undefined)
expect(response.cookies.getWithOptions('fooz')).toEqual({
value: undefined,
options: {},
})
expect(response.cookies.size).toBe(0)
})
it('reflect .clear into `set-cookie`', async () => {
const { NextResponse } = await import(
'next/dist/server/web/spec-extension/response'
)
const response = new NextResponse()
response.cookies.clear()
expect(Object.fromEntries(response.headers.entries())['set-cookie']).toBe(
undefined
)
response.cookies.set('foo', 'bar')
expect(Object.fromEntries(response.headers.entries())['set-cookie']).toBe(
'foo=bar; Path=/'
)
expect(response.cookies.get('foo')).toBe('bar')
expect(response.cookies.getWithOptions('foo')).toEqual({
value: 'bar',
options: { Path: '/' },
})
response.cookies.set('fooz', 'barz')
expect(Object.fromEntries(response.headers.entries())['set-cookie']).toBe(
'foo=bar; Path=/, fooz=barz; Path=/'
)
response.cookies.clear()
expect(Object.fromEntries(response.headers.entries())['set-cookie']).toBe(
'foo=; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMT, fooz=; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMT'
)
})
it('response.cookie does not modify options', async () => {
const { NextResponse } = await import(
'next/dist/server/web/spec-extension/response'
)
const options = { maxAge: 10000 }
feat(middleware)!: forbids middleware response body (#36835) _Hello Next.js team! First PR here, I hope I've followed the right practices._ ### What's in there? It has been decided to only support the following uses cases in Next.js' middleware: - rewrite the URL (`x-middleware-rewrite` response header) - redirect to another URL (`Location` response header) - pass on to the next piece in the request pipeline (`x-middleware-next` response header) 1. during development, a warning on console tells developers when they are returning a response (either with `Response` or `NextResponse`). 2. at build time, this warning becomes an error. 3. at run time, returning a response body will trigger a 500 HTTP error with a JSON payload containing the detailed error. All returned/thrown errors contain a link to the documentation. This is a breaking feature compared to the _beta_ middleware implementation, and also removes `NextResponse.json()` which makes no sense any more. ### How to try it? - runtime behavior: `HEADLESS=true yarn jest test/integration/middleware/core` - build behavior : `yarn jest test/integration/middleware/build-errors` - development behavior: `HEADLESS=true yarn jest test/development/middleware-warnings` ### Notes to reviewers The limitation happens in next's web adapter. ~The initial implementation was to check `response.body` existence, but it turns out [`Response.redirect()`](https://github.com/vercel/next.js/blob/canary/packages/next/server/web/spec-compliant/response.ts#L42-L53) may set the response body (https://github.com/vercel/next.js/pull/31886). Hence why the proposed implementation specifically looks at response headers.~ `Response.redirect()` and `NextResponse.redirect()` do not need to include the final location in their body: it is handled by next server https://github.com/vercel/next.js/blob/canary/packages/next/server/next-server.ts#L1142 Because this is a breaking change, I had to adjust several tests cases, previously returning JSON/stream/text bodies. When relevant, these middlewares are returning data using response headers. About DevEx: relying on AST analysis to detect forbidden use cases is not as good as running the code. Such cases are easy to detect: ```js new Response('a text value') new Response(JSON.stringify({ /* whatever */ }) ``` But these are false-positive cases: ```js function returnNull() { return null } new Response(returnNull()) function doesNothing() {} new Response(doesNothing()) ``` However, I see no good reasons to let users ship middleware such as the one above, hence why the build will fail, even if _technically speaking_, they are not setting the response body. ## Feature - [x] Implements an existing feature request or RFC. Make sure the feature request has been accepted for implementation before opening a PR. - [ ] Related issues linked using `fixes #number` - [x] Integration tests added - [x] Documentation added - [ ] Telemetry added. In case of a feature if it's used or not. - [x] Errors have helpful link attached, see `contributing.md` ## Documentation / Examples - [x] Make sure the linting passes by running `yarn lint`
2022-05-20 00:02:20 +02:00
const response = new NextResponse(null, {
headers: { 'content-type': 'application/json' },
})
response.cookies.set('cookieName', 'cookieValue', options)
expect(options).toEqual({ maxAge: 10000 })
})