Initial Commit

packages/api-stack/api/api-router-worker-bridge/tests/no-raw-request.test.ts

@@ -0,0 +1,42 @@
+import { describe, expect, it } from "@suaveplan/testing/runner";
+import { marshalRequest } from "../src/marshal-request/marshal-request.js";
+
+describe("no-raw-request invariant", () => {
+    it("envelope contains no Request reference and JSON-serialises", {
+        timeout: 5000,
+    }, async () => {
+        const wire = await marshalRequest(
+            new Request("https://api.local/x", {
+                method: "POST",
+                headers: {
+                    "content-type": "application/json",
+                    authorization: "Bearer leak",
+                },
+                body: JSON.stringify({ a: 1 }),
+            })
+        );
+        const replaced = JSON.stringify(wire, (_k, v: unknown) => {
+            if (v instanceof Uint8Array) return { __u8: Array.from(v) };
+            return v;
+        });
+        // No "Request" prototype slipped in
+        expect(replaced.includes("Request")).toBe(false);
+        // No credentials cross the boundary
+        expect(replaced.toLowerCase().includes("authorization")).toBe(false);
+        expect(replaced.includes("Bearer leak")).toBe(false);
+        // The envelope is a plain object — no Request instance
+        expect((wire as unknown as object) instanceof Request).toBe(false);
+    });
+
+    it("exposed keys match the documented surface", {
+        timeout: 5000,
+    }, async () => {
+        const wire = await marshalRequest(new Request("https://api.local/"));
+        expect(Object.keys(wire).sort()).toEqual([
+            "body",
+            "headers",
+            "method",
+            "url",
+        ]);
+    });
+});