openAgent

1import { NodeHttpServer, NodeServices } from "@effect/platform-node"
2import { Flag } from "@opencode-ai/core/flag/flag"
3import { describe, expect } from "bun:test"
4import { Config, ConfigProvider, Effect, Layer } from "effect"
5import { HttpClient, HttpClientRequest, HttpRouter, HttpServer } from "effect/unstable/http"
6import * as Socket from "effect/unstable/socket/Socket"
7import { Server } from "../../src/server/server"
8import { InstancePaths } from "../../src/server/routes/instance/httpapi/groups/instance"
9import { HttpApiApp } from "../../src/server/routes/instance/httpapi/server"
10import { resetDatabase } from "../fixture/db"
11import { testEffect } from "../lib/effect"
12 
13const testStateLayer = Layer.effectDiscard(
14  Effect.gen(function* () {
15    const original = {
16      OPENCODE_SERVER_PASSWORD: Flag.OPENCODE_SERVER_PASSWORD,
17    }
18    Flag.OPENCODE_SERVER_PASSWORD = "secret"
19    yield* Effect.promise(() => resetDatabase())
20    yield* Effect.addFinalizer(() =>
21      Effect.promise(async () => {
22        Flag.OPENCODE_SERVER_PASSWORD = original.OPENCODE_SERVER_PASSWORD
23        await resetDatabase()
24      }),
25    )
26  }),
27)
28 
29const servedRoutes: Layer.Layer<never, Config.ConfigError, HttpServer.HttpServer> = HttpRouter.serve(
30  HttpApiApp.routes,
31  { disableListenLog: true, disableLogger: true },
32)
33 
34const it = testEffect(
35  Layer.mergeAll(
36    testStateLayer,
37    servedRoutes.pipe(
38      Layer.provide(Socket.layerWebSocketConstructorGlobal),
39      Layer.provideMerge(NodeHttpServer.layerTest),
40      Layer.provideMerge(NodeServices.layer),
41    ),
42  ),
43)
44 
45describe("HttpApi CORS", () => {
46  it.live("allows browser preflight requests without credentials", () =>
47    Effect.gen(function* () {
48      const response = yield* HttpClientRequest.options(InstancePaths.path).pipe(
49        HttpClientRequest.setHeaders({
50          origin: "http://localhost:3000",
51          "access-control-request-method": "GET",
52          "access-control-request-headers": "authorization",
53        }),
54        HttpClient.execute,
55      )
56 
57      expect(response.status).toBe(204)
58      expect(response.headers["access-control-allow-origin"]).toBe("http://localhost:3000")
59      expect(response.headers["access-control-allow-headers"]).toBe("authorization")
60    }),
61  )
62 
63  it.live("adds CORS headers to unauthorized responses", () =>
64    Effect.gen(function* () {
65      const handler = HttpRouter.toWebHandler(
66        HttpApiApp.createRoutes().pipe(
67          Layer.provide(ConfigProvider.layer(ConfigProvider.fromUnknown({ OPENCODE_SERVER_PASSWORD: "secret" }))),
68        ),
69        { disableLogger: true },
70      ).handler
71      const response = yield* Effect.promise(() =>
72        handler(
73          new Request(new URL("/global/config", "http://localhost"), {
74            headers: { origin: "https://app.opencode.ai" },
75          }),
76          HttpApiApp.context,
77        ),
78      )
79 
80      expect(response.status).toBe(401)
81      expect(response.headers.get("access-control-allow-origin")).toBe("https://app.opencode.ai")
82    }),
83  )
84 
85  it.live("uses custom CORS origins passed to the server", () =>
86    Effect.gen(function* () {
87      const listener = yield* Effect.acquireRelease(
88        Effect.promise(() => Server.listen({ hostname: "127.0.0.1", port: 0, cors: ["https://custom.example"] })),
89        (listener) => Effect.promise(() => listener.stop(true)),
90      )
91 
92      const response = yield* Effect.promise(() =>
93        fetch(new URL(InstancePaths.path, listener.url), {
94          method: "OPTIONS",
95          headers: {
96            origin: "https://custom.example",
97            "access-control-request-method": "GET",
98            "access-control-request-headers": "authorization",
99          },
100        }),
101      )
102 
103      expect(response.status).toBe(204)
104      expect(response.headers.get("access-control-allow-origin")).toBe("https://custom.example")
105      expect(response.headers.get("access-control-allow-headers")).toBe("authorization")
106 
107      const rejected = yield* Effect.promise(() =>
108        fetch(new URL(InstancePaths.path, listener.url), {
109          method: "OPTIONS",
110          headers: {
111            origin: "https://evil.example",
112            "access-control-request-method": "GET",
113            "access-control-request-headers": "authorization",
114          },
115        }),
116      )
117 
118      expect(rejected.status).toBe(204)
119      expect(rejected.headers.get("access-control-allow-origin")).not.toBe("https://evil.example")
120    }),
121  )
122})
123