Release Network Tools 0.1.0

tests/browser/app.spec.ts

@@ -0,0 +1,69 @@
+import { expect, test, type Page } from "@playwright/test";
+
+const ORIGIN = "http://127.0.0.1:4173";
+async function localOnly(page: Page) {
+  const external: string[] = [];
+  await page.route("**/*", async (route) => {
+    const url = new URL(route.request().url());
+    if (url.origin !== ORIGIN) {
+      external.push(url.href);
+      await route.abort();
+    } else await route.continue();
+  });
+  return external;
+}
+
+test("runs from a nested path without external requests", async ({ page }) => {
+  const errors: string[] = [];
+  page.on("pageerror", (error) => errors.push(error.message));
+  page.on("console", (message) => {
+    if (message.type() === "error") errors.push(message.text());
+  });
+  const external = await localOnly(page);
+  await page.goto("/deep/nested/network/");
+  await expect(
+    page.getByRole("heading", { name: "Network Tools" }),
+  ).toBeVisible();
+  expect(external).toEqual([]);
+  expect(errors).toEqual([]);
+});
+
+test("calculates a subnet and sanitises a credential-bearing URL", async ({
+  page,
+}) => {
+  const external = await localOnly(page);
+  await page.goto("/deep/nested/network/");
+  await expect(
+    page.getByText("Network", { exact: true }).locator("..").locator("dd"),
+  ).toHaveText("192.168.10.0");
+  await expect(
+    page.getByText("Last address", { exact: true }).locator("..").locator("dd"),
+  ).toHaveText("192.168.10.255");
+  await page.getByRole("tab", { name: "URL" }).click();
+  await page
+    .getByLabel("URL or reference")
+    .fill("https://alice:secret@example.test/a?q=one&q=two");
+  await expect(
+    page.getByText("https://alice@example.test/a?q=one&q=two", { exact: true }),
+  ).toBeVisible();
+  await expect(page.getByText(/password; it was removed/u)).toBeVisible();
+  await expect(page.getByText("secret", { exact: false })).toHaveCount(0);
+  expect(external).toEqual([]);
+});
+
+test("serves the release identity and hardened headers", async ({
+  request,
+}) => {
+  const index = await request.get("/deep/nested/network/");
+  expect(index.ok()).toBe(true);
+  expect(index.headers()["content-security-policy"]).toContain(
+    "default-src 'self'",
+  );
+  expect(await index.text()).not.toMatch(/\b(?:src|href)=["']\//u);
+  const manifest = await request.get("/deep/nested/network/toolbox-app.json");
+  await expect(manifest.json()).resolves.toMatchObject({
+    id: "de.add-ideas.network-tools",
+    version: "0.1.0",
+    entry: "./",
+  });
+});

tests/components/app.test.tsx

@@ -0,0 +1,17 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it, vi } from "vitest";
+import { App } from "../../src/App";
+
+describe("Network Tools", () => {
+  it("renders the local workbench and standard shell", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(async () => new Response("Not found", { status: 404 })),
+    );
+    render(<App />);
+    expect(
+      await screen.findByRole("heading", { name: "Network Tools" }),
+    ).toBeVisible();
+    expect(await screen.findByText("No queries sent")).toBeVisible();
+  });
+});

tests/network/http-mime.test.ts

@@ -0,0 +1,41 @@
+import { describe, expect, it } from "vitest";
+import { buildCsp, inspectHeaders } from "../../src/network/http";
+import { lookupMime } from "../../src/network/mime";
+
+describe("HTTP helpers", () => {
+  it("parses duplicates and reports missing security headers", () => {
+    const result = inspectHeaders(
+      "Content-Type: text/html\nSet-Cookie: a=1\nSet-Cookie: b=2",
+    );
+    expect(result.duplicates).toContain("set-cookie");
+    expect(result.findings).toContain(
+      "No Content-Security-Policy header is present.",
+    );
+  });
+
+  it("rejects folded headers", () => {
+    expect(() => inspectHeaders("X-Test: one\n two")).toThrow(/folded/u);
+  });
+
+  it("builds a restrictive CSP and makes dangerous sources visible", () => {
+    const result = buildCsp({
+      defaultSrc: "'self'",
+      scriptSrc: "'self' 'unsafe-eval'",
+      styleSrc: "'self'",
+      imgSrc: "'self' data:",
+      connectSrc: "'self'",
+      workerSrc: "'self' blob:",
+    });
+    expect(result.policy).toContain("object-src 'none'");
+    expect(result.warnings.join(" ")).toMatch(/unsafe-eval/u);
+  });
+});
+
+describe("MIME lookup", () => {
+  it("finds types by extension or media type", () => {
+    expect(lookupMime(".wasm")).toEqual([
+      { extension: "wasm", mime: "application/wasm" },
+    ]);
+    expect(lookupMime("epub")[0]?.mime).toBe("application/epub+zip");
+  });
+});

tests/network/url-dns.test.ts

@@ -0,0 +1,76 @@
+import { describe, expect, it } from "vitest";
+import { buildDnsRecord } from "../../src/network/dns";
+import { buildUrl, inspectUrl } from "../../src/network/url";
+
+describe("URL inspection", () => {
+  it("preserves duplicate query values and resolves relative URLs", () => {
+    const inspected = inspectUrl(
+      "../items?a=1&a=2#part",
+      "https://Example.com/a/b/",
+    );
+    expect(inspected.hostname).toBe("example.com");
+    expect(inspected.query).toEqual([
+      { key: "a", value: "1" },
+      { key: "a", value: "2" },
+    ]);
+    expect(buildUrl(inspected)).toBe(
+      "https://example.com/a/items?a=1&a=2#part",
+    );
+  });
+
+  it("warns about credentials without disclosing the password", () => {
+    const inspected = inspectUrl("https://alice:secret@example.test/");
+    expect(inspected.hasPassword).toBe(true);
+    expect(JSON.stringify(inspected)).not.toContain("secret");
+  });
+});
+
+describe("DNS construction", () => {
+  it("builds common zone-file records", () => {
+    expect(
+      buildDnsRecord({
+        owner: "www",
+        ttl: 3600,
+        type: "A",
+        value: "192.0.2.4",
+      }),
+    ).toBe("www 3600 IN A 192.0.2.4");
+    expect(
+      buildDnsRecord({
+        owner: "@",
+        ttl: 300,
+        type: "MX",
+        value: "mail.example.",
+        priority: 10,
+      }),
+    ).toBe("@ 300 IN MX 10 mail.example.");
+  });
+
+  it("quotes TXT data and rejects oversized values", () => {
+    expect(
+      buildDnsRecord({ owner: "@", ttl: 60, type: "TXT", value: 'a"b' }),
+    ).toContain('"a\\"b"');
+    expect(() =>
+      buildDnsRecord({
+        owner: "@",
+        ttl: 60,
+        type: "TXT",
+        value: "x".repeat(256),
+      }),
+    ).toThrow(/255/u);
+  });
+
+  it("canonicalises addresses and rejects malformed IPv6 text", () => {
+    expect(
+      buildDnsRecord({
+        owner: "@",
+        ttl: 60,
+        type: "AAAA",
+        value: "2001:0db8:0:0:0:0:0:1",
+      }),
+    ).toBe("@ 60 IN AAAA 2001:db8::1");
+    expect(() =>
+      buildDnsRecord({ owner: "@", ttl: 60, type: "AAAA", value: "::::" }),
+    ).toThrow(/IPv6/u);
+  });
+});