Function TestServer_CORSPreflightWithHosts

lib/httpapi/server_test.go:288–371

(t *testing.T)

}

func TestServer_CORSPreflightWithHosts(t *testing.T) {
	cases := []struct {
		name               string
		allowedHosts       []string
		hostHeader         string
		originHeader       string
		expectedStatusCode int
		expectCORSHeaders  bool
	}{
		{
			name:               "preflight with wildcard hosts",
			allowedHosts:       []string{"*"},
			hostHeader:         "example.com",
			originHeader:       "https://example.com",
			expectedStatusCode: http.StatusOK,
			expectCORSHeaders:  true,
		},
		{
			name:               "preflight with specific valid host",
			allowedHosts:       []string{"localhost"},
			hostHeader:         "localhost:3000",
			originHeader:       "https://localhost:3000",
			expectedStatusCode: http.StatusOK,
			expectCORSHeaders:  true,
		},
		{
			name:               "preflight with invalid host",
			allowedHosts:       []string{"localhost"},
			hostHeader:         "malicious.com",
			originHeader:       "https://malicious.com",
			expectedStatusCode: http.StatusBadRequest,
			expectCORSHeaders:  false,
		},
	}

	for _, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			t.Parallel()
			ctx := logctx.WithLogger(context.Background(), slog.New(slog.NewTextHandler(os.Stdout, nil)))
			s, err := httpapi.NewServer(ctx, httpapi.ServerConfig{
				AgentType:      msgfmt.AgentTypeClaude,
				AgentIO:        nil,
				Port:           0,
				ChatBasePath:   "/chat",
				AllowedHosts:   tc.allowedHosts,
				AllowedOrigins: []string{"*"}, // Set wildcard origins to isolate host testing
			})
			require.NoError(t, err)
			tsServer := httptest.NewServer(s.Handler())
			t.Cleanup(tsServer.Close)

			// Test CORS preflight request
			req, err := http.NewRequest("OPTIONS", tsServer.URL+"/status", nil)
			require.NoError(t, err)

			if tc.hostHeader != "" {
				req.Host = tc.hostHeader
			}