chore(release): release v2.0.5

scripts/test-server-routes.mjs

@@ -0,0 +1,94 @@
+import assert from 'node:assert/strict';
+import {
+  ADMIN_METRICS_AUTH_RATE_LIMIT_PER_MINUTE,
+  HEALTH_RATE_LIMIT_PER_MINUTE,
+  healthCounts,
+  adminMetricsAuthCounts,
+  healthResponseCache,
+  httpServer,
+  rooms,
+  startServer,
+  stopServerForTests
+} from '../server/index.js';
+
+const adminToken = process.env.ADMIN_METRICS_TOKEN || 'test-admin-token-with-more-than-32-chars';
+const baseHeaders = { 'x-forwarded-for': '203.0.113.10' };
+
+function url(path) {
+  const address = httpServer.address();
+  return `http://127.0.0.1:${address.port}${path}`;
+}
+
+async function request(path, options = {}) {
+  return fetch(url(path), {
+    ...options,
+    headers: {
+      ...baseHeaders,
+      ...(options.headers || {})
+    }
+  });
+}
+
+try {
+  await startServer(0, '127.0.0.1');
+
+  let res = await request('/');
+  assert.equal(res.status, 200, 'root health endpoint should respond');
+  assert.equal(res.headers.get('cache-control'), 'no-store', 'root response should disable HTTP caching');
+  assert.deepEqual(await res.json(), { status: 'online', service: 'KoalaSync Relay' });
+
+  res = await request('/health');
+  assert.equal(res.status, 200, 'basic health endpoint should respond');
+  assert.equal(res.headers.get('cache-control'), 'no-store', 'basic health response should disable HTTP caching');
+  const basicHealth = await res.json();
+  assert.equal(basicHealth.status, 'ok', 'basic health should report ok');
+  assert.equal(basicHealth.rooms, 0, 'basic health should include room count');
+  assert.equal('peers' in basicHealth, false, 'basic health should not expose admin metrics');
+  assert.equal('memory' in basicHealth, false, 'basic health should not expose memory metrics');
+
+  rooms.set('route-test-room', {
+    peers: new Set(['socket-a', 'socket-b']),
+    peerData: new Map(),
+    peerIds: new Map(),
+    activeLobby: { expectedTitle: 'Episode 1', initiatorPeerId: 'peer-a', readyPeers: ['peer-a'] }
+  });
+  healthResponseCache.clear();
+  healthCounts.clear();
+
+  res = await request('/health', {
+    headers: { authorization: `Bearer ${adminToken}`, 'x-forwarded-for': '203.0.113.20' }
+  });
+  assert.equal(res.status, 200, 'authorized admin health endpoint should respond');
+  const adminHealth = await res.json();
+  assert.equal(adminHealth.rooms, 1, 'admin health should include room count');
+  assert.equal(adminHealth.peers, 2, 'admin health should include aggregate peer count');
+  assert.equal(adminHealth.roomsWithLobby, 1, 'admin health should include aggregate lobby count');
+  assert.equal(typeof adminHealth.memory?.rss, 'number', 'admin health should include aggregate memory metrics');
+  assert.equal('route-test-room' in adminHealth, false, 'admin health should not expose room identifiers');
+
+  healthCounts.clear();
+  adminMetricsAuthCounts.clear();
+  for (let i = 0; i < ADMIN_METRICS_AUTH_RATE_LIMIT_PER_MINUTE; i++) {
+    res = await request('/health', {
+      headers: { authorization: 'Bearer wrong-token', 'x-forwarded-for': '203.0.113.30' }
+    });
+    assert.equal(res.status, 200, `wrong admin bearer attempt ${i + 1} should still return basic health`);
+  }
+  res = await request('/health', {
+    headers: { authorization: 'Bearer wrong-token', 'x-forwarded-for': '203.0.113.30' }
+  });
+  assert.equal(res.status, 429, 'wrong admin bearer attempts should be throttled after the limit');
+
+  healthCounts.clear();
+  for (let i = 0; i < HEALTH_RATE_LIMIT_PER_MINUTE; i++) {
+    const path = i % 2 === 0 ? '/' : '/health';
+    res = await request(path, { headers: { 'x-forwarded-for': '203.0.113.40' } });
+    assert.equal(res.status, 200, `shared health request ${i + 1} should be allowed`);
+  }
+  res = await request('/', { headers: { 'x-forwarded-for': '203.0.113.40' } });
+  assert.equal(res.status, 429, 'root and health should share the public health rate limit');
+
+  console.log('server route tests passed');
+} finally {
+  await stopServerForTests();
+}