gongxue-base/scripts/remote-tenant-cors-smoke-test.js

import assert from 'node:assert/strict';
import http from 'node:http';
import { runRemoteTenantCorsSmoke } from './remote-tenant-cors-smoke.js';

const origins = {
  active: 'https://active.gongxue100.test',
  disabled: 'https://disabled.gongxue100.test',
  unknown: 'https://unknown.gongxue100.test',
};

function json(res, status, payload, headers = {}) {
  res.writeHead(status, { 'content-type': 'application/json', ...headers });
  res.end(JSON.stringify(payload));
}

const server = http.createServer((req, res) => {
  const origin = req.headers.origin || '';
  if (req.url === '/health' && req.method === 'GET' && !origin) {
    json(res, 200, { ok: true });
    return;
  }
  if (req.method === 'OPTIONS' && req.url === '/api/tenant/resolve') {
    if (origin === origins.active) {
      res.writeHead(204, {
        'access-control-allow-origin': origin,
        'access-control-allow-methods': 'GET,POST,OPTIONS',
        vary: 'Origin',
      });
      res.end();
      return;
    }
    json(res, 403, { code: 'CORS_ORIGIN_DENIED' });
    return;
  }
  json(res, 404, { code: 'NOT_FOUND' });
});

await new Promise(resolve => server.listen(0, '127.0.0.1', resolve));
try {
  const address = server.address();
  const summary = await runRemoteTenantCorsSmoke(
    {
      apiBaseUrl: `http://127.0.0.1:${address.port}`,
      activeOrigin: origins.active,
      disabledOrigin: origins.disabled,
      unknownOrigin: origins.unknown,
      timeoutMs: 5_000,
    },
    { quiet: true },
  );
  assert.deepEqual(summary, {
    failed: 0,
    activeTenantOriginAllowed: true,
    unknownOriginDenied: true,
    disabledOriginDenied: true,
    noOriginHealthAllowed: true,
    statuses: { active: 204, disabled: 403, unknown: 403, health: 200 },
  });
  console.log('[PASS] remote dynamic tenant CORS smoke script');
} finally {
  await new Promise(resolve => server.close(resolve));
}