Add tests for denying access to .dev.vars in subdirectories (#9725)

Author: jamesopstad

packages/vite-plugin-cloudflare/playground/sensitive-files/__tests__/sensitive-files.spec.ts

@@ -22,6 +22,16 @@ describe.skipIf(isBuild)("denies access to sensitive files in dev", () => {
 		expect(response.status()).toBe(403);
 	});
 
+	test("denies access to .dev.vars in subdirectory", async () => {
+		const response = await getResponse("/worker-b/.dev.vars");
+		expect(response.status()).toBe(403);
+	});
+
+	test("denies access to .dev.vars.* in subdirectory", async () => {
+		const response = await getResponse("/worker-b/.dev.vars.staging");
+		expect(response.status()).toBe(403);
+	});
+
 	test("denies access to custom-sensitive-file", async () => {
 		const response = await getResponse("/custom-sensitive-file");
 		expect(response.status()).toBe(403);
@@ -31,26 +41,26 @@ describe.skipIf(isBuild)("denies access to sensitive files in dev", () => {
 describe.runIf(isBuild)("doesn't serve sensitive files in preview", () => {
 	test("doesn't serve .env", async () => {
 		const response = await getTextResponse("/.env");
-		expect(response).toBe("Worker response");
+		expect(response).toBe("Worker A response");
 	});
 
 	test("doesn't serve .env.*", async () => {
 		const response = await getTextResponse("/.env.staging");
-		expect(response).toBe("Worker response");
+		expect(response).toBe("Worker A response");
 	});
 
 	test("doesn't serve .dev.vars", async () => {
 		const response = await getTextResponse("/.dev.vars");
-		expect(response).toBe("Worker response");
+		expect(response).toBe("Worker A response");
 	});
 
 	test("doesn't serve .dev.vars.*", async () => {
 		const response = await getTextResponse("/.dev.vars.staging");
-		expect(response).toBe("Worker response");
+		expect(response).toBe("Worker A response");
 	});
 
 	test("doesn't serve custom-sensitive-file", async () => {
 		const response = await getTextResponse("/custom-sensitive-file");
-		expect(response).toBe("Worker response");
+		expect(response).toBe("Worker A response");
 	});
 });

packages/vite-plugin-cloudflare/playground/sensitive-files/tsconfig.worker.json

@@ -1,4 +1,4 @@
 {
 	"extends": ["@cloudflare/workers-tsconfig/worker.json"],
-	"include": ["src"]
+	"include": ["worker-a", "worker-b"]
 }

packages/vite-plugin-cloudflare/playground/sensitive-files/vite.config.ts

@@ -7,5 +7,11 @@ export default defineConfig({
 			deny: ["custom-sensitive-file"],
 		},
 	},
-	plugins: [cloudflare({ inspectorPort: false, persistState: false })],
+	plugins: [
+		cloudflare({
+			inspectorPort: false,
+			persistState: false,
+			auxiliaryWorkers: [{ configPath: "./worker-b/wrangler.jsonc" }],
+		}),
+	],
 });

packages/vite-plugin-cloudflare/playground/sensitive-files/worker-a/index.ts

@@ -0,0 +1,15 @@
+interface Env {
+	WORKER_B: Fetcher;
+}
+
+export default {
+	async fetch(request, env) {
+		const url = new URL(request.url);
+
+		if (url.pathname === "/worker-b") {
+			return env.WORKER_B.fetch(request);
+		}
+
+		return new Response("Worker A response");
+	},
+} satisfies ExportedHandler<Env>;

packages/vite-plugin-cloudflare/playground/sensitive-files/worker-b/.dev.vars

@@ -0,0 +1 @@
+DEV_VAR=dev-var

packages/vite-plugin-cloudflare/playground/sensitive-files/worker-b/.dev.vars.staging

@@ -0,0 +1 @@
+STAGING_DEV_VAR=staging-dev-var

packages/vite-plugin-cloudflare/playground/sensitive-files/src/index.ts renamed to packages/vite-plugin-cloudflare/playground/sensitive-files/worker-b/index.ts

@@ -1,5 +1,5 @@
 export default {
 	async fetch() {
-		return new Response("Worker response");
+		return new Response("Worker B response");
 	},
 } satisfies ExportedHandler;

packages/vite-plugin-cloudflare/playground/sensitive-files/worker-b/wrangler.jsonc

@@ -0,0 +1,5 @@
+{
+	"name": "worker-b",
+	"main": "./index.ts",
+	"compatibility_date": "2024-12-30",
+}

packages/vite-plugin-cloudflare/playground/sensitive-files/wrangler.jsonc

@@ -1,5 +1,11 @@
 {
-	"name": "worker",
-	"main": "./src/index.ts",
+	"name": "worker-a",
+	"main": "./worker-a/index.ts",
 	"compatibility_date": "2024-12-30",
+	"services": [
+		{
+			"binding": "WORKER_B",
+			"service": "worker-b",
+		},
+	],
 }