Merge pull request #1651 from pmcelhaney/copilot/create-failing-tests-for-bugs

Bug Hunt: issue proposals documenting 3 bugs

Author: pmcelhaney

.github/issue-proposals/bug-dispatcher-proxy-throws-on-json-post.md

@@ -0,0 +1,45 @@
+---
+title: "Bug: Dispatcher proxy() always throws when request body is present"
+parentIssue: 1650
+labels:
+  - bug
+assignees: []
+milestone:
+---
+
+The `proxy()` helper inside `Dispatcher.request()` is meant to reject non-JSON requests with a helpful error. The guard is:
+
+```ts
+if (body !== undefined && headers.contentType !== "application/json") {
+  throw new Error(...);
+}
+```
+
+The problem is `headers.contentType` (camelCase). HTTP headers use kebab-case (`content-type`), and the `headers` object never has a `contentType` key. `headers.contentType` is always `undefined`, so `undefined !== "application/json"` is always `true`.
+
+The entire condition reduces to `body !== undefined`, meaning the proxy throws for **every** request that carries a body — including valid `application/json` POST requests.
+
+## Failing test
+
+Added in `test/server/dispatcher.proxy.test.ts`:
+
+```
+does not throw when proxying a POST request with a JSON body and content-type: application/json
+```
+
+Run `yarn test` and look for that test name in the `a dispatcher passes a proxy function to the operation` describe block.
+
+## Root cause
+
+```ts
+// src/server/dispatcher.ts
+if (body !== undefined && headers.contentType !== "application/json") {
+  //                             ^^^^^^^^^^^^^ should be headers["content-type"]
+```
+
+## Acceptance criteria
+
+- [ ] `headers.contentType` is replaced with `headers["content-type"]`
+- [ ] The previously failing test passes
+- [ ] The existing proxy test continues to pass
+- [ ] A POST request with a non-JSON content type is still rejected with the descriptive error

.github/issue-proposals/bug-tools-accepts-ignores-lowercase-accept-header.md

@@ -0,0 +1,35 @@
+---
+title: "Bug: Tools.accepts() ignores lowercase 'accept' header — always returns true in production"
+parentIssue: 1650
+labels:
+  - bug
+assignees: []
+milestone:
+---
+
+`Tools.accepts()` reads `this.headers.Accept` (capital A). Node.js normalises all incoming HTTP header names to **lowercase**, so when a real HTTP request is processed via Koa the header is stored under `accept` (lowercase). `this.headers.Accept` is therefore always `undefined` in production.
+
+Because `undefined` triggers the early-return guard `if (acceptHeader === "" || acceptHeader === undefined) { return true; }`, the method unconditionally returns `true` — completely ignoring the client's actual Accept header.
+
+## Failing test
+
+Added in `test/server/tools.test.ts`:
+
+```
+accepts('application/json') returns false when lowercase 'accept' header is 'text/plain'
+```
+
+Run `yarn test` and look for that test name in the `tools` describe block.
+
+## Root cause
+
+```ts
+// src/server/tools.ts
+const acceptHeader = this.headers.Accept; // ← should be this.headers.accept
+```
+
+## Acceptance criteria
+
+- [ ] `this.headers.Accept` is replaced by a case-insensitive lookup (or lowercased key lookup) so that `accept`, `Accept`, and `ACCEPT` all work
+- [ ] The previously failing test passes
+- [ ] All other `accepts()` tests continue to pass

.github/issue-proposals/bug-tools-accepts-whitespace-in-accept-header.md

@@ -0,0 +1,39 @@
+---
+title: "Bug: Tools.accepts() fails when Accept header has spaces after commas"
+parentIssue: 1650
+labels:
+  - bug
+assignees: []
+milestone:
+---
+
+A well-formed HTTP Accept header commonly separates values with `", "` (comma followed by a space), e.g. `"text/html, application/json"`.
+
+`Tools.accepts()` splits on `","` but does **not** trim whitespace from each part. This produces `[" application/json"]` (with a leading space) as the second element. When that is further split on `"/"`, the type becomes `" application"` rather than `"application"`, so the comparison against the requested content type always fails and `accepts()` returns `false` even when the type is listed in the Accept header.
+
+## Failing test
+
+Added in `test/server/tools.test.ts`:
+
+```
+accepts('application/json') returns true when Accept header is 'text/html, application/json' (with space)
+```
+
+Run `yarn test` and look for that test name in the `tools` describe block.
+
+## Root cause
+
+```ts
+// src/server/tools.ts
+const acceptTypes = String(acceptHeader).split(",");
+return acceptTypes.some((acceptType) => {
+  const [type, subtype] = acceptType.split("/"); // " application" has a leading space
+  ...
+});
+```
+
+## Acceptance criteria
+
+- [ ] Each token is trimmed (e.g. `acceptType.trim()`) before being split on `"/"`
+- [ ] The previously failing test passes
+- [ ] All other `accepts()` tests continue to pass