serve-static.test.ts

import { Hono } from 'hono'
import request from 'supertest'
import { chmodSync, rmSync, statSync, symlinkSync } from 'node:fs'
import path from 'node:path'
import { serveStatic } from './../src/serve-static'
import { createAdaptorServer } from './../src/server'

describe('Serve Static Middleware', () => {
  const app = new Hono<{
    Variables: {
      path: string
    }
  }>()

  app.use(
    '/static/*',
    serveStatic({
      root: './test/assets',
      onFound: (path, c) => {
        c.header('X-Custom', `Found the file at ${path}`)
        if (c.req.query('type')) {
          c.header('Content-Type', c.req.query('type'))
        }
      },
    })
  )
  app.use('/favicon.ico', serveStatic({ path: './test/assets/favicon.ico' }))
  app.use(
    '/dot-static/*',
    serveStatic({
      root: './test/assets',
      rewriteRequestPath: (path) => path.replace(/^\/dot-static/, '/.static'),
    })
  )

  app.use(
    '/static-with-context-path-route/*',
    async (c, next) => {
      c.set('path', '/static-with-context-path')
      await next()
    },
    serveStatic({
      root: './test/assets',
      rewriteRequestPath: (path, c) =>
        path.replace('static-with-context-path-route', c.get('path')),
    })
  )

  let notFoundMessage = ''
  app.use(
    '/on-not-found/*',
    serveStatic({
      root: './not-found',
      onNotFound: (path, c) => {
        notFoundMessage = `${path} is not found, request to ${c.req.path}`
      },
    })
  )

  app.use(
    '/static-with-precompressed/*',
    serveStatic({
      root: './test/assets',
      precompressed: true,
    })
  )

  const server = createAdaptorServer(app)

  it('Should return index.html', async () => {
    const res = await request(server).get('/static/')
    expect(res.status).toBe(200)
    expect(res.text).toBe('<h1>Hello Hono</h1>')
    expect(res.headers['content-type']).toBe('text/html; charset=utf-8')
    expect(res.headers['x-custom']).toMatch(
      /Found the file at test[\/\\]assets[\/\\]static[\/\\]index\.html$/
    )
  })

  it('Should return hono.html', async () => {
    const res = await request(server).get('/static/hono.html')
    expect(res.status).toBe(200)
    expect(res.text).toBe('<h1>This is Hono.html</h1>')
    expect(res.headers['content-type']).toBe('text/html; charset=utf-8')
  })

  it('Should return correct headers for icons', async () => {
    const res = await request(server).get('/favicon.ico')
    expect(res.status).toBe(200)
    expect(res.headers['content-type']).toBe('image/x-icon')
  })

  it('Should return correct headers and data for json files', async () => {
    const res = await request(server).get('/static/data.json')
    expect(res.status).toBe(200)
    expect(res.body).toEqual({
      id: 1,
      name: 'Foo Bar',
      flag: true,
    })
    expect(res.headers['content-type']).toBe('application/json')
  })

  it('Should return correct headers and data for text', async () => {
    const res = await request(server).get('/static/plain.txt')
    const stats = statSync(path.join(__dirname, 'assets', 'static', 'plain.txt'))
    expect(res.status).toBe(200)
    expect(res.headers['content-type']).toBe('text/plain; charset=utf-8')
    expect(res.headers['last-modified']).toBe(stats.mtime.toUTCString())
    expect(res.text).toBe('This is plain.txt')
  })

  it('Should return 404 for non-existent files', async () => {
    const res = await request(server).get('/static/does-not-exist.html')
    expect(res.status).toBe(404)
    expect(res.headers['content-type']).toBe('text/plain; charset=UTF-8')
    expect(res.text).toBe('404 Not Found')
  })

  it('Should return 200 with rewriteRequestPath', async () => {
    const res = await request(server).get('/dot-static/plain.txt')
    expect(res.status).toBe(200)
    expect(res.headers['content-type']).toBe('text/plain; charset=utf-8')
    expect(res.text).toBe('This is plain.txt')
  })

  it('Should return 404 with rewriteRequestPath', async () => {
    const res = await request(server).get('/dot-static/does-no-exists.txt')
    expect(res.status).toBe(404)
  })

  it('Should return 200 with rewriteRequestPath with the context', async () => {
    const res = await request(server).get('/static-with-context-path-route/plain.txt')
    expect(res.status).toBe(200)
    expect(res.headers['content-type']).toBe('text/plain; charset=utf-8')
    expect(res.text).toBe('This is plain.txt')
  })

  it('Should return 200 response to HEAD request', async () => {
    const res = await request(server).head('/static/plain.txt')
    const stats = statSync(path.join(__dirname, 'assets', 'static', 'plain.txt'))
    expect(res.status).toBe(200)
    expect(res.headers['content-type']).toBe('text/plain; charset=utf-8')
    expect(res.headers['content-length']).toBe('17')
    expect(res.headers['last-modified']).toBe(stats.mtime.toUTCString())
    expect(res.text).toBe(undefined)
  })

  it('Should return correct headers and data with range headers', async () => {
    let res = await request(server).get('/static/plain.txt').set('range', '0-9')
    const stats = statSync(path.join(__dirname, 'assets', 'static', 'plain.txt'))
    expect(res.status).toBe(206)
    expect(res.headers['content-type']).toBe('text/plain; charset=utf-8')
    expect(res.headers['content-length']).toBe('10')
    expect(res.headers['content-range']).toBe('bytes 0-9/17')
    expect(res.headers['last-modified']).toBe(stats.mtime.toUTCString())
    expect(res.headers['date']).not.toBe(stats.mtime.toUTCString())
    expect(res.headers['date']).not.toBe(stats.birthtime.toUTCString())
    expect(res.text.length).toBe(10)
    expect(res.text).toBe('This is pl')

    res = await request(server).get('/static/plain.txt').set('range', '10-16')
    expect(res.status).toBe(206)
    expect(res.headers['content-type']).toBe('text/plain; charset=utf-8')
    expect(res.headers['content-length']).toBe('7')
    expect(res.headers['content-range']).toBe('bytes 10-16/17')
    expect(res.text.length).toBe(7)
    expect(res.text).toBe('ain.txt')
  })

  it('Should return correct headers and data if client range exceeds the data size', async () => {
    const res = await request(server).get('/static/plain.txt').set('range', '0-20')
    expect(res.status).toBe(206)
    expect(res.headers['content-type']).toBe('text/plain; charset=utf-8')
    expect(res.headers['content-length']).toBe('17')
    expect(res.headers['content-range']).toBe('bytes 0-16/17')
    expect(res.text.length).toBe(17)
    expect(res.text).toBe('This is plain.txt')
  })

  it('Should handle invalid range header gracefully without NaN error', async () => {
    const res = await request(server).get('/static/plain.txt').set('range', 'hello')
    expect(res.status).toBe(206)
    expect(res.headers['content-length']).toBe('17')
    expect(res.headers['content-range']).toBe('bytes 0-16/17')
  })

  it('Should return the last N bytes for a suffix range', async () => {
    const res = await request(server).get('/static/plain.txt').set('range', 'bytes=-5')
    expect(res.status).toBe(206)
    expect(res.headers['content-length']).toBe('5')
    expect(res.headers['content-range']).toBe('bytes 12-16/17')
    expect(res.text).toBe('n.txt')
  })

  it('Should return the whole file for a suffix range exceeding the file size', async () => {
    const res = await request(server).get('/static/plain.txt').set('range', 'bytes=-100')
    expect(res.status).toBe(206)
    expect(res.headers['content-range']).toBe('bytes 0-16/17')
    expect(res.text).toBe('This is plain.txt')
  })

  it('Should return exactly 1 byte for range bytes=0-0', async () => {
    const res = await request(server).get('/static/plain.txt').set('range', 'bytes=0-0')
    expect(res.status).toBe(206)
    expect(res.headers['content-length']).toBe('1')
    expect(res.headers['content-range']).toBe('bytes 0-0/17')
    expect(res.text).toBe('T')
  })

  it('Should return 416 when the range start is beyond the end of the file', async () => {
    const res = await request(server).get('/static/plain.txt').set('range', 'bytes=100-200')
    expect(res.status).toBe(416)
    expect(res.headers['content-range']).toBe('bytes */17')
  })

  it('Should return 416 when the range start is beyond the file size, even if the window is small', async () => {
    const res = await request(server).get('/static/plain.txt').set('range', 'bytes=20-25')
    expect(res.status).toBe(416)
    expect(res.headers['content-range']).toBe('bytes */17')
  })

  it('Should return 416 when the range start is after the range end', async () => {
    const res = await request(server).get('/static/plain.txt').set('range', 'bytes=10-5')
    expect(res.status).toBe(416)
    expect(res.headers['content-range']).toBe('bytes */17')
  })

  it('Should return 416 for a zero-length suffix range', async () => {
    const res = await request(server).get('/static/plain.txt').set('range', 'bytes=-0')
    expect(res.status).toBe(416)
    expect(res.headers['content-range']).toBe('bytes */17')
  })

  it.each(['bytes=0-1x', 'bytes=x-1', 'bytes=0-1-2', 'bytes=-5-extra'])(
    'Should treat a malformed range as the whole file: %s',
    async (range) => {
      const res = await request(server).get('/static/plain.txt').set('range', range)
      expect(res.status).toBe(206)
      expect(res.headers['content-range']).toBe('bytes 0-16/17')
      expect(res.text).toBe('This is plain.txt')
    }
  )

  it('Should return 416 instead of crashing for a range request on an empty file', async () => {
    const res = await request(server).get('/static/foo..bar.txt').set('range', 'bytes=0-0')
    expect(res.status).toBe(416)
    expect(res.headers['content-range']).toBe('bytes */0')
  })

  it('Should return 416 instead of crashing for a malformed range on an empty file', async () => {
    const res = await request(server).get('/static/foo..bar.txt').set('range', 'hello')
    expect(res.status).toBe(416)
    expect(res.headers['content-range']).toBe('bytes */0')
  })

  it('Should handle the `onNotFound` option', async () => {
    const res = await request(server).get('/on-not-found/foo.txt')
    expect(res.status).toBe(404)
    expect(notFoundMessage).toMatch(
      /not-found[\/\\]on-not-found[\/\\]foo\.txt is not found, request to \/on-not-found\/foo\.txt$/
    )
  })

  it('Should handle the `onFound` option', async () => {
    const res = await request(server).get(
      '/static/data.json?type=application/json;%20charset=utf-8'
    )
    expect(res.status).toBe(200)
    expect(res.headers['content-type']).toBe('application/json; charset=utf-8')
  })

  it('Should handle double dots in URL', async () => {
    const res = await request(server).get('/static/../secret.txt')
    expect(res.status).toBe(404)
  })

  // Skip on Windows as symlink behavior is different
  ;(process.platform === 'win32' ? it.skip : it)('Should follow symlinks', async () => {
    const symlinkPath = path.join(__dirname, 'assets', 'static', 'symlink.html')
    const symlinkTarget = path.join(__dirname, 'assets', 'static', 'index.html')
    try {
      // force: true so it doesn't throw if the symlink doesn't exist
      rmSync(symlinkPath, { force: true })
      symlinkSync(symlinkTarget, symlinkPath)

      const res = await request(server).get('/static/symlink.html')
      expect(res.status).toBe(200)
      expect(res.text).toBe('<h1>Hello Hono</h1>')
    } finally {
      rmSync(symlinkPath, { force: true })
    }
  })

  it('Should handle URIError thrown while decoding URI component', async () => {
    const res = await request(server).get('/static/%c0%afsecret.txt')
    expect(res.status).toBe(404)
  })

  it('Should handle an extension less files', async () => {
    const res = await request(server).get('/static/extensionless')
    expect(res.status).toBe(200)
    expect(res.headers['content-type']).toBe('application/octet-stream')
    expect(res.body.toString()).toBe('Extensionless')
  })

  it('Should return a pre-compressed zstd response - /static-with-precompressed/hello.txt', async () => {
    // Check if it returns a normal response
    let res = await request(server).get('/static-with-precompressed/hello.txt')
    let stats = statSync(path.join(__dirname, 'assets', 'static-with-precompressed', 'hello.txt'))
    expect(res.status).toBe(200)
    expect(res.headers['content-length']).toBe('20')
    expect(res.headers['last-modified']).toBe(stats.mtime.toUTCString())
    expect(res.text).toBe('Hello Not Compressed')

    res = await request(server)
      .get('/static-with-precompressed/hello.txt')
      .set('Accept-Encoding', 'zstd')
    stats = statSync(path.join(__dirname, 'assets', 'static-with-precompressed', 'hello.txt.zst'))
    expect(res.status).toBe(200)
    expect(res.headers['content-length']).toBe('21')
    expect(res.headers['content-encoding']).toBe('zstd')
    expect(res.headers['last-modified']).toBe(stats.mtime.toUTCString())
    expect(res.headers['vary']).toBe('Accept-Encoding')
    expect(res.text).toBe('Hello zstd Compressed')
  })

  it('Should return a pre-compressed brotli response - /static-with-precompressed/hello.txt', async () => {
    const res = await request(server)
      .get('/static-with-precompressed/hello.txt')
      .set('Accept-Encoding', 'wompwomp, gzip, br, deflate, zstd')
    expect(res.status).toBe(200)
    expect(res.headers['content-length']).toBe('23')
    expect(res.headers['content-encoding']).toBe('br')
    expect(res.headers['vary']).toBe('Accept-Encoding')
    expect(res.text).toBe('Hello br Compressed')
  })

  it('Should not return a pre-compressed response - /static-with-precompressed/hello.txt', async () => {
    const res = await request(server)
      .get('/static-with-precompressed/hello.txt')
      .set('Accept-Encoding', 'wompwomp, unknown')
    expect(res.status).toBe(200)
    expect(res.headers['content-encoding']).toBeUndefined()
    expect(res.headers['vary']).toBeUndefined()
    expect(res.text).toBe('Hello Not Compressed')
  })

  it('Should return a pre-compressed response for an octet-stream file - /static-with-precompressed/hello.bin', async () => {
    const res = await request(server)
      .get('/static-with-precompressed/hello.bin')
      .set('Accept-Encoding', 'gzip, br, zstd')
    expect(res.status).toBe(200)
    expect(res.headers['content-type']).toBe('application/octet-stream')
    expect(res.headers['content-length']).toBe('23')
    expect(res.headers['content-encoding']).toBe('br')
    expect(res.headers['vary']).toBe('Accept-Encoding')
    expect(res.body.toString()).toBe('Hello br Compressed')
  })

  describe('Absolute path', () => {
    const rootPaths = [
      path.join(__dirname, 'assets'),
      __dirname + path.sep + '..' + path.sep + 'test' + path.sep + 'assets',
    ]
    rootPaths.forEach((root) => {
      describe(root, () => {
        const app = new Hono()
        const server = createAdaptorServer(app)
        app.use('/static/*', serveStatic({ root }))
        app.use('/favicon.ico', serveStatic({ path: root + path.sep + 'favicon.ico' }))

        it('Should return index.html', async () => {
          const res = await request(server).get('/static')
          expect(res.status).toBe(200)
          expect(res.headers['content-type']).toBe('text/html; charset=utf-8')
          expect(res.text).toBe('<h1>Hello Hono</h1>')
        })

        it('Should return correct headers and data for text', async () => {
          const res = await request(server).get('/static/plain.txt')
          expect(res.status).toBe(200)
          expect(res.headers['content-type']).toBe('text/plain; charset=utf-8')
          expect(res.text).toBe('This is plain.txt')
        })
        it('Should return correct headers for icons', async () => {
          const res = await request(server).get('/favicon.ico')
          expect(res.status).toBe(200)
          expect(res.headers['content-type']).toBe('image/x-icon')
        })
      })
    })
  })

  describe('Root and path combination tests', () => {
    const rootPaths = [
      path.join(__dirname, 'assets'),
      path.join(__dirname, 'assets'),
      __dirname + path.sep + '..' + path.sep + 'test' + path.sep + 'assets',
    ]
    const optionPaths = ['favicon.ico', '/favicon.ico']
    rootPaths.forEach((root) => {
      optionPaths.forEach((optionPath) => {
        describe(`${root} + ${optionPath}`, () => {
          const app = new Hono()
          const server = createAdaptorServer(app)

          app.use(
            '/favicon.ico',
            serveStatic({
              root,
              path: optionPath,
            })
          )

          it('Should return 200 response if both root and path set', async () => {
            const res = await request(server).get('/favicon.ico')
            expect(res.status).toBe(200)
            expect(res.headers['content-type']).toBe('image/x-icon')
          })
        })
      })
    })
  })

  describe('Path traversal security tests', () => {
    const app = new Hono()
    const server = createAdaptorServer(app)
    app.use('/static/*', serveStatic({ root: './test/assets' }))

    it('Should prevent path traversal attacks with double dots', async () => {
      const res = await request(server).get('/static/../secret.txt')
      expect(res.status).toBe(404)
    })

    it('Should prevent path traversal attacks with multiple levels', async () => {
      const res = await request(server).get('/static/../../package.json')
      expect(res.status).toBe(404)
    })

    it('Should prevent path traversal attacks with mixed separators', async () => {
      const res = await request(server).get('/static/..\\..\\package.json')
      expect(res.status).toBe(404)
    })

    it('Should prevent path traversal attacks with encoded dots', async () => {
      const res = await request(server).get('/static/%2e%2e%2fsecret.txt')
      expect(res.status).toBe(404)
    })

    it('Should accept filename with double dots', async () => {
      const res = await request(server).get('/static/foo..bar.txt')
      expect(res.status).toBe(200)
    })
  })

  describe('Path mismatch security tests', () => {
    const app = new Hono()
    const server = createAdaptorServer(app)

    app.use('/static/admin/*', async (c, next) => {
      c.header('X-Authorized', 'true')
      await next()
    })

    app.use('/static/*', serveStatic({ root: './test/assets' }))

    it('Should not allow bypass via path mismatch between middleware and serveStatic', async () => {
      const res = await request(server).get('/static/admin/secret.txt')
      expect(res.headers['x-authorized']).toBe('true')
      expect(res.text).toBe('secret')

      const res2 = await request(server).get('/static/admin%2Fsecret.txt')
      expect(res2.status).toBe(404)
      expect(res2.headers['x-authorized']).toBeUndefined()
      expect(res2.text).not.toBe('secret')

      const res3 = await request(server).get('/static//admin/secret.txt')
      expect(res3.status).toBe(404)

      const res4 = await request(server).get('/static/admin%5Csecret.txt')
      expect(res4.status).toBe(404)
      expect(res4.headers['x-authorized']).toBeUndefined()
      expect(res4.text).not.toBe('secret')
    })
  })

  describe('Stream error handling', () => {
    const testFile = path.join(__dirname, 'assets', 'static', 'plain.txt')
    console.log(testFile)
    let originalMode: number

    beforeEach(() => {
      const stats = statSync(testFile)
      originalMode = stats.mode
      // Remove read permission to trigger stream error
      chmodSync(testFile, 0o000)
    })

    afterEach(() => {
      chmodSync(testFile, originalMode)
    })

    // Skip on Windows as chmod doesn't work for file permissions
    ;(process.platform === 'win32' ? it.skip : it)(
      'Should handle read permission errors gracefully',
      async () => {
        const app = new Hono()
        app.use('/static/*', serveStatic({ root: './test/assets' }))
        const server = createAdaptorServer(app)
        await expect(request(server).get('/static/plain.txt')).rejects.toThrow()
      }
    )
  })
})

describe('Serve Static Middleware with wrong path', () => {
  it('Should show an error when the path is wrong', async () => {
    const logSpy = vi.spyOn(console, 'error')

    const app = new Hono<{
      Variables: {
        path: string
      }
    }>()

    app.use(
      '*',
      serveStatic({
        root: './public',
      })
    )

    expect(logSpy).toHaveBeenCalledWith(
      "serveStatic: root path './public' is not found, are you sure it's correct?"
    )
  })
})