test CORS preflight handling

2026-09-06 18:00:12 +03:00
parent d579d1f0f4
commit 0e1ee33606
1 changed files with 4 additions and 1 deletions
@@ -26,7 +26,10 @@ before(async()=>{
 });
 after(async()=>{if(child){child.kill();await new Promise(r=>child.once('exit',r));}rmSync(dir,{recursive:true,force:true});});
 test('HTTP preparation requires auth, persists draft and rejects stale revisions',async()=>{
- const unauthorized=await request('/api/me/tender-state','GET',null,null);
+ const preflight=await fetch(base+'/api/me/plan',{method:'OPTIONS',headers:{Origin:'https://client.example', 'Access-Control-Request-Method':'GET', 'Access-Control-Request-Headers':'authorization,content-type'}});
+ assert.equal(preflight.status,204);
+ assert.equal(preflight.headers.get('access-control-allow-headers'),'Authorization,Content-Type');
+  const unauthorized=await request('/api/me/tender-state','GET',null,null);
 assert.equal(unauthorized.status,401);
 assert.equal(unauthorized.headers.get('x-content-type-options'),'nosniff');
 assert.equal(unauthorized.headers.get('referrer-policy'),'no-referrer');