1import { env, SELF } from 'cloudflare:test'2import { deflate } from 'pako'3import { describe, expect, it } from 'vitest'4import { extractEditableDocument } from '../../../shared/svg/index.js'56function packedSvg(source: string): string {7 const bytes = deflate(new TextEncoder().encode(source), { level: 9 })8 let binary = ''9 for (const byte of bytes) binary += String.fromCharCode(byte)10 return btoa(binary).replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '')11}1213describe('diagram.zip shell', () => {14 it('serves the application at the root', async () => {15 const response = await SELF.fetch('https://diagram.zip/')1617 expect(response.status).toBe(200)18 expect(response.headers.get('content-type')).toContain('text/html')19 expect(response.headers.get('cache-control')).toBe('no-cache, no-transform')20 expect(await response.text()).toContain('<title>untitled.zip</title>')21 })2223 it('serves the application for a valid alias', async () => {24 const response = await SELF.fetch('https://diagram.zip/d/AbCdEfGhIjKlMnOp')2526 expect(response.status).toBe(200)27 expect(await response.text()).toContain('<div id="app"></div>')28 })2930 it('rejects malformed aliases and legacy Kroki routes', async () => {31 const malformedAlias = await SELF.fetch('https://diagram.zip/d/short')32 const legacyRenderer = await SELF.fetch('https://diagram.zip/plantuml/svg/example')3334 expect(malformedAlias.status).toBe(404)35 expect(legacyRenderer.status).toBe(404)36 })3738 it('serves a safe immutable editable SVG from a packed anonymous URL', async () => {39 const document = '{"diagram":{"options":{},"presentation":{"appearance":"raw","background":"","frame":false,"padding":0},"source":"graph TD\\n A --> B","type":"mermaid"},"metadata":{"description":"","title":"Packed draft"},"schema":1}'40 const source = `<svg xmlns="http://www.w3.org/2000/svg" data-dz-schema="1" data-dz-document="1"><metadata data-dz-kind="document" data-dz-schema="1">${document}</metadata><script>alert(1)</script><rect width="10" height="10" onload="alert(1)"/></svg>`41 const response = await SELF.fetch(`https://diagram.zip/svg/${packedSvg(source)}`)42 const body = await response.text()43 const embedded = extractEditableDocument(body) as { diagram: { presentation: { appearance: string } } }4445 expect(response.status).toBe(200)46 expect(body).toContain('data-dz-appearance=\"raw\"')47 expect(embedded.diagram.presentation.appearance).toBe('raw')48 expect(response.headers.get('content-type')).toContain('image/svg+xml')49 expect(response.headers.get('cache-control')).toBe('public, max-age=31536000, immutable')50 expect(response.headers.get('x-diagram-document')).toBe('editable-svg-1')51 expect(body).toContain('data-dz-document="1"')52 expect(body).toContain('Packed draft')53 expect(body).not.toContain('<script')54 expect(body).not.toContain('onload=')55 })5657 it('rejects malformed packed SVG payloads', async () => {58 const response = await SELF.fetch('https://diagram.zip/svg/not-deflate')5960 expect(response.status).toBe(400)61 expect(await response.text()).toBe('Invalid packed SVG.')62 })6364 it('does not restore the legacy root POST endpoint', async () => {65 const response = await SELF.fetch('https://diagram.zip/', {66 method: 'POST',67 body: 'diagram source',68 })6970 expect(response.status).toBe(404)71 })7273 it('exposes only the shell health check', async () => {74 const health = await SELF.fetch('https://diagram.zip/healthz')75 const legacyHealth = await SELF.fetch('https://diagram.zip/health')76 const metrics = await SELF.fetch('https://diagram.zip/metrics')7778 expect(health.status).toBe(200)79 expect(await health.text()).toBe('ok')80 expect(legacyHealth.status).toBe(404)81 expect(metrics.status).toBe(404)82 })8384 it('serves static assets through the asset binding', async () => {85 const response = await env.ASSETS.fetch('https://diagram.zip/icon.svg')8687 expect(response.status).toBe(200)88 expect(response.headers.get('content-type')).toContain('image/svg+xml')89 })90})