1import { normalizeDeploymentBase, pathWithinDeploymentBase } from "./base-path.ts";23function assertEquals(actual: unknown, expected: unknown): void {4 if (actual !== expected) {5 throw new Error(`expected ${String(expected)}, received ${String(actual)}`);6 }7}89Deno.test("deployment bases are absolute and have one trailing slash", () => {10 assertEquals(normalizeDeploymentBase(undefined), "/");11 assertEquals(normalizeDeploymentBase("/"), "/");12 assertEquals(normalizeDeploymentBase(" /field-notes "), "/field-notes/");13 assertEquals(normalizeDeploymentBase("/teams/notes/"), "/teams/notes/");14});1516Deno.test("deployment bases reject origins, traversal, and URL suffixes", () => {17 for (18 const input of [19 "notes",20 "//example.com/notes",21 "/../notes",22 "/%2e%2e/notes",23 "/notes?x=1",24 "/notes#top",25 "/notes\\admin",26 ]27 ) {28 let rejected = false;29 try {30 normalizeDeploymentBase(input);31 } catch {32 rejected = true;33 }34 if (!rejected) throw new Error(`expected ${JSON.stringify(input)} to be rejected`);35 }36});3738Deno.test("request paths resolve only inside the deployment base", () => {39 assertEquals(pathWithinDeploymentBase("/field-notes/", "/field-notes/"), "");40 assertEquals(pathWithinDeploymentBase("/field-notes/settings/", "/field-notes/"), "settings/");41 assertEquals(pathWithinDeploymentBase("/field-notes", "/field-notes/"), "");42 assertEquals(pathWithinDeploymentBase("/other/", "/field-notes/"), null);43 assertEquals(pathWithinDeploymentBase("/settings/", "/"), "settings/");44});