113 lines · 3 KBtext/plain; charset=utf-8
The Coline App SDK: apps, tools, file types and surfaces that run inside Coline workspaces, and public websites with Coline Sites. TypeScript, with an in-memory test workspace. MIT.
| 5 |
| parseSignedColineRequest, |
| 6 | } from "./hosted-runtime"; |
| 7 | import { createSignedAppRequestHeaders } from "../server/signing"; |
| 8 |
| 9 | describe("hosted runtime helpers", () => { |
| 10 | it("builds typed hosted action responses", () => { |
| 11 | expect(hostedActionResults.ok()).toEqual({ type: "ok" }); |
| 12 | expect(hostedActionResults.refresh()).toEqual({ type: "refresh" }); |
| 13 | expect(hostedActionResults.navigate("/acme")).toEqual({ |
| 14 | type: "navigate", |
| 15 | href: "/acme", |
| 16 | }); |
| 17 | expect(hostedActionResults.openFile("file_123")).toEqual({ |
| 18 | type: "open_file", |
| 19 | fileId: "file_123", |
| 20 | }); |
| 21 | }); |
| 22 |
| 23 | it("verifies and parses signed hosted runtime requests", async () => { |
| 24 | const secret = "1234567890abcdef1234567890abcdef"; |
| 25 | const body = JSON.stringify({ |
| 26 | workspace: { |
| 27 | id: "workspace_123", |
| 28 | slug: "acme", |
| 29 | name: "Acme", |
| 30 | }, |
| 31 | app: { |
| 32 | appInstallId: "install_123", |
| 33 | appId: "app_123", |
| 34 | appKey: "acme-crm", |
| 35 | name: "CRM", |
| 36 | }, |
| 37 | actor: { |
| 38 | userId: "user_123", |
| 39 | email: "user@example.com", |
| 40 | }, |
| 41 | action: { |
| 42 | type: "crm.sync", |
| 43 | }, |
| 44 | }); |
| 45 |
| 46 | const headers = await createSignedAppRequestHeaders({ |
| 47 | secret, |
| 48 | body, |
| 49 | deliveryId: "delivery_123", |
| 50 | }); |
| 51 |
| 52 | const result = await parseSignedColineRequest({ |
| 53 | request: new Request("https://example.com/coline/actions", { |
| 54 | method: "POST", |
| 55 | headers: { |
| 56 | "Content-Type": "application/json", |
| 57 | ...headers, |
| 58 | }, |
| 59 | body, |
| 60 | }), |
| 61 | secret, |
| 62 | schema: colineHostedActionRequestSchema, |
| 63 | }); |
| 64 |
| 65 | expect(result.deliveryId).toBe("delivery_123"); |
| 66 | expect(result.data.action.type).toBe("crm.sync"); |
| 67 | }); |
| 68 |
| 69 | it("rejects stale signed hosted runtime requests", async () => { |
| 70 | const secret = "1234567890abcdef1234567890abcdef"; |
| 71 | const body = JSON.stringify({ |
| 72 | workspace: { |
| 73 | id: "workspace_123", |
| 74 | slug: "acme", |
| 75 | name: "Acme", |
| 76 | }, |
| 77 | app: { |
| 78 | appInstallId: "install_123", |
| 79 | appId: "app_123", |
| 80 | appKey: "acme-crm", |
| 81 | name: "CRM", |
| 82 | }, |
| 83 | action: { |
| 84 | type: "crm.sync", |
| 85 | }, |
| 86 | }); |
| 87 | const timestamp = "2026-06-04T12:00:00.000Z"; |
| 88 |
| 89 | const headers = await createSignedAppRequestHeaders({ |
| 90 | secret, |
| 91 | body, |
| 92 | deliveryId: "delivery_123", |
| 93 | timestamp, |
| 94 | }); |
| 95 |
| 96 | await expect( |
| 97 | parseSignedColineRequest({ |
| 98 | request: new Request("https://example.com/coline/actions", { |
| 99 | method: "POST", |
| 100 | headers: { |
| 101 | "Content-Type": "application/json", |
| 102 | ...headers, |
| 103 | }, |
| 104 | body, |
| 105 | }), |
| 106 | secret, |
| 107 | schema: colineHostedActionRequestSchema, |
| 108 | now: new Date("2026-06-04T12:06:00.000Z"), |
| 109 | }), |
| 110 | ).rejects.toThrow("Coline request timestamp is too old or invalid."); |
| 111 | }); |
| 112 | }); |
| 113 |