Merge branch 'main' into feat/transit-more-cities

src/search/geospatial.test.mjs

@@ -209,7 +209,11 @@ test('routing middleware uses configured OSRM servers while retaining request bo
   const request = async (query) => {
     let payload;
     await handler(
-      { url: `/?${query}`, socket: { remoteAddress: '127.0.0.1' } },
+      {
+        url: `/?${query}`,
+        method: 'GET',
+        socket: { remoteAddress: '127.0.0.1' },
+      },
       {
         writeHead() {},
         end(body) {

src/tooling/liveProviders.test.mjs

@@ -585,6 +585,63 @@ test('track backfill proxy returns 502 on an oversized upstream body and caches
   assert.equal(callCount, 1);
 });
 
+test('the aircraft snapshot routes decline a non-GET before any upstream work', async (t) => {
+  // A fetch that throws proves the refusal comes before any upstream call.
+  t.mock.method(globalThis, 'fetch', async (url) => {
+    throw new Error(`upstream must not be reached: ${url}`);
+  });
+  const cases = [
+    [install(providers.openSkyProxy()), '/api/flights'],
+    [install(providers.adsbLolProxy()), '/api/military'],
+  ];
+  for (const [request, route] of cases) {
+    for (const method of ['POST', 'PUT', 'DELETE', 'PATCH']) {
+      const response = await request(route, '/', method);
+      assert.equal(response.statusCode, 405, `${method} ${route}`);
+      // RFC 9110 section 15.5.6: a 405 names the methods it accepts.
+      assert.equal(response.headers.allow, 'GET', `${method} ${route}`);
+      assert.deepEqual(JSON.parse(response.body), {
+        error: 'Method Not Allowed',
+      });
+    }
+  }
+});
+
+test('the snapshot method check hands each /track route on to its own handler', async () => {
+  // The snapshot mount also matches /track, so it must hand /track on
+  // before it checks the method.
+  for (const [plugin, route] of [
+    [providers.openSkyProxy(), '/api/flights'],
+    [providers.adsbLolProxy(), '/api/military'],
+  ]) {
+    const routes = new Map();
+    plugin.configureServer({
+      middlewares: { use: (path, handler) => routes.set(path, handler) },
+    });
+    const res = {
+      statusCode: 200,
+      writeHead(s) {
+        this.statusCode = s;
+      },
+      end() {},
+    };
+    let handedOn = false;
+    await routes.get(route)(
+      { url: '/track?icao24=abc123', method: 'POST' },
+      res,
+      () => {
+        handedOn = true;
+      },
+    );
+    assert.ok(handedOn, `${route}/track reaches next()`);
+    assert.equal(
+      res.statusCode,
+      200,
+      `${route}/track is not answered by the snapshot handler`,
+    );
+  }
+});
+
 test('the OpenSky snapshot is compressed for clients that ask, and an error body never inherits the cached frame', async (t) => {
   environment(t, {
     OPENSKY_AUTH_MODE: 'anon',

src/tooling/placeProviders.test.mjs

@@ -501,6 +501,25 @@ test('the upstream host is pinned: a redirect is refused, not followed', async (
   assert.deepEqual(seen, ['error'], 'a redirect would escape the pinned host');
 });
 
+test('the routing proxy declines a non-GET before rate limiting or upstream', async (t) => {
+  // A fetch that throws proves the refusal comes before any upstream call.
+  const request = install(installRouteMiddleware);
+  t.mock.method(globalThis, 'fetch', async () => {
+    throw new Error('upstream must not be reached');
+  });
+  for (const method of ['POST', 'PUT', 'DELETE', 'PATCH']) {
+    const response = await request(
+      '/api/route',
+      '?profile=car&coords=-97,30;-97.01,30.01',
+      method,
+    );
+    assert.equal(response.statusCode, 405, method);
+    // RFC 9110 section 15.5.6: a 405 names the methods it accepts.
+    assert.equal(response.headers.allow, 'GET', method);
+    assert.deepEqual(response.body, { error: 'Method Not Allowed' });
+  }
+});
+
 test('both paid Google routes refuse cross-site requests before calling Google', async (t) => {
   const plugin = googlePlacesContextProxy({ resolveApiKey: () => 'key' });
   const routes = new Map();