starred/orca
1
0
Fork 0
mirror of https://github.com/stablyai/orca.git synced 2026-09-30 08:03:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

test(proxy): close the shorthand and chained-receiver holes in the fetch call-site audit

Browse Source 
The audit caught `net.request({ session: x })` and `ident.fetch(`, but not the two
shapes a real regression is just as likely to take: the `{ url, session }` shorthand
that both `net.request` overloads accept, and a receiver with no bare identifier
(`session.fromPartition(...).fetch(`, `ctx.session.fetch(`). Rule 1 now also matches
the shorthand key; rule 2 scans every `.fetch(` and excludes only a literal
`net`/`globalThis`/`global` receiver. Audited counts are unchanged (2/2/1).
This commit is contained in:
Neil
2026-09-03 20:40:34 -07:00
parent 5f6ff4ad46
commit 5d4e150873
1 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/proxy-guarded-fetch-call-site-audit.test.ts
+11 -3
View File
@@ -24,9 +24,12 @@ const AUDITED_NON_NET_FETCH_CALLS = new Map<string, number>([
])
// `globalThis.fetch` / `global.fetch` belong to global-fetch-call-site-audit.test.ts.
const NON_NET_FETCH_CALL = /(?<![.\w$])(?!net\b|globalThis\b|global\b)[A-Za-z_$][\w$]*\.fetch\(/g
const FETCH_CALL = /\.fetch\(/g
const RECEIVER_IDENTIFIER = /(?:^|[^.\w$])([A-Za-z_$][\w$]*)\s*$/
const DEFAULT_SESSION_RECEIVERS = new Set(['net', 'globalThis', 'global'])
const NET_REQUEST_CALL = /(?<![.\w$])net\.(?:fetch|request)\(/g
const SESSION_SCOPED_OPTION = /(?:^|[{,\s])(?:session|partition)\s*:/
// Matches `{ session: x }` and the `{ url, session }` shorthand both `net.request` overloads take.
const SESSION_SCOPED_OPTION = /(?:^|[{,\s])(?:session|partition)\s*[:,}]/
/** Text between the call's parentheses, skipping string bodies so quoted parens don't unbalance. */
function callArgumentText(content: string, callEnd: number): string {
@@ -105,7 +108,12 @@ describe('proxy-guarded fetch call-site audit (main)', () => {
it('keeps every non-default-session fetcher audited with its expected count', () => {
const found = new Map<string, number>()
for (const { file, content } of sources) {
const hits = [...content.matchAll(NON_NET_FETCH_CALL)].length
const hits = [...content.matchAll(FETCH_CALL)].filter((match) => {
const receiver = RECEIVER_IDENTIFIER.exec(content.slice(0, match.index))?.[1]
// A chained (`session.fromPartition(...).fetch(`) or member (`ctx.session.fetch(`)
// receiver has no bare trailing identifier, and is never the default session.
return receiver === undefined || !DEFAULT_SESSION_RECEIVERS.has(receiver)
}).length
if (hits > 0) {
found.set(file, hits)
}