آموزش ساخت HTTP Server با Node.js؛ صفحه، API و TLS

# روی رایانهٔ ویندوز، در PowerShell و داخل hello-http
Get-Location
Get-ChildItem
Get-ChildItem .\public
node --version
npm.cmd --version

PORT=3000

.env
node_modules/
*.log
coverage/

import test, { before, after } from 'node:test';
import assert from 'node:assert/strict';
import { request } from 'node:http';
import { once } from 'node:events';
import { spawnSync } from 'node:child_process';
import { fileURLToPath } from 'node:url';
import { createApp } from './app.mjs';

let server;
let base;
before(async () => {
  server = await createApp();
  server.listen(0, '127.0.0.1');
  await once(server, 'listening');
  base = `http://127.0.0.1:${server.address().port}`;
});
after(async () => {
  server.closeAllConnections();
  await new Promise(resolve => server.close(resolve));
});

async function post(value) {
  return fetch(base + '/api/greet', {
    method: 'POST', headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify(value)
  });
}

test('home is a real Persian RTL HTML document', async () => {
  const res = await fetch(base);
  assert.equal(res.status, 200);
  assert.match(res.headers.get('content-type'), /^text\/html; charset=utf-8$/);
  const html = await res.text();
  assert.match(html, /lang="fa" dir="rtl"/);
  assert.match(html, /سلام، <span>سرور!/);
  assert.match(html, /src="\/app.js"/);
});

test('only local script and style assets are served with correct types', async () => {
  for (const [path, type] of [['/app.js', 'text/javascript'], ['/style.css', 'text/css']]) {
    const res = await fetch(base + path);
    assert.equal(res.status, 200);
    assert.ok(res.headers.get('content-type').startsWith(type));
    assert.ok((await res.text()).length > 100);
  }
});

test('responses have a self-only CSP and nosniff', async () => {
  const res = await fetch(base);
  assert.equal(res.headers.get('x-content-type-options'), 'nosniff');
  assert.match(res.headers.get('content-security-policy'), /script-src 'self'/);
  assert.match(res.headers.get('content-security-policy'), /frame-ancestors 'none'/);
  assert.equal(res.headers.get('cache-control'), 'no-store');
});

test('status API gives only the documented data', async () => {
  const res = await fetch(base + '/api/status');
  const data = await res.json();
  assert.equal(res.status, 200);
  assert.deepEqual(Object.keys(data).sort(), ['ok', 'service', 'uptimeSeconds']);
  assert.equal(data.ok, true);
  assert.equal(data.service, 'darsavand-hello');
  assert.ok(Number.isSafeInteger(data.uptimeSeconds) && data.uptimeSeconds >= 0);
});

test('HEAD home gives headers without a response body', async () => {
  const res = await fetch(base, { method: 'HEAD' });
  assert.equal(res.status, 200);
  assert.ok(Number(res.headers.get('content-length')) > 0);
  assert.equal(await res.text(), '');
});

test('HEAD status is supported', async () => {
  const res = await fetch(base + '/api/status', { method: 'HEAD' });
  assert.equal(res.status, 200);
  assert.equal(await res.text(), '');
});

test('a Persian name is trimmed and returned as valid JSON', async () => {
  const res = await post({ name: '  سارا  ' });
  assert.equal(res.status, 200);
  assert.equal((await res.json()).message, 'سلام، سارا! این پاسخ از Node.js آمده است.');
});

test('the documented 60-code-unit boundary is accepted', async () => {
  const res = await post({ name: 'س'.repeat(60) });
  assert.equal(res.status, 200);
  assert.ok((await res.json()).message.includes('س'.repeat(60)));
});

test('an overlong name is rejected with 422', async () => {
  const res = await post({ name: 'س'.repeat(61) });
  assert.equal(res.status, 422);
  assert.equal((await res.json()).error, 'INVALID_NAME');
});

test('a blank name is rejected', async () => {
  const res = await post({ name: '   ' });
  assert.equal(res.status, 422);
});

test('a number is not silently converted into a name', async () => {
  const res = await post({ name: 123 });
  assert.equal(res.status, 422);
});

test('null, arrays and objects without exactly one name are rejected', async () => {
  for (const input of [null, [], {}, { name: 'سارا', admin: true }]) {
    const res = await post(input);
    assert.equal(res.status, 422);
    assert.equal((await res.json()).error, 'INVALID_FIELDS');
  }
});

test('HTML-like input remains JSON text, never executable HTML', async () => {
  const name = '<img src=x onerror=alert(1)>';
  const res = await post({ name });
  assert.equal(res.status, 200);
  assert.match(res.headers.get('content-type'), /^application\/json/);
  assert.equal((await res.json()).message, `سلام، ${name}! این پاسخ از Node.js آمده است.`);
});

test('malformed JSON gives 400', async () => {
  const res = await fetch(base + '/api/greet', {
    method: 'POST', headers: { 'Content-Type': 'application/json' }, body: '{bad'
  });
  assert.equal(res.status, 400);
  assert.equal((await res.json()).error, 'INVALID_JSON');
});

test('an empty body gives 400', async () => {
  const res = await fetch(base + '/api/greet', {
    method: 'POST', headers: { 'Content-Type': 'application/json' }, body: ''
  });
  assert.equal(res.status, 400);
});

test('invalid UTF-8 is rejected instead of replaced silently', async () => {
  const res = await fetch(base + '/api/greet', {
    method: 'POST', headers: { 'Content-Type': 'application/json' },
    body: Buffer.from([0x7b, 0x22, 0x6e, 0x61, 0x6d, 0x65, 0x22, 0x3a, 0x22, 0xff, 0x22, 0x7d])
  });
  assert.equal(res.status, 400);
});

test('a non-JSON content type gives 415', async () => {
  const res = await fetch(base + '/api/greet', {
    method: 'POST', headers: { 'Content-Type': 'text/plain' }, body: 'Sara'
  });
  assert.equal(res.status, 415);
});

test('an unsupported compressed body gives 415', async () => {
  const res = await fetch(base + '/api/greet', {
    method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Encoding': 'gzip' },
    body: JSON.stringify({ name: 'Sara' })
  });
  assert.equal(res.status, 415);
});

test('an oversized body gives 413', async () => {
  const res = await fetch(base + '/api/greet', {
    method: 'POST', headers: { 'Content-Type': 'application/json' }, body: ' '.repeat(1025)
  });
  assert.equal(res.status, 413);
});

test('a chunked oversized request receives 413 before the sender ends it', async () => {
  await new Promise((resolve, reject) => {
    const req = request(base + '/api/greet', {
      method: 'POST', headers: { 'Content-Type': 'application/json' }
    });
    const deadline = setTimeout(() => { req.destroy(); reject(new Error('No early 413')); }, 3000);
    req.on('error', error => { clearTimeout(deadline); reject(error); });
    req.on('response', res => {
      const chunks = [];
      res.on('data', chunk => chunks.push(chunk));
      res.on('end', () => {
        clearTimeout(deadline);
        try {
          assert.equal(res.statusCode, 413);
          assert.equal(JSON.parse(Buffer.concat(chunks)).error, 'BODY_TOO_LARGE');
          req.destroy(); resolve();
        } catch (error) { req.destroy(); reject(error); }
      });
    });
    req.write('x'.repeat(1200)); // Deliberately do not call end().
  });
});

test('known routes reject an unsupported method and return Allow', async () => {
  for (const [path, method, allow] of [
    ['/api/greet', 'GET', 'POST'], ['/api/status', 'POST', 'GET, HEAD'], ['/', 'DELETE', 'GET, HEAD']
  ]) {
    const res = await fetch(base + path, { method });
    assert.equal(res.status, 405);
    assert.equal(res.headers.get('allow'), allow);
  }
});

test('unknown routes do not expose code or dotfiles', async () => {
  for (const path of ['/missing', '/.env', '/server.mjs', '/package.json', '/..%2fserver.mjs']) {
    const res = await fetch(base + path);
    assert.equal(res.status, 404);
    assert.equal((await res.json()).error, 'NOT_FOUND');
  }
});

test('invalid PORT values stop before creating a listener', () => {
  for (const port of ['', '0', '-1', '65536', '3.5', 'nope']) {
    const result = spawnSync(process.execPath, [fileURLToPath(new URL('./server.mjs', import.meta.url))], {
      env: { ...process.env, PORT: port }, encoding: 'utf8', timeout: 3000
    });
    assert.equal(result.status, 1);
    assert.match(result.stderr, /PORT must be/);
  }
});

# PowerShell در ریشهٔ پروژه؛ هر مرحله پس از موفقیت قبلی
npm.cmd run check
# اگر بررسی موفق بود:
npm.cmd test

# PowerShell؛ پس از موفقیت check و test
npm.cmd start

# Bash روی اوبونتو؛ runtime مسیر ثابت قبلاً نصب شده باشد
(
  set -e
  cd "$HOME/hello-http"
  /opt/node-current/bin/node --test
  /opt/node-current/bin/node server.mjs
)

# PowerShell دوم؛ سرور در ترمینال اول روشن باشد
$base = 'http://127.0.0.1:3000'
Invoke-RestMethod -Uri "$base/api/status" -Method Get -TimeoutSec 10
$payload = @{ name = 'سارا' } | ConvertTo-Json -Compress
$bytes = [System.Text.Encoding]::UTF8.GetBytes($payload)
$reply = Invoke-RestMethod -Uri "$base/api/greet" -Method Post -ContentType 'application/json; charset=utf-8' -Body $bytes -TimeoutSec 10
$reply.message

# Bash روی همان دستگاهی که سرور اجراست؛ هر خط یک آزمایش مستقل
curl -i --max-time 10 http://127.0.0.1:3000/missing
curl -i --max-time 10 http://127.0.0.1:3000/api/greet
curl -i --max-time 10 -H 'Content-Type: application/json' --data-binary '{bad' http://127.0.0.1:3000/api/greet
curl -i --max-time 10 -H 'Content-Type: application/json' --data-binary '{"name":123}' http://127.0.0.1:3000/api/greet