mirror of
https://github.com/only-cli/oc.git
synced 2026-09-15 10:40:56 +02:00
only-cli
5567b31d6a
The test for revalidating redirect hops drove httpbin.org, so httpbin being down failed the suite. It is down now, returning 503, which fails CI on main and would have failed the release: the publish workflow runs npm test before it ships, so a stable version could not have reached npm while a third party's app tier was unwell. It was also testing less than it looked. Each transport carried its own copy of the redirect loop, and the live test only ever exercised whichever one was installed, so the guarantee held in one copy and was unproven in the other. A check that matters twice is a check a change can fix once. Both transports now share one loop that takes the request as a callback, which is what makes the hop check provable against a transport that never leaves the process. Three offline tests replace the live one: a hop to a private address is refused and never asked for, a hop to a public address is still followed (a loop that rejected everything would have passed the first test and broken every redirect on the web), and a cycle gives up. Removing the hop check fails the first of them, which is more than the httpbin test could say for the transport it did not run. Verified live afterwards on both paths: an http to https chain through impers, a plain page, and a literal and a resolved private address both still refused.