Aktueller Stand

backend/node_modules/@fastify/cors/test/hooks.test.js

@@ -1,15 +1,23 @@
 'use strict'
 
-const { test } = require('tap')
+const { test } = require('node:test')
 const Fastify = require('fastify')
 const kFastifyContext = require('fastify/lib/symbols').kRouteContext
 const cors = require('..')
+const { setTimeout: sleep } = require('node:timers/promises')
 
 test('Should error on invalid hook option', async (t) => {
-  t.plan(1)
+  t.plan(3)
 
   const fastify = Fastify()
-  t.rejects(fastify.register(cors, { hook: 'invalid' }), new TypeError('@fastify/cors: Invalid hook option provided.'))
+  await t.assert.rejects(
+    async () => fastify.register(cors, { hook: 'invalid' }),
+    (err) => {
+      t.assert.strictEqual(err.name, 'TypeError')
+      t.assert.strictEqual(err.message, '@fastify/cors: Invalid hook option provided.')
+      return true
+    }
+  )
 })
 
 test('Should set hook onRequest if hook option is not set', async (t) => {
@@ -19,18 +27,18 @@ test('Should set hook onRequest if hook option is not set', async (t) => {
 
   fastify.register(cors)
 
-  fastify.addHook('onResponse', (request, reply, done) => {
-    t.equal(request[kFastifyContext].onError, null)
-    t.equal(request[kFastifyContext].onRequest.length, 1)
-    t.equal(request[kFastifyContext].onSend, null)
-    t.equal(request[kFastifyContext].preHandler, null)
-    t.equal(request[kFastifyContext].preParsing, null)
-    t.equal(request[kFastifyContext].preSerialization, null)
-    t.equal(request[kFastifyContext].preValidation, null)
+  fastify.addHook('onResponse', (request, _reply, done) => {
+    t.assert.strictEqual(request[kFastifyContext].onError, null)
+    t.assert.strictEqual(request[kFastifyContext].onRequest.length, 1)
+    t.assert.strictEqual(request[kFastifyContext].onSend, null)
+    t.assert.strictEqual(request[kFastifyContext].preHandler, null)
+    t.assert.strictEqual(request[kFastifyContext].preParsing, null)
+    t.assert.strictEqual(request[kFastifyContext].preSerialization, null)
+    t.assert.strictEqual(request[kFastifyContext].preValidation, null)
     done()
   })
 
-  fastify.get('/', (req, reply) => {
+  fastify.get('/', (_req, reply) => {
     reply.send('ok')
   })
 
@@ -41,9 +49,12 @@ test('Should set hook onRequest if hook option is not set', async (t) => {
     url: '/'
   })
   delete res.headers.date
-  t.equal(res.statusCode, 200)
-  t.equal(res.payload, 'ok')
-  t.match(res.headers, {
+  t.assert.strictEqual(res.statusCode, 200)
+  t.assert.strictEqual(res.payload, 'ok')
+  const actualHeader = {
+    'access-control-allow-origin': res.headers['access-control-allow-origin']
+  }
+  t.assert.deepStrictEqual(actualHeader, {
     'access-control-allow-origin': '*'
   })
 })
@@ -57,18 +68,18 @@ test('Should set hook onRequest if hook option is set to onRequest', async (t) =
     hook: 'onRequest'
   })
 
-  fastify.addHook('onResponse', (request, reply, done) => {
-    t.equal(request[kFastifyContext].onError, null)
-    t.equal(request[kFastifyContext].onRequest.length, 1)
-    t.equal(request[kFastifyContext].onSend, null)
-    t.equal(request[kFastifyContext].preHandler, null)
-    t.equal(request[kFastifyContext].preParsing, null)
-    t.equal(request[kFastifyContext].preSerialization, null)
-    t.equal(request[kFastifyContext].preValidation, null)
+  fastify.addHook('onResponse', (request, _reply, done) => {
+    t.assert.strictEqual(request[kFastifyContext].onError, null)
+    t.assert.strictEqual(request[kFastifyContext].onRequest.length, 1)
+    t.assert.strictEqual(request[kFastifyContext].onSend, null)
+    t.assert.strictEqual(request[kFastifyContext].preHandler, null)
+    t.assert.strictEqual(request[kFastifyContext].preParsing, null)
+    t.assert.strictEqual(request[kFastifyContext].preSerialization, null)
+    t.assert.strictEqual(request[kFastifyContext].preValidation, null)
     done()
   })
 
-  fastify.get('/', (req, reply) => {
+  fastify.get('/', (_req, reply) => {
     reply.send('ok')
   })
 
@@ -79,9 +90,12 @@ test('Should set hook onRequest if hook option is set to onRequest', async (t) =
     url: '/'
   })
   delete res.headers.date
-  t.equal(res.statusCode, 200)
-  t.equal(res.payload, 'ok')
-  t.match(res.headers, {
+  t.assert.strictEqual(res.statusCode, 200)
+  t.assert.strictEqual(res.payload, 'ok')
+  const actualHeader = {
+    'access-control-allow-origin': res.headers['access-control-allow-origin']
+  }
+  t.assert.deepStrictEqual(actualHeader, {
     'access-control-allow-origin': '*'
   })
 })
@@ -95,18 +109,18 @@ test('Should set hook preParsing if hook option is set to preParsing', async (t)
     hook: 'preParsing'
   })
 
-  fastify.addHook('onResponse', (request, reply, done) => {
-    t.equal(request[kFastifyContext].onError, null)
-    t.equal(request[kFastifyContext].onRequest, null)
-    t.equal(request[kFastifyContext].onSend, null)
-    t.equal(request[kFastifyContext].preHandler, null)
-    t.equal(request[kFastifyContext].preParsing.length, 1)
-    t.equal(request[kFastifyContext].preSerialization, null)
-    t.equal(request[kFastifyContext].preValidation, null)
+  fastify.addHook('onResponse', (request, _reply, done) => {
+    t.assert.strictEqual(request[kFastifyContext].onError, null)
+    t.assert.strictEqual(request[kFastifyContext].onRequest, null)
+    t.assert.strictEqual(request[kFastifyContext].onSend, null)
+    t.assert.strictEqual(request[kFastifyContext].preHandler, null)
+    t.assert.strictEqual(request[kFastifyContext].preParsing.length, 1)
+    t.assert.strictEqual(request[kFastifyContext].preSerialization, null)
+    t.assert.strictEqual(request[kFastifyContext].preValidation, null)
     done()
   })
 
-  fastify.get('/', (req, reply) => {
+  fastify.get('/', (_req, reply) => {
     reply.send('ok')
   })
 
@@ -117,12 +131,15 @@ test('Should set hook preParsing if hook option is set to preParsing', async (t)
     url: '/'
   })
   delete res.headers.date
-  t.equal(res.statusCode, 200)
-  t.equal(res.payload, 'ok')
-  t.match(res.headers, {
+  t.assert.strictEqual(res.statusCode, 200)
+  t.assert.strictEqual(res.payload, 'ok')
+  const actualHeader = {
+    'access-control-allow-origin': res.headers['access-control-allow-origin']
+  }
+  t.assert.deepStrictEqual(actualHeader, {
     'access-control-allow-origin': '*'
   })
-  t.notMatch(res.headers, { vary: 'Origin' })
+  t.assert.notStrictEqual(res.headers.vary, 'Origin')
 })
 
 test('Should set hook preValidation if hook option is set to preValidation', async (t) => {
@@ -134,18 +151,18 @@ test('Should set hook preValidation if hook option is set to preValidation', asy
     hook: 'preValidation'
   })
 
-  fastify.addHook('onResponse', (request, reply, done) => {
-    t.equal(request[kFastifyContext].onError, null)
-    t.equal(request[kFastifyContext].onRequest, null)
-    t.equal(request[kFastifyContext].onSend, null)
-    t.equal(request[kFastifyContext].preHandler, null)
-    t.equal(request[kFastifyContext].preParsing, null)
-    t.equal(request[kFastifyContext].preSerialization, null)
-    t.equal(request[kFastifyContext].preValidation.length, 1)
+  fastify.addHook('onResponse', (request, _reply, done) => {
+    t.assert.strictEqual(request[kFastifyContext].onError, null)
+    t.assert.strictEqual(request[kFastifyContext].onRequest, null)
+    t.assert.strictEqual(request[kFastifyContext].onSend, null)
+    t.assert.strictEqual(request[kFastifyContext].preHandler, null)
+    t.assert.strictEqual(request[kFastifyContext].preParsing, null)
+    t.assert.strictEqual(request[kFastifyContext].preSerialization, null)
+    t.assert.strictEqual(request[kFastifyContext].preValidation.length, 1)
     done()
   })
 
-  fastify.get('/', (req, reply) => {
+  fastify.get('/', (_req, reply) => {
     reply.send('ok')
   })
 
@@ -156,12 +173,15 @@ test('Should set hook preValidation if hook option is set to preValidation', asy
     url: '/'
   })
   delete res.headers.date
-  t.equal(res.statusCode, 200)
-  t.equal(res.payload, 'ok')
-  t.match(res.headers, {
+  t.assert.strictEqual(res.statusCode, 200)
+  t.assert.strictEqual(res.payload, 'ok')
+  const actualHeader = {
+    'access-control-allow-origin': res.headers['access-control-allow-origin']
+  }
+  t.assert.deepStrictEqual(actualHeader, {
     'access-control-allow-origin': '*'
   })
-  t.notMatch(res.headers, { vary: 'Origin' })
+  t.assert.notStrictEqual(res.headers.vary, 'Origin')
 })
 
 test('Should set hook preParsing if hook option is set to preParsing', async (t) => {
@@ -173,18 +193,18 @@ test('Should set hook preParsing if hook option is set to preParsing', async (t)
     hook: 'preParsing'
   })
 
-  fastify.addHook('onResponse', (request, reply, done) => {
-    t.equal(request[kFastifyContext].onError, null)
-    t.equal(request[kFastifyContext].onRequest, null)
-    t.equal(request[kFastifyContext].onSend, null)
-    t.equal(request[kFastifyContext].preHandler, null)
-    t.equal(request[kFastifyContext].preParsing.length, 1)
-    t.equal(request[kFastifyContext].preSerialization, null)
-    t.equal(request[kFastifyContext].preValidation, null)
+  fastify.addHook('onResponse', (request, _reply, done) => {
+    t.assert.strictEqual(request[kFastifyContext].onError, null)
+    t.assert.strictEqual(request[kFastifyContext].onRequest, null)
+    t.assert.strictEqual(request[kFastifyContext].onSend, null)
+    t.assert.strictEqual(request[kFastifyContext].preHandler, null)
+    t.assert.strictEqual(request[kFastifyContext].preParsing.length, 1)
+    t.assert.strictEqual(request[kFastifyContext].preSerialization, null)
+    t.assert.strictEqual(request[kFastifyContext].preValidation, null)
     done()
   })
 
-  fastify.get('/', (req, reply) => {
+  fastify.get('/', (_req, reply) => {
     reply.send('ok')
   })
 
@@ -195,12 +215,15 @@ test('Should set hook preParsing if hook option is set to preParsing', async (t)
     url: '/'
   })
   delete res.headers.date
-  t.equal(res.statusCode, 200)
-  t.equal(res.payload, 'ok')
-  t.match(res.headers, {
+  t.assert.strictEqual(res.statusCode, 200)
+  t.assert.strictEqual(res.payload, 'ok')
+  const actualHeader = {
+    'access-control-allow-origin': res.headers['access-control-allow-origin']
+  }
+  t.assert.deepStrictEqual(actualHeader, {
     'access-control-allow-origin': '*'
   })
-  t.notMatch(res.headers, { vary: 'Origin' })
+  t.assert.notStrictEqual(res.headers.vary, 'Origin')
 })
 
 test('Should set hook preHandler if hook option is set to preHandler', async (t) => {
@@ -212,18 +235,18 @@ test('Should set hook preHandler if hook option is set to preHandler', async (t)
     hook: 'preHandler'
   })
 
-  fastify.addHook('onResponse', (request, reply, done) => {
-    t.equal(request[kFastifyContext].onError, null)
-    t.equal(request[kFastifyContext].onRequest, null)
-    t.equal(request[kFastifyContext].onSend, null)
-    t.equal(request[kFastifyContext].preHandler.length, 1)
-    t.equal(request[kFastifyContext].preParsing, null)
-    t.equal(request[kFastifyContext].preSerialization, null)
-    t.equal(request[kFastifyContext].preValidation, null)
+  fastify.addHook('onResponse', (request, _reply, done) => {
+    t.assert.strictEqual(request[kFastifyContext].onError, null)
+    t.assert.strictEqual(request[kFastifyContext].onRequest, null)
+    t.assert.strictEqual(request[kFastifyContext].onSend, null)
+    t.assert.strictEqual(request[kFastifyContext].preHandler.length, 1)
+    t.assert.strictEqual(request[kFastifyContext].preParsing, null)
+    t.assert.strictEqual(request[kFastifyContext].preSerialization, null)
+    t.assert.strictEqual(request[kFastifyContext].preValidation, null)
     done()
   })
 
-  fastify.get('/', (req, reply) => {
+  fastify.get('/', (_req, reply) => {
     reply.send('ok')
   })
 
@@ -234,12 +257,15 @@ test('Should set hook preHandler if hook option is set to preHandler', async (t)
     url: '/'
   })
   delete res.headers.date
-  t.equal(res.statusCode, 200)
-  t.equal(res.payload, 'ok')
-  t.match(res.headers, {
+  t.assert.strictEqual(res.statusCode, 200)
+  t.assert.strictEqual(res.payload, 'ok')
+  const actualHeader = {
+    'access-control-allow-origin': res.headers['access-control-allow-origin']
+  }
+  t.assert.deepStrictEqual(actualHeader, {
     'access-control-allow-origin': '*'
   })
-  t.notMatch(res.headers, { vary: 'Origin' })
+  t.assert.notStrictEqual(res.headers.vary, 'Origin')
 })
 
 test('Should set hook onSend if hook option is set to onSend', async (t) => {
@@ -251,18 +277,18 @@ test('Should set hook onSend if hook option is set to onSend', async (t) => {
     hook: 'onSend'
   })
 
-  fastify.addHook('onResponse', (request, reply, done) => {
-    t.equal(request[kFastifyContext].onError, null)
-    t.equal(request[kFastifyContext].onRequest, null)
-    t.equal(request[kFastifyContext].onSend.length, 1)
-    t.equal(request[kFastifyContext].preHandler, null)
-    t.equal(request[kFastifyContext].preParsing, null)
-    t.equal(request[kFastifyContext].preSerialization, null)
-    t.equal(request[kFastifyContext].preValidation, null)
+  fastify.addHook('onResponse', (request, _reply, done) => {
+    t.assert.strictEqual(request[kFastifyContext].onError, null)
+    t.assert.strictEqual(request[kFastifyContext].onRequest, null)
+    t.assert.strictEqual(request[kFastifyContext].onSend.length, 1)
+    t.assert.strictEqual(request[kFastifyContext].preHandler, null)
+    t.assert.strictEqual(request[kFastifyContext].preParsing, null)
+    t.assert.strictEqual(request[kFastifyContext].preSerialization, null)
+    t.assert.strictEqual(request[kFastifyContext].preValidation, null)
     done()
   })
 
-  fastify.get('/', (req, reply) => {
+  fastify.get('/', (_req, reply) => {
     reply.send('ok')
   })
 
@@ -273,12 +299,15 @@ test('Should set hook onSend if hook option is set to onSend', async (t) => {
     url: '/'
   })
   delete res.headers.date
-  t.equal(res.statusCode, 200)
-  t.equal(res.payload, 'ok')
-  t.match(res.headers, {
+  t.assert.strictEqual(res.statusCode, 200)
+  t.assert.strictEqual(res.payload, 'ok')
+  const actualHeader = {
+    'access-control-allow-origin': res.headers['access-control-allow-origin']
+  }
+  t.assert.deepStrictEqual(actualHeader, {
     'access-control-allow-origin': '*'
   })
-  t.notMatch(res.headers, { vary: 'Origin' })
+  t.assert.notStrictEqual(res.headers.vary, 'Origin')
 })
 
 test('Should set hook preSerialization if hook option is set to preSerialization', async (t) => {
@@ -290,18 +319,18 @@ test('Should set hook preSerialization if hook option is set to preSerialization
     hook: 'preSerialization'
   })
 
-  fastify.addHook('onResponse', (request, reply, done) => {
-    t.equal(request[kFastifyContext].onError, null)
-    t.equal(request[kFastifyContext].onRequest, null)
-    t.equal(request[kFastifyContext].onSend, null)
-    t.equal(request[kFastifyContext].preHandler, null)
-    t.equal(request[kFastifyContext].preParsing, null)
-    t.equal(request[kFastifyContext].preSerialization.length, 1)
-    t.equal(request[kFastifyContext].preValidation, null)
+  fastify.addHook('onResponse', (request, _reply, done) => {
+    t.assert.strictEqual(request[kFastifyContext].onError, null)
+    t.assert.strictEqual(request[kFastifyContext].onRequest, null)
+    t.assert.strictEqual(request[kFastifyContext].onSend, null)
+    t.assert.strictEqual(request[kFastifyContext].preHandler, null)
+    t.assert.strictEqual(request[kFastifyContext].preParsing, null)
+    t.assert.strictEqual(request[kFastifyContext].preSerialization.length, 1)
+    t.assert.strictEqual(request[kFastifyContext].preValidation, null)
     done()
   })
 
-  fastify.get('/', (req, reply) => {
+  fastify.get('/', (_req, reply) => {
     reply.send({ nonString: true })
   })
 
@@ -312,15 +341,18 @@ test('Should set hook preSerialization if hook option is set to preSerialization
     url: '/'
   })
   delete res.headers.date
-  t.equal(res.statusCode, 200)
-  t.equal(res.payload, '{"nonString":true}')
-  t.match(res.headers, {
+  t.assert.strictEqual(res.statusCode, 200)
+  t.assert.strictEqual(res.payload, '{"nonString":true}')
+  const actualHeader = {
+    'access-control-allow-origin': res.headers['access-control-allow-origin']
+  }
+  t.assert.deepStrictEqual(actualHeader, {
     'access-control-allow-origin': '*'
   })
-  t.notMatch(res.headers, { vary: 'Origin' })
+  t.assert.notStrictEqual(res.headers.vary, 'Origin')
 })
 
-test('Should support custom hook with dynamic config', t => {
+test('Should support custom hook with dynamic config', async t => {
   t.plan(16)
 
   const configs = [{
@@ -341,83 +373,97 @@ test('Should support custom hook with dynamic config', t => {
 
   const fastify = Fastify()
   let requestId = 0
-  const configDelegation = function (req, cb) {
+  const configDelegation = async function (req) {
     // request should have id
-    t.ok(req.id)
+    t.assert.ok(req.id)
     // request should not have send
-    t.notOk(req.send)
+    t.assert.ifError(req.send)
     const config = configs[requestId]
     requestId++
     if (config) {
-      cb(null, config)
+      return Promise.resolve(config)
     } else {
-      cb(new Error('ouch'))
+      return Promise.reject(new Error('ouch'))
     }
   }
-  fastify.register(cors, {
+  await fastify.register(cors, {
     hook: 'preHandler',
     delegator: configDelegation
   })
 
-  fastify.get('/', (req, reply) => {
+  fastify.get('/', (_req, reply) => {
     reply.send('ok')
   })
 
-  fastify.inject({
+  let res = await fastify.inject({
     method: 'GET',
     url: '/'
-  }, (err, res) => {
-    t.error(err)
-    delete res.headers.date
-    t.equal(res.statusCode, 200)
-    t.equal(res.payload, 'ok')
-    t.match(res.headers, {
-      'access-control-allow-origin': 'example.com',
-      'access-control-allow-credentials': 'true',
-      'access-control-expose-headers': 'foo, bar',
-      'content-length': '2',
-      vary: 'Origin'
-    })
+  })
+  t.assert.ok(res)
+  delete res.headers.date
+  t.assert.strictEqual(res.statusCode, 200)
+  t.assert.strictEqual(res.payload, 'ok')
+  let actualHeaders = {
+    'access-control-allow-origin': res.headers['access-control-allow-origin'],
+    'access-control-allow-credentials': res.headers['access-control-allow-credentials'],
+    'access-control-expose-headers': res.headers['access-control-expose-headers'],
+    'content-length': res.headers['content-length'],
+    vary: res.headers.vary
+  }
+  t.assert.deepStrictEqual(actualHeaders, {
+    'access-control-allow-origin': 'example.com',
+    'access-control-allow-credentials': 'true',
+    'access-control-expose-headers': 'foo, bar',
+    'content-length': '2',
+    vary: 'Origin'
   })
 
-  fastify.inject({
+  res = await fastify.inject({
     method: 'OPTIONS',
     url: '/',
     headers: {
       'access-control-request-method': 'GET',
       origin: 'example.com'
     }
-  }, (err, res) => {
-    t.error(err)
-    delete res.headers.date
-    t.equal(res.statusCode, 204)
-    t.equal(res.payload, '')
-    t.match(res.headers, {
-      'access-control-allow-origin': 'sample.com',
-      'access-control-allow-credentials': 'true',
-      'access-control-expose-headers': 'zoo, bar',
-      'access-control-allow-methods': 'GET',
-      'access-control-allow-headers': 'baz, foo',
-      'access-control-max-age': '321',
-      'content-length': '0',
-      vary: 'Origin'
-    })
+  })
+  t.assert.ok(res)
+  delete res.headers.date
+  t.assert.strictEqual(res.statusCode, 204)
+  t.assert.strictEqual(res.payload, '')
+  actualHeaders = {
+    'access-control-allow-origin': res.headers['access-control-allow-origin'],
+    'access-control-allow-credentials': res.headers['access-control-allow-credentials'],
+    'access-control-expose-headers': res.headers['access-control-expose-headers'],
+    'access-control-allow-methods': res.headers['access-control-allow-methods'],
+    'access-control-allow-headers': res.headers['access-control-allow-headers'],
+    'access-control-max-age': res.headers['access-control-max-age'],
+    'content-length': res.headers['content-length'],
+    vary: res.headers.vary
+  }
+  t.assert.deepStrictEqual(actualHeaders, {
+    'access-control-allow-origin': 'sample.com',
+    'access-control-allow-credentials': 'true',
+    'access-control-expose-headers': 'zoo, bar',
+    'access-control-allow-methods': 'GET',
+    'access-control-allow-headers': 'baz, foo',
+    'access-control-max-age': '321',
+    'content-length': '0',
+    vary: 'Origin'
   })
 
-  fastify.inject({
+  res = await fastify.inject({
     method: 'GET',
     url: '/',
     headers: {
       'access-control-request-method': 'GET',
       origin: 'example.com'
     }
-  }, (err, res) => {
-    t.error(err)
-    t.equal(res.statusCode, 500)
   })
+  t.assert.ok(res)
+  t.assert.strictEqual(res.statusCode, 500)
 })
 
-test('Should support custom hook with dynamic config (callback)', t => {
+test('Should support custom hook with dynamic config (callback)', async t => {
   t.plan(16)
 
   const configs = [{
@@ -440,9 +486,9 @@ test('Should support custom hook with dynamic config (callback)', t => {
   let requestId = 0
   const configDelegation = function (req, cb) {
     // request should have id
-    t.ok(req.id)
+    t.assert.ok(req.id)
     // request should not have send
-    t.notOk(req.send)
+    t.assert.ifError(req.send)
     const config = configs[requestId]
     requestId++
     if (config) {
@@ -456,7 +502,7 @@ test('Should support custom hook with dynamic config (callback)', t => {
     delegator: configDelegation
   })
 
-  fastify.get('/', (req, reply) => {
+  fastify.get('/', (_req, reply) => {
     reply.send('ok')
   })
 
@@ -464,11 +510,18 @@ test('Should support custom hook with dynamic config (callback)', t => {
     method: 'GET',
     url: '/'
   }, (err, res) => {
-    t.error(err)
+    t.assert.ifError(err)
     delete res.headers.date
-    t.equal(res.statusCode, 200)
-    t.equal(res.payload, 'ok')
-    t.match(res.headers, {
+    t.assert.strictEqual(res.statusCode, 200)
+    t.assert.strictEqual(res.payload, 'ok')
+    const actualHeaders = {
+      'access-control-allow-origin': res.headers['access-control-allow-origin'],
+      'access-control-allow-credentials': res.headers['access-control-allow-credentials'],
+      'access-control-expose-headers': res.headers['access-control-expose-headers'],
+      'content-length': res.headers['content-length'],
+      vary: res.headers.vary
+    }
+    t.assert.deepStrictEqual(actualHeaders, {
       'access-control-allow-origin': 'example.com',
       'access-control-allow-credentials': 'true',
       'access-control-expose-headers': 'foo, bar',
@@ -485,11 +538,21 @@ test('Should support custom hook with dynamic config (callback)', t => {
       origin: 'example.com'
     }
   }, (err, res) => {
-    t.error(err)
+    t.assert.ifError(err)
     delete res.headers.date
-    t.equal(res.statusCode, 204)
-    t.equal(res.payload, '')
-    t.match(res.headers, {
+    t.assert.strictEqual(res.statusCode, 204)
+    t.assert.strictEqual(res.payload, '')
+    const actualHeaders = {
+      'access-control-allow-origin': res.headers['access-control-allow-origin'],
+      'access-control-allow-credentials': res.headers['access-control-allow-credentials'],
+      'access-control-expose-headers': res.headers['access-control-expose-headers'],
+      'access-control-allow-methods': res.headers['access-control-allow-methods'],
+      'access-control-allow-headers': res.headers['access-control-allow-headers'],
+      'access-control-max-age': res.headers['access-control-max-age'],
+      'content-length': res.headers['content-length'],
+      vary: res.headers.vary
+    }
+    t.assert.deepStrictEqual(actualHeaders, {
       'access-control-allow-origin': 'sample.com',
       'access-control-allow-credentials': 'true',
       'access-control-expose-headers': 'zoo, bar',
@@ -509,12 +572,13 @@ test('Should support custom hook with dynamic config (callback)', t => {
       origin: 'example.com'
     }
   }, (err, res) => {
-    t.error(err)
-    t.equal(res.statusCode, 500)
+    t.assert.ifError(err)
+    t.assert.strictEqual(res.statusCode, 500)
   })
+  await sleep()
 })
 
-test('Should support custom hook with dynamic config (Promise)', t => {
+test('Should support custom hook with dynamic config (Promise)', async t => {
   t.plan(16)
 
   const configs = [{
@@ -535,11 +599,11 @@ test('Should support custom hook with dynamic config (Promise)', t => {
 
   const fastify = Fastify()
   let requestId = 0
-  const configDelegation = function (req) {
+  const configDelegation = async function (req) {
     // request should have id
-    t.ok(req.id)
+    t.assert.ok(req.id)
     // request should not have send
-    t.notOk(req.send)
+    t.assert.ifError(req.send)
     const config = configs[requestId]
     requestId++
     if (config) {
@@ -549,70 +613,85 @@ test('Should support custom hook with dynamic config (Promise)', t => {
     }
   }
 
-  fastify.register(cors, {
+  await fastify.register(cors, {
     hook: 'preParsing',
     delegator: configDelegation
   })
 
-  fastify.get('/', (req, reply) => {
+  fastify.get('/', (_req, reply) => {
     reply.send('ok')
   })
 
-  fastify.inject({
+  let res = await fastify.inject({
     method: 'GET',
     url: '/'
-  }, (err, res) => {
-    t.error(err)
-    delete res.headers.date
-    t.equal(res.statusCode, 200)
-    t.equal(res.payload, 'ok')
-    t.match(res.headers, {
-      'access-control-allow-origin': 'example.com',
-      'access-control-allow-credentials': 'true',
-      'access-control-expose-headers': 'foo, bar',
-      'content-length': '2',
-      vary: 'Origin'
-    })
+  })
+  t.assert.ok(res)
+  delete res.headers.date
+  t.assert.strictEqual(res.statusCode, 200)
+  t.assert.strictEqual(res.payload, 'ok')
+  let actualHeaders = {
+    'access-control-allow-origin': res.headers['access-control-allow-origin'],
+    'access-control-allow-credentials': res.headers['access-control-allow-credentials'],
+    'access-control-expose-headers': res.headers['access-control-expose-headers'],
+    'content-length': res.headers['content-length'],
+    vary: res.headers.vary
+  }
+
+  t.assert.deepStrictEqual(actualHeaders, {
+    'access-control-allow-origin': 'example.com',
+    'access-control-allow-credentials': 'true',
+    'access-control-expose-headers': 'foo, bar',
+    'content-length': '2',
+    vary: 'Origin'
   })
 
-  fastify.inject({
+  res = await fastify.inject({
     method: 'OPTIONS',
     url: '/',
     headers: {
       'access-control-request-method': 'GET',
       origin: 'example.com'
     }
-  }, (err, res) => {
-    t.error(err)
-    delete res.headers.date
-    t.equal(res.statusCode, 204)
-    t.equal(res.payload, '')
-    t.match(res.headers, {
-      'access-control-allow-origin': 'sample.com',
-      'access-control-allow-credentials': 'true',
-      'access-control-expose-headers': 'zoo, bar',
-      'access-control-allow-methods': 'GET',
-      'access-control-allow-headers': 'baz, foo',
-      'access-control-max-age': '321',
-      'content-length': '0',
-      vary: 'Origin'
-    })
+  })
+  t.assert.ok(res)
+  delete res.headers.date
+  t.assert.strictEqual(res.statusCode, 204)
+  t.assert.strictEqual(res.payload, '')
+  actualHeaders = {
+    'access-control-allow-origin': res.headers['access-control-allow-origin'],
+    'access-control-allow-credentials': res.headers['access-control-allow-credentials'],
+    'access-control-expose-headers': res.headers['access-control-expose-headers'],
+    'access-control-allow-methods': res.headers['access-control-allow-methods'],
+    'access-control-allow-headers': res.headers['access-control-allow-headers'],
+    'access-control-max-age': res.headers['access-control-max-age'],
+    'content-length': res.headers['content-length'],
+    vary: res.headers.vary
+  }
+  t.assert.deepStrictEqual(actualHeaders, {
+    'access-control-allow-origin': 'sample.com',
+    'access-control-allow-credentials': 'true',
+    'access-control-expose-headers': 'zoo, bar',
+    'access-control-allow-methods': 'GET',
+    'access-control-allow-headers': 'baz, foo',
+    'access-control-max-age': '321',
+    'content-length': '0',
+    vary: 'Origin'
   })
 
-  fastify.inject({
+  res = await fastify.inject({
     method: 'GET',
     url: '/',
     headers: {
       'access-control-request-method': 'GET',
       origin: 'example.com'
     }
-  }, (err, res) => {
-    t.error(err)
-    t.equal(res.statusCode, 500)
   })
+  t.assert.ok(res)
+  t.assert.strictEqual(res.statusCode, 500)
 })
 
-test('Should support custom hook with dynamic config (Promise), but should error /1', t => {
+test('Should support custom hook with dynamic config (Promise), but should error /1', async t => {
   t.plan(6)
 
   const fastify = Fastify()
@@ -620,46 +699,47 @@ test('Should support custom hook with dynamic config (Promise), but should error
     return false
   }
 
-  fastify.register(cors, {
+  await fastify.register(cors, {
     hook: 'preParsing',
     delegator: configDelegation
   })
 
-  fastify.get('/', (req, reply) => {
+  fastify.get('/', (_req, reply) => {
     reply.send('ok')
   })
 
-  fastify.inject({
+  let res = await fastify.inject({
     method: 'OPTIONS',
     url: '/',
     headers: {
       'access-control-request-method': 'GET',
       origin: 'example.com'
     }
-  }, (err, res) => {
-    t.error(err)
-    delete res.headers.date
-    t.equal(res.statusCode, 500)
-    t.equal(res.payload, '{"statusCode":500,"error":"Internal Server Error","message":"Invalid CORS origin option"}')
-    t.match(res.headers, {
-      'content-length': '89'
-    })
+  })
+  t.assert.ok(res)
+  delete res.headers.date
+  t.assert.strictEqual(res.statusCode, 500)
+  t.assert.strictEqual(res.payload, '{"statusCode":500,"error":"Internal Server Error","message":"Invalid CORS origin option"}')
+  const actualHeaders = {
+    'content-length': res.headers['content-length']
+  }
+  t.assert.deepStrictEqual(actualHeaders, {
+    'content-length': '89'
   })
 
-  fastify.inject({
+  res = await fastify.inject({
     method: 'GET',
     url: '/',
     headers: {
       'access-control-request-method': 'GET',
       origin: 'example.com'
     }
-  }, (err, res) => {
-    t.error(err)
-    t.equal(res.statusCode, 500)
   })
+  t.assert.ok(res)
+  t.assert.strictEqual(res.statusCode, 500)
 })
 
-test('Should support custom hook with dynamic config (Promise), but should error /2', t => {
+test('Should support custom hook with dynamic config (Promise), but should error /2', async t => {
   t.plan(6)
 
   const fastify = Fastify()
@@ -667,40 +747,41 @@ test('Should support custom hook with dynamic config (Promise), but should error
     return false
   }
 
-  fastify.register(cors, {
+  await fastify.register(cors, {
     delegator: configDelegation
   })
 
-  fastify.get('/', (req, reply) => {
+  fastify.get('/', (_req, reply) => {
     reply.send('ok')
   })
 
-  fastify.inject({
+  let res = await fastify.inject({
     method: 'OPTIONS',
     url: '/',
     headers: {
       'access-control-request-method': 'GET',
       origin: 'example.com'
     }
-  }, (err, res) => {
-    t.error(err)
-    delete res.headers.date
-    t.equal(res.statusCode, 500)
-    t.equal(res.payload, '{"statusCode":500,"error":"Internal Server Error","message":"Invalid CORS origin option"}')
-    t.match(res.headers, {
-      'content-length': '89'
-    })
+  })
+  t.assert.ok(res)
+  delete res.headers.date
+  t.assert.strictEqual(res.statusCode, 500)
+  t.assert.strictEqual(res.payload, '{"statusCode":500,"error":"Internal Server Error","message":"Invalid CORS origin option"}')
+  const actualHeaders = {
+    'content-length': res.headers['content-length']
+  }
+  t.assert.deepStrictEqual(actualHeaders, {
+    'content-length': '89'
   })
 
-  fastify.inject({
+  res = await fastify.inject({
     method: 'GET',
     url: '/',
     headers: {
       'access-control-request-method': 'GET',
       origin: 'example.com'
     }
-  }, (err, res) => {
-    t.error(err)
-    t.equal(res.statusCode, 500)
   })
+  t.assert.ok(res)
+  t.assert.strictEqual(res.statusCode, 500)
 })

backend/node_modules/@fastify/cors/test/preflight.test.js

@@ -1,43 +1,48 @@
 'use strict'
 
-const { test } = require('tap')
+const { test } = require('node:test')
 const Fastify = require('fastify')
 const cors = require('../')
 
-test('Should reply to preflight requests', t => {
+test('Should reply to preflight requests', async t => {
   t.plan(4)
 
   const fastify = Fastify()
-  fastify.register(cors)
+  await fastify.register(cors)
 
-  fastify.inject({
+  const res = await fastify.inject({
     method: 'OPTIONS',
     url: '/',
     headers: {
       'access-control-request-method': 'GET',
       origin: 'example.com'
     }
-  }, (err, res) => {
-    t.error(err)
-    delete res.headers.date
-    t.equal(res.statusCode, 204)
-    t.equal(res.payload, '')
-    t.match(res.headers, {
-      'access-control-allow-origin': '*',
-      'access-control-allow-methods': 'GET,HEAD,PUT,PATCH,POST,DELETE',
-      vary: 'Access-Control-Request-Headers',
-      'content-length': '0'
-    })
+  })
+  t.assert.ok(res)
+  delete res.headers.date
+  t.assert.strictEqual(res.statusCode, 204)
+  t.assert.strictEqual(res.payload, '')
+  const actualHeaders = {
+    'access-control-allow-origin': res.headers['access-control-allow-origin'],
+    'access-control-allow-methods': res.headers['access-control-allow-methods'],
+    vary: res.headers.vary,
+    'content-length': res.headers['content-length']
+  }
+  t.assert.deepStrictEqual(actualHeaders, {
+    'access-control-allow-origin': '*',
+    'access-control-allow-methods': 'GET,HEAD,POST',
+    vary: 'Access-Control-Request-Headers',
+    'content-length': '0'
   })
 })
 
-test('Should add access-control-allow-headers to response if preflight req has access-control-request-headers', t => {
+test('Should add access-control-allow-headers to response if preflight req has access-control-request-headers', async t => {
   t.plan(4)
 
   const fastify = Fastify()
-  fastify.register(cors)
+  await fastify.register(cors)
 
-  fastify.inject({
+  const res = await fastify.inject({
     method: 'OPTIONS',
     url: '/',
     headers: {
@@ -46,390 +51,540 @@ test('Should add access-control-allow-headers to response if preflight req has a
       origin: 'example.com'
     }
 
-  }, (err, res) => {
-    t.error(err)
-    delete res.headers.date
-    t.equal(res.statusCode, 204)
-    t.equal(res.payload, '')
-    t.match(res.headers, {
-      'access-control-allow-origin': '*',
-      'access-control-allow-methods': 'GET,HEAD,PUT,PATCH,POST,DELETE',
-      'access-control-allow-headers': 'x-requested-with',
-      vary: 'Access-Control-Request-Headers',
-      'content-length': '0'
-    })
+  })
+  t.assert.ok(res)
+  delete res.headers.date
+  t.assert.strictEqual(res.statusCode, 204)
+  t.assert.strictEqual(res.payload, '')
+  const actualHeaders = {
+    'access-control-allow-origin': res.headers['access-control-allow-origin'],
+    'access-control-allow-methods': res.headers['access-control-allow-methods'],
+    'access-control-allow-headers': res.headers['access-control-allow-headers'],
+    vary: res.headers.vary,
+    'content-length': res.headers['content-length']
+  }
+  t.assert.deepStrictEqual(actualHeaders, {
+    'access-control-allow-origin': '*',
+    'access-control-allow-methods': 'GET,HEAD,POST',
+    'access-control-allow-headers': 'x-requested-with',
+    vary: 'Access-Control-Request-Headers',
+    'content-length': '0'
   })
 })
 
-test('Should reply to preflight requests with custom status code', t => {
+test('Should reply to preflight requests with custom status code', async t => {
   t.plan(4)
 
   const fastify = Fastify()
-  fastify.register(cors, { optionsSuccessStatus: 200 })
+  await fastify.register(cors, { optionsSuccessStatus: 200 })
 
-  fastify.inject({
+  const res = await fastify.inject({
     method: 'OPTIONS',
     url: '/',
     headers: {
       'access-control-request-method': 'GET',
       origin: 'example.com'
     }
-  }, (err, res) => {
-    t.error(err)
-    delete res.headers.date
-    t.equal(res.statusCode, 200)
-    t.equal(res.payload, '')
-    t.match(res.headers, {
-      'access-control-allow-origin': '*',
-      'access-control-allow-methods': 'GET,HEAD,PUT,PATCH,POST,DELETE',
-      vary: 'Access-Control-Request-Headers',
-      'content-length': '0'
-    })
+  })
+  t.assert.ok(res)
+  delete res.headers.date
+  t.assert.strictEqual(res.statusCode, 200)
+  t.assert.strictEqual(res.payload, '')
+  const actualHeaders = {
+    'access-control-allow-origin': res.headers['access-control-allow-origin'],
+    'access-control-allow-methods': res.headers['access-control-allow-methods'],
+    vary: res.headers.vary,
+    'content-length': res.headers['content-length']
+  }
+  t.assert.deepStrictEqual(actualHeaders, {
+    'access-control-allow-origin': '*',
+    'access-control-allow-methods': 'GET,HEAD,POST',
+    vary: 'Access-Control-Request-Headers',
+    'content-length': '0'
   })
 })
 
-test('Should be able to override preflight response with a route', t => {
+test('Should be able to override preflight response with a route', async t => {
   t.plan(5)
 
   const fastify = Fastify()
-  fastify.register(cors, { preflightContinue: true })
+  await fastify.register(cors, { preflightContinue: true })
 
-  fastify.options('/', (req, reply) => {
+  fastify.options('/', (_req, reply) => {
     reply.send('ok')
   })
 
-  fastify.inject({
+  const res = await fastify.inject({
     method: 'OPTIONS',
     url: '/',
     headers: {
       'access-control-request-method': 'GET',
       origin: 'example.com'
     }
-  }, (err, res) => {
-    t.error(err)
-    delete res.headers.date
-    t.equal(res.statusCode, 200)
-    t.equal(res.payload, 'ok')
-    t.match(res.headers, {
-      // Only the base cors headers and no preflight headers
-      'access-control-allow-origin': '*'
-    })
-    t.notMatch(res.headers, { vary: 'Origin' })
   })
+  t.assert.ok(res)
+  delete res.headers.date
+  t.assert.strictEqual(res.statusCode, 200)
+  t.assert.strictEqual(res.payload, 'ok')
+  const actualHeaders = {
+    'access-control-allow-origin': res.headers['access-control-allow-origin']
+  }
+  t.assert.deepStrictEqual(actualHeaders, {
+    // Only the base cors headers and no preflight headers
+    'access-control-allow-origin': '*'
+  })
+  t.assert.notStrictEqual(res.headers.vary, 'Origin')
 })
 
-test('Should reply to all options requests', t => {
+test('Should reply to all options requests', async t => {
   t.plan(4)
 
   const fastify = Fastify()
-  fastify.register(cors)
+  await fastify.register(cors)
 
-  fastify.inject({
+  const res = await fastify.inject({
     method: 'OPTIONS',
     url: '/hello',
     headers: {
       'access-control-request-method': 'GET',
       origin: 'example.com'
     }
-  }, (err, res) => {
-    t.error(err)
-    delete res.headers.date
-    t.equal(res.statusCode, 204)
-    t.equal(res.payload, '')
-    t.match(res.headers, {
-      'access-control-allow-origin': '*',
-      'access-control-allow-methods': 'GET,HEAD,PUT,PATCH,POST,DELETE',
-      vary: 'Access-Control-Request-Headers',
-      'content-length': '0'
-    })
+  })
+  t.assert.ok(res)
+  delete res.headers.date
+  t.assert.strictEqual(res.statusCode, 204)
+  t.assert.strictEqual(res.payload, '')
+  const actualHeaders = {
+    'access-control-allow-origin': res.headers['access-control-allow-origin'],
+    'access-control-allow-methods': res.headers['access-control-allow-methods'],
+    vary: res.headers.vary,
+    'content-length': res.headers['content-length']
+  }
+  t.assert.deepStrictEqual(actualHeaders, {
+    'access-control-allow-origin': '*',
+    'access-control-allow-methods': 'GET,HEAD,POST',
+    vary: 'Access-Control-Request-Headers',
+    'content-length': '0'
   })
 })
 
-test('Should support a prefix for preflight requests', t => {
+test('Should support a prefix for preflight requests', async t => {
   t.plan(6)
 
   const fastify = Fastify()
-  fastify.register((instance, opts, next) => {
+  await fastify.register((instance, _opts, next) => {
     instance.register(cors)
     next()
   }, { prefix: '/subsystem' })
 
-  fastify.inject({
+  let res = await fastify.inject({
     method: 'OPTIONS',
     url: '/hello'
-  }, (err, res) => {
-    t.error(err)
-    t.equal(res.statusCode, 404)
   })
+  t.assert.ok(res)
+  t.assert.strictEqual(res.statusCode, 404)
 
-  fastify.inject({
+  res = await fastify.inject({
     method: 'OPTIONS',
     url: '/subsystem/hello',
     headers: {
       'access-control-request-method': 'GET',
       origin: 'example.com'
     }
-  }, (err, res) => {
-    t.error(err)
-    delete res.headers.date
-    t.equal(res.statusCode, 204)
-    t.equal(res.payload, '')
-    t.match(res.headers, {
-      'access-control-allow-origin': '*',
-      'access-control-allow-methods': 'GET,HEAD,PUT,PATCH,POST,DELETE',
-      vary: 'Access-Control-Request-Headers',
-      'content-length': '0'
-    })
+  })
+  t.assert.ok(res)
+  delete res.headers.date
+  t.assert.strictEqual(res.statusCode, 204)
+  t.assert.strictEqual(res.payload, '')
+  const actualHeaders = {
+    'access-control-allow-origin': res.headers['access-control-allow-origin'],
+    'access-control-allow-methods': res.headers['access-control-allow-methods'],
+    vary: res.headers.vary,
+    'content-length': res.headers['content-length']
+  }
+  t.assert.deepStrictEqual(actualHeaders, {
+    'access-control-allow-origin': '*',
+    'access-control-allow-methods': 'GET,HEAD,POST',
+    vary: 'Access-Control-Request-Headers',
+    'content-length': '0'
   })
 })
 
-test('hide options route by default', t => {
+test('hide options route by default', async t => {
   t.plan(2)
 
   const fastify = Fastify()
 
   fastify.addHook('onRoute', (route) => {
     if (route.method === 'OPTIONS' && route.url === '*') {
-      t.equal(route.schema.hide, true)
+      t.assert.strictEqual(route.schema.hide, true)
     }
   })
-  fastify.register(cors)
+  await fastify.register(cors)
 
-  fastify.ready(err => {
-    t.error(err)
-  })
+  const ready = await fastify.ready()
+  t.assert.ok(ready)
 })
 
-test('show options route', t => {
+test('show options route', async t => {
   t.plan(2)
 
   const fastify = Fastify()
 
   fastify.addHook('onRoute', (route) => {
     if (route.method === 'OPTIONS' && route.url === '*') {
-      t.equal(route.schema.hide, false)
+      t.assert.strictEqual(route.schema.hide, false)
     }
   })
-  fastify.register(cors, { hideOptionsRoute: false })
+  await fastify.register(cors, { hideOptionsRoute: false })
 
-  fastify.ready(err => {
-    t.error(err)
-  })
+  const ready = await fastify.ready()
+  t.assert.ok(ready)
 })
 
-test('Allow only request from with specific methods', t => {
+test('Allow only request from with specific methods', async t => {
   t.plan(4)
 
   const fastify = Fastify()
-  fastify.register(cors, { methods: ['GET', 'POST'] })
+  await fastify.register(cors, { methods: ['GET', 'POST'] })
 
-  fastify.inject({
+  const res = await fastify.inject({
     method: 'OPTIONS',
     url: '/',
     headers: {
       'access-control-request-method': 'GET',
       origin: 'example.com'
     }
-  }, (err, res) => {
-    t.error(err)
-    delete res.headers.date
-    t.equal(res.statusCode, 204)
-    t.match(res.headers, {
-      'access-control-allow-methods': 'GET, POST'
-    })
-    t.notMatch(res.headers, { vary: 'Origin' })
   })
+  t.assert.ok(res)
+  delete res.headers.date
+  t.assert.strictEqual(res.statusCode, 204)
+  const actualHeaders = {
+    'access-control-allow-methods': res.headers['access-control-allow-methods']
+  }
+  t.assert.deepStrictEqual(actualHeaders, {
+    'access-control-allow-methods': 'GET, POST'
+  })
+  t.assert.notStrictEqual(res.headers.vary, 'Origin')
 })
 
-test('Should reply with 400 error to OPTIONS requests missing origin header when default strictPreflight', t => {
+test('Should reply with 400 error to OPTIONS requests missing origin header when default strictPreflight', async t => {
   t.plan(3)
 
   const fastify = Fastify()
-  fastify.register(cors)
+  await fastify.register(cors)
 
-  fastify.inject({
+  const res = await fastify.inject({
     method: 'OPTIONS',
     url: '/',
     headers: {
       'access-control-request-method': 'GET'
     }
-  }, (err, res) => {
-    t.error(err)
-    t.equal(res.statusCode, 400)
-    t.equal(res.payload, 'Invalid Preflight Request')
   })
+  t.assert.ok(res)
+  t.assert.strictEqual(res.statusCode, 400)
+  t.assert.strictEqual(res.payload, 'Invalid Preflight Request')
 })
 
-test('Should reply with 400 to OPTIONS requests when missing Access-Control-Request-Method header when default strictPreflight', t => {
+test('Should reply with 400 to OPTIONS requests when missing Access-Control-Request-Method header when default strictPreflight', async t => {
   t.plan(3)
 
   const fastify = Fastify()
-  fastify.register(cors, {
+  await fastify.register(cors, {
     strictPreflight: true
   })
 
-  fastify.inject({
+  const res = await fastify.inject({
     method: 'OPTIONS',
     url: '/',
     headers: {
       origin: 'example.com'
     }
-  }, (err, res) => {
-    t.error(err)
-    t.equal(res.statusCode, 400)
-    t.equal(res.payload, 'Invalid Preflight Request')
   })
+  t.assert.ok(res)
+  t.assert.strictEqual(res.statusCode, 400)
+  t.assert.strictEqual(res.payload, 'Invalid Preflight Request')
 })
 
-test('Should reply to all preflight requests when strictPreflight is disabled', t => {
+test('Should reply to all preflight requests when strictPreflight is disabled', async t => {
   t.plan(4)
 
   const fastify = Fastify()
-  fastify.register(cors, { strictPreflight: false })
+  await fastify.register(cors, { strictPreflight: false })
 
-  fastify.inject({
+  const res = await fastify.inject({
     method: 'OPTIONS',
     url: '/'
     // No access-control-request-method or origin headers
-  }, (err, res) => {
-    t.error(err)
-    delete res.headers.date
-    t.equal(res.statusCode, 204)
-    t.equal(res.payload, '')
-    t.match(res.headers, {
-      'access-control-allow-origin': '*',
-      'access-control-allow-methods': 'GET,HEAD,PUT,PATCH,POST,DELETE',
-      vary: 'Access-Control-Request-Headers',
-      'content-length': '0'
-    })
+  })
+  t.assert.ok(res)
+  delete res.headers.date
+  t.assert.strictEqual(res.statusCode, 204)
+  t.assert.strictEqual(res.payload, '')
+  const actualHeaders = {
+    'access-control-allow-origin': res.headers['access-control-allow-origin'],
+    'access-control-allow-methods': res.headers['access-control-allow-methods'],
+    vary: res.headers.vary,
+    'content-length': res.headers['content-length']
+  }
+  t.assert.deepStrictEqual(actualHeaders, {
+    'access-control-allow-origin': '*',
+    'access-control-allow-methods': 'GET,HEAD,POST',
+    vary: 'Access-Control-Request-Headers',
+    'content-length': '0'
   })
 })
 
-test('Default empty 200 response with preflightContinue on OPTIONS routes', t => {
+test('Default empty 200 response with preflightContinue on OPTIONS routes', async t => {
   t.plan(4)
 
   const fastify = Fastify()
-  fastify.register(cors, { preflightContinue: true })
+  await fastify.register(cors, { preflightContinue: true })
 
-  fastify.inject({
+  const res = await fastify.inject({
     method: 'OPTIONS',
     url: '/doesnotexist',
     headers: {
       'access-control-request-method': 'GET',
       origin: 'example.com'
     }
-  }, (err, res) => {
-    t.error(err)
-    delete res.headers.date
-    t.equal(res.statusCode, 200)
-    t.equal(res.payload, '')
-    t.match(res.headers, {
-      'access-control-allow-origin': '*',
-      'access-control-allow-methods': 'GET,HEAD,PUT,PATCH,POST,DELETE',
-      vary: 'Access-Control-Request-Headers'
-    })
+  })
+  t.assert.ok(res)
+  delete res.headers.date
+  t.assert.strictEqual(res.statusCode, 200)
+  t.assert.strictEqual(res.payload, '')
+  const actualHeaders = {
+    'access-control-allow-origin': res.headers['access-control-allow-origin'],
+    'access-control-allow-methods': res.headers['access-control-allow-methods'],
+    vary: res.headers.vary
+  }
+  t.assert.deepStrictEqual(actualHeaders, {
+    'access-control-allow-origin': '*',
+    'access-control-allow-methods': 'GET,HEAD,POST',
+    vary: 'Access-Control-Request-Headers'
   })
 })
 
-test('Can override preflight response with preflightContinue', t => {
+test('Can override preflight response with preflightContinue', async t => {
   t.plan(4)
 
   const fastify = Fastify()
-  fastify.register(cors, { preflightContinue: true })
+  await fastify.register(cors, { preflightContinue: true })
 
-  fastify.options('/', (req, reply) => {
+  fastify.options('/', (_req, reply) => {
     reply.send('ok')
   })
 
-  fastify.inject({
+  const res = await fastify.inject({
     method: 'OPTIONS',
     url: '/',
     headers: {
       'access-control-request-method': 'GET',
       origin: 'example.com'
     }
-  }, (err, res) => {
-    t.error(err)
-    delete res.headers.date
-    t.equal(res.statusCode, 200)
-    t.equal(res.payload, 'ok')
-    t.match(res.headers, {
-      'access-control-allow-origin': '*',
-      'access-control-allow-methods': 'GET,HEAD,PUT,PATCH,POST,DELETE',
-      vary: 'Access-Control-Request-Headers'
-    })
+  })
+  t.assert.ok(res)
+  delete res.headers.date
+  t.assert.strictEqual(res.statusCode, 200)
+  t.assert.strictEqual(res.payload, 'ok')
+  const actualHeaders = {
+    'access-control-allow-origin': res.headers['access-control-allow-origin'],
+    'access-control-allow-methods': res.headers['access-control-allow-methods'],
+    vary: res.headers.vary
+  }
+  t.assert.deepStrictEqual(actualHeaders, {
+    'access-control-allow-origin': '*',
+    'access-control-allow-methods': 'GET,HEAD,POST',
+    vary: 'Access-Control-Request-Headers'
   })
 })
 
-test('Should support ongoing prefix ', t => {
+test('Should support ongoing prefix ', async t => {
   t.plan(12)
 
   const fastify = Fastify()
 
-  fastify.register(async (instance) => {
+  await fastify.register(async (instance) => {
     instance.register(cors)
   }, { prefix: '/prefix' })
 
   // support prefixed route
-  fastify.inject({
+  let res = await fastify.inject({
     method: 'OPTIONS',
     url: '/prefix',
     headers: {
       'access-control-request-method': 'GET',
       origin: 'example.com'
     }
-  }, (err, res) => {
-    t.error(err)
-    delete res.headers.date
-    t.equal(res.statusCode, 204)
-    t.equal(res.payload, '')
-    t.match(res.headers, {
-      'access-control-allow-origin': '*',
-      'access-control-allow-methods': 'GET,HEAD,PUT,PATCH,POST,DELETE',
-      vary: 'Access-Control-Request-Headers',
-      'content-length': '0'
-    })
+  })
+  t.assert.ok(res)
+  delete res.headers.date
+  t.assert.strictEqual(res.statusCode, 204)
+  t.assert.strictEqual(res.payload, '')
+  let actualHeaders = {
+    'access-control-allow-origin': res.headers['access-control-allow-origin'],
+    'access-control-allow-methods': res.headers['access-control-allow-methods'],
+    vary: res.headers.vary,
+    'content-length': res.headers['content-length']
+  }
+  t.assert.deepStrictEqual(actualHeaders, {
+    'access-control-allow-origin': '*',
+    'access-control-allow-methods': 'GET,HEAD,POST',
+    vary: 'Access-Control-Request-Headers',
+    'content-length': '0'
   })
 
   // support prefixed route without / continue
-  fastify.inject({
+  res = await fastify.inject({
     method: 'OPTIONS',
     url: '/prefixfoo',
     headers: {
       'access-control-request-method': 'GET',
       origin: 'example.com'
     }
-  }, (err, res) => {
-    t.error(err)
-    delete res.headers.date
-    t.equal(res.statusCode, 204)
-    t.equal(res.payload, '')
-    t.match(res.headers, {
-      'access-control-allow-origin': '*',
-      'access-control-allow-methods': 'GET,HEAD,PUT,PATCH,POST,DELETE',
-      vary: 'Access-Control-Request-Headers',
-      'content-length': '0'
-    })
+  })
+  t.assert.ok(res)
+  delete res.headers.date
+  t.assert.strictEqual(res.statusCode, 204)
+  t.assert.strictEqual(res.payload, '')
+  actualHeaders = {
+    'access-control-allow-origin': res.headers['access-control-allow-origin'],
+    'access-control-allow-methods': res.headers['access-control-allow-methods'],
+    vary: res.headers.vary,
+    'content-length': res.headers['content-length']
+  }
+  t.assert.deepStrictEqual(actualHeaders, {
+    'access-control-allow-origin': '*',
+    'access-control-allow-methods': 'GET,HEAD,POST',
+    vary: 'Access-Control-Request-Headers',
+    'content-length': '0'
   })
 
   // support prefixed route with / continue
-  fastify.inject({
+  res = await fastify.inject({
     method: 'OPTIONS',
     url: '/prefix/foo',
     headers: {
       'access-control-request-method': 'GET',
       origin: 'example.com'
     }
-  }, (err, res) => {
-    t.error(err)
-    delete res.headers.date
-    t.equal(res.statusCode, 204)
-    t.equal(res.payload, '')
-    t.match(res.headers, {
-      'access-control-allow-origin': '*',
-      'access-control-allow-methods': 'GET,HEAD,PUT,PATCH,POST,DELETE',
-      vary: 'Access-Control-Request-Headers',
-      'content-length': '0'
-    })
+  })
+  t.assert.ok(res)
+  delete res.headers.date
+  t.assert.strictEqual(res.statusCode, 204)
+  t.assert.strictEqual(res.payload, '')
+  actualHeaders = {
+    'access-control-allow-origin': res.headers['access-control-allow-origin'],
+    'access-control-allow-methods': res.headers['access-control-allow-methods'],
+    vary: res.headers.vary,
+    'content-length': res.headers['content-length']
+  }
+  t.assert.deepStrictEqual(actualHeaders, {
+    'access-control-allow-origin': '*',
+    'access-control-allow-methods': 'GET,HEAD,POST',
+    vary: 'Access-Control-Request-Headers',
+    'content-length': '0'
   })
 })
+
+test('Silences preflight logs when logLevel is "silent"', async t => {
+  const logs = []
+  const fastify = Fastify({
+    logger: {
+      level: 'info',
+      stream: {
+        write (line) {
+          try {
+            logs.push(JSON.parse(line))
+          } catch {
+          }
+        }
+      }
+    }
+  })
+
+  await fastify.register(cors, { logLevel: 'silent' })
+
+  fastify.get('/', async () => ({ ok: true }))
+
+  await fastify.ready()
+  t.assert.ok(fastify)
+
+  await fastify.inject({
+    method: 'OPTIONS',
+    url: '/',
+    headers: {
+      'access-control-request-method': 'GET',
+      origin: 'https://example.com'
+    }
+  })
+
+  await fastify.inject({ method: 'GET', url: '/' })
+
+  const hasOptionsLog = logs.some(l => l.req && l.req.method === 'OPTIONS')
+  const hasGetLog = logs.some(l => l.req && l.req.method === 'GET')
+
+  t.assert.strictEqual(hasOptionsLog, false)
+  t.assert.strictEqual(hasGetLog, true)
+
+  await fastify.close()
+})
+test('delegator + logLevel:"silent" → OPTIONS logs are suppressed', async t => {
+  t.plan(3)
+
+  const logs = []
+  const app = Fastify({
+    logger: {
+      level: 'info',
+      stream: { write: l => { try { logs.push(JSON.parse(l)) } catch {} } }
+    }
+  })
+
+  await app.register(cors, {
+    delegator: () => ({ origin: '*' }),
+    logLevel: 'silent'
+  })
+
+  app.get('/', () => ({ ok: true }))
+  await app.ready()
+  t.assert.ok(app)
+
+  await app.inject({
+    method: 'OPTIONS',
+    url: '/',
+    headers: {
+      'access-control-request-method': 'GET',
+      origin: 'https://example.com'
+    }
+  })
+
+  await app.inject({ method: 'GET', url: '/' })
+
+  const hasOptionsLog = logs.some(l => l.req?.method === 'OPTIONS')
+  const hasGetLog = logs.some(l => l.req?.method === 'GET')
+
+  t.assert.strictEqual(hasOptionsLog, false)
+  t.assert.strictEqual(hasGetLog, true)
+
+  await app.close()
+})
+test('delegator + hideOptionsRoute:false → OPTIONS route is visible', async t => {
+  t.plan(2)
+
+  const app = Fastify()
+
+  app.addHook('onRoute', route => {
+    if (route.method === 'OPTIONS' && route.url === '*') {
+      t.assert.strictEqual(route.schema.hide, false)
+    }
+  })
+
+  await app.register(cors, {
+    delegator: () => ({ origin: '*' }),
+    hideOptionsRoute: false
+  })
+
+  await app.ready()
+  t.assert.ok(app)
+  await app.close()
+})

backend/node_modules/@fastify/cors/test/vary.test.js

@@ -1,24 +1,24 @@
 'use strict'
 
-const test = require('tap').test
-const createAddFieldnameToVary = require('../vary').createAddFieldnameToVary
-const parse = require('../vary').parse
+const { test } = require('node:test')
+const { createAddFieldnameToVary } = require('../vary')
+const { parse } = require('../vary')
 
-test('Should set * even if we set a specific field', t => {
+test('Should set * even if we set a specific field', async t => {
   t.plan(1)
 
   const addOriginToVary = createAddFieldnameToVary('Origin')
   const replyMock = {
-    getHeader (name) {
+    getHeader () {
       return '*'
     },
-    header (name, value) {
+    header () {
       t.fail('Should not be here')
     }
   }
 
   addOriginToVary(replyMock)
-  t.pass()
+  t.assert.ok(true) // equalivant to tap t.pass()
 })
 
 test('Should set * even if we set a specific field', t => {
@@ -26,12 +26,12 @@ test('Should set * even if we set a specific field', t => {
 
   const addWildcardToVary = createAddFieldnameToVary('*')
   const replyMock = {
-    getHeader (name) {
+    getHeader () {
       return 'Origin'
     },
     header (name, value) {
-      t.same(name, 'Vary')
-      t.same(value, '*')
+      t.assert.deepStrictEqual(name, 'Vary')
+      t.assert.deepStrictEqual(value, '*')
     }
   }
 
@@ -43,17 +43,17 @@ test('Should set * when field contains a *', t => {
 
   const addOriginToVary = createAddFieldnameToVary('Origin')
   const replyMock = {
-    getHeader (name) {
+    getHeader () {
       return ['Origin', '*', 'Access-Control-Request-Headers']
     },
     header (name, value) {
-      t.same(name, 'Vary')
-      t.same(value, '*')
+      t.assert.deepStrictEqual(name, 'Vary')
+      t.assert.deepStrictEqual(value, '*')
     }
   }
 
   addOriginToVary(replyMock)
-  t.pass()
+  t.assert.ok(true) // equalivant to tap t.pass()
 })
 
 test('Should concat vary values', t => {
@@ -61,17 +61,17 @@ test('Should concat vary values', t => {
 
   const addOriginToVary = createAddFieldnameToVary('Origin')
   const replyMock = {
-    getHeader (name) {
+    getHeader () {
       return 'Access-Control-Request-Headers'
     },
     header (name, value) {
-      t.same(name, 'Vary')
-      t.same(value, 'Access-Control-Request-Headers, Origin')
+      t.assert.deepStrictEqual(name, 'Vary')
+      t.assert.deepStrictEqual(value, 'Access-Control-Request-Headers, Origin')
     }
   }
 
   addOriginToVary(replyMock)
-  t.pass()
+  t.assert.ok(true) // equalivant to tap t.pass()
 })
 
 test('Should concat vary values ignoring consecutive commas', t => {
@@ -79,17 +79,17 @@ test('Should concat vary values ignoring consecutive commas', t => {
 
   const addOriginToVary = createAddFieldnameToVary('Origin')
   const replyMock = {
-    getHeader (name) {
+    getHeader () {
       return ' Access-Control-Request-Headers,Access-Control-Request-Method'
     },
     header (name, value) {
-      t.same(name, 'Vary')
-      t.same(value, ' Access-Control-Request-Headers,Access-Control-Request-Method, Origin')
+      t.assert.deepStrictEqual(name, 'Vary')
+      t.assert.deepStrictEqual(value, ' Access-Control-Request-Headers,Access-Control-Request-Method, Origin')
     }
   }
 
   addOriginToVary(replyMock)
-  t.pass()
+  t.assert.ok(true) // equalivant to tap t.pass()
 })
 
 test('Should concat vary values ignoring whitespace', t => {
@@ -97,17 +97,17 @@ test('Should concat vary values ignoring whitespace', t => {
 
   const addOriginToVary = createAddFieldnameToVary('Origin')
   const replyMock = {
-    getHeader (name) {
+    getHeader () {
       return ' Access-Control-Request-Headers ,Access-Control-Request-Method'
     },
     header (name, value) {
-      t.same(name, 'Vary')
-      t.same(value, ' Access-Control-Request-Headers ,Access-Control-Request-Method, Origin')
+      t.assert.deepStrictEqual(name, 'Vary')
+      t.assert.deepStrictEqual(value, ' Access-Control-Request-Headers ,Access-Control-Request-Method, Origin')
     }
   }
 
   addOriginToVary(replyMock)
-  t.pass()
+  t.assert.ok(true) // equalivant to tap t.pass()
 })
 
 test('Should set the field as value for vary if no vary is defined', t => {
@@ -115,12 +115,12 @@ test('Should set the field as value for vary if no vary is defined', t => {
 
   const addOriginToVary = createAddFieldnameToVary('Origin')
   const replyMock = {
-    getHeader (name) {
+    getHeader () {
       return undefined
     },
     header (name, value) {
-      t.same(name, 'Vary')
-      t.same(value, 'Origin')
+      t.assert.deepStrictEqual(name, 'Vary')
+      t.assert.deepStrictEqual(value, 'Origin')
     }
   }
 
@@ -132,12 +132,12 @@ test('Should set * as value for vary if vary contains *', t => {
 
   const addOriginToVary = createAddFieldnameToVary('Origin')
   const replyMock = {
-    getHeader (name) {
+    getHeader () {
       return 'Accept,*'
     },
     header (name, value) {
-      t.same(name, 'Vary')
-      t.same(value, '*')
+      t.assert.deepStrictEqual(name, 'Vary')
+      t.assert.deepStrictEqual(value, '*')
     }
   }
 
@@ -149,12 +149,12 @@ test('Should set Accept-Encoding as value for vary if vary is empty string', t =
 
   const addAcceptEncodingToVary = createAddFieldnameToVary('Accept-Encoding')
   const replyMock = {
-    getHeader (name) {
+    getHeader () {
       return ''
     },
     header (name, value) {
-      t.same(name, 'Vary')
-      t.same(value, 'Accept-Encoding')
+      t.assert.deepStrictEqual(name, 'Vary')
+      t.assert.deepStrictEqual(value, 'Accept-Encoding')
     }
   }
 
@@ -167,12 +167,12 @@ test('Should have no issues with values containing dashes', t => {
   const addXFooToVary = createAddFieldnameToVary('X-Foo')
   const replyMock = {
     value: 'Accept-Encoding',
-    getHeader (name) {
+    getHeader () {
       return this.value
     },
     header (name, value) {
-      t.same(name, 'Vary')
-      t.same(value, 'Accept-Encoding, X-Foo')
+      t.assert.deepStrictEqual(name, 'Vary')
+      t.assert.deepStrictEqual(value, 'Accept-Encoding, X-Foo')
       this.value = value
     }
   }
@@ -186,44 +186,52 @@ test('Should ignore the header as value for vary if it is already in vary', t =>
 
   const addOriginToVary = createAddFieldnameToVary('Origin')
   const replyMock = {
-    getHeader (name) {
+    getHeader () {
       return 'Origin'
     },
-    header (name, value) {
+    header () {
       t.fail('Should not be here')
     }
   }
   addOriginToVary(replyMock)
   addOriginToVary(replyMock)
-  t.pass()
+
+  t.assert.ok(true) // equalivant to tap t.pass()
 })
 
 test('parse', t => {
   t.plan(18)
-  t.same(parse(''), [])
-  t.same(parse('a'), ['a'])
-  t.same(parse('a,b'), ['a', 'b'])
-  t.same(parse('  a,b'), ['a', 'b'])
-  t.same(parse('a,b  '), ['a', 'b'])
-  t.same(parse('a,b,c'), ['a', 'b', 'c'])
-  t.same(parse('A,b,c'), ['a', 'b', 'c'])
-  t.same(parse('a,b,c,'), ['a', 'b', 'c'])
-  t.same(parse('a,b,c, '), ['a', 'b', 'c'])
-  t.same(parse(',a,b,c'), ['a', 'b', 'c'])
-  t.same(parse(' ,a,b,c'), ['a', 'b', 'c'])
-  t.same(parse('a,,b,c'), ['a', 'b', 'c'])
-  t.same(parse('a,,,b,,c'), ['a', 'b', 'c'])
-  t.same(parse('a, b,c'), ['a', 'b', 'c'])
-  t.same(parse('a,   b,c'), ['a', 'b', 'c'])
-  t.same(parse('a, , b,c'), ['a', 'b', 'c'])
-  t.same(parse('a,  , b,c'), ['a', 'b', 'c'])
+  t.assert.deepStrictEqual(parse(''), [])
+  t.assert.deepStrictEqual(parse('a'), ['a'])
+  t.assert.deepStrictEqual(parse('a,b'), ['a', 'b'])
+  t.assert.deepStrictEqual(parse('  a,b'), ['a', 'b'])
+  t.assert.deepStrictEqual(parse('a,b  '), ['a', 'b'])
+  t.assert.deepStrictEqual(parse('a,b,c'), ['a', 'b', 'c'])
+  t.assert.deepStrictEqual(parse('A,b,c'), ['a', 'b', 'c'])
+  t.assert.deepStrictEqual(parse('a,b,c,'), ['a', 'b', 'c'])
+  t.assert.deepStrictEqual(parse('a,b,c, '), ['a', 'b', 'c'])
+  t.assert.deepStrictEqual(parse(',a,b,c'), ['a', 'b', 'c'])
+  t.assert.deepStrictEqual(parse(' ,a,b,c'), ['a', 'b', 'c'])
+  t.assert.deepStrictEqual(parse('a,,b,c'), ['a', 'b', 'c'])
+  t.assert.deepStrictEqual(parse('a,,,b,,c'), ['a', 'b', 'c'])
+  t.assert.deepStrictEqual(parse('a, b,c'), ['a', 'b', 'c'])
+  t.assert.deepStrictEqual(parse('a,   b,c'), ['a', 'b', 'c'])
+  t.assert.deepStrictEqual(parse('a, , b,c'), ['a', 'b', 'c'])
+  t.assert.deepStrictEqual(parse('a,  , b,c'), ['a', 'b', 'c'])
 
   // one for the cache
-  t.same(parse('A,b,c'), ['a', 'b', 'c'])
+  t.assert.deepStrictEqual(parse('A,b,c'), ['a', 'b', 'c'])
 })
 
-test('createAddFieldnameToVary', t => {
-  t.plan(2)
-  t.same(typeof createAddFieldnameToVary('valid-header'), 'function')
-  t.throws(() => createAddFieldnameToVary('invalid:header'), TypeError, 'Field contains invalid characters.')
+test('createAddFieldnameToVary', async t => {
+  t.plan(4)
+  t.assert.strictEqual(typeof createAddFieldnameToVary('valid-header'), 'function')
+  await t.assert.rejects(
+    async () => createAddFieldnameToVary('invalid:header'),
+    (err) => {
+      t.assert.strictEqual(err.name, 'TypeError')
+      t.assert.strictEqual(err.message, 'Fieldname contains invalid characters.')
+      return true
+    }
+  )
 })