
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
A library for JavaScript consumers to verify if they satisfy externally defined HTTP contracts
npm install node-cdc
Consumer Driven Contracts are a pattern that drives the development of the producer from its consumer's point of view. It is TDD for services. This library provides an implementation for JavaScript consumers to verify if they satisfy externally defined HTTP contracts.
A contract mapping is a json file containing a WireMock stub definition. More information on this format can be found in the WireMock documentation.
A contract artifact is an archive file (zip, jar, ...) that contains WireMock json mappings generated from contracts. If the artifact contains the contract mappings for multiple consumers then it needs to seperate these in different directories using the consumer name as the identifier. This identifier can then be used as the value of the consumerName option when creating a StubRunner.
Artifacts can be referenced by using the following string format ${groupId}:${artifactId}:${version}(:${classifier}).
The StubRunner class is the entrypoint of the library. It is used to start a WireMock standalone server for each defined contract artifact.
The StubRunner can be configured using the StubRunnerOptions interface.
export interface StubRunnerOptions {
consumerName?: string,
wireMockArtifact?: string,
repositoryManager: RepositoryManager
}
Specifies the name of the consumer. This option will ensure that only the contracts mappings for this specific consumer will be extracted from the contract artifact. If this option is not defined all contract mappings from the contract artifact will be extracted.
Specifies the WireMock standalone artifact reference. It will default to com.github.tomakehurst:wiremock-standalone:2.21.0 if this option is not defined.
Specifies the repository manager to be used when downloading the WireMock standalone and contract artifacts. See the maven repository manager documentation for more information
The StubRunner can be started using the ContractPortMappings interface. The interface uses the port as its key and the contract artifact reference as its value.
export interface ContractPortMappings {
[key: number]: string
}
Example:
import { StubRunner } from 'node-cdc';
import { createPerson } from './person-client';
const STUBRUNNER_OPTIONS = {
consumerName: 'frontend'
};
const CONTRACT_MAPPINGS = {
8080: 'com.company:contracts:local:stubs'
};
describe('Person API', () => {
let stubrunner = new StubRunner(STUBRUNNER_OPTIONS);
beforeAll((done) => {
stubrunner.start(CONTRACT_MAPPINGS)
.then(() => done());
});
it('should be able to create a person by name', (done) => {
createPerson('David')
.then((response) => {
expect(response.status).toBe(201);
done();
});
});
afterAll(() => {
stubrunner.stop();
});
});
This error specifies that the HTTP client on the consuming side made a request that did not match the contract. The StubRunner will log the 'Closest stub' that was found and the 'Request' that was made. Use this information to find which part of the request did not match the contract.
This is currently an unresolved error. You can try to put the WireMock artifact in a local registry and see if this helps.
${artifactReference}' could not be found in any of the declared repositoriesIf you encounter this error make sure that the artifact is present in one of the declared repositories. You can specify the repositories by using the artifactRepositories when creating a StubRunner. Make sure that you use ~/.m2/repository/ for your local maven registry and not ~/.m2/.
In theory all contract artifacts containing WireMock json mappings are supported. Spring Cloud Contract is a perfect example that uses this format and will be used as demo material in further examples.
FAQs
A library for JavaScript consumers to verify if they satisfy externally defined HTTP contracts
The npm package node-cdc receives a total of 2 weekly downloads. As such, node-cdc popularity was classified as not popular.
We found that node-cdc demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.