fix: replace koa-helmet

package.json

@@ -20,12 +20,12 @@
   "//": "Dependencies required at runtime",
   "dependencies": {
     "@graphile-contrib/pg-simplify-inflector": "6.1.0",
-    "@koa/router": "15.0.0",
     "@koa/bodyparser": "6.0.0",
+    "@koa/router": "15.0.0",
     "dotenv": "17.2.3",
+    "helmet": "8.1.0",
     "koa": "3.1.1",
     "koa-compress": "5.1.1",
-    "koa-helmet": "8.0.1",
     "pg": "8.16.3",
     "postgraphile": "4.14.1"
   },

src/index.test.ts

@@ -27,7 +27,10 @@ vi.mock('./config.js', () => ({
 vi.mock('./middleware/index.js', () => ({
   bodyParser: vi.fn().mockName('bodyParser'),
   compress: vi.fn().mockName('compress'),
-  helmet: vi.fn().mockName('helmet'),
+  helmet: vi
+    .fn()
+    .mockName('helmet')
+    .mockReturnValue(vi.fn().mockName('helmet-middleware')),
   postGraphile: vi.fn().mockName('postGraphile'),
 }))
 vi.mock('./router/index.js', () => ({
@@ -43,7 +46,7 @@ describe('index', () => {
   })
 
   it('should be tested', async () => {
-    expect.assertions(12)
+    expect.assertions(13)
 
     await import('./index.js')
 
@@ -53,7 +56,8 @@ describe('index', () => {
     expect.soft(mockKoaInstance.use).toHaveBeenCalledTimes(6)
     expect.soft(mockKoaInstance.use).toHaveBeenCalledWith(bodyParser)
     expect.soft(mockKoaInstance.use).toHaveBeenCalledWith(compress)
-    expect.soft(mockKoaInstance.use).toHaveBeenCalledWith(helmet)
+    expect.soft(helmet).toHaveBeenCalledWith()
+    expect.soft(mockKoaInstance.use).toHaveBeenCalledWith(helmet())
     expect.soft(healthRouter.routes).toHaveBeenCalledOnce()
     expect.soft(mockKoaInstance.use).toHaveBeenCalledWith(healthRouter.routes())
     expect.soft(healthRouter.allowedMethods).toHaveBeenCalledOnce()

src/index.ts

@@ -14,7 +14,7 @@ app
   // register common middleware
   .use(bodyParser)
   .use(compress)
-  .use(helmet)
+  .use(helmet())
   // register health router
   .use(healthRouter.routes())
   .use(healthRouter.allowedMethods())

src/middleware/helmet.test.ts

@@ -1,15 +1,15 @@
-import helmet from 'koa-helmet'
+import helmet from 'helmet'
 import { describe, expect, it, vi } from 'vitest'
 
-vi.mock('koa-helmet')
+vi.mock('helmet')
 
 describe('helmet', () => {
   it('should export helmet', async () => {
     expect.assertions(2)
 
     const { default: actual } = await import('./helmet.js')
 
-    expect(helmet.default).toHaveBeenCalledOnce()
-    expect(actual).toStrictEqual(helmet.default())
+    expect(helmet).toHaveBeenCalledOnce()
+    expect(actual).toStrictEqual(helmet)
   })
 })

src/middleware/helmet.ts

@@ -1,3 +1,19 @@
-import helmet from 'koa-helmet'
+import helmet, { type HelmetOptions } from 'helmet'
+import type { Middleware } from 'koa'
 
-export default helmet.default()
+/**
+ * Koa-compatible Helmet middleware.
+ *
+ * Accepts the same options helmet() does.
+ */
+export default function (options?: HelmetOptions): Middleware {
+  const expressHelmet = helmet(options)
+  return async (ctx, next) => {
+    return new Promise<void>((resolve, reject) => {
+      expressHelmet(ctx.req, ctx.res, (err) => {
+        if (err) return reject(err)
+        resolve(next())
+      })
+    })
+  }
+}