Add content-type negotiation test for GET /api/streams with `Accept: application/xml` returning 406

[Jagadeeshftw]

📌 Description

src/middleware/contentType.ts enforces Content-Type: application/json on write routes but there are no tests confirming that routes correctly return 406 Not Acceptable when a client sends Accept: application/xml or another non-JSON type. The Express default behavior is to return JSON regardless of the Accept header, which is technically incorrect. Tests should confirm the current behavior and, if 406 is not returned, open a ticket or add content negotiation middleware to enforce it on read routes.

💡 Why it matters: Clients relying on Accept header negotiation will silently receive JSON when they expect XML or another format, violating HTTP content negotiation contracts.

🧩 Requirements and context

• Test GET /api/streams with Accept: application/xml — document whether it returns 200 (JSON) or 406
• Test GET /api/streams with Accept: application/json — assert 200
• Test GET /api/streams with Accept: */* — assert 200
• If 406 is not currently returned for application/xml, add a middleware that enforces it
• Update tests/routes/streams.test.ts with the content-negotiation assertions

Non-functional requirements

• Must be secure, tested, and documented.
• Should be efficient and easy to review.

🛠️ Suggested execution

1. Fork the repo and create a branch

git checkout -b feat/content-negotiation-406

2. Implement changes

• Write/modify the relevant source: src/middleware/contentType.ts, src/routes/index.ts (if middleware needed)
• Write comprehensive tests: tests/middleware/contentNegotiation.test.ts
• Add documentation: TSDoc on the content negotiation middleware
• Include TSDoc on the Accept header validation logic
• Validate security assumptions: 406 response must not expose server internals in the body

3. Test and commit

• Run tests:

npm test -- --testPathPattern=contentNegotiation

• Cover edge cases: Accept: application/json;q=0.9, application/xml;q=1.0 (XML preferred), Accept: empty header
• Include test output and security notes in the PR description.

Example commit message

feat(content-type): add 406 Not Acceptable for non-JSON Accept headers on GET routes

✅ Acceptance criteria

• GET /api/streams with Accept: application/xml returns 406 with JSON error body
• GET /api/streams with Accept: application/json returns 200
• GET /api/streams with Accept: */* returns 200
• Tests cover all three scenarios
• CI passes with no type errors

🔒 Security notes

The 406 response body must use the standard error envelope and must not include the raw Accept header value to prevent header-injection reflection.

📋 Guidelines

• Minimum 95% test coverage
• Clear documentation
• Timeframe: 96 hours

[greatest0fallt1me]

Hello Maintainers 👋,
I’m interested in picking up this issue and contributing to the project.
I have solid experience working across both frontend and blockchain layers, including building user interfaces with Next.js and developing Stellar smart contracts using Rust (Soroban). I’m familiar with translating Figma designs into pixel-accurate UIs, handling wallet integrations, and writing efficient, well-tested contract logic.
I focus on writing clean, maintainable code, following repository standards, and keeping communication transparent throughout the development process. I can start immediately and complete the work within the expected timeframe.
Excited to collaborate and add value to the project 🚀
Thank you!

[grantfox-oss]

🦊 GrantFox — @greatest0fallt1me has been assigned to this issue as part of the Official Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #587)
2. Your PR will be reviewed by the Fluxora-Org maintainers

Good luck! Track your progress on GrantFox.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Official Campaign campaign!

@greatest0fallt1me's PR #596 was approved and merged by @Jagadeeshftw.

🏆 @greatest0fallt1me: You earned 40 FoxPoints for this contribution! Your current tier: Builder (1,268 total points). Track your full progress on GrantFox.

👏 Great work, @greatest0fallt1me! Keep contributing to Fluxora-Org.