style(13-03): apply Prettier formatting across repo
Mechanical reformat — no logic changes. 398 files changed, 19125 insertions(+), 16457 deletions(-). Prettier 3.8.4 with .prettierrc (singleQuote:true, semi:true, tabWidth:2, trailingComma:all, printWidth:100). Isolated per D-13-08 for reviewability.
This commit is contained in:
Lucas Berger
File diff suppressed because it is too large
Load Diff
+788
-690
File diff suppressed because it is too large
Load Diff
@@ -14,7 +14,7 @@
|
||||
* directly and redirects to '/'.
|
||||
*/
|
||||
|
||||
import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
|
||||
import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Shared mock: DB — avoids real DB connections across all tests in this file.
|
||||
@@ -34,76 +34,73 @@ vi.mock('../../src/db/client.js', () => ({
|
||||
}),
|
||||
}),
|
||||
},
|
||||
}))
|
||||
}));
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Track whether oidcAuthMiddleware was registered on the app.
|
||||
// ---------------------------------------------------------------------------
|
||||
const oidcMiddlewareSpy = vi.fn(
|
||||
() => async (_c: unknown, next: () => Promise<void>) => next(),
|
||||
)
|
||||
const oidcMiddlewareSpy = vi.fn(() => async (_c: unknown, next: () => Promise<void>) => next());
|
||||
|
||||
vi.mock('@hono/oidc-auth', () => ({
|
||||
oidcAuthMiddleware: () => oidcMiddlewareSpy(),
|
||||
processOAuthCallback: () => async (c: { json: (v: unknown) => unknown }) =>
|
||||
c.json({ ok: true }),
|
||||
processOAuthCallback: () => async (c: { json: (v: unknown) => unknown }) => c.json({ ok: true }),
|
||||
getAuth: vi.fn().mockResolvedValue(null),
|
||||
}))
|
||||
}));
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Env snapshot — restored after each test.
|
||||
// ---------------------------------------------------------------------------
|
||||
const originalNodeEnv = process.env.NODE_ENV
|
||||
const originalBypassFlag = process.env.DEV_AUTH_BYPASS
|
||||
const originalNodeEnv = process.env.NODE_ENV;
|
||||
const originalBypassFlag = process.env.DEV_AUTH_BYPASS;
|
||||
|
||||
afterEach(() => {
|
||||
process.env.NODE_ENV = originalNodeEnv
|
||||
process.env.NODE_ENV = originalNodeEnv;
|
||||
if (originalBypassFlag === undefined) {
|
||||
delete process.env.DEV_AUTH_BYPASS
|
||||
delete process.env.DEV_AUTH_BYPASS;
|
||||
} else {
|
||||
process.env.DEV_AUTH_BYPASS = originalBypassFlag
|
||||
process.env.DEV_AUTH_BYPASS = originalBypassFlag;
|
||||
}
|
||||
vi.resetModules()
|
||||
oidcMiddlewareSpy.mockClear()
|
||||
})
|
||||
vi.resetModules();
|
||||
oidcMiddlewareSpy.mockClear();
|
||||
});
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
describe('GET /api/login — dev-auth bypass (DEV_AUTH_BYPASS=true)', () => {
|
||||
beforeEach(() => {
|
||||
process.env.NODE_ENV = 'test'
|
||||
process.env.DEV_AUTH_BYPASS = 'true'
|
||||
})
|
||||
process.env.NODE_ENV = 'test';
|
||||
process.env.DEV_AUTH_BYPASS = 'true';
|
||||
});
|
||||
|
||||
it('returns 302 with location "/" (bypass active, guard not mounted)', async () => {
|
||||
const { app } = await import('../../src/index.js')
|
||||
const { app } = await import('../../src/index.js');
|
||||
|
||||
const res = await app.request('/api/login')
|
||||
expect(res.status).toBe(302)
|
||||
expect(res.headers.get('location')).toBe('/')
|
||||
})
|
||||
const res = await app.request('/api/login');
|
||||
expect(res.status).toBe(302);
|
||||
expect(res.headers.get('location')).toBe('/');
|
||||
});
|
||||
|
||||
it('does not invoke oidcAuthMiddleware when bypass is active', async () => {
|
||||
const { app } = await import('../../src/index.js')
|
||||
const { app } = await import('../../src/index.js');
|
||||
|
||||
await app.request('/api/login')
|
||||
await app.request('/api/login');
|
||||
|
||||
expect(oidcMiddlewareSpy).not.toHaveBeenCalled()
|
||||
})
|
||||
})
|
||||
expect(oidcMiddlewareSpy).not.toHaveBeenCalled();
|
||||
});
|
||||
});
|
||||
|
||||
describe('GET /api/login — OIDC path (no DEV_AUTH_BYPASS)', () => {
|
||||
beforeEach(() => {
|
||||
process.env.NODE_ENV = 'test'
|
||||
delete process.env.DEV_AUTH_BYPASS
|
||||
})
|
||||
process.env.NODE_ENV = 'test';
|
||||
delete process.env.DEV_AUTH_BYPASS;
|
||||
});
|
||||
|
||||
it('returns 302 with location "/" when OIDC passthrough allows the request', async () => {
|
||||
const { app } = await import('../../src/index.js')
|
||||
const { app } = await import('../../src/index.js');
|
||||
|
||||
// oidcAuthMiddleware is mocked as a passthrough — request reaches the handler.
|
||||
const res = await app.request('/api/login')
|
||||
expect(res.status).toBe(302)
|
||||
expect(res.headers.get('location')).toBe('/')
|
||||
})
|
||||
})
|
||||
const res = await app.request('/api/login');
|
||||
expect(res.status).toBe(302);
|
||||
expect(res.headers.get('location')).toBe('/');
|
||||
});
|
||||
});
|
||||
|
||||
@@ -15,7 +15,7 @@
|
||||
* vitest.resetModules() ensures each test gets a fresh module registry.
|
||||
*/
|
||||
|
||||
import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
|
||||
import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Shared mock: DB — avoids real DB connections across all tests in this file.
|
||||
@@ -35,109 +35,106 @@ vi.mock('../../src/db/client.js', () => ({
|
||||
}),
|
||||
}),
|
||||
},
|
||||
}))
|
||||
}));
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Track whether oidcAuthMiddleware was registered on the app.
|
||||
// The spy is set up fresh per test via beforeEach/afterEach.
|
||||
// ---------------------------------------------------------------------------
|
||||
const oidcMiddlewareSpy = vi.fn(
|
||||
() => async (_c: unknown, next: () => Promise<void>) => next(),
|
||||
)
|
||||
const oidcMiddlewareSpy = vi.fn(() => async (_c: unknown, next: () => Promise<void>) => next());
|
||||
|
||||
vi.mock('@hono/oidc-auth', () => ({
|
||||
oidcAuthMiddleware: () => oidcMiddlewareSpy(),
|
||||
processOAuthCallback: () => async (c: { json: (v: unknown) => unknown }) =>
|
||||
c.json({ ok: true }),
|
||||
processOAuthCallback: () => async (c: { json: (v: unknown) => unknown }) => c.json({ ok: true }),
|
||||
getAuth: vi.fn().mockResolvedValue(null),
|
||||
}))
|
||||
}));
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Env snapshot — restored after each test to avoid cross-test pollution.
|
||||
// ---------------------------------------------------------------------------
|
||||
const originalNodeEnv = process.env.NODE_ENV
|
||||
const originalBypassFlag = process.env.DEV_AUTH_BYPASS
|
||||
const originalNodeEnv = process.env.NODE_ENV;
|
||||
const originalBypassFlag = process.env.DEV_AUTH_BYPASS;
|
||||
|
||||
afterEach(() => {
|
||||
process.env.NODE_ENV = originalNodeEnv
|
||||
process.env.NODE_ENV = originalNodeEnv;
|
||||
if (originalBypassFlag === undefined) {
|
||||
delete process.env.DEV_AUTH_BYPASS
|
||||
delete process.env.DEV_AUTH_BYPASS;
|
||||
} else {
|
||||
process.env.DEV_AUTH_BYPASS = originalBypassFlag
|
||||
process.env.DEV_AUTH_BYPASS = originalBypassFlag;
|
||||
}
|
||||
vi.resetModules()
|
||||
oidcMiddlewareSpy.mockClear()
|
||||
})
|
||||
vi.resetModules();
|
||||
oidcMiddlewareSpy.mockClear();
|
||||
});
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
describe('GET /api/me — dev-auth bypass (DEV_AUTH_BYPASS=true)', () => {
|
||||
beforeEach(() => {
|
||||
process.env.NODE_ENV = 'test'
|
||||
process.env.DEV_AUTH_BYPASS = 'true'
|
||||
})
|
||||
process.env.NODE_ENV = 'test';
|
||||
process.env.DEV_AUTH_BYPASS = 'true';
|
||||
});
|
||||
|
||||
it('returns 200 with the injected dev user identity', async () => {
|
||||
// Import AFTER setting env — index.ts reads env at module load time.
|
||||
const { app } = await import('../../src/index.js')
|
||||
const { DEV_USER } = await import('../../src/auth/devBypass.js')
|
||||
const { app } = await import('../../src/index.js');
|
||||
const { DEV_USER } = await import('../../src/auth/devBypass.js');
|
||||
|
||||
const res = await app.request('/api/me')
|
||||
expect(res.status).toBe(200)
|
||||
const res = await app.request('/api/me');
|
||||
expect(res.status).toBe(200);
|
||||
|
||||
const body = await res.json() as { user: { id: number; displayName: string; color: string } }
|
||||
expect(body).toHaveProperty('user')
|
||||
expect(body.user.id).toBe(DEV_USER.id)
|
||||
expect(body.user.displayName).toBe(DEV_USER.displayName)
|
||||
expect(body.user.color).toBe(DEV_USER.color)
|
||||
})
|
||||
const body = (await res.json()) as { user: { id: number; displayName: string; color: string } };
|
||||
expect(body).toHaveProperty('user');
|
||||
expect(body.user.id).toBe(DEV_USER.id);
|
||||
expect(body.user.displayName).toBe(DEV_USER.displayName);
|
||||
expect(body.user.color).toBe(DEV_USER.color);
|
||||
});
|
||||
|
||||
it('returns id=1 and color=#4A90D9 (first palette slot)', async () => {
|
||||
const { app } = await import('../../src/index.js')
|
||||
const { app } = await import('../../src/index.js');
|
||||
|
||||
const res = await app.request('/api/me')
|
||||
expect(res.status).toBe(200)
|
||||
const res = await app.request('/api/me');
|
||||
expect(res.status).toBe(200);
|
||||
|
||||
const body = await res.json() as { user: { id: number; color: string } }
|
||||
expect(body.user.id).toBe(1)
|
||||
expect(body.user.color).toBe('#4A90D9')
|
||||
})
|
||||
const body = (await res.json()) as { user: { id: number; color: string } };
|
||||
expect(body.user.id).toBe(1);
|
||||
expect(body.user.color).toBe('#4A90D9');
|
||||
});
|
||||
|
||||
it('does not invoke oidcAuthMiddleware on /api/* when bypass is active', async () => {
|
||||
const { app } = await import('../../src/index.js')
|
||||
const { app } = await import('../../src/index.js');
|
||||
|
||||
// Hit any /api/* route to trigger the middleware stack.
|
||||
await app.request('/api/me')
|
||||
await app.request('/api/me');
|
||||
|
||||
// oidcAuthMiddleware() factory must NOT have been called — index.ts skips it.
|
||||
expect(oidcMiddlewareSpy).not.toHaveBeenCalled()
|
||||
})
|
||||
})
|
||||
expect(oidcMiddlewareSpy).not.toHaveBeenCalled();
|
||||
});
|
||||
});
|
||||
|
||||
describe('GET /api/me — OIDC path (no DEV_AUTH_BYPASS)', () => {
|
||||
beforeEach(() => {
|
||||
process.env.NODE_ENV = 'test'
|
||||
delete process.env.DEV_AUTH_BYPASS
|
||||
})
|
||||
process.env.NODE_ENV = 'test';
|
||||
delete process.env.DEV_AUTH_BYPASS;
|
||||
});
|
||||
|
||||
it('wires oidcAuthMiddleware on /api/* when bypass is not active', async () => {
|
||||
// Import app — devBypassActive will be false, so oidcAuthMiddleware() is called
|
||||
// during app construction (index.ts registers it via app.use('/api/*', ...)).
|
||||
await import('../../src/index.js')
|
||||
await import('../../src/index.js');
|
||||
|
||||
// The spy wraps the oidcAuthMiddleware() factory call in index.ts.
|
||||
// It must have been called exactly once (one app.use registration).
|
||||
expect(oidcMiddlewareSpy).toHaveBeenCalledTimes(1)
|
||||
})
|
||||
expect(oidcMiddlewareSpy).toHaveBeenCalledTimes(1);
|
||||
});
|
||||
|
||||
it('returns 401 when no OIDC session is present (getAuth returns null)', async () => {
|
||||
const { app } = await import('../../src/index.js')
|
||||
const { app } = await import('../../src/index.js');
|
||||
|
||||
// oidcAuthMiddleware is mocked as a passthrough; getAuth is mocked to return null.
|
||||
// me.ts falls through to the getAuth path and returns 401.
|
||||
const res = await app.request('/api/me')
|
||||
expect(res.status).toBe(401)
|
||||
const body = await res.json() as { error: string }
|
||||
expect(body.error).toBe('Unauthorized')
|
||||
})
|
||||
})
|
||||
const res = await app.request('/api/me');
|
||||
expect(res.status).toBe(401);
|
||||
const body = (await res.json()) as { error: string };
|
||||
expect(body.error).toBe('Unauthorized');
|
||||
});
|
||||
});
|
||||
|
||||
@@ -13,42 +13,46 @@
|
||||
* Uses the same mock boilerplate as lists.test.ts.
|
||||
*/
|
||||
|
||||
import { describe, it, expect, beforeEach, vi } from 'vitest'
|
||||
import { randomUUID } from 'node:crypto'
|
||||
import { db } from '../../src/db/client.js'
|
||||
import { users, pushSubscriptions } from '../../src/db/schema.js'
|
||||
import { describe, it, expect, beforeEach, vi } from 'vitest';
|
||||
import { randomUUID } from 'node:crypto';
|
||||
import { db } from '../../src/db/client.js';
|
||||
import { users, pushSubscriptions } from '../../src/db/schema.js';
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Dev-bypass mock: inject a specific user ID as the "logged-in" user.
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
let currentDevUserId = 1
|
||||
let currentDevUserId = 1;
|
||||
|
||||
vi.mock('../../src/auth/devBypass.js', () => ({
|
||||
devAuthBypass: () => async (c: { set: (k: string, v: unknown) => void }, next: () => Promise<void>) => {
|
||||
c.set('user', { id: currentDevUserId })
|
||||
await next()
|
||||
},
|
||||
}))
|
||||
devAuthBypass:
|
||||
() => async (c: { set: (k: string, v: unknown) => void }, next: () => Promise<void>) => {
|
||||
c.set('user', { id: currentDevUserId });
|
||||
await next();
|
||||
},
|
||||
}));
|
||||
|
||||
vi.mock('@hono/oidc-auth', () => ({
|
||||
oidcAuthMiddleware: () => async (_c: unknown, next: () => Promise<void>) => next(),
|
||||
processOAuthCallback: () => async (c: { json: (v: unknown) => unknown }) => c.json({ ok: true }),
|
||||
getAuth: () => null,
|
||||
}))
|
||||
}));
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Seed helpers
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
async function seedUser(label: string): Promise<number> {
|
||||
const [result] = await db.insert(users).values({
|
||||
oidcIss: 'https://auth.test',
|
||||
oidcSub: `sub-${label}-${randomUUID()}`,
|
||||
displayName: `User ${label}`,
|
||||
color: '#4A90D9',
|
||||
}).$returningId()
|
||||
return result.id
|
||||
const [result] = await db
|
||||
.insert(users)
|
||||
.values({
|
||||
oidcIss: 'https://auth.test',
|
||||
oidcSub: `sub-${label}-${randomUUID()}`,
|
||||
displayName: `User ${label}`,
|
||||
color: '#4A90D9',
|
||||
})
|
||||
.$returningId();
|
||||
return result.id;
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
@@ -56,8 +60,8 @@ async function seedUser(label: string): Promise<number> {
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
async function getApp() {
|
||||
const { app } = await import('../../src/index.js')
|
||||
return app
|
||||
const { app } = await import('../../src/index.js');
|
||||
return app;
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
@@ -69,7 +73,7 @@ function jsonRequest(method: string, path: string, body?: unknown): Request {
|
||||
method,
|
||||
headers: { 'Content-Type': 'application/json' },
|
||||
body: body !== undefined ? JSON.stringify(body) : undefined,
|
||||
})
|
||||
});
|
||||
}
|
||||
|
||||
function makeSubscriptionBody() {
|
||||
@@ -79,7 +83,7 @@ function makeSubscriptionBody() {
|
||||
p256dh: 'BNbxV8eFzxF7rPv3fakekey==',
|
||||
auth: 'fakeauthtoken==',
|
||||
},
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
@@ -88,18 +92,18 @@ function makeSubscriptionBody() {
|
||||
|
||||
beforeEach(async () => {
|
||||
// Users are seeded fresh per test; setup.ts truncates pushSubscriptions in afterEach
|
||||
})
|
||||
});
|
||||
|
||||
describe('GET /api/push/vapid-public-key', () => {
|
||||
it('returns { publicKey } without authentication', async () => {
|
||||
process.env.VAPID_PUBLIC_KEY = 'test_public_key_value'
|
||||
const app = await getApp()
|
||||
const res = await app.fetch(new Request('http://localhost/api/push/vapid-public-key'))
|
||||
expect(res.status).toBe(200)
|
||||
const body = (await res.json()) as { publicKey: string }
|
||||
expect(typeof body.publicKey).toBe('string')
|
||||
})
|
||||
})
|
||||
process.env.VAPID_PUBLIC_KEY = 'test_public_key_value';
|
||||
const app = await getApp();
|
||||
const res = await app.fetch(new Request('http://localhost/api/push/vapid-public-key'));
|
||||
expect(res.status).toBe(200);
|
||||
const body = (await res.json()) as { publicKey: string };
|
||||
expect(typeof body.publicKey).toBe('string');
|
||||
});
|
||||
});
|
||||
|
||||
describe('POST /api/push/subscription', () => {
|
||||
it('returns 401 when unauthenticated', async () => {
|
||||
@@ -107,56 +111,57 @@ describe('POST /api/push/subscription', () => {
|
||||
// and OIDC getAuth returns null — so resolveUserId returns null → 401.
|
||||
vi.doMock('../../src/auth/devBypass.js', () => ({
|
||||
devAuthBypass: () => async (_c: unknown, next: () => Promise<void>) => next(),
|
||||
}))
|
||||
}));
|
||||
vi.doMock('../../src/auth/middleware.js', () => ({
|
||||
getAuth: () => null,
|
||||
oidcAuthMiddleware: () => async (_c: unknown, next: () => Promise<void>) => next(),
|
||||
processOAuthCallback: () => async (c: { json: (v: unknown) => unknown }) => c.json({ ok: true }),
|
||||
}))
|
||||
processOAuthCallback: () => async (c: { json: (v: unknown) => unknown }) =>
|
||||
c.json({ ok: true }),
|
||||
}));
|
||||
|
||||
const { app: freshApp } = await import('../../src/index.js?v=unauth')
|
||||
const res = await freshApp.fetch(jsonRequest('POST', '/api/push/subscription', makeSubscriptionBody()))
|
||||
expect(res.status).toBe(401)
|
||||
})
|
||||
const { app: freshApp } = await import('../../src/index.js?v=unauth');
|
||||
const res = await freshApp.fetch(
|
||||
jsonRequest('POST', '/api/push/subscription', makeSubscriptionBody()),
|
||||
);
|
||||
expect(res.status).toBe(401);
|
||||
});
|
||||
|
||||
it('persists a push_subscriptions row scoped to the authed user', async () => {
|
||||
const userId = await seedUser('alice')
|
||||
currentDevUserId = userId
|
||||
const app = await getApp()
|
||||
const userId = await seedUser('alice');
|
||||
currentDevUserId = userId;
|
||||
const app = await getApp();
|
||||
|
||||
const body = makeSubscriptionBody()
|
||||
const res = await app.fetch(jsonRequest('POST', '/api/push/subscription', body))
|
||||
expect(res.status).toBe(201)
|
||||
const body = makeSubscriptionBody();
|
||||
const res = await app.fetch(jsonRequest('POST', '/api/push/subscription', body));
|
||||
expect(res.status).toBe(201);
|
||||
|
||||
const rows = await db
|
||||
.select()
|
||||
.from(pushSubscriptions)
|
||||
.where(
|
||||
(await import('drizzle-orm')).eq(pushSubscriptions.userId, userId),
|
||||
)
|
||||
expect(rows).toHaveLength(1)
|
||||
expect(rows[0].endpoint).toBe(body.endpoint)
|
||||
})
|
||||
})
|
||||
.where((await import('drizzle-orm')).eq(pushSubscriptions.userId, userId));
|
||||
expect(rows).toHaveLength(1);
|
||||
expect(rows[0].endpoint).toBe(body.endpoint);
|
||||
});
|
||||
});
|
||||
|
||||
describe('DELETE /api/push/subscription', () => {
|
||||
it("removes the caller's subscription rows", async () => {
|
||||
const userId = await seedUser('bob')
|
||||
currentDevUserId = userId
|
||||
const app = await getApp()
|
||||
const userId = await seedUser('bob');
|
||||
currentDevUserId = userId;
|
||||
const app = await getApp();
|
||||
|
||||
// First subscribe
|
||||
await app.fetch(jsonRequest('POST', '/api/push/subscription', makeSubscriptionBody()))
|
||||
await app.fetch(jsonRequest('POST', '/api/push/subscription', makeSubscriptionBody()));
|
||||
|
||||
// Then unsubscribe
|
||||
const res = await app.fetch(jsonRequest('DELETE', '/api/push/subscription'))
|
||||
expect(res.status).toBe(200)
|
||||
const res = await app.fetch(jsonRequest('DELETE', '/api/push/subscription'));
|
||||
expect(res.status).toBe(200);
|
||||
|
||||
const { eq } = await import('drizzle-orm')
|
||||
const { eq } = await import('drizzle-orm');
|
||||
const rows = await db
|
||||
.select()
|
||||
.from(pushSubscriptions)
|
||||
.where(eq(pushSubscriptions.userId, userId))
|
||||
expect(rows).toHaveLength(0)
|
||||
})
|
||||
})
|
||||
.where(eq(pushSubscriptions.userId, userId));
|
||||
expect(rows).toHaveLength(0);
|
||||
});
|
||||
});
|
||||
|
||||
Reference in New Issue
Block a user