Files
Lucas BergerandClaude Opus 4.8 b6490feff4
CI / changes (pull_request) Successful in 9s
CI / api (pull_request) Successful in 3m2s
CI / fast-checks (pull_request) Successful in 4m20s
CI / security (pull_request) Successful in 1m14s
CI / harness (pull_request) Successful in 6m56s
CI / gate (pull_request) Successful in 2s
fix(19): satisfy CI fast-checks + secret scan
Lint (eslint --max-warnings 0):
- index.ts: disable no-unsafe-argument on the type-only Context mismatch when
  delegating to the OIDC handler inside the local-session skip wrapper
- localAuth.ts: handleLogout is sync (no await) — drop async (require-await)
- devBypass.ts: disable detect-possible-timing-attacks on the public well-known
  dev-placeholder string compare (not a secret comparison)
- remove dead code / unused bindings flagged by no-unused-vars: makeTestApp
  (localSession.test), makeUnauthContext + BrowserContext import (login.spec),
  unused memberId (admin.test), unused txSelectCount counter (me.test)
- localAuthMiddleware.test / me.test: fix unused + reflow-detached
  eslint-disable directives

Format: prettier --write across the 20 Phase-19 files that were never formatted.

Secret scan (gitleaks): allowlist two false positives — the synthetic >=32-char
TEST_SECRET in localSession.test.ts, and .planning/ design prose (a generic-api-key
regex hit on "credential atomically, 409-equivalent"). Neither is a real secret.

Verified locally: format:check, lint, typecheck, md:lint, gitleaks (no leaks),
PWA 266/266, API 452/452.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-17 23:05:15 -04:00

56 lines
2.3 KiB
TypeScript

/**
* Vitest per-file test setup for apps/api.
*
* Tests now run against the isolated `familysync_test` database, which is
* auto-provisioned and migrated by `test/global-setup.ts` before the suite
* starts. The dev `familysync` database is never touched by a local test run.
*
* Cleanup strategy:
* - afterEach truncates list/push tables in FK-safe order so each test
* starts with a clean slate for those tables.
* - `users` is intentionally left intact across tests within a single run.
* Many tests seed user id=1 once and reuse it; deleting users between tests
* would break FK-dependent rows mid-suite. The globalSetup provides a fresh
* migrated `familysync_test` at run start, so `users` starts empty and any
* seed inserted by the first test that needs it persists for the session.
* If a specific test leaks `users` rows that affect another test, scope a
* targeted delete inside that test's own beforeEach/afterEach instead.
*
* Environment:
* DB_HOST, DB_USER, DB_PASSWORD, and DB_NAME=familysync_test are injected by
* vitest.config.ts (test.env) for local runs. Under CI, DB_NAME=familysync is
* preserved from the job-level env and globalSetup is a no-op.
*/
import { afterEach } from 'vitest';
import { db } from '../src/db/client.js';
import {
lists,
listItems,
listShares,
pushSubscriptions,
localCredentials,
} from '../src/db/schema.js';
/**
* Truncate list and push tables in FK-safe order after each test.
* list_items and list_shares have FK to lists; delete children first.
* pushSubscriptions has FK to users via user_id; deleted before lists (no FK to lists).
* Called automatically via afterEach — no per-test setup needed.
*/
afterEach(async () => {
try {
// Delete child rows first to avoid FK constraint violations
await db.delete(listItems);
await db.delete(listShares);
await db.delete(pushSubscriptions);
await db.delete(lists);
// Phase 19: local_credentials has FK to users (cascade delete via users); truncate here
// so each test starts with a clean credential slate. users intentionally left intact.
await db.delete(localCredentials);
} catch {
// DB may not be available in pure-unit test runs (no DB_HOST configured).
// Swallow the error — pure-logic tests do not need cleanup.
}
});