jcreek/LivingDexTracker
1
0
Fork 0
mirror of https://github.com/jcreek/LivingDexTracker.git synced 2026-09-14 17:42:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: remediate branch review findings

Browse Source
This commit is contained in:
Josh Creek
2026-09-14 11:47:58 +01:00
parent 4af33709a3
commit 86f1c21e4d
38 changed files with 65833 additions and 58545 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/bdd/steps/account.steps.ts
+66 -12
View File
@@ -14,6 +14,28 @@ async function mailCountFor(email: string, subject: string): Promise<number> {
return body.total ?? body.messages?.length ?? 0;
}
async function recoveryLinkFromMail(email: string): Promise<string> {
for (let attempt = 0; attempt < 50; attempt++) {
const search = await fetch(
`${MAILPIT_URL}/api/v1/search?query=${encodeURIComponent(`to:${email} subject:Reset`)}`
);
if (search.ok) {
const result = (await search.json()) as { messages?: Array<{ ID?: string; Id?: string }> };
const id = result.messages?.[0]?.ID ?? result.messages?.[0]?.Id;
if (id) {
const response = await fetch(`${MAILPIT_URL}/api/v1/message/${id}`);
if (response.ok) {
const message = JSON.stringify(await response.json());
const match = message.match(/https?:\/\/[^"'<>\s]+\/auth\/v1\/verify[^"'<>\s]+/);
if (match) return match[0].replaceAll('&amp;', '&').replaceAll('\\u0026', '&');
}
}
}
await new Promise((resolve) => setTimeout(resolve, 200));
}
throw new Error('No password recovery link arrived in MailPit');
}
Given('I am a new visitor', async ({ page }) => {
await page.goto('/');
});
@@ -28,19 +50,16 @@ Given('I am signed in', async ({ page, state }) => {
await expect(page).toHaveURL(/\/my-pokedexes$/);
});
/**
* Deliberately an ordinary signed-in session, not a recovery one: following a real recovery
* action link currently bounces to /signin, because the browser client in src/routes/+layout.ts
* has no cookie `set`/`remove` method and so cannot persist the session it parses out of the
* URL. Until that is fixed, these scenarios cover the form, not the emailed-link flow - hence
* the step name. `createRecoveryLink` in ../support/app.ts is ready for when it is.
*/
Given('I am signed in on the password reset page', async ({ page, state }) => {
Given('I follow a valid password reset link', async ({ page, state }) => {
await createConfirmedUser(state);
await signIn(page, state);
await expect(page).toHaveURL(/\/my-pokedexes$/);
await page.goto('/reset-password');
await expect(page.getByLabel('New Password')).toBeVisible();
await page.goto('/forgot-password');
await page.getByLabel('Email').fill(state.email);
await page.getByRole('button', { name: 'Send Reset Link' }).click();
await expect(page.getByText('Check your email for the password reset link')).toBeVisible();
const actionLink = await recoveryLinkFromMail(state.email);
await page.goto(actionLink);
await expect(page).toHaveURL(/\/reset-password/);
await expect(page.getByLabel('New Password')).toBeEnabled();
});
When('I register with valid account details', async ({ page, state }) => {
@@ -66,12 +85,28 @@ When('I sign out', async ({ page }) => {
await page.getByRole('button', { name: 'Sign Out', exact: true }).click();
});
When('the sign-out request fails', async ({ page }) => {
await page.route('**/auth/v1/logout*', (route) =>
route.fulfill({
status: 503,
contentType: 'application/json',
body: '{"message":"unavailable"}'
})
);
await page.getByRole('button', { name: 'usericon' }).click();
await page.getByRole('button', { name: 'Sign Out', exact: true }).click();
});
When('I request a password reset', async ({ page, state }) => {
await page.goto('/forgot-password');
await page.getByLabel('Email').fill(state.email);
await page.getByRole('button', { name: 'Send Reset Link' }).click();
});
When('I visit the password recovery page directly', async ({ page }) => {
await page.goto('/reset-password');
});
When('I enter two different replacement passwords', async ({ page, state }) => {
await page.getByLabel('New Password').fill(state.replacementPassword);
await page.getByLabel('Confirm Password').fill(`${state.replacementPassword}-different`);
@@ -105,11 +140,21 @@ Then('I return to the public home page', async ({ page }) => {
await expect(page).toHaveURL(/\/$/);
});
Then('I remain signed in with an error', async ({ page }) => {
await expect(page).toHaveURL(/\/my-pokedexes$/);
await expect(page.locator('.alert-error.rounded-none')).toContainText('Sign out failed');
});
Then('a password reset email is captured locally', async ({ page, state }) => {
await expect(page.getByText('Check your email for the password reset link')).toBeVisible();
await expect.poll(() => mailCountFor(state.email, 'Reset')).toBeGreaterThan(0);
});
Then('the replacement password form is unavailable', async ({ page }) => {
await expect(page.getByLabel('New Password')).toBeDisabled();
await expect(page.getByText(/invalid or expired/i)).toBeVisible();
});
Then('I am told that the passwords do not match', async ({ page }) => {
await expect(page.getByText('Passwords do not match')).toBeVisible();
});
@@ -117,3 +162,12 @@ Then('I am told that the passwords do not match', async ({ page }) => {
Then('I am told that my password was updated', async ({ page }) => {
await expect(page.getByText(/Password updated successfully/)).toBeVisible();
});
Then('only the replacement password signs me in', async ({ page, state }) => {
await expect(page).toHaveURL(/\/signin$/, { timeout: 10_000 });
await signIn(page, state, state.password);
await expect(page.locator('.alert-error')).toBeVisible();
await page.getByLabel('Password').fill(state.replacementPassword);
await page.getByRole('button', { name: 'Sign In' }).click();
await expect(page).toHaveURL(/\/my-pokedexes$/);
});
tests/bdd/steps/pwa.steps.ts
+91 -11
View File
@@ -28,12 +28,22 @@ async function cacheContents(page: Page) {
});
}
When('I open the built application', async ({ page }) => {
function recordLegacyWorkerRequest(page: Page, state: { legacyServiceWorkerRequested: boolean }) {
page.on('request', (request) => {
if (new URL(request.url()).pathname === '/service-worker.js') {
state.legacyServiceWorkerRequested = true;
}
});
}
When('I open the built application', async ({ page, state }) => {
recordLegacyWorkerRequest(page, state);
await page.goto('/');
await waitForServiceWorker(page);
});
Given('I have opened the built application online', async ({ page }) => {
Given('I have opened the built application online', async ({ page, state }) => {
recordLegacyWorkerRequest(page, state);
await page.context().setOffline(false);
await page.goto('/');
await waitForServiceWorker(page);
@@ -45,11 +55,45 @@ When('I go offline and reload the home page', async ({ page }) => {
await page.reload({ waitUntil: 'domcontentloaded' });
});
When('I go offline and navigate to the sign-in page', async ({ page }) => {
When('I go offline and reload the sign-in page', async ({ page }) => {
await page.goto('/signin');
await page.context().setOffline(true);
// Client-side navigation, which only works if the route's chunks were precached.
await page.getByRole('link', { name: 'Sign In' }).click();
await expect(page).toHaveURL(/\/signin$/);
await page.reload({ waitUntil: 'domcontentloaded' });
});
Given('my offline copy is synchronized', async ({ page, state }) => {
await waitForServiceWorker(page);
await expect
.poll(() =>
page.evaluate(async (userId) => {
const meta = await (
await caches.open('livingdex-offline-meta-v1')
).match('/__offline/current');
if (!meta) return false;
const value = await meta.json();
return value.userId === userId;
}, state.userId)
)
.toBe(true);
const serializedSnapshot = await page.evaluate(async () => {
const metaResponse = await (
await caches.open('livingdex-offline-meta-v1')
).match('/__offline/current');
if (!metaResponse) return '';
const meta = await metaResponse.json();
const snapshotResponse = await (
await caches.open(meta.dataCache)
).match(`/__offline/snapshot/${encodeURIComponent(meta.userId)}`);
return snapshotResponse ? await snapshotResponse.text() : '';
});
expect(serializedSnapshot).not.toMatch(/access_token|refresh_token/i);
});
When('I go offline and reload the current Pokédex', async ({ page, state }) => {
await page.context().setOffline(true);
await page.goto(`/pokedex/${state.pokedexId}/offline`, {
waitUntil: 'domcontentloaded'
});
});
When('I go offline and then return online', async ({ page }) => {
@@ -61,6 +105,15 @@ When('I go offline and then return online', async ({ page }) => {
Then('a service worker controls the page', async ({ page }) => {
expect(await waitForServiceWorker(page)).toMatch(/\/(?:sw|prompt-sw)\.js$/);
expect(
await page.evaluate(() =>
navigator.serviceWorker.getRegistrations().then((items) => items.length)
)
).toBe(1);
});
Then('no legacy service worker is requested', async ({ state }) => {
expect(state.legacyServiceWorkerRequested).toBe(false);
});
/**
@@ -77,7 +130,11 @@ Then('the application shell is precached', async ({ page }) => {
const origin = new URL(page.url()).origin;
const urls = contents[names[0]].map((url) => url.slice(`${origin}/`.length));
expect(urls, 'app shell is not precached').toContain('');
expect(urls, 'personalized SSR root must not be precached').not.toContain('');
expect(
urls.some((url) => /^offline(?:\.html)?(?:\?__WB_REVISION__=|$)/.test(url)),
'offline viewer is not precached'
).toBe(true);
expect(
urls.some((url) => url.startsWith('manifest.webmanifest?__WB_REVISION__=')),
'revisioned manifest.webmanifest is not precached'
@@ -100,8 +157,31 @@ Then('the application remains available', async ({ page }) => {
await expect(page.getByRole('heading', { name: /Start Your Pokédex Journey/ })).toBeVisible();
});
Then('the sign-in form is available offline', async ({ page }) => {
await expect(page.getByLabel('Email')).toBeVisible();
await expect(page.getByLabel('Password')).toBeVisible();
await expect(page.getByRole('button', { name: 'Sign In' })).toBeVisible();
Then('the read-only offline viewer is available', async ({ page }) => {
await expect(page.getByText(/offline.*read-only/i)).toBeVisible();
});
Then('the offline copy contains {string}', async ({ page }, name: string) => {
await expect(page.getByRole('heading', { name })).toBeVisible();
await expect(page.getByText(/read-only copy/i)).toBeVisible();
await expect(page.locator('button, input, textarea, select')).toHaveCount(0);
});
Then('my offline copy is removed', async ({ page }) => {
await expect
.poll(() =>
page.evaluate(async () => {
const names = await caches.keys();
return names.some((name) => name.startsWith('livingdex-offline-'));
})
)
.toBe(false);
});
Then('my offline copy remains', async ({ page, state }) => {
const owner = await page.evaluate(async () => {
const meta = await (await caches.open('livingdex-offline-meta-v1')).match('/__offline/current');
return meta ? (await meta.json()).userId : null;
});
expect(owner).toBe(state.userId);
});