The endpoint overrides are read through `$env/dynamic/private`, so they are
evaluated per request in production, not baked in at build time. That made a
single injected environment variable enough to redirect the authorization-code
and refresh-token POSTs - which carry the OAuth client secret and the user's
refresh token - to an arbitrary host, and to redirect the user's authorize hop
to an arbitrary URL.
Overrides are now ignored unless ALLOW_PROVIDER_ENDPOINT_OVERRIDES is exactly
"true" and the value is a loopback URL. `npm run test:bdd` sets the flag;
nothing else should. resolveProviderEndpoints is pure so the refusals are unit
tested, including near-miss hosts such as http://127.0.0.1.example.
Also drops the unused `pokedex` parameter from buildCsv rather than silencing it
with `void`, and the dead hasGigantamaxed field from its fallback record.
Three defects that together meant `npm run test:build` could not pass in any of
its four variants:
- svelte.config.js constructed adapter-netlify inline and never used the
`adapter` export from adapter.mjs, so NODE_ADAPTER=true still produced a flat
build/ directory while the build test expects the node adapter's build/client
layout. adapter.mjs now returns netlify (the deployment target) or node, and
svelte.config.js consumes it.
- No route is prerendered, so workbox's glob found no HTML document and a
generateSW build precached nothing navigable: the app had no offline support
in that mode at all. Adds the root entry and a navigation fallback, matching
what prompt-sw.ts already did by hand for injectManifest builds.
- The build scripts used by the tests skipped the tailwind step that `build`
runs, so static/output.css was never generated on a clean checkout and the
app under test had no stylesheet.
The offline entry point assertion now also accepts the unquoted object key that
prompt-sw.ts's own precache call survives minification as.
Splits testing into five layers so a failure points at the responsible one:
- tests/unit isolated utility, repository and service tests
- tests/data validates the tracked Pokémon, game, region and dex files
- tests/integration schema, views, constraints, RLS and repositories
- tests/bdd executable Gherkin for user-visible behaviour
- tests/build service worker and manifest artifacts per build variant
Replaces the two Playwright specs in client-test/ and the two Vitest files in
test/. Adds a GitHub Actions workflow running the layers as separate jobs, a
mock OAuth provider server so the Drive and Dropbox scenarios never touch real
accounts, and a wrapper that reads the local Supabase keys from
`supabase status` rather than hard-coding them.
Extracts the pure formatting helpers out of PokedexExportService so they can be
unit tested, and makes the provider endpoints configurable so the mock server
can stand in for Google and Dropbox.
Josh Creek