mirror of
https://github.com/jcreek/LivingDexTracker.git
synced 2026-09-14 17:42:17 +00:00
Josh Creek
de39dc78ea
Splits testing into five layers so a failure points at the responsible one: - tests/unit isolated utility, repository and service tests - tests/data validates the tracked Pokémon, game, region and dex files - tests/integration schema, views, constraints, RLS and repositories - tests/bdd executable Gherkin for user-visible behaviour - tests/build service worker and manifest artifacts per build variant Replaces the two Playwright specs in client-test/ and the two Vitest files in test/. Adds a GitHub Actions workflow running the layers as separate jobs, a mock OAuth provider server so the Drive and Dropbox scenarios never touch real accounts, and a wrapper that reads the local Supabase keys from `supabase status` rather than hard-coding them. Extracts the pure formatting helpers out of PokedexExportService so they can be unit tested, and makes the provider endpoints configurable so the mock server can stand in for Google and Dropbox.
63 lines
1.8 KiB
TypeScript
63 lines
1.8 KiB
TypeScript
import { describe, expect, it, vi } from 'vitest';
|
|
import {
|
|
clearOAuthStateCookie,
|
|
createOAuthState,
|
|
readOAuthStateCookie,
|
|
setOAuthStateCookie,
|
|
type OAuthStatePayload
|
|
} from '../../src/lib/utils/oauthState';
|
|
|
|
function eventWithCookie(raw?: string) {
|
|
return {
|
|
url: new URL('https://example.test/callback'),
|
|
cookies: {
|
|
get: vi.fn(() => raw),
|
|
set: vi.fn(),
|
|
delete: vi.fn()
|
|
}
|
|
} as never;
|
|
}
|
|
|
|
describe('OAuth state cookies', () => {
|
|
it('creates opaque unique state values', () => {
|
|
const first = createOAuthState();
|
|
const second = createOAuthState();
|
|
expect(first).toMatch(/^[0-9a-f-]{36}$/);
|
|
expect(second).not.toBe(first);
|
|
});
|
|
|
|
it('writes a secure, short-lived, provider-scoped cookie', () => {
|
|
const event = eventWithCookie();
|
|
const payload: OAuthStatePayload = {
|
|
state: 'state-1',
|
|
userId: 'user-1',
|
|
provider: 'google_drive',
|
|
returnTo: '/backup-settings'
|
|
};
|
|
setOAuthStateCookie(event, 'google_drive', payload);
|
|
expect(event.cookies.set).toHaveBeenCalledWith(
|
|
'oauth_state_google_drive',
|
|
JSON.stringify(payload),
|
|
expect.objectContaining({ httpOnly: true, sameSite: 'lax', secure: true, maxAge: 600 })
|
|
);
|
|
});
|
|
|
|
it('reads only structurally valid state', () => {
|
|
expect(readOAuthStateCookie(eventWithCookie('{bad json'), 'dropbox')).toBeNull();
|
|
expect(readOAuthStateCookie(eventWithCookie('{}'), 'dropbox')).toBeNull();
|
|
expect(readOAuthStateCookie(eventWithCookie(), 'dropbox')).toBeNull();
|
|
expect(
|
|
readOAuthStateCookie(
|
|
eventWithCookie(JSON.stringify({ state: 's', userId: 'u', provider: 'dropbox' })),
|
|
'dropbox'
|
|
)
|
|
).toMatchObject({ state: 's', userId: 'u' });
|
|
});
|
|
|
|
it('clears the provider cookie at the shared path', () => {
|
|
const event = eventWithCookie();
|
|
clearOAuthStateCookie(event, 'dropbox');
|
|
expect(event.cookies.delete).toHaveBeenCalledWith('oauth_state_dropbox', { path: '/' });
|
|
});
|
|
});
|