Public: anyone can read this; the crew can change it.
Sentinel: shared:01m23vygyffx5hg2f5vm8r74sr:3ttdnwdbsb is past its budget: trevato/forge: "a pin's cart > a captured cart plays sandboxed, with its picture, and the builds page links it" failed … #10583
Check · Review · Land · Live done — Landed and live in production.
scout/forge:scout/10540-sentinel-shared-01m23vygyffx5hg2f5vm8r74 → main 1 commit fork 1 thread · 1 unresolved
1 file
changed +7
−5
test/build-cart.test.ts +7 −5
| @@ -23,7 +23,9 @@ describe("a pin's cart", () => { | ||
| 23 | 23 | let servers: Servers; |
| 24 | 24 | let base: string; |
| 25 | 25 | const tokens: Record<string, string> = {}; |
| 26 | let oid = ""; | |
| 26 | // Each repository's own pinned commit: captures are keyed by oid, and two | |
| 27 | // commits only share one when they land in the same clock second. | |
| 28 | const oids: Record<string, string> = {}; | |
| 27 | 29 | |
| 28 | 30 | const api = (path: string, who?: string, init: RequestInit = {}) => |
| 29 | 31 | fetch(`${base}/api/v1/repos/alice/${path}`, { |
| @@ -47,8 +49,8 @@ describe("a pin's cart", () => { | ||
| 47 | 49 | if (!made.ok) throw new Error(String(made.error)); |
| 48 | 50 | const c = await commitToBranch(app, alice, made.value, { message: "one", files: [{ path: "a.txt", content: "a\n" }] }); |
| 49 | 51 | if (!c.ok) throw new Error(JSON.stringify(c.error)); |
| 50 | oid = c.value.commitOid; | |
| 51 | const pinned = await pinBuild(app, alice, made.value, { label: "v1", oid }); | |
| 52 | oids[name] = c.value.commitOid; | |
| 53 | const pinned = await pinBuild(app, alice, made.value, { label: "v1", oid: c.value.commitOid }); | |
| 52 | 54 | if (!pinned.ok) throw new Error(pinned.error); |
| 53 | 55 | } |
| 54 | 56 | }); |
| @@ -82,7 +84,7 @@ describe("a pin's cart", () => { | ||
| 82 | 84 | }); |
| 83 | 85 | |
| 84 | 86 | test("a captured cart plays sandboxed, with its picture, and the builds page links it", async () => { |
| 85 | importCapture(dataDir, { ownerName: "alice", name: "karts" }, oid, "/", new TextEncoder().encode("<p>kart</p>"), PNG); | |
| 87 | importCapture(dataDir, { ownerName: "alice", name: "karts" }, oids.karts!, "/", new TextEncoder().encode("<p>kart</p>"), PNG); | |
| 86 | 88 | expect(await (await api("karts/builds/v1/cart")).json()).toMatchObject({ |
| 87 | 89 | capture: { state: "done" }, |
| 88 | 90 | play_url: "/alice/karts/builds/v1/cart", |
| @@ -106,7 +108,7 @@ describe("a pin's cart", () => { | ||
| 106 | 108 | test("a private repository's cart is not found by a stranger", async () => { |
| 107 | 109 | const send = await api("secret/builds/v1/cart", "alice", { method: "POST", body: JSON.stringify({ name: "hush", version: "1", page: "/", showcase: false }) }); |
| 108 | 110 | expect(send.status).toBe(202); |
| 109 | importCapture(dataDir, { ownerName: "alice", name: "secret" }, oid, "/", new TextEncoder().encode("<p>hush</p>")); | |
| 111 | importCapture(dataDir, { ownerName: "alice", name: "secret" }, oids.secret!, "/", new TextEncoder().encode("<p>hush</p>")); | |
| 110 | 112 | expect((await api("secret/builds/v1/cart")).status).toBe(404); |
| 111 | 113 | expect((await fetch(`${base}/alice/secret/builds/v1/cart`)).status).toBe(404); |
| 112 | 114 | expect((await api("secret/builds/v1/cart", "alice")).status).toBe(200); |
Good: a per-repo record removes the hidden coupling. The comment explains why, which is enough.