Public: anyone can read this; the crew can change it.
A test pins `readReturns`' refusals: a bad window, no viewer, and a repository the viewer may not read are refused the same way a missing one is #6772
Check · Review · Land · Live done — Landed and live in production.
scout/forge:scout/6761-a-test-pins-readreturns-refusals-a-bad-w → main 1 commit fork
1 file
changed +94
−0
test/returns-refusals.test.ts added +94
| @@ -0,0 +1,94 @@ | ||
| 1 | /** `readReturns` refuses a bad window, no viewer and a repository the viewer may not read alike (#6761). */ | |
| 2 | import { afterAll, beforeAll, expect, test } from "bun:test"; | |
| 3 | import { mkdtemp, rm } from "node:fs/promises"; | |
| 4 | import { tmpdir } from "node:os"; | |
| 5 | import { join } from "node:path"; | |
| 6 | import { createApp, type App } from "../src/app.ts"; | |
| 7 | import { RETURNS_DAYS, readReturns } from "../src/actions/returns.ts"; | |
| 8 | import { createRepo } from "../src/actions/repos.ts"; | |
| 9 | import { createUser, type User } from "../src/core/users.ts"; | |
| 10 | import { quietLogs } from "./helpers/globals.ts"; | |
| 11 | import { proveAll } from "./helpers/verified.ts"; | |
| 12 | import { promote } from "./helpers/members.ts"; | |
| 13 | ||
| 14 | quietLogs(); | |
| 15 | ||
| 16 | let dataDir: string; | |
| 17 | let app: App; | |
| 18 | let viewer: User; | |
| 19 | const DAY = 86_400_000; | |
| 20 | const now = new Date("2026-10-01T12:00:00.000Z"); | |
| 21 | ||
| 22 | async function person(username: string): Promise<User> { | |
| 23 | const made = await createUser(app.db, { | |
| 24 | origin: "seed", | |
| 25 | username, | |
| 26 | email: `${username}@forge.local`, | |
| 27 | password: "a-good-passphrase", | |
| 28 | adminIfFirst: false, | |
| 29 | }); | |
| 30 | if (!made.ok) throw new Error(made.error); | |
| 31 | return made.value; | |
| 32 | } | |
| 33 | ||
| 34 | beforeAll(async () => { | |
| 35 | dataDir = await mkdtemp(join(tmpdir(), "forge-returns-refusals-")); | |
| 36 | app = createApp({ dataDir, port: 0 }); | |
| 37 | viewer = await person("olive"); | |
| 38 | const stranger = await person("sam"); | |
| 39 | proveAll(app); | |
| 40 | promote(app.db, viewer, stranger); | |
| 41 | for (const [who, name] of [ | |
| 42 | [viewer, "mine"], | |
| 43 | [stranger, "theirs"], | |
| 44 | ] as const) { | |
| 45 | const made = await createRepo(app, who, { name, visibility: "public" }); | |
| 46 | if (!made.ok) throw new Error(String(made.error)); | |
| 47 | } | |
| 48 | }); | |
| 49 | ||
| 50 | afterAll(async () => { | |
| 51 | app.close?.(); | |
| 52 | await rm(dataDir, { recursive: true, force: true }); | |
| 53 | }); | |
| 54 | ||
| 55 | test("no viewer is unauthorized", () => { | |
| 56 | const r = readReturns(app, undefined, { now }); | |
| 57 | expect(r.ok).toBe(false); | |
| 58 | if (!r.ok) expect(r.error).toBe("unauthorized"); | |
| 59 | }); | |
| 60 | ||
| 61 | test("days outside 1..max or not whole are bad_days; the edges and omitted are accepted", () => { | |
| 62 | for (const days of [0, 91, 1.5, NaN, -1]) { | |
| 63 | const r = readReturns(app, viewer, { days, now }); | |
| 64 | expect(r.ok).toBe(false); | |
| 65 | if (!r.ok) expect(r.error).toBe("bad_days"); | |
| 66 | } | |
| 67 | const span = (days?: number) => { | |
| 68 | const r = readReturns(app, viewer, days === undefined ? { now } : { days, now }); | |
| 69 | if (!r.ok) throw new Error(r.error); | |
| 70 | return Date.parse(r.value.window.until) - Date.parse(r.value.window.since); | |
| 71 | }; | |
| 72 | expect(span(1)).toBe(DAY); | |
| 73 | expect(span(RETURNS_DAYS.max)).toBe(RETURNS_DAYS.max * DAY); | |
| 74 | expect(span()).toBe(RETURNS_DAYS.default * DAY); | |
| 75 | }); | |
| 76 | ||
| 77 | test("a stranger's, a missing and a malformed repo are the same not_found", () => { | |
| 78 | const seen = ["sam/theirs", "olive/nothing", "nobody/x", "a/b/c", "a/"].map((repo) => | |
| 79 | readReturns(app, viewer, { repo, now }), | |
| 80 | ); | |
| 81 | for (const r of seen) expect(r).toEqual(seen[0]!); | |
| 82 | expect(seen[0]!.ok).toBe(false); | |
| 83 | if (!seen[0]!.ok) expect(seen[0]!.error).toBe("not_found"); | |
| 84 | }); | |
| 85 | ||
| 86 | test("without repo only the viewer's repository is listed, and the window ends at now", () => { | |
| 87 | const r = readReturns(app, viewer, { now }); | |
| 88 | if (!r.ok) throw new Error(r.error); | |
| 89 | expect(r.value.repos).toEqual(["olive/mine"]); | |
| 90 | expect(r.value.window.until).toBe(now.toISOString()); | |
| 91 | const one = readReturns(app, viewer, { repo: "olive/mine", now }); | |
| 92 | if (!one.ok) throw new Error(one.error); | |
| 93 | expect(one.value.repos).toEqual(["olive/mine"]); | |
| 94 | }); |
new above
offline