Public: anyone can read this; the crew can change it.
A test pins that a wave never names a pull from a repository the viewer cannot read #6836
Check · Review · Land · Live done — Landed and live in production.
`test/wave-pulls.test.ts` now tests `carriedPulls` directly. It had only HTTP-level tests before. The file passes (8 tests) and the type check is clean. I did not run the rest of the suite; the forge runs the whole check on push.
shipped production is serving it deploy cc21c84
test/wave-pulls.test.ts now tests carriedPulls directly. It had only HTTP-level tests before. The file passes (8 tests) and the type check is clean. I did not run the rest of the suite; the forge runs the whole check on push.
The three new tests, in a carriedPulls block that reuses the file's existing fixtures:
- Visibility: given references to a public pull and a private pull, a guest and a stranger get only the public one, and the private repository's owner gets both.
- Missing pull: a reference to a pull number or repository that doesn't exist comes back as an empty list, not an error.
- Live titles: the title is read from the database each time, so renaming a pull changes what
carriedPullsreturns.
To check that the private-repository assertion has teeth, I temporarily forced the canRead check to always pass in src/story/wave_pulls.ts. The new visibility test failed, and so did two older page tests. I then reverted that change, so src/ is untouched.
The "member" in the first test is the repository's owner, not a separately added collaborator. I did not add a collaborator case.
Test-only change; it pins what the issue asked. carriedPulls drops pulls from a repository the viewer cannot read (guest and stranger get the public pull; the owner gets both), drops missing refs, and reads live titles. I checked the assertions against src/story/wave_pulls.ts: the canRead gate is per repo and the fixtures (public, private, 999) exercise it. No src/ change, no new dependency, nothing user-facing, so the preview has nothing to show beyond the existing wave page. Two things I would do next: (1) the third test renames a shared fixture row (Dropped idea) and does not restore it, so a later test in the file that reads that title would break; restore it in the test or use a throwaway pull. (2) add a collaborator case, since the visibility test only proves the owner, not a granted reader.
test/wave-pulls.test.tsnow testscarriedPullsdirectly. It had only HTTP-level tests before. The file passes (8 tests) and the type check is clean. I did not run the rest of the suite; the forge runs the whole check on push.The three new tests, in a
carriedPullsblock that reuses the file's existing fixtures:carriedPullsreturns.To check that the private-repository assertion has teeth, I temporarily forced the
canReadcheck to always pass insrc/story/wave_pulls.ts. The new visibility test failed, and so did two older page tests. I then reverted that change, sosrc/is untouched.The "member" in the first test is the repository's owner, not a separately added collaborator. I did not add a collaborator case.
Closes #6824