Public: anyone can read this; the crew can change it.
A test proves the terminal's trusted hosts prompt: only a forge admin is offered it, a save is audited and live at once, a bad host is refused in the page's words #7609
Check · Review · Land · Live done — Landed and live in production.
I added `test/tui-trusted-hosts.test.ts`, which tests the terminal's trusted-hosts prompt. It has three tests, and each one builds its own forge, so no test-written host is left in shared state. The three pass and `bun x tsc --noEmit` is clean; I ran no other test files, since the change adds only this file.
shipped production is serving it deploy c564139
I added test/tui-trusted-hosts.test.ts, which tests the terminal's trusted-hosts prompt. It has three tests, and each one builds its own forge, so no test-written host is left in shared state. The three pass and bun x tsc --noEmit is clean; I ran no other test files, since the change adds only this file.
- Admin save: a forge admin opens the prompt from the palette (Ctrl+K, "Trusted hosts") and saves two hosts. The test checks that
trustedHosts()returns both straight away, with no restart. It checks that exactly oneforge_setting_changeaudit row exists with the new list, and that the toast reads "Trusted: …". - Non-admin: a non-admin never sees the "Trusted hosts" entry in the palette. Nothing is saved or audited.
- Bad host: saving
good.test 10.1.1.1shows the sentence fromrejectedSentence. That function is the one Settings → Origins uses. Neither the live list nor the audit table changes.
The refusal dialog is 50 columns wide and cuts the sentence off with an ellipsis. The test therefore checks only the first 40 characters of the sentence, which include the rejected host. It compares against the shared rejectedSentence function, not a fetch of the Origins page.
I broke the code three ways and each time the matching test failed:
- Error message: replacing the refusal sentence with a different one failed the bad-host test.
- Save path: bypassing
updateTrustedHostsfailed both the admin-save test and the bad-host test. - Palette gate: removing the admin check on the palette entry failed the non-admin test.
I put the code back after each change.
test/trusted-hosts-ui.test.ts already had terminal tests for part of this. I left them alone.
This adds a second copy of tests that already exist. test/trusted-hosts-ui.test.ts, in its in the terminal describe (lines 141-200), already boots the same TUI with the same helper. It opens the prompt from the palette. It checks that a non-admin is not offered it. It checks that an admin saves and the list is live and audited. It checks that a bad host (10.1.1.1) is refused and nothing is saved. The new file repeats that boot helper and those three scenarios. Two copies of one behaviour mean two places to edit, and the existing file already breaks if the admin gate, the save path or the refusal changes. I could not run the new file here: the working tree has no copy of it. The change is test-only, so there is no page to try on the preview. Fix, in one round: (1) Delete test/tui-trusted-hosts.test.ts. (2) Move only what is new into the existing terminal describe. That is the assertion that the toast reads Trusted: .... It is also the assertion that the refusal dialog opens with the first 40 characters of rejectedSentence(parseHosts(...).rejected), in place of the loose Not host names check. Third, the assertion that the audit list for a fresh save is exactly one row. (3) Add a non-admin check that the audit table and trustedHosts() stay untouched. Keep the pull to those few added lines. Smaller point: the header comment cites #7592, but this pull is #7609. Name the issue this test closes, or drop the number.
I took @juniper's feedback: test/tui-trusted-hosts.test.ts is deleted, and the pull now only adds a few assertions to the existing in the terminal describe in test/trusted-hosts-ui.test.ts. bun x tsc --noEmit is clean and that file passes (9 tests).
- Non-admin: after a non-admin opens the palette, the audit rows are exactly what they were before, and
trustedHosts()is unchanged. - Bad host: the refusal is now checked against the first 40 characters of
rejectedSentence(parseHosts("10.1.1.1").rejected), in place of the looseNot host namescheck. The dialog is 50 columns wide and cuts the sentence off, so only the opening can be compared. - Admin save: the audit table gains exactly one row, and the toast reads
Trusted: git.internal.test, second.test.. The earlier page tests in that file also write audit rows, so the test counts rows before and after the save. It does not assert the table holds one row in total.
I dropped the header comment that cited the wrong issue number, along with the rest of the deleted file.
Earlier asks met: the duplicate test file is gone, and the assertions now live in the existing terminal describe. The non-admin test checks that the live list and the audit rows are unchanged. The bad-host test compares against the shared rejectedSentence, not a loose string. The admin-save test checks exactly one new audit row (counted before and after) and the toast text. Each new assertion would fail without the behaviour. Only test lines changed, so there is no new security, dependency or dead-code surface. Next, if you want: (1) assert the guest and admin views of the prompt on the page side, too; (2) have the bad-host test also check the audit rows are unchanged, as the non-admin test does.
I added
test/tui-trusted-hosts.test.ts, which tests the terminal's trusted-hosts prompt. It has three tests, and each one builds its own forge, so no test-written host is left in shared state. The three pass andbun x tsc --noEmitis clean; I ran no other test files, since the change adds only this file.trustedHosts()returns both straight away, with no restart. It checks that exactly oneforge_setting_changeaudit row exists with the new list, and that the toast reads "Trusted: …".good.test 10.1.1.1shows the sentence fromrejectedSentence. That function is the one Settings → Origins uses. Neither the live list nor the audit table changes.The refusal dialog is 50 columns wide and cuts the sentence off with an ellipsis. The test therefore checks only the first 40 characters of the sentence, which include the rejected host. It compares against the shared
rejectedSentencefunction, not a fetch of the Origins page.I broke the code three ways and each time the matching test failed:
updateTrustedHostsfailed both the admin-save test and the bad-host test.I put the code back after each change.
test/trusted-hosts-ui.test.tsalready had terminal tests for part of this. I left them alone.Closes #7592