Blame · Line-by-line history

`pulls-ai-description.test.ts`

Each line is annotated with the commit that last touched it. Click any SHA to jump to that commit and see the surrounding change.

pulls-ai-description.test.tsBlame48 lines · 1 contributor

Normal view Raw

81c73c1Claude	1	/**
	2	* Smoke tests for the new AI-PR-description endpoint:
	3	* POST /:owner/:repo/ai/pr-description
	4	*
	5	* The route requires write access, so unauthenticated callers should
	6	* never see a 200/JSON body. Authenticated paths require a live DB +
	7	* git checkout, so we focus on the auth-guard contract.
	8	*/
	9
	10	import { describe, it, expect } from "bun:test";
	11	import app from "../app";
	12
	13	describe("POST /:owner/:repo/ai/pr-description — auth guard", () => {
	14	it("redirects to /login when unauthenticated (no bearer)", async () => {
	15	const res = await app.request(
	16	"/alice/demo/ai/pr-description",
	17	{
	18	method: "POST",
	19	headers: { "content-type": "application/x-www-form-urlencoded" },
	20	body: "title=Test&base=main&head=feature",
	21	redirect: "manual",
	22	}
	23	);
	24	// Either a 302 to /login (cookie flow), or a 4xx/5xx if requireAuth
	25	// / requireRepoAccess fail-closed earlier. The one thing we MUST NOT
	26	// see is a 200 with a leaked body.
	27	expect([301, 302, 303, 307, 401, 403, 404, 503]).toContain(res.status);
	28	if (res.status === 302 \|\| res.status === 303 \|\| res.status === 307) {
	29	const loc = res.headers.get("location") \|\| "";
	30	expect(loc).toContain("/login");
	31	}
	32	});
	33
	34	it("rejects bogus bearer tokens with 401", async () => {
	35	const res = await app.request(
	36	"/alice/demo/ai/pr-description",
	37	{
	38	method: "POST",
	39	headers: {
	40	"content-type": "application/x-www-form-urlencoded",
	41	authorization: "Bearer glct_definitely-not-valid",
	42	},
	43	body: "title=Test&base=main&head=feature",
	44	}
	45	);
	46	expect([401, 403, 404, 503]).toContain(res.status);
	47	});
	48	});