Blame · Line-by-line history

`green-ecosystem.test.ts`

Each line is annotated with the commit that last touched it. Click any SHA to jump to that commit and see the surrounding change.

green-ecosystem.test.tsBlame796 lines · 1 contributor

Normal view Raw

3ef4c9dClaude	1	/**
	2	* Tests for the green ecosystem: secret scanner, codeowners parser,
	3	* auto-repair helpers, notification + audit log helpers, health routes,
	4	* and rate limiting.
	5	*
	6	* These unit-level tests avoid DB + git subprocess work so they run fast.
	7	*/
	8
	9	import { describe, it, expect } from "bun:test";
	10	import app from "../app";
	11	import { scanForSecrets, SECRET_PATTERNS } from "../lib/security-scan";
	12	import {
	13	parseCodeowners,
	14	ownersForPath,
40d3e3fClaude	15	isTeamToken,
	16	expandOwnerTokens,
3ef4c9dClaude	17	} from "../lib/codeowners";
	18	import { generateCommitMessage } from "../lib/ai-generators";
	19	import { isAiAvailable } from "../lib/ai-client";
6fc53bdClaude	20	import {
	21	isAllowedEmoji,
	22	isAllowedTarget,
	23	ALLOWED_EMOJIS,
	24	EMOJI_GLYPH,
	25	} from "../lib/reactions";
24cf2caClaude	26	import { sendEmail, absoluteUrl } from "../lib/email";
	27	import { __internal as notifyInternal } from "../lib/notify";
6563f0aClaude	28	import {
	29	isValidSlug,
	30	normalizeSlug,
	31	orgRoleAtLeast,
	32	isValidOrgRole,
	33	isValidTeamRole,
	34	__test as orgsInternal,
	35	} from "../lib/orgs";
7298a17Claude	36	import {
	37	base32Encode,
	38	base32Decode,
	39	generateTotpSecret,
	40	totpCode,
	41	verifyTotpCode,
	42	otpauthUrl,
	43	generateRecoveryCodes,
	44	hashRecoveryCode,
	45	} from "../lib/totp";
3ef4c9dClaude	46
	47	describe("secret scanner", () => {
	48	it("detects AWS access keys", () => {
	49	const findings = scanForSecrets([
	50	{
	51	path: "config.env",
	52	content: "AWS_ACCESS_KEY=AKIAZ2J4NPQR5LTMWXYZ\n",
	53	},
	54	]);
	55	expect(findings.length).toBeGreaterThan(0);
	56	expect(findings.some((f) => /AWS/i.test(f.type))).toBe(true);
	57	});
	58
	59	it("detects Anthropic API keys", () => {
	60	const findings = scanForSecrets([
	61	{
	62	path: "app.ts",
	63	content:
	64	'const key = "sk-ant-api03-QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ-AAAAAA";',
	65	},
	66	]);
	67	expect(findings.some((f) => /anthropic/i.test(f.type))).toBe(true);
	68	});
	69
	70	it("ignores binary/lock paths", () => {
	71	const findings = scanForSecrets([
	72	{
	73	path: "package-lock.json",
	74	content: "AKIAZ2J4NPQR5LTMWXYZ secret content",
	75	},
	76	]);
	77	expect(findings.length).toBe(0);
	78	});
	79
	80	it("does not match placeholder strings in test fixtures", () => {
	81	const findings = scanForSecrets([
	82	{
	83	path: "test.js",
	84	content:
	85	'// example: AKIA" + "XAMPLE_PLACEHOLDER_KEY_FIXTURE"\nconst k = "FAKE_TEST_PLACEHOLDER";',
	86	},
	87	]);
	88	// all findings should be filtered by the placeholder heuristic
	89	expect(findings.every((f) => !/placeholder\|fixture/i.test(f.snippet))).toBe(true);
	90	});
	91
	92	it("has a rich library of rules", () => {
	93	expect(SECRET_PATTERNS.length).toBeGreaterThanOrEqual(10);
	94	});
	95	});
	96
	97	describe("codeowners parser", () => {
	98	it("parses simple rules", () => {
	99	const rules = parseCodeowners(
	100	"# top-level owner\n* @alice\nsrc/api/** @bob @carol\n/docs/ @alice\n"
	101	);
	102	expect(rules.length).toBe(3);
	103	expect(rules[0].owners).toEqual(["alice"]);
	104	expect(rules[1].owners).toEqual(["bob", "carol"]);
	105	});
	106
	107	it("resolves last-matching rule wins", () => {
	108	const rules = parseCodeowners("* @alice\nsrc/api/** @bob\n");
	109	expect(ownersForPath("README.md", rules)).toEqual(["alice"]);
	110	expect(ownersForPath("src/api/users.ts", rules)).toEqual(["bob"]);
	111	});
	112
	113	it("anchors leading-slash patterns to repo root", () => {
	114	const rules = parseCodeowners("/docs/ @alice\n");
	115	expect(ownersForPath("docs/readme.md", rules)).toEqual(["alice"]);
	116	expect(ownersForPath("src/docs/readme.md", rules)).toEqual([]);
	117	});
	118
	119	it("ignores comments and blank lines", () => {
	120	const rules = parseCodeowners(
	121	"# comment\n\n \n# another\n* @ghost # trailing comment\n"
	122	);
	123	expect(rules.length).toBe(1);
	124	expect(rules[0].owners).toEqual(["ghost"]);
	125	});
40d3e3fClaude	126
	127	it("preserves @org/team tokens (B3)", () => {
	128	const rules = parseCodeowners(
	129	"api/ @acme/backend @alice\nweb/ @acme/frontend\n"
	130	);
	131	expect(rules[0].owners).toEqual(["acme/backend", "alice"]);
	132	expect(rules[1].owners).toEqual(["acme/frontend"]);
	133	expect(isTeamToken("acme/backend")).toBe(true);
	134	expect(isTeamToken("alice")).toBe(false);
	135	});
	136
	137	it("expandOwnerTokens passes plain usernames through and drops unknown teams gracefully", async () => {
	138	// Real team lookup requires DB rows. Without DB the helper must still
	139	// resolve without throwing; plain usernames must always pass through.
	140	const result = await expandOwnerTokens([
	141	"alice",
	142	"bob",
	143	"nonexistent-org-xyz/some-team",
	144	]);
	145	expect(result).toContain("alice");
	146	expect(result).toContain("bob");
	147	// Unknown team silently drops (no throw, no crash).
	148	expect(result).not.toContain("nonexistent-org-xyz/some-team");
	149	});
3ef4c9dClaude	150	});
	151
	152	describe("AI generator fallbacks", () => {
	153	it("returns a safe fallback commit message when AI is unavailable", async () => {
	154	if (isAiAvailable()) {
	155	// API key is set — skip fallback assertion
	156	return;
	157	}
	158	const msg = await generateCommitMessage("");
	159	expect(msg.length).toBeGreaterThan(0);
	160	expect(msg).toMatch(/^\S+/);
	161	});
	162	});
	163
	164	describe("health + metrics endpoints", () => {
	165	it("GET /healthz returns 200", async () => {
	166	const res = await app.request("/healthz");
	167	expect(res.status).toBe(200);
	168	const body = await res.json();
	169	expect(body.ok).toBe(true);
	170	});
	171
	172	it("GET /metrics returns process metrics", async () => {
	173	const res = await app.request("/metrics");
	174	expect(res.status).toBe(200);
	175	const body = await res.json();
	176	expect(typeof body.uptimeMs).toBe("number");
	177	expect(typeof body.heapUsed).toBe("number");
	178	});
	179
	180	it("response carries X-Request-Id header", async () => {
	181	const res = await app.request("/healthz");
	182	expect(res.headers.get("X-Request-Id")).toBeTruthy();
	183	});
	184	});
	185
	186	describe("rate limiting", () => {
	187	it("rate-limit headers appear on /api requests", async () => {
	188	const res = await app.request("/api/users/nonexistent/repos");
	189	// Headers should exist even though user is missing
	190	const limit = res.headers.get("X-RateLimit-Limit");
	191	expect(limit).toBeTruthy();
	192	});
	193	});
	194
	195	describe("shortcuts + search page", () => {
	196	it("GET /shortcuts is public", async () => {
	197	const res = await app.request("/shortcuts");
	198	expect(res.status).toBe(200);
	199	const html = await res.text();
	200	expect(html).toContain("Keyboard shortcuts");
	201	});
	202
	203	it("GET /search with no query shows the type tabs", async () => {
	204	const res = await app.request("/search");
	205	expect(res.status).toBe(200);
	206	const html = await res.text();
	207	expect(html).toContain("Repositories");
	208	expect(html).toContain("Users");
	209	});
	210	});
ad6d4adClaude	211
	212	describe("GateTest inbound hook", () => {
	213	it("GET /api/hooks/ping is unauthenticated and reports service", async () => {
	214	const res = await app.request("/api/hooks/ping");
	215	expect(res.status).toBe(200);
	216	const body = await res.json();
	217	expect(body.ok).toBe(true);
	218	expect(body.service).toBe("gluecron");
	219	expect(Array.isArray(body.hooks)).toBe(true);
	220	});
	221
	222	it("POST /api/hooks/gatetest rejects when no secret configured", async () => {
	223	const prev = process.env.GATETEST_CALLBACK_SECRET;
	224	const prevH = process.env.GATETEST_HMAC_SECRET;
	225	delete process.env.GATETEST_CALLBACK_SECRET;
	226	delete process.env.GATETEST_HMAC_SECRET;
	227	const res = await app.request("/api/hooks/gatetest", {
	228	method: "POST",
	229	headers: { "content-type": "application/json" },
	230	body: JSON.stringify({ repository: "a/b", sha: "x", status: "passed" }),
	231	});
	232	expect(res.status).toBe(401);
	233	if (prev) process.env.GATETEST_CALLBACK_SECRET = prev;
	234	if (prevH) process.env.GATETEST_HMAC_SECRET = prevH;
	235	});
	236
	237	it("POST /api/hooks/gatetest rejects bad bearer token", async () => {
	238	const prev = process.env.GATETEST_CALLBACK_SECRET;
	239	process.env.GATETEST_CALLBACK_SECRET = "real-secret-abc123";
	240	const res = await app.request("/api/hooks/gatetest", {
	241	method: "POST",
	242	headers: {
	243	"content-type": "application/json",
	244	authorization: "Bearer wrong-token",
	245	},
	246	body: JSON.stringify({ repository: "a/b", sha: "x", status: "passed" }),
	247	});
	248	expect(res.status).toBe(401);
	249	if (prev === undefined) delete process.env.GATETEST_CALLBACK_SECRET;
	250	else process.env.GATETEST_CALLBACK_SECRET = prev;
	251	});
	252
	253	it("POST /api/hooks/gatetest rejects malformed payload even when authed", async () => {
	254	const prev = process.env.GATETEST_CALLBACK_SECRET;
	255	process.env.GATETEST_CALLBACK_SECRET = "real-secret-abc123";
	256	const res = await app.request("/api/hooks/gatetest", {
	257	method: "POST",
	258	headers: {
	259	"content-type": "application/json",
	260	authorization: "Bearer real-secret-abc123",
	261	},
	262	body: "not-json",
	263	});
	264	expect(res.status).toBe(400);
	265	if (prev === undefined) delete process.env.GATETEST_CALLBACK_SECRET;
	266	else process.env.GATETEST_CALLBACK_SECRET = prev;
	267	});
	268
	269	it("POST /api/v1/gate-runs (backup) rejects without bearer", async () => {
	270	const res = await app.request("/api/v1/gate-runs", {
	271	method: "POST",
	272	headers: { "content-type": "application/json" },
	273	body: JSON.stringify({ repository: "a/b", sha: "x", status: "passed" }),
	274	});
	275	expect(res.status).toBe(401);
	276	});
	277	});
6fc53bdClaude	278
	279	describe("theme toggle", () => {
	280	it("GET /theme/toggle sets a cookie and redirects", async () => {
	281	const res = await app.request("/theme/toggle");
	282	// 302 redirect; no cookie yet means we flip from the default (dark) → light
	283	expect([301, 302, 303, 307]).toContain(res.status);
	284	const setCookie = res.headers.get("set-cookie") \|\| "";
	285	expect(/theme=light/.test(setCookie)).toBe(true);
	286	});
	287
	288	it("GET /theme/toggle flips an existing 'light' cookie back to dark", async () => {
	289	const res = await app.request("/theme/toggle", {
	290	headers: { cookie: "theme=light" },
	291	});
	292	const setCookie = res.headers.get("set-cookie") \|\| "";
	293	expect(/theme=dark/.test(setCookie)).toBe(true);
	294	});
	295
	296	it("GET /theme/set?mode=light returns JSON when asked", async () => {
	297	const res = await app.request("/theme/set?mode=light", {
	298	headers: { accept: "application/json" },
	299	});
	300	expect(res.status).toBe(200);
	301	const body = await res.json();
	302	expect(body.ok).toBe(true);
	303	expect(body.theme).toBe("light");
	304	});
	305
	306	it("GET /theme/set rejects unknown modes", async () => {
	307	const res = await app.request("/theme/set?mode=neon", {
	308	headers: { accept: "application/json" },
	309	});
	310	expect(res.status).toBe(400);
	311	});
	312
	313	it("home page includes the pre-paint theme script + data-theme attribute", async () => {
	314	const res = await app.request("/");
	315	const html = await res.text();
	316	expect(html).toContain("data-theme");
	317	expect(html).toContain("theme-icon-");
	318	// The pre-paint script reads the cookie.
	319	expect(html).toContain("document.cookie");
	320	});
	321	});
	322
	323	describe("reactions", () => {
	324	it("allowed emojis and targets are self-consistent", () => {
	325	expect(ALLOWED_EMOJIS.length).toBeGreaterThanOrEqual(6);
	326	for (const e of ALLOWED_EMOJIS) {
	327	expect(isAllowedEmoji(e)).toBe(true);
	328	expect(EMOJI_GLYPH[e]).toBeTruthy();
	329	}
	330	expect(isAllowedEmoji("nope")).toBe(false);
	331	expect(isAllowedTarget("issue")).toBe(true);
	332	expect(isAllowedTarget("martian")).toBe(false);
	333	});
	334
	335	it("POST /api/reactions/.../toggle requires auth", async () => {
	336	const res = await app.request(
	337	"/api/reactions/issue/00000000-0000-0000-0000-000000000000/thumbs_up/toggle",
	338	{ method: "POST" }
	339	);
	340	// Unauthenticated -> redirect to /login (302)
	341	expect([301, 302, 303, 307]).toContain(res.status);
	342	});
	343
	344	it("GET /api/reactions/:type/:id returns empty summary when no reactions exist", async () => {
	345	const res = await app.request(
	346	"/api/reactions/issue/00000000-0000-0000-0000-000000000000"
	347	);
	348	expect(res.status).toBe(200);
	349	const body = await res.json();
	350	expect(body.ok).toBe(true);
	351	expect(Array.isArray(body.reactions)).toBe(true);
	352	});
	353
	354	it("rejects unknown target type on the listing endpoint", async () => {
	355	const res = await app.request(
	356	"/api/reactions/martian/00000000-0000-0000-0000-000000000000"
	357	);
	358	expect(res.status).toBe(400);
	359	});
	360	});
	361
	362	describe("audit log UI", () => {
	363	it("GET /settings/audit redirects unauthenticated users to /login", async () => {
	364	const res = await app.request("/settings/audit");
	365	expect([301, 302, 303, 307]).toContain(res.status);
	366	const loc = res.headers.get("location") \|\| "";
	367	expect(loc.startsWith("/login")).toBe(true);
	368	});
	369	});
24cf2caClaude	370
	371	describe("email", () => {
	372	it("sendEmail in log mode never throws and returns ok", async () => {
	373	const prev = process.env.EMAIL_PROVIDER;
	374	process.env.EMAIL_PROVIDER = "log";
	375	const res = await sendEmail({
	376	to: "test@gluecron.local",
	377	subject: "hello",
	378	text: "body",
	379	});
	380	expect(res.ok).toBe(true);
	381	expect(res.provider).toBe("log");
	382	if (prev === undefined) delete process.env.EMAIL_PROVIDER;
	383	else process.env.EMAIL_PROVIDER = prev;
	384	});
	385
	386	it("sendEmail rejects invalid recipient without throwing", async () => {
	387	const res = await sendEmail({
	388	to: "not-an-email",
	389	subject: "x",
	390	text: "y",
	391	});
	392	expect(res.ok).toBe(false);
	393	expect(res.skipped).toBeTruthy();
	394	});
	395
	396	it("sendEmail rejects empty subject/body without throwing", async () => {
	397	const res = await sendEmail({ to: "a@b.co", subject: "", text: "" });
	398	expect(res.ok).toBe(false);
	399	});
	400
	401	it("absoluteUrl joins paths against APP_BASE_URL", () => {
	402	const prev = process.env.APP_BASE_URL;
	403	process.env.APP_BASE_URL = "https://gluecron.example/";
	404	expect(absoluteUrl("/x")).toBe("https://gluecron.example/x");
	405	expect(absoluteUrl("x")).toBe("https://gluecron.example/x");
	406	expect(absoluteUrl("https://other/y")).toBe("https://other/y");
	407	if (prev === undefined) delete process.env.APP_BASE_URL;
	408	else process.env.APP_BASE_URL = prev;
	409	});
	410
	411	it("notify email-eligible set only includes user-opt-in kinds", () => {
	412	// Any kind in EMAIL_ELIGIBLE must map to a preference column
	413	for (const k of notifyInternal.EMAIL_ELIGIBLE) {
	414	expect(notifyInternal.prefFor(k)).not.toBeNull();
	415	}
	416	// gate_passed is not eligible (too spammy; only gate_failed is)
	417	expect(notifyInternal.EMAIL_ELIGIBLE.has("gate_passed" as any)).toBe(false);
	418	expect(notifyInternal.EMAIL_ELIGIBLE.has("deploy_failed" as any)).toBe(
	419	false
	420	);
	421	});
	422
	423	it("notify email subject is tagged and truncated", () => {
	424	const subj = notifyInternal.subjectFor("gate_failed", "x".repeat(300));
	425	expect(subj.startsWith("[gate failed]")).toBe(true);
	426	expect(subj.length).toBeLessThanOrEqual(180);
	427	});
	428	});
	429
	430	describe("settings email preferences", () => {
	431	it("GET /settings redirects unauthenticated users to /login", async () => {
	432	const res = await app.request("/settings");
	433	expect([301, 302, 303, 307]).toContain(res.status);
	434	const loc = res.headers.get("location") \|\| "";
	435	expect(loc.startsWith("/login")).toBe(true);
	436	});
	437
	438	it("POST /settings/notifications redirects unauthenticated users to /login", async () => {
	439	const res = await app.request("/settings/notifications", {
	440	method: "POST",
	441	headers: { "content-type": "application/x-www-form-urlencoded" },
	442	body: "notify_email_on_mention=1",
	443	});
	444	expect([301, 302, 303, 307]).toContain(res.status);
	445	const loc = res.headers.get("location") \|\| "";
	446	expect(loc.startsWith("/login")).toBe(true);
	447	});
	448	});
6563f0aClaude	449
	450	describe("orgs helpers (B1)", () => {
	451	describe("isValidSlug", () => {
	452	it("accepts simple slugs", () => {
	453	expect(isValidSlug("acme")).toBe(true);
	454	expect(isValidSlug("acme-corp")).toBe(true);
	455	expect(isValidSlug("a1")).toBe(true);
	456	expect(isValidSlug("a-b-c-1-2-3")).toBe(true);
	457	});
	458
	459	it("rejects too-short or too-long", () => {
	460	expect(isValidSlug("")).toBe(false);
	461	expect(isValidSlug("a")).toBe(false);
	462	expect(isValidSlug("a".repeat(40))).toBe(false);
	463	});
	464
	465	it("rejects leading/trailing hyphen", () => {
	466	expect(isValidSlug("-acme")).toBe(false);
	467	expect(isValidSlug("acme-")).toBe(false);
	468	});
	469
	470	it("rejects consecutive hyphens", () => {
	471	expect(isValidSlug("foo--bar")).toBe(false);
	472	});
	473
	474	it("rejects uppercase + invalid chars", () => {
	475	expect(isValidSlug("Acme")).toBe(false);
	476	expect(isValidSlug("acme_corp")).toBe(false);
	477	expect(isValidSlug("acme.corp")).toBe(false);
	478	expect(isValidSlug("acme corp")).toBe(false);
	479	});
	480
	481	it("rejects reserved words", () => {
	482	expect(isValidSlug("api")).toBe(false);
	483	expect(isValidSlug("admin")).toBe(false);
	484	expect(isValidSlug("settings")).toBe(false);
	485	expect(isValidSlug("orgs")).toBe(false);
	486	expect(isValidSlug("new")).toBe(false);
	487	});
	488	});
	489
	490	describe("normalizeSlug", () => {
	491	it("lowercases and trims", () => {
	492	expect(normalizeSlug(" ACME ")).toBe("acme");
	493	expect(normalizeSlug("Acme-Corp")).toBe("acme-corp");
	494	});
	495	});
	496
	497	describe("orgRoleAtLeast", () => {
	498	it("owner beats admin beats member", () => {
	499	expect(orgRoleAtLeast("owner", "member")).toBe(true);
	500	expect(orgRoleAtLeast("owner", "admin")).toBe(true);
	501	expect(orgRoleAtLeast("owner", "owner")).toBe(true);
	502	expect(orgRoleAtLeast("admin", "member")).toBe(true);
	503	expect(orgRoleAtLeast("admin", "admin")).toBe(true);
	504	expect(orgRoleAtLeast("admin", "owner")).toBe(false);
	505	expect(orgRoleAtLeast("member", "admin")).toBe(false);
	506	expect(orgRoleAtLeast("member", "owner")).toBe(false);
	507	});
	508
	509	it("treats unknown role as rank 0", () => {
	510	expect(orgRoleAtLeast("", "member")).toBe(false);
	511	expect(orgRoleAtLeast("banana", "member")).toBe(false);
	512	});
	513	});
	514
	515	describe("role type guards", () => {
	516	it("isValidOrgRole", () => {
	517	expect(isValidOrgRole("owner")).toBe(true);
	518	expect(isValidOrgRole("admin")).toBe(true);
	519	expect(isValidOrgRole("member")).toBe(true);
	520	expect(isValidOrgRole("maintainer")).toBe(false);
	521	expect(isValidOrgRole("banana")).toBe(false);
	522	});
	523
	524	it("isValidTeamRole", () => {
	525	expect(isValidTeamRole("maintainer")).toBe(true);
	526	expect(isValidTeamRole("member")).toBe(true);
	527	expect(isValidTeamRole("owner")).toBe(false);
	528	expect(isValidTeamRole("banana")).toBe(false);
	529	});
	530	});
	531
	532	describe("internal", () => {
	533	it("rank table orders correctly", () => {
	534	const r = orgsInternal.ORG_ROLE_RANK;
	535	expect(r.owner).toBeGreaterThan(r.admin);
	536	expect(r.admin).toBeGreaterThan(r.member);
	537	});
	538
	539	it("reserved set contains the app's top-level paths", () => {
	540	expect(orgsInternal.RESERVED_SLUGS.has("api")).toBe(true);
	541	expect(orgsInternal.RESERVED_SLUGS.has("settings")).toBe(true);
	542	expect(orgsInternal.RESERVED_SLUGS.has("login")).toBe(true);
	543	});
	544	});
	545	});
	546
	547	describe("orgs routes (B1)", () => {
	548	it("GET /orgs redirects unauthenticated users to /login", async () => {
	549	const res = await app.request("/orgs");
	550	expect([301, 302, 303, 307]).toContain(res.status);
	551	const loc = res.headers.get("location") \|\| "";
	552	expect(loc.startsWith("/login")).toBe(true);
	553	});
	554
	555	it("GET /orgs/new redirects unauthenticated users to /login", async () => {
	556	const res = await app.request("/orgs/new");
	557	expect([301, 302, 303, 307]).toContain(res.status);
	558	const loc = res.headers.get("location") \|\| "";
	559	expect(loc.startsWith("/login")).toBe(true);
	560	});
	561
	562	it("POST /orgs/new redirects unauthenticated users to /login", async () => {
	563	const res = await app.request("/orgs/new", {
	564	method: "POST",
	565	headers: { "content-type": "application/x-www-form-urlencoded" },
	566	body: "slug=acme&name=Acme",
	567	});
	568	expect([301, 302, 303, 307]).toContain(res.status);
	569	const loc = res.headers.get("location") \|\| "";
	570	expect(loc.startsWith("/login")).toBe(true);
	571	});
	572
	573	it("GET /orgs/:slug redirects unauthenticated users to /login", async () => {
	574	const res = await app.request("/orgs/some-org");
	575	expect([301, 302, 303, 307]).toContain(res.status);
	576	const loc = res.headers.get("location") \|\| "";
	577	expect(loc.startsWith("/login")).toBe(true);
	578	});
	579
	580	it("POST /orgs/:slug/people/add redirects unauthenticated users to /login", async () => {
	581	const res = await app.request("/orgs/some-org/people/add", {
	582	method: "POST",
	583	headers: { "content-type": "application/x-www-form-urlencoded" },
	584	body: "username=alice&role=member",
	585	});
	586	expect([301, 302, 303, 307]).toContain(res.status);
	587	const loc = res.headers.get("location") \|\| "";
	588	expect(loc.startsWith("/login")).toBe(true);
	589	});
	590	});
7437605Claude	591
	592	describe("org-owned repos (B2)", () => {
	593	it("GET /orgs/:slug/repos redirects unauthenticated users to /login", async () => {
	594	const res = await app.request("/orgs/some-org/repos");
	595	expect([301, 302, 303, 307]).toContain(res.status);
	596	const loc = res.headers.get("location") \|\| "";
	597	expect(loc.startsWith("/login")).toBe(true);
	598	});
	599
	600	it("GET /orgs/:slug/repos/new redirects unauthenticated users to /login", async () => {
	601	const res = await app.request("/orgs/some-org/repos/new");
	602	expect([301, 302, 303, 307]).toContain(res.status);
	603	const loc = res.headers.get("location") \|\| "";
	604	expect(loc.startsWith("/login")).toBe(true);
	605	});
	606
	607	it("POST /orgs/:slug/repos/new redirects unauthenticated users to /login", async () => {
	608	const res = await app.request("/orgs/some-org/repos/new", {
	609	method: "POST",
	610	headers: { "content-type": "application/x-www-form-urlencoded" },
	611	body: "name=web",
	612	});
	613	expect([301, 302, 303, 307]).toContain(res.status);
	614	const loc = res.headers.get("location") \|\| "";
	615	expect(loc.startsWith("/login")).toBe(true);
	616	});
	617
	618	it("POST /api/repos with orgSlug still validates required fields", async () => {
	619	const res = await app.request("/api/repos", {
	620	method: "POST",
	621	headers: { "Content-Type": "application/json" },
	622	body: JSON.stringify({ orgSlug: "acme" }),
	623	});
	624	// Missing name + owner → 400 before any DB access.
	625	expect(res.status).toBe(400);
	626	});
	627
	628	it("POST /api/repos rejects invalid repo names before DB access", async () => {
	629	const res = await app.request("/api/repos", {
	630	method: "POST",
	631	headers: { "Content-Type": "application/json" },
	632	body: JSON.stringify({
	633	name: "bad name with spaces",
	634	owner: "alice",
	635	}),
	636	});
	637	expect(res.status).toBe(400);
	638	});
	639	});
7298a17Claude	640
	641	describe("TOTP / 2FA (B4)", () => {
	642	it("base32 round-trips bytes", () => {
	643	const bytes = new Uint8Array([0x74, 0x65, 0x73, 0x74]); // "test"
	644	const enc = base32Encode(bytes);
	645	const dec = base32Decode(enc);
	646	expect(Array.from(dec)).toEqual(Array.from(bytes));
	647	});
	648
	649	it("generateTotpSecret returns 32-char Base32", () => {
	650	const s = generateTotpSecret();
	651	expect(s.length).toBe(32);
	652	expect(/^[A-Z2-7]+$/.test(s)).toBe(true);
	653	});
	654
	655	it("totpCode is 6 digits", async () => {
	656	const s = generateTotpSecret();
	657	const c = await totpCode(s);
	658	expect(/^\d{6}$/.test(c)).toBe(true);
	659	});
	660
	661	it("verifyTotpCode accepts a freshly-generated code", async () => {
	662	const s = generateTotpSecret();
	663	const c = await totpCode(s);
	664	expect(await verifyTotpCode(s, c)).toBe(true);
	665	});
	666
	667	it("verifyTotpCode tolerates a ±30s drift", async () => {
	668	const s = generateTotpSecret();
	669	const now = Math.floor(Date.now() / 1000);
	670	const past = await totpCode(s, now - 30);
	671	const future = await totpCode(s, now + 30);
	672	expect(await verifyTotpCode(s, past, now)).toBe(true);
	673	expect(await verifyTotpCode(s, future, now)).toBe(true);
	674	});
	675
	676	it("verifyTotpCode rejects a wrong code", async () => {
	677	const s = generateTotpSecret();
	678	expect(await verifyTotpCode(s, "000000")).toBe(false);
	679	});
	680
	681	it("verifyTotpCode rejects non-6-digit input", async () => {
	682	const s = generateTotpSecret();
	683	expect(await verifyTotpCode(s, "abc")).toBe(false);
	684	expect(await verifyTotpCode(s, "12345")).toBe(false);
	685	expect(await verifyTotpCode(s, "1234567")).toBe(false);
	686	});
	687
	688	it("otpauthUrl has the expected shape", () => {
	689	const u = otpauthUrl({
	690	secret: "JBSWY3DPEHPK3PXP",
	691	accountName: "alice@example.com",
	692	issuer: "gluecron",
	693	});
	694	expect(u.startsWith("otpauth://totp/")).toBe(true);
	695	expect(u).toContain("secret=JBSWY3DPEHPK3PXP");
	696	expect(u).toContain("issuer=gluecron");
	697	expect(u).toContain("period=30");
	698	expect(u).toContain("digits=6");
	699	});
	700
	701	it("generateRecoveryCodes returns the expected count + format", () => {
	702	const codes = generateRecoveryCodes(5);
	703	expect(codes.length).toBe(5);
	704	for (const c of codes) {
	705	expect(/^[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}$/.test(c)).toBe(true);
	706	}
	707	// Uniqueness: ~70 bits of entropy each, collisions should be astronomical.
	708	expect(new Set(codes).size).toBe(5);
	709	});
	710
	711	it("hashRecoveryCode is deterministic + normalised", async () => {
	712	const a = await hashRecoveryCode("ABCD-1234-efgh");
	713	const b = await hashRecoveryCode("abcd-1234-efgh");
	714	const c = await hashRecoveryCode(" abcd-1234-efgh ");
	715	expect(a).toBe(b);
	716	expect(a).toBe(c);
	717	expect(a.length).toBe(64); // SHA-256 hex
	718	});
	719	});
	720
	721	describe("2FA routes (B4)", () => {
	722	it("GET /settings/2fa redirects unauthenticated users to /login", async () => {
	723	const res = await app.request("/settings/2fa");
	724	expect([301, 302, 303, 307]).toContain(res.status);
	725	const loc = res.headers.get("location") \|\| "";
	726	expect(loc.startsWith("/login")).toBe(true);
	727	});
	728
	729	it("POST /settings/2fa/enroll redirects unauthenticated users to /login", async () => {
	730	const res = await app.request("/settings/2fa/enroll", {
	731	method: "POST",
	732	headers: { "content-type": "application/x-www-form-urlencoded" },
	733	body: "",
	734	});
	735	expect([301, 302, 303, 307]).toContain(res.status);
	736	const loc = res.headers.get("location") \|\| "";
	737	expect(loc.startsWith("/login")).toBe(true);
	738	});
	739
	740	it("GET /login/2fa redirects to /login when no session cookie", async () => {
	741	const res = await app.request("/login/2fa");
	742	expect([301, 302, 303, 307]).toContain(res.status);
	743	const loc = res.headers.get("location") \|\| "";
	744	expect(loc.startsWith("/login")).toBe(true);
	745	});
	746	});
2df1f8cClaude	747
	748	describe("passkeys routes (B5)", () => {
	749	it("GET /settings/passkeys redirects unauthenticated users to /login", async () => {
	750	const res = await app.request("/settings/passkeys");
	751	expect([301, 302, 303, 307]).toContain(res.status);
	752	const loc = res.headers.get("location") \|\| "";
	753	expect(loc.startsWith("/login")).toBe(true);
	754	});
	755
	756	it("POST /api/passkeys/register/options redirects unauthenticated users to /login", async () => {
	757	const res = await app.request("/api/passkeys/register/options", {
	758	method: "POST",
	759	headers: { "content-type": "application/json" },
	760	body: "{}",
	761	});
	762	expect([301, 302, 303, 307]).toContain(res.status);
	763	const loc = res.headers.get("location") \|\| "";
	764	expect(loc.startsWith("/login")).toBe(true);
	765	});
	766
	767	it("POST /api/passkeys/auth/verify returns 400 when body is invalid", async () => {
	768	const res = await app.request("/api/passkeys/auth/verify", {
	769	method: "POST",
	770	headers: { "content-type": "application/json" },
	771	body: "not json",
	772	});
	773	// Either 400 (bad JSON) or 503 (DB down) — never a 500.
	774	expect([400, 503]).toContain(res.status);
	775	});
	776
	777	it("POST /api/passkeys/auth/verify rejects missing fields", async () => {
	778	const res = await app.request("/api/passkeys/auth/verify", {
	779	method: "POST",
	780	headers: { "content-type": "application/json" },
	781	body: "{}",
	782	});
	783	expect([400, 503]).toContain(res.status);
	784	});
	785
	786	it("POST /settings/passkeys/:id/delete redirects unauthenticated users to /login", async () => {
	787	const res = await app.request("/settings/passkeys/abc/delete", {
	788	method: "POST",
	789	headers: { "content-type": "application/x-www-form-urlencoded" },
	790	body: "",
	791	});
	792	expect([301, 302, 303, 307]).toContain(res.status);
	793	const loc = res.headers.get("location") \|\| "";
	794	expect(loc.startsWith("/login")).toBe(true);
	795	});
	796	});