Blame · Line-by-line history

`collaborators.test.ts`

Each line is annotated with the commit that last touched it. Click any SHA to jump to that commit and see the surrounding change.

collaborators.test.tsBlame44 lines · 1 contributor

Normal view Raw

23d1a81Claude	1	/**
	2	* Collaborator management — route auth smoke.
	3	*
	4	* The routes in src/routes/collaborators.tsx are owner-only. These two
	5	* smoke tests pin down the externally-observable auth contract:
	6	* - unauthenticated GET redirects to /login (requireAuth)
	7	* - an authed non-owner gets a 403 (or is bounced away — the 302→/login
	8	* path is also acceptable if the DB is unavailable and the middleware
	9	* can't resolve the session cookie)
	10	*
	11	* We intentionally don't spin up a real session; we rely on the middleware
	12	* contract already covered by api-tokens.test.ts — requireAuth redirects
	13	* when no valid session cookie is present.
	14	*/
	15
	16	import { describe, it, expect } from "bun:test";
	17	import app from "../app";
	18
	19	describe("collaborators — auth guard", () => {
	20	it("GET /:owner/:repo/settings/collaborators without auth redirects to /login", async () => {
	21	const res = await app.request(
	22	"/somebody/some-repo/settings/collaborators"
	23	);
	24	expect(res.status).toBe(302);
	25	expect(res.headers.get("location") \|\| "").toContain("/login");
	26	});
	27
	28	it("GET as an authed non-owner returns 403 or redirects away", async () => {
	29	// We can't easily mint a real session without touching the DB, so we
	30	// stub by sending a bogus session cookie. The middleware will fail to
	31	// resolve it and redirect to /login — which is the "redirects away"
	32	// branch the requirement allows. If a DB is configured and somehow the
	33	// cookie resolves to a different user, we'd see a 403 from the
	34	// inline owner check. Either outcome proves the route is not wide open.
	35	const res = await app.request(
	36	"/some-owner/some-repo/settings/collaborators",
	37	{ headers: { cookie: "session=not-a-real-token" } }
	38	);
	39	expect([302, 403, 404]).toContain(res.status);
	40	if (res.status === 302) {
	41	expect(res.headers.get("location") \|\| "").toContain("/login");
	42	}
	43	});
	44	});