55 lines
2.7 KiB
JavaScript
55 lines
2.7 KiB
JavaScript
import test from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { mkdtempSync } from 'node:fs';
|
|
import { tmpdir } from 'node:os';
|
|
import { join } from 'node:path';
|
|
import { createApp } from '../src/server.js';
|
|
|
|
async function setup() {
|
|
const app = createApp({ dbPath: join(mkdtempSync(join(tmpdir(), 'updates-')), 'updates.sqlite'), adminToken: 'test-token' });
|
|
await new Promise(resolve => app.server.listen(0, resolve));
|
|
const port = app.server.address().port;
|
|
const request = (path, options = {}) => fetch(`http://127.0.0.1:${port}${path}`, options);
|
|
return { app, request };
|
|
}
|
|
async function teardown(app) { await new Promise(resolve => app.server.close(resolve)); app.close(); }
|
|
|
|
const headers = { 'content-type': 'application/json', authorization: 'Bearer test-token' };
|
|
const draft = { product: 'standalone', title: 'Standalone 1', summary: 'First update', body_markdown: 'Details' };
|
|
|
|
test('public feed hides drafts until authenticated publish', async () => {
|
|
const { app, request } = await setup();
|
|
try {
|
|
const created = await request('/v1/admin/updates', { method: 'POST', headers, body: JSON.stringify(draft) });
|
|
assert.equal(created.status, 201);
|
|
const hidden = await request('/v1/updates?product=standalone');
|
|
assert.deepEqual((await hidden.json()).data, []);
|
|
const id = (await (await request('/v1/admin/updates?product=standalone')).json()).data; // route must remain private
|
|
assert.equal(id, undefined);
|
|
const unauthorized = await request('/v1/admin/updates/1/publish', { method: 'POST' });
|
|
assert.equal(unauthorized.status, 401);
|
|
const published = await request('/v1/admin/updates/1/publish', { method: 'POST', headers });
|
|
assert.equal(published.status, 200);
|
|
const visible = await request('/v1/updates?product=standalone');
|
|
assert.equal((await visible.json()).data.length, 1);
|
|
} finally { await teardown(app); }
|
|
});
|
|
|
|
test('validates product and keeps health response minimal', async () => {
|
|
const { app, request } = await setup();
|
|
try {
|
|
assert.deepEqual(await (await request('/healthz')).json(), { status: 'ok' });
|
|
const response = await request('/v1/admin/updates', { method: 'POST', headers, body: JSON.stringify({ ...draft, product: 'other' }) });
|
|
assert.equal(response.status, 400);
|
|
assert.equal((await response.json()).error.code, 'INVALID_PRODUCT');
|
|
} finally { await teardown(app); }
|
|
});
|
|
|
|
test('rejects oversized request bodies', async () => {
|
|
const { app, request } = await setup();
|
|
try {
|
|
const response = await request('/v1/admin/updates', { method: 'POST', headers, body: JSON.stringify({ ...draft, body_markdown: 'x'.repeat(70_000) }) });
|
|
assert.equal(response.status, 413);
|
|
} finally { await teardown(app); }
|
|
});
|