v3: the backend gets a test suite, and the bugs it turned up are fixed — deno task test runs 186 tests over api/ in about 18s, against a throwaway database and uploads directory (GERBEUR_DB_PATH and GERBEUR_UPLOADS_DIR now override the defaults; api/test/setup.ts sets them before any app module loads), with requests sent through the whole middleware stack in-process via app.handle, outbound fetches and DNS stubbed, and the socket tests on a real Oak listener since an upgraded request has no response for handle() to return. It covers auth (token purposes, revocation after a password change, live roles, login rate limiting, invites claimed once even under parallel registrations, password resets), dumps end to end (create, privacy, by-url matching on the canonical key, backlinks, categories, edits, file replacement, thumbnails, refresh, delete), file serving headers and ranges, attachments, avatars, comments and likes, playlists, follows and feeds, notifications and mentions, categories, search, chat cursors and read markers, link previews and the SSRF guard on every redirect hop, the Bandcamp and YouTube resolvers, migrations (a fresh schema is left untouched; the data rewrites in 0004/0005 and 0010–0013 do what they say), CORS, OG tags, static caching, and the WebSocket protocol. Fixed along the way: an unknown category id on a new dump returned 400 but kept the dump row, and for a file dump deleted the file while keeping the row; an edit or file replacement with one was half-applied before the 400 — categories are now checked before anything is written. A suffix range (bytes=-3) was read as an end offset and got a 416 instead of the last three bytes. Reordering a playlist accepted a list naming a member twice. verifyPassword threw on a stored hash without a salt instead of answering false. And a request with no Accept-Encoding, which RFC 9110 lets a server treat as accepting anything, was sent the brotli sibling; curl and bots now get the plain file.
All checks were successful
Build and Publish Docker Image / build-and-push (push) Successful in 46s
All checks were successful
Build and Publish Docker Image / build-and-push (push) Successful in 46s
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
khannurien
303
api/test/playlists.test.ts
Normal file
303
api/test/playlists.test.ts
Normal file
@@ -0,0 +1,303 @@
|
||||
import {
|
||||
count,
|
||||
createUser,
|
||||
db,
|
||||
del,
|
||||
formWithFile,
|
||||
get,
|
||||
insertDump,
|
||||
insertPlaylist,
|
||||
PNG,
|
||||
post,
|
||||
put,
|
||||
test,
|
||||
} from "./helpers.ts";
|
||||
import { assertEquals, assertMatch } from "@std/assert";
|
||||
|
||||
function ids(res: { body: { data: { dumps: { id: string }[] } } }): string[] {
|
||||
return res.body.data.dumps.map((d) => d.id);
|
||||
}
|
||||
|
||||
test("POST /api/playlists creates; GET finds it by id or slug", async () => {
|
||||
const user = await createUser();
|
||||
const res = await post("/api/playlists", {
|
||||
auth: user.auth,
|
||||
json: { title: "Road Trip", description: "songs", isPublic: true },
|
||||
});
|
||||
assertEquals(res.status, 201);
|
||||
const { id, slug } = res.body.data;
|
||||
assertMatch(slug, /^road-trip-/);
|
||||
assertEquals(
|
||||
(await get(`/api/playlists/${id}`)).body.data.title,
|
||||
"Road Trip",
|
||||
);
|
||||
const bySlug = await get(`/api/playlists/${slug}`);
|
||||
assertEquals(bySlug.body.data.id, id);
|
||||
assertEquals(bySlug.body.data.ownerUsername, user.username);
|
||||
assertEquals(bySlug.body.data.dumps, []);
|
||||
assertEquals(
|
||||
(await post("/api/playlists", { auth: user.auth, json: { title: "" } }))
|
||||
.status,
|
||||
400,
|
||||
);
|
||||
assertEquals(
|
||||
(await post("/api/playlists", { json: { title: "x", isPublic: true } }))
|
||||
.status,
|
||||
401,
|
||||
);
|
||||
});
|
||||
|
||||
test("private playlists are the owner's alone", async () => {
|
||||
const owner = await createUser();
|
||||
const other = await createUser();
|
||||
const { id } = insertPlaylist({ userId: owner.id, isPublic: false });
|
||||
assertEquals((await get(`/api/playlists/${id}`)).status, 404);
|
||||
assertEquals(
|
||||
(await get(`/api/playlists/${id}`, { auth: other.auth })).status,
|
||||
404,
|
||||
);
|
||||
assertEquals(
|
||||
(await get(`/api/playlists/${id}`, { auth: owner.auth })).status,
|
||||
200,
|
||||
);
|
||||
insertPlaylist({ userId: owner.id });
|
||||
const path = `/api/users/${owner.username}/playlists`;
|
||||
assertEquals((await get(path)).body.data.total, 1);
|
||||
assertEquals((await get(path, { auth: owner.auth })).body.data.total, 2);
|
||||
});
|
||||
|
||||
test("adding dumps: newest on top, no duplicates, only dumps you can see", async () => {
|
||||
const owner = await createUser();
|
||||
const other = await createUser();
|
||||
const { id } = insertPlaylist({ userId: owner.id });
|
||||
const a = insertDump({ userId: owner.id, title: "a" });
|
||||
const b = insertDump({ userId: other.id, title: "b" });
|
||||
const theirs = insertDump({ userId: other.id, isPrivate: true });
|
||||
|
||||
assertEquals(
|
||||
(await post(`/api/playlists/${id}/dumps/${a.id}`, { auth: owner.auth }))
|
||||
.status,
|
||||
204,
|
||||
);
|
||||
assertEquals(
|
||||
(await post(`/api/playlists/${id}/dumps/${b.id}`, { auth: owner.auth }))
|
||||
.status,
|
||||
204,
|
||||
);
|
||||
assertEquals(ids(await get(`/api/playlists/${id}`)), [b.id, a.id]);
|
||||
assertEquals(
|
||||
(await post(`/api/playlists/${id}/dumps/${a.id}`, { auth: owner.auth }))
|
||||
.status,
|
||||
409,
|
||||
);
|
||||
assertEquals(
|
||||
(await post(`/api/playlists/${id}/dumps/${theirs.id}`, {
|
||||
auth: owner.auth,
|
||||
})).status,
|
||||
404,
|
||||
);
|
||||
assertEquals(
|
||||
(await post(`/api/playlists/${id}/dumps/${crypto.randomUUID()}`, {
|
||||
auth: owner.auth,
|
||||
}))
|
||||
.status,
|
||||
404,
|
||||
);
|
||||
assertEquals(
|
||||
(await post(`/api/playlists/${id}/dumps/${a.id}`, { auth: other.auth }))
|
||||
.status,
|
||||
403,
|
||||
);
|
||||
assertEquals((await get(`/api/playlists/${id}`)).body.data.dumpCount, 2);
|
||||
});
|
||||
|
||||
test("a public playlist hides its private dumps from everyone but their owner", async () => {
|
||||
const owner = await createUser();
|
||||
const { id } = insertPlaylist({ userId: owner.id });
|
||||
const pub = insertDump({ userId: owner.id });
|
||||
const priv = insertDump({ userId: owner.id, isPrivate: true });
|
||||
for (const d of [pub, priv]) {
|
||||
await post(`/api/playlists/${id}/dumps/${d.id}`, { auth: owner.auth });
|
||||
}
|
||||
assertEquals(ids(await get(`/api/playlists/${id}`)), [pub.id]);
|
||||
assertEquals(
|
||||
ids(await get(`/api/playlists/${id}`, { auth: owner.auth })).length,
|
||||
2,
|
||||
);
|
||||
});
|
||||
|
||||
test("reorder: must name exactly the current members", async () => {
|
||||
const owner = await createUser();
|
||||
const { id } = insertPlaylist({ userId: owner.id });
|
||||
const [a, b, c] = [1, 2, 3].map(() => insertDump({ userId: owner.id }));
|
||||
for (const d of [a, b, c]) {
|
||||
await post(`/api/playlists/${id}/dumps/${d.id}`, { auth: owner.auth });
|
||||
}
|
||||
const order = [a.id, c.id, b.id];
|
||||
assertEquals(
|
||||
(await put(`/api/playlists/${id}/order`, {
|
||||
auth: owner.auth,
|
||||
json: { dumpIds: order },
|
||||
}))
|
||||
.status,
|
||||
200,
|
||||
);
|
||||
assertEquals(ids(await get(`/api/playlists/${id}`)), order);
|
||||
for (const dumpIds of [[a.id, b.id], [a.id, b.id, crypto.randomUUID()]]) {
|
||||
assertEquals(
|
||||
(await put(`/api/playlists/${id}/order`, {
|
||||
auth: owner.auth,
|
||||
json: { dumpIds },
|
||||
}))
|
||||
.status,
|
||||
400,
|
||||
JSON.stringify(dumpIds),
|
||||
);
|
||||
}
|
||||
// A dump added after reordering still lands on top.
|
||||
const d = insertDump({ userId: owner.id });
|
||||
await post(`/api/playlists/${id}/dumps/${d.id}`, { auth: owner.auth });
|
||||
assertEquals(ids(await get(`/api/playlists/${id}`))[0], d.id);
|
||||
});
|
||||
|
||||
test("reorder: a list naming a member twice is not the current members", async () => {
|
||||
const owner = await createUser();
|
||||
const { id } = insertPlaylist({ userId: owner.id });
|
||||
const [a, b] = [1, 2].map(() => insertDump({ userId: owner.id }));
|
||||
for (const d of [a, b]) {
|
||||
await post(`/api/playlists/${id}/dumps/${d.id}`, { auth: owner.auth });
|
||||
}
|
||||
const res = await put(`/api/playlists/${id}/order`, {
|
||||
auth: owner.auth,
|
||||
json: { dumpIds: [a.id, b.id, a.id] },
|
||||
});
|
||||
assertEquals(res.status, 400);
|
||||
});
|
||||
|
||||
test("removing a dump; updating; deleting", async () => {
|
||||
const owner = await createUser();
|
||||
const other = await createUser();
|
||||
const mod = await createUser({ role: "moderator" });
|
||||
const { id } = insertPlaylist({ userId: owner.id, title: "Old" });
|
||||
const a = insertDump({ userId: owner.id });
|
||||
await post(`/api/playlists/${id}/dumps/${a.id}`, { auth: owner.auth });
|
||||
assertEquals(
|
||||
(await del(`/api/playlists/${id}/dumps/${a.id}`, { auth: other.auth }))
|
||||
.status,
|
||||
403,
|
||||
);
|
||||
assertEquals(
|
||||
(await del(`/api/playlists/${id}/dumps/${a.id}`, { auth: owner.auth }))
|
||||
.status,
|
||||
204,
|
||||
);
|
||||
assertEquals(ids(await get(`/api/playlists/${id}`)), []);
|
||||
|
||||
assertEquals(
|
||||
(await put(`/api/playlists/${id}`, {
|
||||
auth: other.auth,
|
||||
json: { title: "x" },
|
||||
})).status,
|
||||
403,
|
||||
);
|
||||
const updated = await put(`/api/playlists/${id}`, {
|
||||
auth: owner.auth,
|
||||
json: { title: "New", description: "d", isPublic: false },
|
||||
});
|
||||
assertEquals(updated.body.data.title, "New");
|
||||
assertMatch(updated.body.data.slug, /^new-/);
|
||||
assertEquals(updated.body.data.isPublic, false);
|
||||
const cleared = await put(`/api/playlists/${id}`, {
|
||||
auth: owner.auth,
|
||||
json: { description: null },
|
||||
});
|
||||
assertEquals(cleared.body.data.description, undefined);
|
||||
assertEquals(cleared.body.data.title, "New");
|
||||
|
||||
assertEquals(
|
||||
(await del(`/api/playlists/${id}`, { auth: other.auth })).status,
|
||||
403,
|
||||
);
|
||||
assertEquals(
|
||||
(await del(`/api/playlists/${id}`, { auth: mod.auth })).status,
|
||||
204,
|
||||
);
|
||||
assertEquals(
|
||||
(await get(`/api/playlists/${id}`, { auth: owner.auth })).status,
|
||||
404,
|
||||
);
|
||||
assertEquals(count(`SELECT COUNT(*) as n FROM playlist_dumps;`), 0);
|
||||
});
|
||||
|
||||
test("memberships: which of my playlists hold this dump", async () => {
|
||||
const owner = await createUser();
|
||||
const other = await createUser();
|
||||
const p1 = insertPlaylist({ userId: owner.id, title: "has" });
|
||||
insertPlaylist({ userId: owner.id, title: "hasnt" });
|
||||
insertPlaylist({ userId: other.id, title: "theirs" });
|
||||
const d = insertDump({ userId: owner.id });
|
||||
await post(`/api/playlists/${p1.id}/dumps/${d.id}`, { auth: owner.auth });
|
||||
const res = await get(`/api/playlists/by-dump/${d.id}/memberships`, {
|
||||
auth: owner.auth,
|
||||
});
|
||||
const byTitle = Object.fromEntries(
|
||||
res.body.data.map((
|
||||
m: { playlist: { title: string }; hasDump: boolean },
|
||||
) => [
|
||||
m.playlist.title,
|
||||
m.hasDump,
|
||||
]),
|
||||
);
|
||||
assertEquals(byTitle, { has: true, hasnt: false });
|
||||
});
|
||||
|
||||
test("adding to a followed public playlist notifies followers, private dumps excepted", async () => {
|
||||
const owner = await createUser();
|
||||
const follower = await createUser();
|
||||
const { id } = insertPlaylist({ userId: owner.id, title: "Mix" });
|
||||
await post(`/api/follows/playlists/${id}`, { auth: follower.auth });
|
||||
db.exec(`DELETE FROM notifications;`); // the follow notified the owner
|
||||
const priv = insertDump({ userId: owner.id, isPrivate: true });
|
||||
await post(`/api/playlists/${id}/dumps/${priv.id}`, { auth: owner.auth });
|
||||
assertEquals(count(`SELECT COUNT(*) as n FROM notifications;`), 0);
|
||||
const pub = insertDump({ userId: owner.id, title: "Song" });
|
||||
await post(`/api/playlists/${id}/dumps/${pub.id}`, { auth: owner.auth });
|
||||
const note = db.prepare(`SELECT user_id, type, data FROM notifications;`)
|
||||
.get() as {
|
||||
user_id: string;
|
||||
type: string;
|
||||
data: string;
|
||||
};
|
||||
assertEquals(note.user_id, follower.id);
|
||||
assertEquals(note.type, "playlist_dump_added");
|
||||
assertEquals(JSON.parse(note.data), {
|
||||
dumpId: pub.id,
|
||||
dumpTitle: "Song",
|
||||
playlistId: id,
|
||||
playlistTitle: "Mix",
|
||||
});
|
||||
});
|
||||
|
||||
test("playlist images: upload and serve", async () => {
|
||||
const owner = await createUser();
|
||||
const other = await createUser();
|
||||
const { id, slug } = insertPlaylist({ userId: owner.id });
|
||||
assertEquals((await get(`/api/playlists/${id}/image`)).status, 404);
|
||||
assertEquals(
|
||||
(await post(`/api/playlists/${id}/image`, {
|
||||
auth: other.auth,
|
||||
form: formWithFile(PNG),
|
||||
}))
|
||||
.status,
|
||||
403,
|
||||
);
|
||||
const res = await post(`/api/playlists/${slug}/image`, {
|
||||
auth: owner.auth,
|
||||
form: formWithFile(PNG),
|
||||
});
|
||||
assertEquals(res.status, 200);
|
||||
assertEquals(res.body.data.imageMime, "image/png");
|
||||
const served = await get(`/api/playlists/${slug}/image`);
|
||||
assertEquals(served.status, 200);
|
||||
assertEquals(served.bytes, PNG);
|
||||
});
|
||||
Reference in New Issue
Block a user