mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-20 22:16:26 +00:00
38f3cb3101
An adversarial review of what had already landed here turned up three that
were wrong, and they are the reason for this commit.
The CSP change removed 'unsafe-eval', which is not leftover: heic-to's
libheif build initialises embind through new Function(), and without it every
iPhone .heic upload fails in the browser. 'wasm-unsafe-eval' alone was tried
once already and was not enough (93b51a0b). Put back, with the reason written
down this time and the test pinning it rather than its absence.
The idempotency in-flight guard never fired. finalize() runs when the
handler's observable completes, but Nest writes the response - and therefore
stores the row - several microtasks later, so the waiting request always woke
up before the row existed and ran the handler a second time. It releases from
the point the row is written now; finalize is the backstop for handlers that
answer another way. The test drove the two in the opposite order from Nest,
which is why it passed either way.
And the trip-scoping check treated an id that resolves to nothing like one
belonging to someone else. accommodation_id has no foreign key, so shortening
a trip's dates leaves a booking pointing at a gap - which update() has always
healed by clearing the link, and which would have become a permanent 400.
The rest: a reply to a soft-deleted chat message is refused and the create
path blanks the quote like the list path does; the ws-token buckets are keyed
by account rather than by IP, where every user behind one NAT shared a
ceiling; the weather and vacay caps read through the stream, since a chunked
response has no content-length to check; the Google host gate takes country
domains again; abandoned response bodies are cancelled instead of left to GC;
the boot failure prints its errno; and a share link that is not yours to read
now says so instead of reporting that the journey has none.
TICKETJSON gets a real repair: the in-place GLOB fix only helps installs that
have not run it yet, so an appended migration puts back the note text the
case-insensitive LIKE cut off, for rows where what it stored is not valid
JSON. A genuine receipt always parses, so it cannot be touched.
Wiki: the audit log records the IP Express resolves after TRUST_PROXY, not
the leftmost X-Forwarded-For entry a caller can write. That is the right way
round, but it means the hop count has to be accurate - said plainly in both
places now.
87 lines
3.6 KiB
TypeScript
87 lines
3.6 KiB
TypeScript
/**
|
|
* demo-reset's DB path.
|
|
*
|
|
* demo-reset closes the live connection, copies the baseline over the database
|
|
* file and reopens. It used to compute that file itself as data/travel.db, which
|
|
* is wrong the moment TREK_DB_FILE moves the database elsewhere: the baseline
|
|
* lands on an unrelated file and the real database is never reset. The path has
|
|
* to come from the connection that database.ts actually opened, so what these
|
|
* cases assert is which file each copy names.
|
|
*
|
|
* demo-reset resolves ../db/database through a runtime require() — the module is
|
|
* a boot-time singleton — and vitest's mock registry never sees that call: it
|
|
* goes to Node's own resolver, which cannot load a .ts file and throws
|
|
* "Cannot find module '../db/database'". Hence the loader below, which is the
|
|
* seam that lets the module run at all. The file system is spied rather than
|
|
* written to, because the baseline path is fixed at data/travel-baseline.db and
|
|
* a developer running a demo instance has a real one sitting there.
|
|
*/
|
|
import { describe, it, expect, vi, beforeEach, afterEach, afterAll } from 'vitest';
|
|
import fs from 'node:fs';
|
|
import path from 'node:path';
|
|
// eslint-disable-next-line @typescript-eslint/no-require-imports
|
|
const Module = require('node:module');
|
|
|
|
const BASELINE = path.resolve(__dirname, '..', '..', '..', 'data', 'travel-baseline.db');
|
|
const LIVE_DB = path.join(path.sep, 'srv', 'trek', 'custom-name.db');
|
|
|
|
const dbStub = {
|
|
name: LIVE_DB,
|
|
exec: vi.fn(),
|
|
prepare: vi.fn(() => ({ get: () => undefined, all: () => [], run: () => undefined })),
|
|
};
|
|
const databaseModule = { db: dbStub, closeDb: vi.fn(), reinitialize: vi.fn() };
|
|
|
|
// Teach Node's require how to answer the one runtime require demo-reset makes.
|
|
const previousLoader = Module._extensions['.ts'];
|
|
Module._extensions['.ts'] = (mod: { exports: unknown }, filename: string) => {
|
|
if (filename.endsWith(path.join('src', 'db', 'database.ts'))) {
|
|
mod.exports = databaseModule;
|
|
return;
|
|
}
|
|
throw new Error(`unexpected runtime require of ${filename}`);
|
|
};
|
|
afterAll(() => {
|
|
if (previousLoader) Module._extensions['.ts'] = previousLoader;
|
|
else delete Module._extensions['.ts'];
|
|
});
|
|
|
|
import { resetDemoUser, saveBaseline } from '../../../src/demo/demo-reset';
|
|
|
|
describe('demo-reset DB path', () => {
|
|
let copyFileSync: ReturnType<typeof vi.spyOn>;
|
|
|
|
beforeEach(() => {
|
|
dbStub.name = LIVE_DB;
|
|
vi.spyOn(console, 'log').mockImplementation(() => undefined);
|
|
copyFileSync = vi.spyOn(fs, 'copyFileSync').mockImplementation(() => undefined);
|
|
vi.spyOn(fs, 'unlinkSync').mockImplementation(() => undefined);
|
|
vi.spyOn(fs, 'existsSync').mockImplementation(((p: fs.PathLike) => String(p) === BASELINE) as typeof fs.existsSync);
|
|
});
|
|
|
|
afterEach(() => {
|
|
vi.restoreAllMocks();
|
|
});
|
|
|
|
it('DEMORESET-001: saves the baseline from the file the connection has open', () => {
|
|
saveBaseline();
|
|
expect(copyFileSync).toHaveBeenCalledWith(LIVE_DB, BASELINE);
|
|
});
|
|
|
|
it('DEMORESET-002: restores the baseline onto that same file, not data/travel.db', () => {
|
|
resetDemoUser();
|
|
expect(copyFileSync).toHaveBeenCalledWith(BASELINE, LIVE_DB);
|
|
// Closed before the copy and reopened after it — copying over an open
|
|
// SQLite file is how a database ends up half of each.
|
|
expect(databaseModule.closeDb).toHaveBeenCalled();
|
|
expect(databaseModule.reinitialize).toHaveBeenCalled();
|
|
});
|
|
|
|
it('DEMORESET-003: an in-memory database is left alone rather than copied around', () => {
|
|
dbStub.name = ':memory:';
|
|
saveBaseline();
|
|
resetDemoUser();
|
|
expect(copyFileSync).not.toHaveBeenCalled();
|
|
});
|
|
});
|