mirror of
https://github.com/penpot/penpot.git
synced 2026-09-24 12:56:15 +00:00
2255266d45
* ✨ Enable closed schemas for RPC methods * 🐛 Fix duplicate make-dummy-request test helper definition The branch added a variadic DummyRequest/make-dummy-request pair but left the pre-existing single-arg definition in place. Because it was loaded last, zero-arg (make-dummy-request) calls added by prepare-rpc-params and rpc-nitrate-test threw ArityException, which broke 384 tests and caused 14 downstream assertion failures. Remove the stale duplicate so the variadic definition is the only one, and drop the now-unused yrq alias and duplicate yres alias. AI-assisted-by: deepseek-v4.1-flash * ✨ Add focused tests for make-dummy-request helper Pin the call contract of make-dummy-request, which the suite uses in three styles: no arguments, a single options map, and keyword arguments. The helper's redefinition shadowing in 8ca95adb98 was only caught by a full-suite run with hundreds of unrelated errors; these tests fail locally in a focused --focus run. Cover the zero-arg defaults, map and keyword overrides, the :body-bytes -> ByteArrayInputStream wrapping, :body-stream precedence, and cookie readback. Also clarify the docstring to list all supported call styles. AI-assisted-by: deepseek-v4.1-flash * 🚑 Prevent RPC client params from overriding auth context Strip qualified keys from decoded request params before merging them with the server-built auth context, so transit bodies can no longer override ::profile-id, ::auth-type or ::token-perms. Adds a regression test proving the override and the fix. AI-assisted-by: muse-spark-1.3-contributor * 📚 Merge backend subtleties memories under generic name Rename rpc-db-worker-subtleties to subtleties and fold in http-storage-filedata-subtleties, so the name no longer enumerates topics. Update all mem: references accordingly. AI-assisted-by: muse-spark-1.3-contributor * ✨ Add realistic tests for RPC auth override Cover the transit wire vector and the real wrapped :get-profile method with two database profiles, proving a session cannot read another profile by smuggling :app.rpc/profile-id in the body. AI-assisted-by: muse-spark-1.3-contributor * ✨ Add e2e test for RPC auth context override Parametrize rpcPost with contentType, accept and query so e2e can send hand-written transit bodies without new dependencies. The new test proves a transit-smuggled :app.rpc/profile-id no longer overrides the session in get-profile. Also fix the demo email assertion in auth-flow to the current uuid format. AI-assisted-by: muse-spark-1.3-contributor
93 lines
3.5 KiB
Clojure
93 lines
3.5 KiB
Clojure
;; This Source Code Form is subject to the terms of the Mozilla Public
|
|
;; License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
|
;;
|
|
;; Copyright (c) KALEIDOS SUBSIDIARY SL
|
|
|
|
(ns backend-tests.helpers-test
|
|
"Focused unit tests for the shared test request constructor.
|
|
|
|
`make-dummy-request` is called with three styles across the suite
|
|
(no arguments, a single options map, and keyword arguments). These
|
|
tests pin that contract so a future redefinition or reordering of
|
|
the helper fails loudly here instead of as a flood of unrelated
|
|
test errors."
|
|
(:require
|
|
[backend-tests.helpers :as th]
|
|
[clojure.test :as t]
|
|
[yetti.request :as yreq]))
|
|
|
|
(defn- utf8-bytes
|
|
^bytes
|
|
[^String s]
|
|
(.getBytes s "UTF-8"))
|
|
|
|
;; --- DEFAULTS (ZERO ARGUMENTS)
|
|
|
|
(t/deftest make-dummy-request-zero-args-uses-defaults
|
|
(let [req (th/make-dummy-request)]
|
|
(t/is (instance? backend_tests.helpers.DummyRequest req))
|
|
(t/is (= :get (yreq/method req)))
|
|
(t/is (= "/test" (yreq/path req)))
|
|
(t/is (= :http (yreq/scheme req)))
|
|
(t/is (= "HTTP/1.1" (yreq/protocol req)))
|
|
(t/is (= "127.0.0.1" (yreq/remote-addr req)))
|
|
(t/is (= "test" (yreq/server-name req)))
|
|
(t/is (= 0 (yreq/server-port req)))
|
|
(t/is (nil? (yreq/query req)))
|
|
(t/is (nil? (yreq/body req)))))
|
|
|
|
;; --- SINGLE OPTIONS MAP
|
|
|
|
(t/deftest make-dummy-request-single-map-arg-overrides-given-keys
|
|
(let [req (th/make-dummy-request {:method :post
|
|
:headers {"x-test" "yes"}
|
|
:path "/custom"
|
|
:query "a=1"})]
|
|
(t/is (= :post (yreq/method req)))
|
|
(t/is (= "yes" (yreq/get-header req "x-test")))
|
|
(t/is (= "/custom" (yreq/path req)))
|
|
(t/is (= "a=1" (yreq/query req)))))
|
|
|
|
(t/deftest make-dummy-request-single-map-arg-keeps-defaults-for-omitted-keys
|
|
(let [req (th/make-dummy-request {:method :post})]
|
|
(t/is (= "/test" (yreq/path req)))
|
|
(t/is (= :http (yreq/scheme req)))
|
|
(t/is (= "test" (yreq/server-name req)))))
|
|
|
|
;; --- KEYWORD ARGUMENTS
|
|
|
|
(t/deftest make-dummy-request-keyword-args-override-given-keys
|
|
(let [req (th/make-dummy-request :method :delete
|
|
:path "/by-id"
|
|
:server-port 8080)]
|
|
(t/is (= :delete (yreq/method req)))
|
|
(t/is (= "/by-id" (yreq/path req)))
|
|
(t/is (= 8080 (yreq/server-port req)))))
|
|
|
|
;; --- BODY
|
|
|
|
(t/deftest make-dummy-request-string-body-bytes-wrapped-in-stream
|
|
(let [req (th/make-dummy-request :method :post :body-bytes "hello")]
|
|
(t/is (instance? java.io.ByteArrayInputStream (yreq/body req)))
|
|
(t/is (= "hello" (slurp (yreq/body req))))))
|
|
|
|
(t/deftest make-dummy-request-byte-array-body-bytes-wrapped-in-stream
|
|
(let [req (th/make-dummy-request :body-bytes (utf8-bytes "raw"))]
|
|
(t/is (= "raw" (slurp (yreq/body req))))))
|
|
|
|
(t/deftest make-dummy-request-body-stream-takes-precedence-over-body-bytes
|
|
(let [stream (java.io.ByteArrayInputStream. (utf8-bytes "stream"))
|
|
req (th/make-dummy-request :body-stream stream :body-bytes "bytes")]
|
|
(t/is (identical? stream (yreq/body req)))
|
|
(t/is (= "stream" (slurp (yreq/body req))))))
|
|
|
|
;; --- COOKIES
|
|
|
|
(t/deftest make-dummy-request-cookie-readable-via-get-cookie
|
|
(let [req (th/make-dummy-request {:cookies {"auth-token" "abc"}})]
|
|
(t/is (= {:value "abc"} (yreq/get-cookie req "auth-token")))))
|
|
|
|
(t/deftest make-dummy-request-missing-cookie-returns-nil-value
|
|
(t/is (= {:value nil} (yreq/get-cookie (th/make-dummy-request) "missing"))))
|