mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
Claude
0918f859a0
Audits what actually has tests, then closes the gaps it found. Full write-up with before/after numbers in docs/audit-test-coverage-2026-07-25.md. Measurement first: `go test ./... -coverprofile` (what CI runs) instruments each package only for itself, so code exercised through another package's tests reads as uncovered — `service` reported 36.7% against a real 85%. All analysis here uses -coverpkg=./..., and both views now have Makefile targets. Features that had zero coverage at every layer: - user blocking (db + service + the /api/v1/blocks routes) - auth lockout persistence — the DB round-trip that survives a restart - plugin install/enable/disable/uninstall and the plugin KV namespace - event replay bounds (GetMaxEventSeq, PruneEventsOlderThan) - LiveKit participant_joined webhook (replayed-token guard), the room-service client, and proxyWebSocket/copyWS - ws_proxy.rs and livekit_proxy.rs — pure helpers extracted, matching the existing tofu.rs pattern, so cert-pin and header-injection checks are testable Gaps that were hidden rather than absent: - Server/admin reported 0.3% coverage with 307 tests passing. TestSpawnDetached_* re-execs the test binary; the child inherited GOCOVERDIR and the parent's stdout, clobbering the profile and printing "[no tests to run]". Now 71.4%, and CI's uploaded artifact is correct. - vitest.config.ts excluded 2.2k LOC unexplained, including two files that already had tests. Trimmed to three entries, each justified inline. - api.HandleLiveKitHealthForTest re-implemented the handler it claimed to expose, so eight call sites tested a copy. Added a hook to the real one. Two bugs found and pinned rather than silently patched: logctx.WithGroup nests req_id under the group, and drag-reorder.ts takes one listener ref per channel but releases one per sidebar, so the count never reaches zero. Coverage: client 92.93% -> 94.87% statements (3371 -> 3572 tests) even after un-excluding hidden files; Rust 47 -> 74 tests; Go zero-coverage functions ~70 -> 21, with plugin 61->77%, admin 67->86%, db 76->84%, service 85->91%. Verified: go vet, all four build-tag variants, go test -race, -tags deadlock, vitest --coverage, cargo test --lib, cargo clippy --all-targets, playwright. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AEETs3Vh6sAHHb1jMBL75g
93 lines
2.2 KiB
Go
93 lines
2.2 KiB
Go
package admin
|
|
|
|
import "testing"
|
|
|
|
// isSetupOriginAllowed guards the first-run setup endpoint, which creates the
|
|
// server owner. It had no coverage. The safe default matters most: an empty
|
|
// allowlist must deny, not allow.
|
|
|
|
func TestIsSetupOriginAllowed(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
origin string
|
|
allowed []string
|
|
want bool
|
|
}{
|
|
{
|
|
name: "empty allowlist denies",
|
|
origin: "https://app.example",
|
|
allowed: nil,
|
|
want: false,
|
|
},
|
|
{
|
|
name: "empty allowlist denies even an empty origin",
|
|
origin: "",
|
|
allowed: nil,
|
|
want: false,
|
|
},
|
|
{
|
|
name: "exact match allows",
|
|
origin: "https://app.example",
|
|
allowed: []string{"https://app.example"},
|
|
want: true,
|
|
},
|
|
{
|
|
name: "match is case-insensitive",
|
|
origin: "https://APP.example",
|
|
allowed: []string{"https://app.example"},
|
|
want: true,
|
|
},
|
|
{
|
|
name: "wildcard allows anything",
|
|
origin: "https://anywhere.example",
|
|
allowed: []string{"*"},
|
|
want: true,
|
|
},
|
|
{
|
|
name: "wildcard anywhere in the list allows",
|
|
origin: "https://anywhere.example",
|
|
allowed: []string{"https://app.example", "*"},
|
|
want: true,
|
|
},
|
|
{
|
|
name: "non-matching origin denied",
|
|
origin: "https://evil.example",
|
|
allowed: []string{"https://app.example"},
|
|
want: false,
|
|
},
|
|
{
|
|
name: "match against any list entry",
|
|
origin: "https://second.example",
|
|
allowed: []string{"https://first.example", "https://second.example"},
|
|
want: true,
|
|
},
|
|
{
|
|
name: "a suffix of an allowed origin is not a match",
|
|
origin: "https://evil-app.example",
|
|
allowed: []string{"https://app.example"},
|
|
want: false,
|
|
},
|
|
{
|
|
name: "a prefix of an allowed origin is not a match",
|
|
origin: "https://app.example.evil.test",
|
|
allowed: []string{"https://app.example"},
|
|
want: false,
|
|
},
|
|
{
|
|
name: "scheme must match too",
|
|
origin: "http://app.example",
|
|
allowed: []string{"https://app.example"},
|
|
want: false,
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
if got := isSetupOriginAllowed(tt.origin, tt.allowed); got != tt.want {
|
|
t.Errorf("isSetupOriginAllowed(%q, %v) = %v, want %v",
|
|
tt.origin, tt.allowed, got, tt.want)
|
|
}
|
|
})
|
|
}
|
|
}
|