test: cover the captcha and sign-up gates #276

Sammanfogat

supernaut sammanfogade 1 incheckning från test/255-signup-gate in i main

2026-10-02 09:50:37 +00:00

supernaut kommenterad

2026-10-02 09:38:17 +00:00

Ägare

What

Tests for the captcha and sign-up gates: 95 new tests in four files. No version bump.

src/lib/captcha.test.ts: CAP_SECRET unset in production fails closed for create, redeem and validate; outside production it bypasses as documented. Tokens are single-use; never-issued, malformed, wrong-secret and expired tokens are rejected; double redeem returns already_redeemed.
src/lib/signup-access.test.ts: signupsOpen() and trialOpen() env handling, read at call time.
src/test/captcha-routes.test.ts: challenge and redeem routes for success, sign-ups closed (404), rate limit (429, nothing minted), library throw (500), library refusal (403), and 9 malformed bodies (400, library never called).
src/test/signup.test.ts: kill switch, rate limit, captcha missing/invalid/valid (checked after cheap input checks so a bad form does not spend the token), terms, email, username, country eligibility, trial flag, DB health check before provisioning, and every status mapping.

One production change: /api/captcha/redeem validates its body with a zod schema that mirrors the library's ValidateChallengeBody (token, solutions, optional instr*), and returns 400 invalid_body otherwise.

Findings

No gate fails open. There are no allowlist or invite gates in the code. The country gate is unreachable through the real route today (requiresCountry is false for every account type); its branches are tested with a mock.

Verification

487 tests pass across 33 files. Lint, astro check, build and e2e pass.

Closes #255

## What Tests for the captcha and sign-up gates: 95 new tests in four files. No version bump. - `src/lib/captcha.test.ts`: `CAP_SECRET` unset in production fails closed for create, redeem and validate; outside production it bypasses as documented. Tokens are single-use; never-issued, malformed, wrong-secret and expired tokens are rejected; double redeem returns `already_redeemed`. - `src/lib/signup-access.test.ts`: `signupsOpen()` and `trialOpen()` env handling, read at call time. - `src/test/captcha-routes.test.ts`: challenge and redeem routes for success, sign-ups closed (404), rate limit (429, nothing minted), library throw (500), library refusal (403), and 9 malformed bodies (400, library never called). - `src/test/signup.test.ts`: kill switch, rate limit, captcha missing/invalid/valid (checked after cheap input checks so a bad form does not spend the token), terms, email, username, country eligibility, trial flag, DB health check before provisioning, and every status mapping. One production change: `/api/captcha/redeem` validates its body with a zod schema that mirrors the library's `ValidateChallengeBody` (`token`, `solutions`, optional `instr*`), and returns 400 `invalid_body` otherwise. ## Findings No gate fails open. There are no allowlist or invite gates in the code. The country gate is unreachable through the real route today (`requiresCountry` is false for every account type); its branches are tested with a mock. ## Verification 487 tests pass across 33 files. Lint, `astro check`, build and e2e pass. Closes #255

supernaut lade till 1 incheckning

2026-10-02 09:38:17 +00:00

test: cover the captcha and sign-up gates

ci / ci (pull_request) Successful in 1m37s

Detaljer

d677e1fc1d

Add tests for captcha.ts, signup-access.ts, the sign-up route and the
captcha challenge and redeem routes. Validate the redeem request body
with a zod schema instead of a bare cast.

Closes #255

supernaut sammanfogade incheckning 603f4649e7 till main

2026-10-02 09:50:37 +00:00

supernaut tog bort grenen test/255-signup-gate

2026-10-02 09:50:37 +00:00

supernaut refererade denna ändringsförfrågan från en incheckning

2026-10-02 09:50:38 +00:00

test: cover the captcha and sign-up gates (#276)

supernaut refererade denna ändringsförfrågan från en incheckning

2026-10-02 17:56:59 +00:00

test: cover the captcha and sign-up gates (#276)

Logga in för att delta i denna konversation.

Inga granskare