test(auth): add vitest harness + 16 auth-focused unit tests (Brief 5 of fix-auth-bypass) #11

Merged

varutasu merged 1 commit from brief/fix-auth-bypass/5-vitest-and-auth-tests into main

2026-05-23 12:12:15 -04:00

varutasu commented

2026-05-23 12:07:22 -04:00

(Migrated from github.com)

Summary

Convoy fix-auth-bypass / Brief 5 of 5 — the final brief. Adds a vitest test harness and 16 unit tests that lock in the security-critical behavior shipped by Briefs 1, 2, and 4.

vitest@^3.2.4 as a single devDep (no UI/coverage/jsdom add-ons — bundle stays minimal).
3 new test files / 16 tests covering: JWT secret helper exports + fail-loud throw, getUserFromRequest null-for-unauthenticated contract (incl. a regression lock against Brief 2's synthetic-admin shape), and auth-utils.generateToken 24h JWT mint + verify round-trip.
CI test: job re-enabled (previously commented out) — blocking (no || true wrapper). First repo to ship with vitest as a real gate.

Files changed

package.json — vitest@^3.2.4 in devDeps; test + test:run scripts
package-lock.json — regenerated (single vitest@3.2.4, single vite@7.3.3)
vitest.config.js (new) — ESM, environment: 'node', globals: false, setupFiles: ['./test/setup.js']
test/setup.js (new) — sets JWT_SECRET + NODE_ENV='test' before any module loads
test/lib/auth-secret.test.js (new) — 3 tests
test/lib/permission-middleware.test.js (new) — 8 tests (mocks @vercel/postgres)
test/api/auth-utils.test.js (new) — 5 tests (mocks lib/database.js)
.github/workflows/ci.yml — re-enabled test: job; header comment updated

Test plan

npm run test:run → 3 files / 16 tests pass in 1.68s (zero retries used)
npm run build → exit 0 (Next.js prod build unaffected)
npm run lint → matches baseline (128 problems pre-existing; 0 new from test/ or vitest.config.js)
npm ls vitest → single vitest@3.2.4
npm install clean — only one transitive deprecation warning (node-domexception@1.0.0), no ERESOLVE
No scope expansion (no edits to lib/** or pages/api/**)
Reviewer to verify on CI: the new test: job runs and passes on this PR's preview build. Temporarily reintroduce the synthetic admin in a side-branch and confirm the Brief 2 regression test fails as designed.

⚠️ Implementer deviation worth surfacing

The brief was strict on test contract (3 + 8 + 5 = 16 tests verbatim). The implementer also made a one-line consistency edit to the CI workflow header comment (added "- Unit tests (vitest)" to the "What this CI covers" bullet list), in addition to the brief's required removal of the "no test runner installed yet" note. They flagged it explicitly and offered to revert if reviewer prefers strict scope. My (parent) read: keep the consistency edit — the alternative is a stale comment that contradicts the now-real test: job.

Pre-merge requirements

None on env vars (CI test: job uses a fake JWT_SECRET for tests; production secret is unaffected)
CI must successfully run the new test: job — verify in the GH Actions tab before merge

Out of scope (intentionally — see convoy plan)

Rate-limit tests (lib/rate-limit.js from Brief 4) → future expand-auth-tests convoy per architect's R11 call
Integration tests for pages/api/auth/login.js / register.js → same future convoy
withCollectionPermission / checkCollectionPermission test coverage → same future convoy
Vitest lint plugin (@vitest/eslint-plugin) → only useful if we enable globals: true later
AGENTS.md §6 "Testing: None yet" cleanup → doc-writer pass after this convoy closes

Convoy completion

This is the last brief in fix-auth-bypass. After this merges, the only remaining work is the doc-writer sweep:

AGENTS.md gotchas #2, #3, #5 marked as resolved
AGENTS.md §6 "Testing" updated to reflect vitest
.convoys/fix-auth-bypass/brief-4-tighten-auth-surface.md env var names corrected (UPSTASH_REDIS_REST_* → KV_REST_API_*)
.cursor/rules/api-routes.mdc § "Dev/test endpoints" removed (Brief 3 deleted them)
.convoys/ship-readiness.md P0 items marked resolved

🤖 Pipeline metadata: convoy=fix-auth-bypass, brief=5 (final), depends_on=[1, 2, 4 all merged], audit=reviewer-only

Made with Cursor

## Summary Convoy `fix-auth-bypass` / **Brief 5 of 5 — the final brief**. Adds a vitest test harness and 16 unit tests that lock in the security-critical behavior shipped by Briefs 1, 2, and 4. - `vitest@^3.2.4` as a single devDep (no UI/coverage/jsdom add-ons — bundle stays minimal). - 3 new test files / 16 tests covering: JWT secret helper exports + fail-loud throw, `getUserFromRequest` null-for-unauthenticated contract (incl. a **regression lock against Brief 2's synthetic-admin shape**), and `auth-utils.generateToken` 24h JWT mint + verify round-trip. - CI `test:` job re-enabled (previously commented out) — **blocking** (no `|| true` wrapper). First repo to ship with vitest as a real gate. ## Files changed - `package.json` — `vitest@^3.2.4` in devDeps; `test` + `test:run` scripts - `package-lock.json` — regenerated (single `vitest@3.2.4`, single `vite@7.3.3`) - `vitest.config.js` (**new**) — ESM, `environment: 'node'`, `globals: false`, `setupFiles: ['./test/setup.js']` - `test/setup.js` (**new**) — sets `JWT_SECRET` + `NODE_ENV='test'` before any module loads - `test/lib/auth-secret.test.js` (**new**) — 3 tests - `test/lib/permission-middleware.test.js` (**new**) — 8 tests (mocks `@vercel/postgres`) - `test/api/auth-utils.test.js` (**new**) — 5 tests (mocks `lib/database.js`) - `.github/workflows/ci.yml` — re-enabled `test:` job; header comment updated ## Test plan - [x] `npm run test:run` → 3 files / 16 tests pass in 1.68s (zero retries used) - [x] `npm run build` → exit 0 (Next.js prod build unaffected) - [x] `npm run lint` → matches baseline (128 problems pre-existing; 0 new from `test/` or `vitest.config.js`) - [x] `npm ls vitest` → single `vitest@3.2.4` - [x] `npm install` clean — only one transitive deprecation warning (`node-domexception@1.0.0`), no `ERESOLVE` - [x] No scope expansion (no edits to `lib/**` or `pages/api/**`) - [ ] **Reviewer to verify on CI:** the new `test:` job runs and passes on this PR's preview build. Temporarily reintroduce the synthetic admin in a side-branch and confirm the Brief 2 regression test fails as designed. ## ⚠️ Implementer deviation worth surfacing The brief was strict on test contract (3 + 8 + 5 = 16 tests verbatim). The implementer also made a **one-line consistency edit** to the CI workflow header comment (added "- Unit tests (vitest)" to the "What this CI covers" bullet list), in addition to the brief's required removal of the "no test runner installed yet" note. They flagged it explicitly and offered to revert if reviewer prefers strict scope. **My (parent) read: keep the consistency edit — the alternative is a stale comment that contradicts the now-real `test:` job.** ## Pre-merge requirements - None on env vars (CI `test:` job uses a fake `JWT_SECRET` for tests; production secret is unaffected) - CI must successfully run the new `test:` job — verify in the GH Actions tab before merge ## Out of scope (intentionally — see convoy plan) - Rate-limit tests (`lib/rate-limit.js` from Brief 4) → future `expand-auth-tests` convoy per architect's R11 call - Integration tests for `pages/api/auth/login.js` / `register.js` → same future convoy - `withCollectionPermission` / `checkCollectionPermission` test coverage → same future convoy - Vitest lint plugin (`@vitest/eslint-plugin`) → only useful if we enable `globals: true` later - AGENTS.md §6 "Testing: None yet" cleanup → **doc-writer pass after this convoy closes** ## Convoy completion This is the last brief in `fix-auth-bypass`. After this merges, the only remaining work is the doc-writer sweep: - AGENTS.md gotchas #2, #3, #5 marked as resolved - AGENTS.md §6 "Testing" updated to reflect vitest - `.convoys/fix-auth-bypass/brief-4-tighten-auth-surface.md` env var names corrected (`UPSTASH_REDIS_REST_*` → `KV_REST_API_*`) - `.cursor/rules/api-routes.mdc` § "Dev/test endpoints" removed (Brief 3 deleted them) - `.convoys/ship-readiness.md` P0 items marked resolved --- 🤖 Pipeline metadata: convoy=fix-auth-bypass, brief=5 (final), depends_on=[1, 2, 4 all merged], audit=reviewer-only Made with [Cursor](https://cursor.com)

vercel[bot] commented

2026-05-23 12:07:28 -04:00

(Migrated from github.com)

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
tcg-vault	Ready	Preview, Comment	May 23, 2026 4:07pm

[vc]: #YoWsGJn8oJj9vQqr73CXDS5z1RS50DXv6/HaTmITmts=:eyJpc01vbm9yZXBvIjp0cnVlLCJ0eXBlIjoiZ2l0aHViIiwicHJvamVjdHMiOlt7Im5hbWUiOiJ0Y2ctdmF1bHQiLCJwcm9qZWN0SWQiOiJwcmpfRjZXOEVvRkd3Y0g3aWVGcnRvRlNlOXdVVkFhNSIsImxpdmVGZWVkYmFjayI6eyJyZXNvbHZlZCI6MCwidW5yZXNvbHZlZCI6MCwidG90YWwiOjAsImxpbmsiOiJ0Y2ctdmF1bHQtZ2l0LWJyaWVmLWZpeC1hdXRoLTViMTI3NS1yYW5kYWxsLXN0aWxsd2VsbHMtcHJvamVjdHMudmVyY2VsLmFwcCJ9LCJpbnNwZWN0b3JVcmwiOiJodHRwczovL3ZlcmNlbC5jb20vcmFuZGFsbC1zdGlsbHdlbGxzLXByb2plY3RzL3RjZy12YXVsdC9Id3BuRVZnNnBGVmJHOFBvdkdMZzFIajdGWktIIiwicHJldmlld1VybCI6InRjZy12YXVsdC1naXQtYnJpZWYtZml4LWF1dGgtNWIxMjc1LXJhbmRhbGwtc3RpbGx3ZWxscy1wcm9qZWN0cy52ZXJjZWwuYXBwIiwibmV4dENvbW1pdFN0YXR1cyI6IkRFUExPWUVEIn1dLCJyZXF1ZXN0UmV2aWV3VXJsIjoiaHR0cHM6Ly92ZXJjZWwuY29tL3ZlcmNlbC1hZ2VudC9yZXF1ZXN0LXJldmlldz9vd25lcj12YXJ1dGFzdSZyZXBvPXRjZy12YXVsdCZwcj0xMSJ9 The latest updates on your projects. Learn more about [Vercel for GitHub](https://vercel.link/github-learn-more). | Project | Deployment | Actions | Updated (UTC) | | :--- | :----- | :------ | :------ | | [tcg-vault](https://vercel.com/randall-stillwells-projects/tcg-vault) | ![Ready](https://vercel.com/static/status/ready.svg) [Ready](https://vercel.com/randall-stillwells-projects/tcg-vault/HwpnEVg6pFVbG8PovGLg1Hj7FZKH) | [Preview](https://tcg-vault-git-brief-fix-auth-5b1275-randall-stillwells-projects.vercel.app), [Comment](https://vercel.live/open-feedback/tcg-vault-git-brief-fix-auth-5b1275-randall-stillwells-projects.vercel.app?via=pr-comment-feedback-link) | May 23, 2026 4:07pm | <a href="https://vercel.com/vercel-agent/request-review?owner=varutasu&repo=tcg-vault&pr=11" rel="noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://agents-vade-review.vercel.sh/request-review-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://agents-vade-review.vercel.sh/request-review-light.svg"><img src="https://agents-vade-review.vercel.sh/request-review-light.svg" alt="Request Review"></picture></a>

github-actions[bot] commented

2026-05-23 12:07:33 -04:00

(Migrated from github.com)

Pipeline Health

Build + CI gates

Gate	Status
Vercel build (Preview)	✅ pass
CI: Lint	✅ pass
CI: Schema map fresh	❌ skipped
Preview smoke	❌ skipped
Visual diff	⏭ skipped or pending

Build runs on Vercel; this CI runs lint and schema-map drift only (no duplicate build).

Role reports

Role	Status
Reviewer report	⏳ pending
A11y audit	⏳ pending
Design system audit	⏳ pending

See individual comments above for details. This rollup updates automatically.

## Pipeline Health ### Build + CI gates | Gate | Status | | --- | --- | | Vercel build (Preview) | ✅ pass | | CI: Lint | ✅ pass | | CI: Schema map fresh | ❌ skipped | | Preview smoke | ❌ skipped | | Visual diff | ⏭ skipped or pending | _Build runs on Vercel; this CI runs lint and schema-map drift only (no duplicate build)._ ### Role reports | Role | Status | | --- | --- | | Reviewer report | ⏳ pending | | A11y audit | ⏳ pending | | Design system audit | ⏳ pending | See individual comments above for details. This rollup updates automatically.