1629afbb76
Closes AGENTS.md gotcha #11 (well, the relevant half of it — "Testing: None yet" line in §6 is now stale). Installs vitest@^3.2.4 (single devDep, no UI / coverage / jsdom) and adds 16 unit tests across 3 files that lock in post-Brief-1/2/4 behavior: test/lib/auth-secret.test.js (3 tests) - JWT_SECRET exports the env value - JWT_TOKEN_TTL is canonical 24h - Module throws at load when JWT_SECRET is empty test/lib/permission-middleware.test.js (8 tests) - getUserFromRequest returns null for: missing header, non-Bearer scheme, malformed token, wrong-secret token, expired token, valid-token-no-user-row - Returns user object for valid token + user row - Brief 2 regression lock: does NOT return the synthetic admin shape { userId: 1, email: 'admin@tcgvault.com', role: 'admin' } when no Authorization header is present test/api/auth-utils.test.js (5 tests) - generateToken issues 24h JWT (exp - iat === 86400) - Payload includes userId, email, role - verifyToken round-trips valid tokens - Returns null for malformed / wrong-secret tokens CI: re-enabled the previously commented-out test: job in .github/workflows/ci.yml. Blocking (no || true wrapper) — vitest is the first runner in this repo and we want CI red on test regression. JWT_SECRET is set via a CI-only fake; production secret is unaffected. Rate-limit (Brief 4) coverage deferred to a future expand-auth-tests convoy per architect's call (R11). package.json has "type": "module" so vitest's default Vite-based transform handles .js ESM out of the box — no transform config needed. Convoy: fix-auth-bypass / Brief 5 (last brief) Co-authored-by: Cursor <cursoragent@cursor.com>
41 lines
1 KiB
JSON
41 lines
1 KiB
JSON
{
|
|
"name": "tcg-vault",
|
|
"version": "0.1.0",
|
|
"private": true,
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "next dev",
|
|
"build": "next build",
|
|
"start": "next start",
|
|
"lint": "eslint .",
|
|
"setup-db": "node scripts/setup-neon-db.js",
|
|
"import-popular": "node scripts/import-popular-sets.js",
|
|
"import-all": "node scripts/bulk-import-all.js",
|
|
"test": "vitest",
|
|
"test:run": "vitest run"
|
|
},
|
|
"dependencies": {
|
|
"@neondatabase/serverless": "^1.0.1",
|
|
"@upstash/ratelimit": "^2.0.8",
|
|
"@upstash/redis": "^1.38.0",
|
|
"@vercel/blob": "^1.1.1",
|
|
"@vercel/postgres": "^0.10.0",
|
|
"bcryptjs": "^3.0.2",
|
|
"dotenv": "^17.2.1",
|
|
"jsonwebtoken": "^9.0.2",
|
|
"next": "^16.2.6",
|
|
"node-fetch": "^3.3.2",
|
|
"react": "^18.3.1",
|
|
"react-dom": "^18.3.1",
|
|
"resend": "^4.7.0"
|
|
},
|
|
"devDependencies": {
|
|
"autoprefixer": "^10.4.21",
|
|
"eslint": "^9.39.4",
|
|
"eslint-config-next": "^16.2.6",
|
|
"postcss": "^8.5.6",
|
|
"tailwindcss": "^3.4.17",
|
|
"typescript": "^5.9.3",
|
|
"vitest": "^3.2.4"
|
|
}
|
|
}
|