feat(tests): add unit and integration test suite (node:test)

Adds 215 tests across three tiers using node:test + node:assert/strict
(no new test framework dependencies):

- test/tools/ — middleware and utility tests (token, hash, authenticate,
  jsonBody, convertError, validators)
- test/shared/ — DbInterface/BackendDbInterface contract suites reusable
  across backends (users, abodes, residents, apikeys, sessions, auth)
- test/backends/sqlite/ — SQLite-private tests (sql builder, WrappedDb,
  migrator) + shared suites via SqliteInterface
- test/backends/api/ — ApiInterface unit tests + shared suites via a
  live Koa server backed by SQLite

Also fixes four bugs uncovered by the tests:
- ApiInterface: path params leaked into query string (slice(1) fix)
- ApiInterface: calling res.json() on 204 No Content responses
- SqliteInterface.updateResident: missing comma in SET clause
- WrappedBetterSqlite3Db: readonly:undefined rejected by better-sqlite3

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
2026-06-30 11:33:32 +00:00
co-authored by Claude
parent 3b9a6bc85c
commit da4e597f73
24 changed files with 2212 additions and 3 deletions
+109
View File
@@ -0,0 +1,109 @@
import { describe, it, before, after } from "node:test";
import assert from "node:assert/strict";
import type { DbInterface } from "../../src/db/types/DbInterface.js";
import { NotFoundAbodeError, InvalidAbodeError } from "../../src/db/types/errors.js";
import { hashPassword } from "../../src/util/hash.js";
export function runAbodeTests(
name: string,
getDb: () => Promise<{ db: DbInterface; close(): void }>
): void {
describe(`${name}: abodes`, async () => {
let db: DbInterface;
let close: () => void;
let ctxUid: string;
before(async () => {
({ db, close } = await getDb());
const pw = await hashPassword("abode-ctx");
const user = await db.createUser({
email: `abode-ctx-${Date.now()}@test.example`,
name: "Abode Ctx User",
password: pw,
flags: {},
});
ctxUid = user.uid;
});
after(() => close());
it("createAbode returns an Abode with expected fields", async () => {
const abode = await db.createAbode({ name: "Test Abode" }, { uid: ctxUid });
assert.ok(abode.aid, "has aid");
assert.equal(abode.name, "Test Abode");
assert.ok(abode.created_at);
assert.ok(abode.updated_at);
});
it("getAbodeById returns the created abode", async () => {
const created = await db.createAbode({ name: "ById Abode" }, { uid: ctxUid });
const found = await db.getAbodeById(created.aid);
assert.equal(found.aid, created.aid);
assert.equal(found.name, "ById Abode");
});
it("getAbodeById throws NotFoundAbodeError for unknown aid", async () => {
await assert.rejects(
() => db.getAbodeById("00000000-0000-0000-0000-000000000000"),
(err) => {
assert.ok(err instanceof NotFoundAbodeError);
return true;
}
);
});
it("listAbodes includes the created abode", async () => {
const created = await db.createAbode(
{ name: `Listed Abode ${Date.now()}` },
{ uid: ctxUid }
);
const abodes = await db.listAbodes();
assert.ok(Array.isArray(abodes));
const found = abodes.find((a) => a.aid === created.aid);
assert.ok(found, "created abode appears in listAbodes");
});
it("updateAbode updates the name", async () => {
const created = await db.createAbode({ name: "Before" }, { uid: ctxUid });
const updated = await db.updateAbode(
{ aid: created.aid, name: "After" },
{ uid: ctxUid }
);
assert.equal(updated.aid, created.aid);
assert.equal(updated.name, "After");
});
it("updateAbode with no fields throws InvalidAbodeError", async () => {
const created = await db.createAbode({ name: "No Update" }, { uid: ctxUid });
await assert.rejects(
() => db.updateAbode({ aid: created.aid }, { uid: ctxUid }),
(err) => {
assert.ok(err instanceof InvalidAbodeError);
return true;
}
);
});
it("deleteAbodeById removes the abode", async () => {
const created = await db.createAbode({ name: "To Delete" }, { uid: ctxUid });
await db.deleteAbodeById(created.aid);
await assert.rejects(
() => db.getAbodeById(created.aid),
(err) => {
assert.ok(err instanceof NotFoundAbodeError);
return true;
}
);
});
it("deleteAbodeById throws NotFoundAbodeError for unknown aid", async () => {
await assert.rejects(
() => db.deleteAbodeById("00000000-0000-0000-0000-000000000000"),
(err) => {
assert.ok(err instanceof NotFoundAbodeError);
return true;
}
);
});
});
}
+102
View File
@@ -0,0 +1,102 @@
import { describe, it, before, after } from "node:test";
import assert from "node:assert/strict";
import type { DbInterface } from "../../src/db/types/DbInterface.js";
import { NotFoundAbodeError } from "../../src/db/types/errors.js";
import { hashPassword } from "../../src/util/hash.js";
export function runApikeyTests(
name: string,
getDb: () => Promise<{ db: DbInterface; close(): void }>
): void {
describe(`${name}: apikeys`, async () => {
let db: DbInterface;
let close: () => void;
let uid: string;
before(async () => {
({ db, close } = await getDb());
const pw = await hashPassword("apikey-password");
const user = await db.createUser({
email: `apikey-user-${Date.now()}@test.example`,
name: "Apikey User",
password: pw,
flags: {},
});
uid = user.uid;
});
after(() => close());
it("createApikey returns [ClientApikey, at_token]", async () => {
const [apikey, token] = await db.createApikey({
uid,
name: "Test Key",
permissions: {},
});
assert.ok(apikey.kid, "has kid");
assert.equal(apikey.uid, uid);
assert.equal(apikey.name, "Test Key");
assert.ok(!("token" in apikey), "ClientApikey has no token field");
assert.ok(token.startsWith("at_"), `token starts with at_: ${token}`);
});
it("listApikeysByUser returns created key", async () => {
const [created] = await db.createApikey({
uid,
name: "List Key",
permissions: {},
});
const keys = await db.listApikeysByUser(uid);
assert.ok(Array.isArray(keys));
const found = keys.find((k) => k.kid === created.kid);
assert.ok(found, "created key appears in listApikeysByUser");
});
it("getApikeyById returns the key", async () => {
const [created] = await db.createApikey({
uid,
name: "GetById Key",
permissions: {},
});
const found = await db.getApikeyById(created.kid);
assert.equal(found.kid, created.kid);
assert.equal(found.name, "GetById Key");
});
it("getApikeyById throws NotFoundAbodeError for unknown kid", async () => {
await assert.rejects(
() => db.getApikeyById("00000000-0000-0000-0000-000000000000"),
(err) => {
assert.ok(err instanceof NotFoundAbodeError);
return true;
}
);
});
it("deleteApikeyById removes the key", async () => {
const [created] = await db.createApikey({
uid,
name: "Delete Key",
permissions: {},
});
await db.deleteApikeyById(created.kid);
await assert.rejects(
() => db.getApikeyById(created.kid),
(err) => {
assert.ok(err instanceof NotFoundAbodeError);
return true;
}
);
});
it("deleteApikeyById throws NotFoundAbodeError for unknown kid", async () => {
await assert.rejects(
() => db.deleteApikeyById("00000000-0000-0000-0000-000000000000"),
(err) => {
assert.ok(err instanceof NotFoundAbodeError);
return true;
}
);
});
});
}
+136
View File
@@ -0,0 +1,136 @@
import { describe, it, before, after } from "node:test";
import assert from "node:assert/strict";
import type { BackendDbInterface } from "../../src/db/types/DbInterface.js";
import {
NotFoundAbodeError,
NotAuthorizedAbodeError,
ConflictAbodeError,
} from "../../src/db/types/errors.js";
import { hashPassword } from "../../src/util/hash.js";
export function runAuthTests(
name: string,
getDb: () => Promise<{ db: BackendDbInterface; close(): void }>,
createExpiredApikey?: (db: BackendDbInterface, uid: string) => Promise<`at_${string}`>
): void {
describe(`${name}: auth`, async () => {
let db: BackendDbInterface;
let close: () => void;
let email: string;
const password = "auth-test-password";
before(async () => {
({ db, close } = await getDb());
email = `auth-user-${Date.now()}@test.example`;
const pw = await hashPassword(password);
await db.createUser({ email, name: "Auth User", password: pw, flags: {} });
});
after(() => close());
it("getUserByLogin returns user on correct credentials", async () => {
const user = await db.getUserByLogin({ email, password });
assert.equal(user.email, email);
assert.ok(!("password" in user));
});
it("getUserByLogin throws NotAuthorizedAbodeError for wrong password", async () => {
await assert.rejects(
() => db.getUserByLogin({ email, password: "wrong-password" }),
(err) => {
assert.ok(err instanceof NotAuthorizedAbodeError);
return true;
}
);
});
it("getUserByLogin throws NotFoundAbodeError for unknown email", async () => {
await assert.rejects(
() =>
db.getUserByLogin({
email: "nobody@nowhere.example",
password: "any",
}),
(err) => {
assert.ok(err instanceof NotFoundAbodeError);
return true;
}
);
});
it("getUserByLogin throws ConflictAbodeError for #unset password", async () => {
const unsetEmail = `unset-${Date.now()}@test.example`;
await db.createUser({
email: unsetEmail,
name: "Unset User",
password: "#unset",
flags: {},
});
await assert.rejects(
() => db.getUserByLogin({ email: unsetEmail, password: "any" }),
(err) => {
assert.ok(err instanceof ConflictAbodeError);
return true;
}
);
});
});
describe(`${name}: auth apikey`, async () => {
let db: BackendDbInterface;
let close: () => void;
let uid: string;
before(async () => {
({ db, close } = await getDb());
const pw = await hashPassword("apikey-auth-password");
const user = await db.createUser({
email: `apikey-auth-${Date.now()}@test.example`,
name: "Apikey Auth User",
password: pw,
flags: {},
});
uid = user.uid;
});
after(() => close());
it("getUserByApikey returns [user, apikey] for valid token", async () => {
const [, token] = await db.createApikey({
uid,
name: "Auth Key",
permissions: {},
});
const [user, apikey] = await db.getUserByApikey(token);
assert.equal(user.uid, uid);
assert.ok(apikey.kid);
assert.equal(apikey.uid, uid);
});
it("getUserByApikey throws NotAuthorizedAbodeError for expired key", async (t) => {
if (!createExpiredApikey) {
t.skip("createExpiredApikey helper not provided for this backend");
return;
}
const token = await createExpiredApikey(db, uid);
await assert.rejects(
() => db.getUserByApikey(token),
(err) => {
assert.ok(err instanceof NotAuthorizedAbodeError);
return true;
}
);
});
it("getUserByApikey throws NotFoundAbodeError for unknown token", async () => {
const fakeToken = `at_${"0".repeat(32)}` as `at_${string}`;
await assert.rejects(
() => db.getUserByApikey(fakeToken),
(err) => {
assert.ok(err instanceof NotFoundAbodeError);
return true;
}
);
});
});
}
+154
View File
@@ -0,0 +1,154 @@
import { describe, it, before, after } from "node:test";
import assert from "node:assert/strict";
import type { DbInterface } from "../../src/db/types/DbInterface.js";
import { NotFoundAbodeError, InvalidAbodeError } from "../../src/db/types/errors.js";
import { hashPassword } from "../../src/util/hash.js";
export function runResidentTests(
name: string,
getDb: () => Promise<{ db: DbInterface; close(): void }>
): void {
describe(`${name}: residents`, async () => {
let db: DbInterface;
let close: () => void;
let uid: string;
let aid: string;
let ctxUid: string;
before(async () => {
({ db, close } = await getDb());
const pw = await hashPassword("resident-pw");
// ctx user (creator of abode)
const ctx = await db.createUser({
email: `res-ctx-${Date.now()}@test.example`,
name: "Resident Ctx",
password: pw,
flags: {},
});
ctxUid = ctx.uid;
// the resident user
const resUser = await db.createUser({
email: `resident-${Date.now()}@test.example`,
name: "Resident User",
password: pw,
flags: {},
});
uid = resUser.uid;
const abode = await db.createAbode(
{ name: `Resident Abode ${Date.now()}` },
{ uid: ctxUid }
);
aid = abode.aid;
await db.createResident({ uid, aid, flags: {} }, { uid: ctxUid });
});
after(() => close());
it("getResidentById returns the created resident", async () => {
const found = await db.getResidentById(uid, aid);
assert.equal(found.uid, uid);
assert.equal(found.aid, aid);
assert.ok(found.created_at);
});
it("getResidentById throws NotFoundAbodeError for unknown pair", async () => {
await assert.rejects(
() =>
db.getResidentById(
"00000000-0000-0000-0000-000000000000",
"00000000-0000-0000-0000-000000000001"
),
(err) => {
assert.ok(err instanceof NotFoundAbodeError);
return true;
}
);
});
it("listResidents includes the created resident", async () => {
const residents = await db.listResidents();
assert.ok(Array.isArray(residents));
const found = residents.find((r) => r.uid === uid && r.aid === aid);
assert.ok(found, "created resident appears in listResidents");
});
it("listResidentsByUserId filters by uid", async () => {
const results = await db.listResidentsByUserId(uid);
assert.ok(results.every((r) => r.uid === uid));
assert.ok(results.some((r) => r.aid === aid));
});
it("listResidentsByAbodeId filters by aid", async () => {
const results = await db.listResidentsByAbodeId(aid);
assert.ok(results.every((r) => r.aid === aid));
assert.ok(results.some((r) => r.uid === uid));
});
it("listUsersByAbodeId returns users in the abode", async () => {
const users = await db.listUsersByAbodeId(aid);
assert.ok(Array.isArray(users));
const found = users.find((u) => u.uid === uid);
assert.ok(found, "resident user appears in listUsersByAbodeId");
});
it("listAbodesByUserId returns abodes for user", async () => {
const abodes = await db.listAbodesByUserId(uid);
assert.ok(Array.isArray(abodes));
const found = abodes.find((a) => a.aid === aid);
assert.ok(found, "abode appears in listAbodesByUserId");
});
it("updateResident updates flags", async () => {
const updated = await db.updateResident(
{ uid, aid, flags: { admin: true } },
{ uid: ctxUid }
);
assert.equal(updated.uid, uid);
assert.deepEqual(updated.flags, { admin: true });
});
it("updateResident with no fields throws InvalidAbodeError", async () => {
await assert.rejects(
() => db.updateResident({ uid, aid }, { uid: ctxUid }),
(err) => {
assert.ok(err instanceof InvalidAbodeError);
return true;
}
);
});
it("deleteResidentById removes the resident then throws on re-fetch", async () => {
const pw = await hashPassword("del-res-pw");
const user2 = await db.createUser({
email: `del-res-${Date.now()}@test.example`,
name: "Del Res User",
password: pw,
flags: {},
});
const abode2 = await db.createAbode({ name: "Del Abode" }, { uid: ctxUid });
await db.createResident({ uid: user2.uid, aid: abode2.aid, flags: {} }, { uid: ctxUid });
await db.deleteResidentById(user2.uid, abode2.aid);
await assert.rejects(
() => db.getResidentById(user2.uid, abode2.aid),
(err) => {
assert.ok(err instanceof NotFoundAbodeError);
return true;
}
);
});
it("deleteResidentById throws NotFoundAbodeError for unknown pair", async () => {
await assert.rejects(
() =>
db.deleteResidentById(
"00000000-0000-0000-0000-000000000002",
"00000000-0000-0000-0000-000000000003"
),
(err) => {
assert.ok(err instanceof NotFoundAbodeError);
return true;
}
);
});
});
}
+65
View File
@@ -0,0 +1,65 @@
import { describe, it, before, after } from "node:test";
import assert from "node:assert/strict";
import type { BackendDbInterface } from "../../src/db/types/DbInterface.js";
import { NotFoundAbodeError } from "../../src/db/types/errors.js";
import { hashPassword } from "../../src/util/hash.js";
export function runSessionTests(
name: string,
getDb: () => Promise<{ db: BackendDbInterface; close(): void }>
): void {
describe(`${name}: sessions`, async () => {
let db: BackendDbInterface;
let close: () => void;
let uid: string;
before(async () => {
({ db, close } = await getDb());
const pw = await hashPassword("session-password");
const user = await db.createUser({
email: `session-user-${Date.now()}@test.example`,
name: "Session User",
password: pw,
flags: {},
});
uid = user.uid;
});
after(() => close());
it("createSession returns an as_ token", async () => {
const token = await db.createSession(uid);
assert.ok(token.startsWith("as_"), `token starts with as_: ${token}`);
assert.equal(token.length, 35, "as_ + 32 hex chars");
});
it("getUserBySession returns the correct user", async () => {
const token = await db.createSession(uid);
const user = await db.getUserBySession(token);
assert.equal(user.uid, uid);
});
it("getUserBySession throws NotFoundAbodeError for unknown token", async () => {
const fakeToken = `as_${"0".repeat(32)}` as `as_${string}`;
await assert.rejects(
() => db.getUserBySession(fakeToken),
(err) => {
assert.ok(err instanceof NotFoundAbodeError);
return true;
}
);
});
it("deleteSessionsByUser invalidates all sessions for user", async () => {
const token = await db.createSession(uid);
await db.deleteSessionsByUser(uid);
await assert.rejects(
() => db.getUserBySession(token),
(err) => {
assert.ok(err instanceof NotFoundAbodeError);
return true;
}
);
});
});
}
+179
View File
@@ -0,0 +1,179 @@
import { describe, it, before, after } from "node:test";
import assert from "node:assert/strict";
import type { DbInterface } from "../../src/db/types/DbInterface.js";
import {
NotFoundAbodeError,
InvalidAbodeError,
ReadonlyAbodeError,
} from "../../src/db/types/errors.js";
import { hashPassword } from "../../src/util/hash.js";
export function runUserTests(
name: string,
getDb: () => Promise<{ db: DbInterface; close(): void }>
): void {
describe(`${name}: users`, async () => {
let db: DbInterface;
let close: () => void;
let hashedPw: string;
before(async () => {
({ db, close } = await getDb());
hashedPw = await hashPassword("test-password");
});
after(() => close());
it("createUser returns a ClientUser without password", async () => {
const user = await db.createUser({
email: `user-create-${Date.now()}@test.example`,
name: "Test User",
password: hashedPw,
flags: {},
});
assert.ok(user.uid, "has uid");
assert.equal(user.name, "Test User");
assert.ok(!("password" in user), "no password field");
assert.ok(user.created_at);
assert.ok(user.updated_at);
});
it("getUserById returns the created user", async () => {
const created = await db.createUser({
email: `user-byid-${Date.now()}@test.example`,
name: "ById User",
password: hashedPw,
flags: {},
});
const found = await db.getUserById(created.uid);
assert.equal(found.uid, created.uid);
assert.equal(found.name, "ById User");
});
it("getUserById throws NotFoundAbodeError for unknown uid", async () => {
await assert.rejects(
() => db.getUserById("00000000-0000-0000-0000-000000000000"),
(err) => {
assert.ok(err instanceof NotFoundAbodeError);
return true;
}
);
});
it("getUserByEmail returns the created user", async () => {
const email = `user-byemail-${Date.now()}@test.example`;
await db.createUser({ email, name: "ByEmail User", password: hashedPw, flags: {} });
const found = await db.getUserByEmail(email);
assert.equal(found.email, email);
});
it("getUserByEmail throws NotFoundAbodeError for unknown email", async () => {
await assert.rejects(
() => db.getUserByEmail("nobody@nowhere.example"),
(err) => {
assert.ok(err instanceof NotFoundAbodeError);
return true;
}
);
});
it("listUsers includes the created user", async () => {
const email = `user-list-${Date.now()}@test.example`;
const created = await db.createUser({
email,
name: "Listed User",
password: hashedPw,
flags: {},
});
const users = await db.listUsers();
assert.ok(Array.isArray(users));
const found = users.find((u) => u.uid === created.uid);
assert.ok(found, "created user appears in listUsers");
});
it("updateUser updates the name", async () => {
const created = await db.createUser({
email: `user-update-${Date.now()}@test.example`,
name: "Before Update",
password: hashedPw,
flags: {},
});
const updated = await db.updateUser({ uid: created.uid, name: "After Update" });
assert.equal(updated.uid, created.uid);
assert.equal(updated.name, "After Update");
});
it("updateUser with no fields throws InvalidAbodeError", async () => {
const created = await db.createUser({
email: `user-noupdate-${Date.now()}@test.example`,
name: "No Update",
password: hashedPw,
flags: {},
});
await assert.rejects(
() => db.updateUser({ uid: created.uid }),
(err) => {
assert.ok(err instanceof InvalidAbodeError);
return true;
}
);
});
it("deleteUserById removes the user", async () => {
const created = await db.createUser({
email: `user-delete-${Date.now()}@test.example`,
name: "To Delete",
password: hashedPw,
flags: {},
});
await db.deleteUserById(created.uid);
await assert.rejects(
() => db.getUserById(created.uid),
(err) => {
assert.ok(err instanceof NotFoundAbodeError);
return true;
}
);
});
it("deleteUserById throws NotFoundAbodeError for unknown uid", async () => {
await assert.rejects(
() => db.deleteUserById("00000000-0000-0000-0000-000000000000"),
(err) => {
assert.ok(err instanceof NotFoundAbodeError);
return true;
}
);
});
});
describe(`${name}: users readonly`, async () => {
let db: DbInterface;
let close: () => void;
let hashedPw: string;
before(async () => {
({ db, close } = await getDb());
hashedPw = await hashPassword("test-password");
});
after(() => close());
it("createUser on readonly db throws ReadonlyAbodeError", async () => {
if (!db.readonly) return;
await assert.rejects(
() =>
db.createUser({
email: "readonly@test.example",
name: "Readonly",
password: hashedPw,
flags: {},
}),
(err) => {
assert.ok(err instanceof ReadonlyAbodeError);
return true;
}
);
});
});
}