5 Commits

Include renames

Author	SHA1	Message	Date
codingetandCodex	a1992eb57a	fix: restrict user email visibility ... Co-Authored-By: gpt-5.6-sol <noreply@openai.com>	2026-07-23 18:49:49 +00:00
codingetandCodex	31d4636dde	ci: add pull request quality gates ... Co-Authored-By: gpt-5.6-terra <noreply@openai.com>	2026-07-22 21:50:29 +00:00
codingetandClaude	73c4b169c5	fix(auth): invalidate session server-side on logout, not just the cookie ... /auth/logout previously only cleared the client's cookie, leaving the session token valid in the sessions table — a stolen cookie captured before logout would still work afterwards. Add BackendDbInterface#deleteSession (implemented in SqliteInterface) and call it from the logout route using the session token from the cookie. Caught by the new auth-http.test.ts integration test, updated to assert the session is actually invalidated. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-02 01:43:50 +00:00
codingetandClaude	4d9a0cf228	fix(tests): address review gaps in test suite ... - Add tsconfig.test.json + typecheck:test script so test/ is type-checked; fixes real type errors it surfaced (hashedPw typing, PartialUser|ClientUser narrowing for .email). - Add HTTP-level auth-http.test.ts for the api backend covering login/session-cookie/logout/clear-sessions/bearer-apikey flows, since ApiInterface doesn't implement the session/login methods needed to run the shared session/auth suites directly. - Make the readonly-db test in shared/users.ts actually construct a readonly db instance (previously a no-op that never ran) via a new getReadonlyDb parameter, wired up for both sqlite and api backends. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-02 01:38:21 +00:00
codingetandClaude	da4e597f73	feat(tests): add unit and integration test suite (node:test) ... Adds 215 tests across three tiers using node:test + node:assert/strict (no new test framework dependencies): - test/tools/ — middleware and utility tests (token, hash, authenticate, jsonBody, convertError, validators) - test/shared/ — DbInterface/BackendDbInterface contract suites reusable across backends (users, abodes, residents, apikeys, sessions, auth) - test/backends/sqlite/ — SQLite-private tests (sql builder, WrappedDb, migrator) + shared suites via SqliteInterface - test/backends/api/ — ApiInterface unit tests + shared suites via a live Koa server backed by SQLite Also fixes four bugs uncovered by the tests: - ApiInterface: path params leaked into query string (slice(1) fix) - ApiInterface: calling res.json() on 204 No Content responses - SqliteInterface.updateResident: missing comma in SET clause - WrappedBetterSqlite3Db: readonly:undefined rejected by better-sqlite3 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-30 11:33:32 +00:00