commit 8caa2a98034d8629218454939ae0b18a7d8b76a5 · dunkirk.sh/thistle

+2 -1

src/db/schema.ts

···

       1
        
       import { Database } from "bun:sqlite";

     

       2
        
       

     

       3
        
       // Use test database when NODE_ENV is test

     

       4
       -
       const dbPath = process.env.NODE_ENV === "test" ? "thistle.test.db" : "thistle.db";

     

       0
        
       
     

       5
        
       export const db = new Database(dbPath);

     

       6
        
       

     

       7
        
       console.log(`[Database] Using database: ${dbPath}`);

···

       1
        
       import { Database } from "bun:sqlite";

     

       2
        
       

     

       3
        
       // Use test database when NODE_ENV is test

     

       4
       +
       const dbPath =

     

       5
       +
       	process.env.NODE_ENV === "test" ? "thistle.test.db" : "thistle.db";

     

       6
        
       export const db = new Database(dbPath);

     

       7
        
       

     

       8
        
       console.log(`[Database] Using database: ${dbPath}`);

+72 -66

src/index.test.ts

···

       6
        
       	expect,

     

       7
        
       	test,

     

       8
        
       } from "bun:test";

     

       9
       -
       import { hashPasswordClient } from "./lib/client-auth";

     

       10
        
       import type { Subprocess } from "bun";

     

       0
        
       
     

       11
        
       

     

       12
        
       // Test server configuration

     

       13
        
       const TEST_PORT = 3001;

     
···

       54
        
       	const stdoutReader = serverProcess.stdout.getReader();

     

       55
        
       	const stderrReader = serverProcess.stderr.getReader();

     

       56
        
       	const decoder = new TextDecoder();

     

       57
       -
       	

     

       58
        
       	(async () => {

     

       59
        
       		try {

     

       60
        
       			while (true) {

     
···

       65
        
       			}

     

       66
        
       		} catch {}

     

       67
        
       	})();

     

       68
       -
       	

     

       69
        
       	(async () => {

     

       70
        
       		try {

     

       71
        
       			while (true) {

     
···

       123
        
       // Clear database between each test

     

       124
        
       beforeEach(async () => {

     

       125
        
       	const db = require("bun:sqlite").Database.open(TEST_DB_PATH);

     

       126
       -
       	

     

       127
        
       	// Delete all data from tables (preserve schema)

     

       128
        
       	db.run("DELETE FROM rate_limit_attempts");

     

       129
        
       	db.run("DELETE FROM email_change_tokens");

     
···

       138
        
       	db.run("DELETE FROM classes");

     

       139
        
       	db.run("DELETE FROM class_waitlist");

     

       140
        
       	db.run("DELETE FROM users WHERE id != 0"); // Keep ghost user

     

       141
       -
       	

     

       142
        
       	db.close();

     

       143
        
       });

     

       144
        
       

     
···

       194
        
       }

     

       195
        
       

     

       196
        
       // Helper to register a user, verify email, and get session via login

     

       197
       -
       async function registerAndLogin(user: { email: string; password: string; name?: string }): Promise<string> {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       198
        
       	const hashedPassword = await clientHashPassword(user.email, user.password);

     

       199
        
       

     

       200
        
       	// Register the user

     
···

       242
        
       // Helper to add active subscription to a user

     

       243
        
       function addSubscription(userEmail: string): void {

     

       244
        
       	const db = require("bun:sqlite").Database.open(TEST_DB_PATH);

     

       245
       -
       	const user = db.query("SELECT id FROM users WHERE email = ?").get(userEmail) as { id: number };

     

       0
        
       
     

       0
        
       
     

       246
        
       	if (!user) {

     

       247
        
       		db.close();

     

       248
        
       		throw new Error(`User ${userEmail} not found`);

     

       249
        
       	}

     

       250
       -
       	

     

       251
        
       	db.run(

     

       252
        
       		"INSERT INTO subscriptions (id, user_id, customer_id, status) VALUES (?, ?, ?, ?)",

     

       253
       -
       		[`test-sub-${user.id}`, user.id, `test-customer-${user.id}`, "active"]

     

       254
        
       	);

     

       255
        
       	db.close();

     

       256
        
       }

     
···

       281
        
       			}

     

       282
        
       

     

       283
        
       			expect(response.status).toBe(201);

     

       284
       -
       			

     

       285
        
       			const data = await response.json();

     

       286
        
       			expect(data.user).toBeDefined();

     

       287
        
       			expect(data.user.email).toBe(TEST_USER.email);

     
···

       302
        
       			expect(data.error).toBe("Email and password required");

     

       303
        
       		});

     

       304
        
       

     

       305
       -
       		test(

     

       306
       -
       			"should reject registration with invalid password format",

     

       307
       -
       			async () => {

     

       308
       -
       				const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       309
       -
       					method: "POST",

     

       310
       -
       					headers: { "Content-Type": "application/json" },

     

       311
       -
       					body: JSON.stringify({

     

       312
       -
       						email: TEST_USER.email,

     

       313
       -
       						password: "short",

     

       314
       -
       					}),

     

       315
       -
       				});

     

       316
        
       

     

       317
       -
       				expect(response.status).toBe(400);

     

       318
       -
       				const data = await response.json();

     

       319
       -
       				expect(data.error).toBe("Invalid password format");

     

       320
       -
       			},

     

       321
       -
       		);

     

       322
        
       

     

       323
        
       		test("should reject duplicate email registration", async () => {

     

       324
        
       			const hashedPassword = await clientHashPassword(

     
···

       473
        
       

     

       474
        
       			// Manually complete the email change in the database (simulating verification)

     

       475
        
       			const db = require("bun:sqlite").Database.open(TEST_DB_PATH);

     

       476
       -
       			const tokenData = db.query("SELECT user_id, new_email FROM email_change_tokens ORDER BY created_at DESC LIMIT 1").get() as { user_id: number, new_email: string };

     

       477
       -
       			db.run("UPDATE users SET email = ?, email_verified = 1 WHERE id = ?", [tokenData.new_email, tokenData.user_id]);

     

       478
       -
       			db.run("DELETE FROM email_change_tokens WHERE user_id = ?", [tokenData.user_id]);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       479
        
       			db.close();

     

       480
        
       

     

       481
        
       			// Verify email updated

     
···

       646
        
       

     

       647
        
       describe("API Endpoints - Health", () => {

     

       648
        
       	describe("GET /api/health", () => {

     

       649
       -
       		test(

     

       650
       -
       			"should return service health status with details",

     

       651
       -
       			async () => {

     

       652
       -
       				const response = await fetch(`${BASE_URL}/api/health`);

     

       653
        
       

     

       654
       -
       				expect(response.status).toBe(200);

     

       655
       -
       				const data = await response.json();

     

       656
       -
       				expect(data).toHaveProperty("status");

     

       657
       -
       				expect(data).toHaveProperty("timestamp");

     

       658
       -
       				expect(data).toHaveProperty("services");

     

       659
       -
       				expect(data.services).toHaveProperty("database");

     

       660
       -
       				expect(data.services).toHaveProperty("whisper");

     

       661
       -
       				expect(data.services).toHaveProperty("storage");

     

       662
       -
       			},

     

       663
       -
       		);

     

       664
        
       	});

     

       665
        
       });

     

       666
        
       

     
···

       669
        
       		test("should return user transcriptions", async () => {

     

       670
        
       			// Register and login

     

       671
        
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       672
       -
       			

     

       673
        
       			// Add subscription

     

       674
        
       			addSubscription(TEST_USER.email);

     

       675
        
       

     
···

       696
        
       		test("should upload audio file and start transcription", async () => {

     

       697
        
       			// Register and login

     

       698
        
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       699
       -
       			

     

       700
        
       			// Add subscription

     

       701
        
       			addSubscription(TEST_USER.email);

     

       702
        
       

     
···

       725
        
       		test("should reject non-audio files", async () => {

     

       726
        
       			// Register and login

     

       727
        
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       728
       -
       			

     

       729
        
       			// Add subscription

     

       730
        
       			addSubscription(TEST_USER.email);

     

       731
        
       

     
···

       749
        
       		test("should reject files exceeding size limit", async () => {

     

       750
        
       			// Register and login

     

       751
        
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       752
       -
       			

     

       753
        
       			// Add subscription

     

       754
        
       			addSubscription(TEST_USER.email);

     

       755
        
       

     
···

       797
        
       	beforeEach(async () => {

     

       798
        
       		// Create admin user

     

       799
        
       		adminCookie = await registerAndLogin(TEST_ADMIN);

     

       800
       -
       		

     

       801
        
       		// Manually set admin role in database

     

       802
        
       		const db = require("bun:sqlite").Database.open(TEST_DB_PATH);

     

       803
        
       		db.run("UPDATE users SET role = 'admin' WHERE email = ?", [

     
···

       812
        
       			.query<{ id: number }, [string]>("SELECT id FROM users WHERE email = ?")

     

       813
        
       			.get(TEST_USER.email);

     

       814
        
       		userId = userIdResult?.id;

     

       815
       -
       		

     

       816
        
       		db.close();

     

       817
        
       	});

     

       818
        
       

     
···

       1095
        
       	});

     

       1096
        
       

     

       1097
        
       	describe("POST /api/passkeys/register/options", () => {

     

       1098
       -
       		test(

     

       1099
       -
       			"should return registration options for authenticated user",

     

       1100
       -
       			async () => {

     

       1101
       -
       				const response = await authRequest(

     

       1102
       -
       					`${BASE_URL}/api/passkeys/register/options`,

     

       1103
       -
       					sessionCookie,

     

       1104
       -
       					{

     

       1105
       -
       						method: "POST",

     

       1106
       -
       					},

     

       1107
       -
       				);

     

       1108
        
       

     

       1109
       -
       				expect(response.status).toBe(200);

     

       1110
       -
       				const data = await response.json();

     

       1111
       -
       				expect(data).toHaveProperty("challenge");

     

       1112
       -
       				expect(data).toHaveProperty("rp");

     

       1113
       -
       				expect(data).toHaveProperty("user");

     

       1114
       -
       			},

     

       1115
       -
       		);

     

       1116
        
       

     

       1117
        
       		test("should require authentication", async () => {

     

       1118
        
       			const response = await fetch(

···

       6
        
       	expect,

     

       7
        
       	test,

     

       8
        
       } from "bun:test";

     

       0
        
       
     

       9
        
       import type { Subprocess } from "bun";

     

       10
       +
       import { hashPasswordClient } from "./lib/client-auth";

     

       11
        
       

     

       12
        
       // Test server configuration

     

       13
        
       const TEST_PORT = 3001;

     
···

       54
        
       	const stdoutReader = serverProcess.stdout.getReader();

     

       55
        
       	const stderrReader = serverProcess.stderr.getReader();

     

       56
        
       	const decoder = new TextDecoder();

     

       57
       +
       

     

       58
        
       	(async () => {

     

       59
        
       		try {

     

       60
        
       			while (true) {

     
···

       65
        
       			}

     

       66
        
       		} catch {}

     

       67
        
       	})();

     

       68
       +
       

     

       69
        
       	(async () => {

     

       70
        
       		try {

     

       71
        
       			while (true) {

     
···

       123
        
       // Clear database between each test

     

       124
        
       beforeEach(async () => {

     

       125
        
       	const db = require("bun:sqlite").Database.open(TEST_DB_PATH);

     

       126
       +
       

     

       127
        
       	// Delete all data from tables (preserve schema)

     

       128
        
       	db.run("DELETE FROM rate_limit_attempts");

     

       129
        
       	db.run("DELETE FROM email_change_tokens");

     
···

       138
        
       	db.run("DELETE FROM classes");

     

       139
        
       	db.run("DELETE FROM class_waitlist");

     

       140
        
       	db.run("DELETE FROM users WHERE id != 0"); // Keep ghost user

     

       141
       +
       

     

       142
        
       	db.close();

     

       143
        
       });

     

       144
        
       

     
···

       194
        
       }

     

       195
        
       

     

       196
        
       // Helper to register a user, verify email, and get session via login

     

       197
       +
       async function registerAndLogin(user: {

     

       198
       +
       	email: string;

     

       199
       +
       	password: string;

     

       200
       +
       	name?: string;

     

       201
       +
       }): Promise<string> {

     

       202
        
       	const hashedPassword = await clientHashPassword(user.email, user.password);

     

       203
        
       

     

       204
        
       	// Register the user

     
···

       246
        
       // Helper to add active subscription to a user

     

       247
        
       function addSubscription(userEmail: string): void {

     

       248
        
       	const db = require("bun:sqlite").Database.open(TEST_DB_PATH);

     

       249
       +
       	const user = db

     

       250
       +
       		.query("SELECT id FROM users WHERE email = ?")

     

       251
       +
       		.get(userEmail) as { id: number };

     

       252
        
       	if (!user) {

     

       253
        
       		db.close();

     

       254
        
       		throw new Error(`User ${userEmail} not found`);

     

       255
        
       	}

     

       256
       +
       

     

       257
        
       	db.run(

     

       258
        
       		"INSERT INTO subscriptions (id, user_id, customer_id, status) VALUES (?, ?, ?, ?)",

     

       259
       +
       		[`test-sub-${user.id}`, user.id, `test-customer-${user.id}`, "active"],

     

       260
        
       	);

     

       261
        
       	db.close();

     

       262
        
       }

     
···

       287
        
       			}

     

       288
        
       

     

       289
        
       			expect(response.status).toBe(201);

     

       290
       +
       

     

       291
        
       			const data = await response.json();

     

       292
        
       			expect(data.user).toBeDefined();

     

       293
        
       			expect(data.user.email).toBe(TEST_USER.email);

     
···

       308
        
       			expect(data.error).toBe("Email and password required");

     

       309
        
       		});

     

       310
        
       

     

       311
       +
       		test("should reject registration with invalid password format", async () => {

     

       312
       +
       			const response = await fetch(`${BASE_URL}/api/auth/register`, {

     

       313
       +
       				method: "POST",

     

       314
       +
       				headers: { "Content-Type": "application/json" },

     

       315
       +
       				body: JSON.stringify({

     

       316
       +
       					email: TEST_USER.email,

     

       317
       +
       					password: "short",

     

       318
       +
       				}),

     

       319
       +
       			});

     

       0
        
       
     

       0
        
       
     

       320
        
       

     

       321
       +
       			expect(response.status).toBe(400);

     

       322
       +
       			const data = await response.json();

     

       323
       +
       			expect(data.error).toBe("Invalid password format");

     

       324
       +
       		});

     

       0
        
       
     

       325
        
       

     

       326
        
       		test("should reject duplicate email registration", async () => {

     

       327
        
       			const hashedPassword = await clientHashPassword(

     
···

       476
        
       

     

       477
        
       			// Manually complete the email change in the database (simulating verification)

     

       478
        
       			const db = require("bun:sqlite").Database.open(TEST_DB_PATH);

     

       479
       +
       			const tokenData = db

     

       480
       +
       				.query(

     

       481
       +
       					"SELECT user_id, new_email FROM email_change_tokens ORDER BY created_at DESC LIMIT 1",

     

       482
       +
       				)

     

       483
       +
       				.get() as { user_id: number; new_email: string };

     

       484
       +
       			db.run("UPDATE users SET email = ?, email_verified = 1 WHERE id = ?", [

     

       485
       +
       				tokenData.new_email,

     

       486
       +
       				tokenData.user_id,

     

       487
       +
       			]);

     

       488
       +
       			db.run("DELETE FROM email_change_tokens WHERE user_id = ?", [

     

       489
       +
       				tokenData.user_id,

     

       490
       +
       			]);

     

       491
        
       			db.close();

     

       492
        
       

     

       493
        
       			// Verify email updated

     
···

       658
        
       

     

       659
        
       describe("API Endpoints - Health", () => {

     

       660
        
       	describe("GET /api/health", () => {

     

       661
       +
       		test("should return service health status with details", async () => {

     

       662
       +
       			const response = await fetch(`${BASE_URL}/api/health`);

     

       0
        
       
     

       0
        
       
     

       663
        
       

     

       664
       +
       			expect(response.status).toBe(200);

     

       665
       +
       			const data = await response.json();

     

       666
       +
       			expect(data).toHaveProperty("status");

     

       667
       +
       			expect(data).toHaveProperty("timestamp");

     

       668
       +
       			expect(data).toHaveProperty("services");

     

       669
       +
       			expect(data.services).toHaveProperty("database");

     

       670
       +
       			expect(data.services).toHaveProperty("whisper");

     

       671
       +
       			expect(data.services).toHaveProperty("storage");

     

       672
       +
       		});

     

       0
        
       
     

       673
        
       	});

     

       674
        
       });

     

       675
        
       

     
···

       678
        
       		test("should return user transcriptions", async () => {

     

       679
        
       			// Register and login

     

       680
        
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       681
       +
       

     

       682
        
       			// Add subscription

     

       683
        
       			addSubscription(TEST_USER.email);

     

       684
        
       

     
···

       705
        
       		test("should upload audio file and start transcription", async () => {

     

       706
        
       			// Register and login

     

       707
        
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       708
       +
       

     

       709
        
       			// Add subscription

     

       710
        
       			addSubscription(TEST_USER.email);

     

       711
        
       

     
···

       734
        
       		test("should reject non-audio files", async () => {

     

       735
        
       			// Register and login

     

       736
        
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       737
       +
       

     

       738
        
       			// Add subscription

     

       739
        
       			addSubscription(TEST_USER.email);

     

       740
        
       

     
···

       758
        
       		test("should reject files exceeding size limit", async () => {

     

       759
        
       			// Register and login

     

       760
        
       			const sessionCookie = await registerAndLogin(TEST_USER);

     

       761
       +
       

     

       762
        
       			// Add subscription

     

       763
        
       			addSubscription(TEST_USER.email);

     

       764
        
       

     
···

       806
        
       	beforeEach(async () => {

     

       807
        
       		// Create admin user

     

       808
        
       		adminCookie = await registerAndLogin(TEST_ADMIN);

     

       809
       +
       

     

       810
        
       		// Manually set admin role in database

     

       811
        
       		const db = require("bun:sqlite").Database.open(TEST_DB_PATH);

     

       812
        
       		db.run("UPDATE users SET role = 'admin' WHERE email = ?", [

     
···

       821
        
       			.query<{ id: number }, [string]>("SELECT id FROM users WHERE email = ?")

     

       822
        
       			.get(TEST_USER.email);

     

       823
        
       		userId = userIdResult?.id;

     

       824
       +
       

     

       825
        
       		db.close();

     

       826
        
       	});

     

       827
        
       

     
···

       1104
        
       	});

     

       1105
        
       

     

       1106
        
       	describe("POST /api/passkeys/register/options", () => {

     

       1107
       +
       		test("should return registration options for authenticated user", async () => {

     

       1108
       +
       			const response = await authRequest(

     

       1109
       +
       				`${BASE_URL}/api/passkeys/register/options`,

     

       1110
       +
       				sessionCookie,

     

       1111
       +
       				{

     

       1112
       +
       					method: "POST",

     

       1113
       +
       				},

     

       1114
       +
       			);

     

       0
        
       
     

       0
        
       
     

       1115
        
       

     

       1116
       +
       			expect(response.status).toBe(200);

     

       1117
       +
       			const data = await response.json();

     

       1118
       +
       			expect(data).toHaveProperty("challenge");

     

       1119
       +
       			expect(data).toHaveProperty("rp");

     

       1120
       +
       			expect(data).toHaveProperty("user");

     

       1121
       +
       		});

     

       0
        
       
     

       1122
        
       

     

       1123
        
       		test("should require authentication", async () => {

     

       1124
        
       			const response = await fetch(

+3 -1

src/lib/email.ts

···

       27
        
       export async function sendEmail(options: SendEmailOptions): Promise<void> {

     

       28
        
       	// Skip sending emails in test mode

     

       29
        
       	if (process.env.NODE_ENV === "test" || process.env.SKIP_EMAILS === "true") {

     

       30
       -
       		console.log(`[Email] SKIPPED (test mode): "${options.subject}" to ${typeof options.to === "string" ? options.to : options.to.email}`);

     

       0
        
       
     

       0
        
       
     

       31
        
       		return;

     

       32
        
       	}

     

       33

···

       27
        
       export async function sendEmail(options: SendEmailOptions): Promise<void> {

     

       28
        
       	// Skip sending emails in test mode

     

       29
        
       	if (process.env.NODE_ENV === "test" || process.env.SKIP_EMAILS === "true") {

     

       30
       +
       		console.log(

     

       31
       +
       			`[Email] SKIPPED (test mode): "${options.subject}" to ${typeof options.to === "string" ? options.to : options.to.email}`,

     

       32
       +
       		);

     

       33
        
       		return;

     

       34
        
       	}

     

       35

+3 -3

src/lib/vtt-cleaner.test.ts

···

       55
        
       

     

       56
        
       test("cleanVTT preserves empty VTT", async () => {

     

       57
        
       	const emptyVTT = "WEBVTT\n\n";

     

       58
       -
       	

     

       59
        
       	// Save and remove API key to avoid burning tokens

     

       60
        
       	const originalKey = process.env.LLM_API_KEY;

     

       61
        
       	delete process.env.LLM_API_KEY;

     

       62
       -
       	

     

       63
        
       	const result = await cleanVTT("test-empty", emptyVTT);

     

       64
        
       

     

       65
        
       	expect(result).toBe(emptyVTT);

     

       66
       -
       	

     

       67
        
       	// Restore original key

     

       68
        
       	if (originalKey) {

     

       69
        
       		process.env.LLM_API_KEY = originalKey;

···

       55
        
       

     

       56
        
       test("cleanVTT preserves empty VTT", async () => {

     

       57
        
       	const emptyVTT = "WEBVTT\n\n";

     

       58
       +
       

     

       59
        
       	// Save and remove API key to avoid burning tokens

     

       60
        
       	const originalKey = process.env.LLM_API_KEY;

     

       61
        
       	delete process.env.LLM_API_KEY;

     

       62
       +
       

     

       63
        
       	const result = await cleanVTT("test-empty", emptyVTT);

     

       64
        
       

     

       65
        
       	expect(result).toBe(emptyVTT);

     

       66
       +
       

     

       67
        
       	// Restore original key

     

       68
        
       	if (originalKey) {

     

       69
        
       		process.env.LLM_API_KEY = originalKey;