88197060de
Re-checked every item of the audit's own outcome section against the tree.
Most held, but five items marked fixed had residual gaps — one of them a
live IDOR — and the deferred list was untouched.
Security:
- Analytics IDOR: /api/analytics/{ws}/overview and /projection took
child_id as an unchecked query param, and get_overview called
get_days_left_at_age_4 without workspace_id, so the ownership guard
never ran. Any member could read another workspace's child projection.
Fixed at both layers.
- Scraper: session ids no longer logged at INFO; a persist-callback
failure's raw exception text and the FK maintenance banner's scraped
text no longer reach the poll client.
- Email is now case-normalised at the API boundary, with migration 009
lowercasing existing rows (aborts naming colliding rows rather than
failing opaquely on the UNIQUE constraint).
Frontend correctness:
- usePlanProposal/usePlanSync gained the stale-response guard the other
hooks already had.
- PlanSyncProvider no longer fires POST /plan/sync before auth resolves
off a blindly-read localStorage workspaceId.
- Busy flags are cleared unconditionally across all 16 useLatestRequest
consumers. setBusy(true) was unconditional while the clear was guarded
by isCurrent, so a superseded call stranded its flag forever — under
StrictMode this hung every in-app navigation behind the PageSkeleton.
isCurrent decides which response's data wins, never whether a call
releases the flag it raised.
Performance:
- Calendar no longer blanks on a mutation, and a multi-day save issues N
writes plus one background refetch instead of 2N requests.
- take_pl_on_red_days moved onto GET /auth/context, dropping a redundant
GET /workspace/:id from every cold load.
CI and repo hygiene: least-privilege permissions block, actions pinned to
commit SHAs, npm ci, uv sync --locked, failure-only artifact upload,
dependabot; dead frontend/out.js removed; CSP added to the nginx template
(repeated into the location blocks that set their own add_header, since
nginx does not merge them across levels).
Left deferred by decision: refresh-token revocation, the phase-2 contract
change, M4, M5, L2, and H12's cross-route cache. Details and the smaller
follow-ups browser verification turned up are in the audit report.
Backend 901 passed, coverage 92%. Frontend 1322 tests, coverage
98.17/94.79/92.14/98.17.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PngVF38MLpdkgXcByKfdW6
323 lines
9.0 KiB
TypeScript
323 lines
9.0 KiB
TypeScript
/**
|
|
* Shared test fixtures — return values of `src/context/*` and `src/hooks/*`.
|
|
*
|
|
* None of these hooks export their result interface (e.g. `useAnalytics`'s
|
|
* `UseAnalyticsResult` is private to useAnalytics.ts), and this file
|
|
* deliberately does not add exports to make that possible — `ReturnType<typeof
|
|
* theHook>` gets the same fully-typed result without touching source files.
|
|
* `import type` erases at compile time, so this doesn't pull the hooks'
|
|
* runtime code (or React) into the test bundle.
|
|
*/
|
|
|
|
import { vi } from 'vitest'
|
|
import type { useWorkspace } from '@/context/WorkspaceContext'
|
|
import type { useAuth } from '@/context/AuthContext'
|
|
import type { usePlanSyncContext } from '@/context/PlanSyncProvider'
|
|
import type { useAnalytics } from '@/hooks/useAnalytics'
|
|
import type { useParentalLeave } from '@/hooks/useParentalLeave'
|
|
import type { usePlannedDays } from '@/hooks/usePlannedDays'
|
|
import type { useScraperFetch } from '@/hooks/useScraperFetch'
|
|
import type { useWorkspaceMembers } from '@/hooks/useWorkspaceMembers'
|
|
import type { useOptimizationTips } from '@/hooks/useOptimizationTips'
|
|
import type { usePlannedDayExclusions } from '@/hooks/usePlannedDayExclusions'
|
|
import type { useDayOverrides } from '@/hooks/useDayOverrides'
|
|
import type { useLeaveWishes } from '@/hooks/useLeaveWishes'
|
|
import type { usePlanProposal } from '@/hooks/usePlanProposal'
|
|
import type { usePlanSync } from '@/hooks/usePlanSync'
|
|
import type { useVacationDays } from '@/hooks/useVacationDays'
|
|
import type { useChildSettings } from '@/hooks/useChildSettings'
|
|
import type { useCalendarDays } from '@/hooks/useCalendarDays'
|
|
import type { usePreschoolPlanningDays } from '@/hooks/usePreschoolPlanningDays'
|
|
import type { usePreschoolPlanningDaysList } from '@/hooks/usePreschoolPlanningDaysList'
|
|
import type { useShowWeekNumbers } from '@/hooks/useCalendarPreferences'
|
|
import { makeChild, makePersonalData, makeVacationDays, makeWorkspace, makeParentalLeaveFetch } from './mockData'
|
|
import { makeWorkspaceOverview } from './analytics'
|
|
import { makeCalendarWindow } from './calendar'
|
|
import { makePreschoolPlanningDays } from './workspace'
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Contexts
|
|
// ---------------------------------------------------------------------------
|
|
|
|
export function makeWorkspaceContextValue(
|
|
overrides: Partial<ReturnType<typeof useWorkspace>> = {},
|
|
): ReturnType<typeof useWorkspace> {
|
|
const workspace = makeWorkspace()
|
|
const child = makeChild()
|
|
const parent = makePersonalData({ uuid: 'pd-a', name: 'Förälder A' })
|
|
return {
|
|
workspace,
|
|
isLoading: false,
|
|
error: null,
|
|
workspaceId: workspace.id,
|
|
setWorkspaceId: vi.fn(),
|
|
refetch: vi.fn(),
|
|
children: [{ id: child.id, name: child.name, birth_date: child.birthDate }],
|
|
selectedChildId: child.id,
|
|
selectChild: vi.fn(),
|
|
personalDataUuid: parent.uuid,
|
|
parentName: parent.name,
|
|
refreshContext: vi.fn(),
|
|
planVersion: 0,
|
|
bumpPlanVersion: vi.fn(),
|
|
...overrides,
|
|
}
|
|
}
|
|
|
|
export function makePlanSyncContextValue(
|
|
overrides: Partial<ReturnType<typeof usePlanSyncContext>> = {},
|
|
): ReturnType<typeof usePlanSyncContext> {
|
|
return {
|
|
pendingEvictionPreview: null,
|
|
clearPendingEvictionPreview: vi.fn(),
|
|
latestProposal: null,
|
|
latestProposalVersion: 0,
|
|
...overrides,
|
|
}
|
|
}
|
|
|
|
export function makeAuthContextValue(
|
|
overrides: Partial<ReturnType<typeof useAuth>> = {},
|
|
): ReturnType<typeof useAuth> {
|
|
return {
|
|
accessToken: 'token-123',
|
|
isAuthenticated: true,
|
|
isLoading: false,
|
|
login: vi.fn(),
|
|
register: vi.fn(),
|
|
logout: vi.fn(),
|
|
...overrides,
|
|
}
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Data-fetching hooks
|
|
// ---------------------------------------------------------------------------
|
|
|
|
export function makeAnalyticsResult(
|
|
overrides: Partial<ReturnType<typeof useAnalytics>> = {},
|
|
): ReturnType<typeof useAnalytics> {
|
|
return {
|
|
data: makeWorkspaceOverview(),
|
|
isLoading: false,
|
|
error: null,
|
|
refresh: vi.fn(),
|
|
...overrides,
|
|
}
|
|
}
|
|
|
|
export function makeParentalLeaveResult(
|
|
overrides: Partial<ReturnType<typeof useParentalLeave>> = {},
|
|
): ReturnType<typeof useParentalLeave> {
|
|
return {
|
|
data: makeParentalLeaveFetch(),
|
|
isLoading: false,
|
|
error: null,
|
|
refresh: vi.fn(),
|
|
...overrides,
|
|
}
|
|
}
|
|
|
|
export function makePlannedDaysResult(
|
|
overrides: Partial<ReturnType<typeof usePlannedDays>> = {},
|
|
): ReturnType<typeof usePlannedDays> {
|
|
return {
|
|
data: [],
|
|
isLoading: false,
|
|
isRefreshing: false,
|
|
error: null,
|
|
refresh: vi.fn(),
|
|
add: vi.fn(),
|
|
update: vi.fn(),
|
|
remove: vi.fn(),
|
|
...overrides,
|
|
}
|
|
}
|
|
|
|
export function makeScraperFetchResult(
|
|
overrides: Partial<ReturnType<typeof useScraperFetch>> = {},
|
|
): ReturnType<typeof useScraperFetch> {
|
|
return {
|
|
sessionId: null,
|
|
pollData: null,
|
|
resolvedIds: null,
|
|
error: null,
|
|
isUnauthorized: false,
|
|
start: vi.fn(),
|
|
cancel: vi.fn(),
|
|
isRunning: false,
|
|
isTerminal: false,
|
|
partnerDeduction: null,
|
|
...overrides,
|
|
}
|
|
}
|
|
|
|
export function makeWorkspaceMembersResult(
|
|
overrides: Partial<ReturnType<typeof useWorkspaceMembers>> = {},
|
|
): ReturnType<typeof useWorkspaceMembers> {
|
|
return {
|
|
data: [makePersonalData({ uuid: 'pd-a', name: 'Förälder A' })],
|
|
isLoading: false,
|
|
error: null,
|
|
refresh: vi.fn(),
|
|
...overrides,
|
|
}
|
|
}
|
|
|
|
export function makeOptimizationTipsResult(
|
|
overrides: Partial<ReturnType<typeof useOptimizationTips>> = {},
|
|
): ReturnType<typeof useOptimizationTips> {
|
|
return {
|
|
data: [],
|
|
isLoading: false,
|
|
error: null,
|
|
refresh: vi.fn(),
|
|
dismiss: vi.fn(),
|
|
...overrides,
|
|
}
|
|
}
|
|
|
|
export function makeDayOverridesResult(
|
|
overrides: Partial<ReturnType<typeof useDayOverrides>> = {},
|
|
): ReturnType<typeof useDayOverrides> {
|
|
return {
|
|
data: [],
|
|
isLoading: false,
|
|
isRefreshing: false,
|
|
error: null,
|
|
upsert: vi.fn(),
|
|
remove: vi.fn(),
|
|
...overrides,
|
|
}
|
|
}
|
|
|
|
export function makePlannedDayExclusionsResult(
|
|
overrides: Partial<ReturnType<typeof usePlannedDayExclusions>> = {},
|
|
): ReturnType<typeof usePlannedDayExclusions> {
|
|
return {
|
|
data: [],
|
|
isLoading: false,
|
|
error: null,
|
|
exclude: vi.fn(),
|
|
restore: vi.fn(),
|
|
...overrides,
|
|
}
|
|
}
|
|
|
|
export function makeLeaveWishesResult(
|
|
overrides: Partial<ReturnType<typeof useLeaveWishes>> = {},
|
|
): ReturnType<typeof useLeaveWishes> {
|
|
return {
|
|
data: [],
|
|
isLoading: false,
|
|
isRefreshing: false,
|
|
error: null,
|
|
refresh: vi.fn(),
|
|
add: vi.fn(),
|
|
update: vi.fn(),
|
|
remove: vi.fn(),
|
|
...overrides,
|
|
}
|
|
}
|
|
|
|
export function makePlanProposalResult(
|
|
overrides: Partial<ReturnType<typeof usePlanProposal>> = {},
|
|
): ReturnType<typeof usePlanProposal> {
|
|
return {
|
|
data: null,
|
|
isLoading: false,
|
|
error: null,
|
|
propose: vi.fn(),
|
|
...overrides,
|
|
}
|
|
}
|
|
|
|
export function makePlanSyncResult(
|
|
overrides: Partial<ReturnType<typeof usePlanSync>> = {},
|
|
): ReturnType<typeof usePlanSync> {
|
|
return {
|
|
isSyncing: false,
|
|
error: null,
|
|
lastChanges: null,
|
|
sync: vi.fn(),
|
|
...overrides,
|
|
}
|
|
}
|
|
|
|
export function makeVacationDaysResult(
|
|
overrides: Partial<ReturnType<typeof useVacationDays>> = {},
|
|
): ReturnType<typeof useVacationDays> {
|
|
return {
|
|
data: [makeVacationDays()],
|
|
isLoading: false,
|
|
isRefreshing: false,
|
|
error: null,
|
|
upsert: vi.fn(),
|
|
...overrides,
|
|
}
|
|
}
|
|
|
|
export function makeChildSettingsResult(
|
|
overrides: Partial<ReturnType<typeof useChildSettings>> = {},
|
|
): ReturnType<typeof useChildSettings> {
|
|
return {
|
|
data: makeChild(),
|
|
isLoading: false,
|
|
isRefreshing: false,
|
|
error: null,
|
|
update: vi.fn(),
|
|
...overrides,
|
|
}
|
|
}
|
|
|
|
export function makeCalendarDaysResult(
|
|
overrides: Partial<ReturnType<typeof useCalendarDays>> = {},
|
|
): ReturnType<typeof useCalendarDays> {
|
|
return {
|
|
data: makeCalendarWindow(),
|
|
isLoading: false,
|
|
isRefreshing: false,
|
|
error: null,
|
|
refetch: vi.fn(),
|
|
...overrides,
|
|
}
|
|
}
|
|
|
|
export function makePreschoolPlanningDaysResult(
|
|
overrides: Partial<ReturnType<typeof usePreschoolPlanningDays>> = {},
|
|
): ReturnType<typeof usePreschoolPlanningDays> {
|
|
return {
|
|
data: makePreschoolPlanningDays(),
|
|
isLoading: false,
|
|
isRefreshing: false,
|
|
error: null,
|
|
setPlanned: vi.fn(),
|
|
recordTaken: vi.fn(),
|
|
...overrides,
|
|
}
|
|
}
|
|
|
|
export function makePreschoolPlanningDaysListResult(
|
|
overrides: Partial<ReturnType<typeof usePreschoolPlanningDaysList>> = {},
|
|
): ReturnType<typeof usePreschoolPlanningDaysList> {
|
|
return {
|
|
data: [makePreschoolPlanningDays()],
|
|
isLoading: false,
|
|
isRefreshing: false,
|
|
error: null,
|
|
refresh: vi.fn(),
|
|
...overrides,
|
|
}
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Local-storage-backed preference hook (a tuple, not an object)
|
|
// ---------------------------------------------------------------------------
|
|
|
|
export function makeShowWeekNumbersTuple(
|
|
show = false,
|
|
setShow: (show: boolean) => void = vi.fn(),
|
|
): ReturnType<typeof useShowWeekNumbers> {
|
|
return [show, setShow]
|
|
}
|