Spaces:
Running
Running
File size: 2,847 Bytes
a66365f | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 | import assert from "node:assert/strict";
import { createServer } from "node:http";
import type { AddressInfo } from "node:net";
import { test } from "node:test";
import express from "express";
import type { SupabaseClient } from "@supabase/supabase-js";
test("media lookups skip timing data while retaining session ownership checks", async () => {
Object.assign(process.env, {
NODE_ENV: "test", FRONTEND_URL: "http://127.0.0.1:3000", BACKEND_URL: "http://127.0.0.1:4000",
ANALYSIS_PROXY_SECRET: "test-analysis-proxy-secret-32-chars", SUPABASE_URL: "http://127.0.0.1:54321",
SUPABASE_ANON_KEY: "test-anon-key", SUPABASE_SERVICE_ROLE_KEY: "test-service-role-key",
});
const { analysisRouter } = await import("../src/analysis.js");
const sessionId = "11111111-1111-4111-8111-111111111111";
const userId = "22222222-2222-4222-8222-222222222222";
const times = [{ action_id: sessionId, start_time_seconds: 1, end_time_seconds: 2 }];
const filters: [string, string][] = [];
const tables: string[] = [];
let owned = true;
const db = {
from(table: string) {
tables.push(table);
const query = {
select() { return query; },
eq(column: string, value: string) { filters.push([column, value]); return query; },
async maybeSingle() { return { data: owned ? { session_id: sessionId, user_id: userId } : null, error: null }; },
then(resolve: (value: unknown) => void) { return Promise.resolve({ data: times, error: null }).then(resolve); },
};
return query;
},
} as unknown as SupabaseClient;
const app = express();
const secret = process.env.ANALYSIS_PROXY_SECRET!;
app.use("/internal/analysis", analysisRouter(db, secret));
const server = createServer(app);
await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
const url = `http://127.0.0.1:${(server.address() as AddressInfo).port}/internal/analysis/${sessionId}`;
const headers = { "x-sporalize-proxy-secret": secret, "x-sporalize-user-id": userId };
try {
const media = await fetch(`${url}?playbackTimes=false`, { headers });
assert.equal(media.status, 200);
assert.deepEqual(tables, ["sessions"]);
assert.ok(filters.some(([column, value]) => column === "user_id" && value === userId));
tables.length = 0;
const results = await fetch(url, { headers });
assert.equal(results.status, 200);
assert.deepEqual((await results.json()).action_times, times);
assert.deepEqual(tables, ["sessions", "actions"]);
owned = false;
tables.length = 0;
const denied = await fetch(`${url}?playbackTimes=false`, { headers });
assert.equal(denied.status, 404);
assert.deepEqual(tables, ["sessions"]);
} finally {
await new Promise<void>((resolve, reject) => server.close((error) => error ? reject(error) : resolve()));
}
});
|