Spaces:
Running
Running
| import assert from "node:assert/strict"; | |
| import { createServer } from "node:http"; | |
| import type { AddressInfo } from "node:net"; | |
| import { test } from "node:test"; | |
| import express from "express"; | |
| import type { SupabaseClient } from "@supabase/supabase-js"; | |
| test("media lookups skip timing data while retaining session ownership checks", async () => { | |
| Object.assign(process.env, { | |
| NODE_ENV: "test", FRONTEND_URL: "http://127.0.0.1:3000", BACKEND_URL: "http://127.0.0.1:4000", | |
| ANALYSIS_PROXY_SECRET: "test-analysis-proxy-secret-32-chars", SUPABASE_URL: "http://127.0.0.1:54321", | |
| SUPABASE_ANON_KEY: "test-anon-key", SUPABASE_SERVICE_ROLE_KEY: "test-service-role-key", | |
| }); | |
| const { analysisRouter } = await import("../src/analysis.js"); | |
| const sessionId = "11111111-1111-4111-8111-111111111111"; | |
| const userId = "22222222-2222-4222-8222-222222222222"; | |
| const times = [{ action_id: sessionId, start_time_seconds: 1, end_time_seconds: 2 }]; | |
| const filters: [string, string][] = []; | |
| const tables: string[] = []; | |
| let owned = true; | |
| const db = { | |
| from(table: string) { | |
| tables.push(table); | |
| const query = { | |
| select() { return query; }, | |
| eq(column: string, value: string) { filters.push([column, value]); return query; }, | |
| async maybeSingle() { return { data: owned ? { session_id: sessionId, user_id: userId } : null, error: null }; }, | |
| then(resolve: (value: unknown) => void) { return Promise.resolve({ data: times, error: null }).then(resolve); }, | |
| }; | |
| return query; | |
| }, | |
| } as unknown as SupabaseClient; | |
| const app = express(); | |
| const secret = process.env.ANALYSIS_PROXY_SECRET!; | |
| app.use("/internal/analysis", analysisRouter(db, secret)); | |
| const server = createServer(app); | |
| await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve)); | |
| const url = `http://127.0.0.1:${(server.address() as AddressInfo).port}/internal/analysis/${sessionId}`; | |
| const headers = { "x-sporalize-proxy-secret": secret, "x-sporalize-user-id": userId }; | |
| try { | |
| const media = await fetch(`${url}?playbackTimes=false`, { headers }); | |
| assert.equal(media.status, 200); | |
| assert.deepEqual(tables, ["sessions"]); | |
| assert.ok(filters.some(([column, value]) => column === "user_id" && value === userId)); | |
| tables.length = 0; | |
| const results = await fetch(url, { headers }); | |
| assert.equal(results.status, 200); | |
| assert.deepEqual((await results.json()).action_times, times); | |
| assert.deepEqual(tables, ["sessions", "actions"]); | |
| owned = false; | |
| tables.length = 0; | |
| const denied = await fetch(`${url}?playbackTimes=false`, { headers }); | |
| assert.equal(denied.status, 404); | |
| assert.deepEqual(tables, ["sessions"]); | |
| } finally { | |
| await new Promise<void>((resolve, reject) => server.close((error) => error ? reject(error) : resolve())); | |
| } | |
| }); | |