serfowiandClaude Opus 5
66dd4ac942
Stands up packages/api so the swipe path stops trusting its caller, and puts the auth library behind an interface we own. - packages/api: tRPC v11 with a Session type WE define, not one re-exported from an auth library. Swapping providers means rewriting one SessionResolver, not touching a router. - Procedure layers: public / protected / client / pro / verifiedPro / admin. Admin routes 404 rather than 403 so they cannot be probed. - deck router replaces the untrusted server action. Ownership is checked on every operation and returns NOT_FOUND, never FORBIDDEN, so job ids cannot be enumerated. 23 tests, mostly authorization. - packages/storage: presigned direct-to-R2 uploads. The server picks the key, so a caller can only write under their own user id. 14 tests. Three defects found and fixed: - The lazy db Proxy failed drizzle's is(db, PgDatabase) because it did not trap getPrototypeOf. Auth adapters dispatch on exactly that check, so this would have failed at runtime inside third-party code. Fixed and pinned with a regression test. - The open-request cap was a read-then-write race: concurrent swipes could both read 4 and both insert. Now one transaction with the job row locked. The cap is checked before the tombstone is written, so a rejected swipe leaves no trace and the card stays on the deck. - superjson was configured in two of the three required places. Without the QueryClient dehydrate/hydrate pair, RSC-prefetched data arrives as a raw envelope with no type error to warn you. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
51 lines
1.6 KiB
TypeScript
51 lines
1.6 KiB
TypeScript
/**
|
|
* The db handle is a lazy Proxy. These tests exist because a proxy that lies
|
|
* about its prototype breaks drizzle's own runtime type dispatch — and the
|
|
* failure surfaces deep inside a third-party adapter, nowhere near this file.
|
|
*/
|
|
import { config } from 'dotenv';
|
|
import { is } from 'drizzle-orm';
|
|
import { PgDatabase } from 'drizzle-orm/pg-core';
|
|
import { afterAll, describe, expect, it } from 'vitest';
|
|
|
|
config({ path: '../../.env' });
|
|
|
|
const { closePool, db } = await import('../src/client');
|
|
|
|
afterAll(async () => {
|
|
await closePool();
|
|
});
|
|
|
|
describe('lazy db proxy', () => {
|
|
it('passes the drizzle is() check that adapters dispatch on', () => {
|
|
// Auth adapters dispatch on this. If it returns false they silently take a
|
|
// different code path and fail with an unrelated-looking error.
|
|
expect(is(db, PgDatabase)).toBe(true);
|
|
});
|
|
|
|
it('satisfies instanceof', () => {
|
|
expect(db instanceof PgDatabase).toBe(true);
|
|
});
|
|
|
|
it('exposes the query builders', () => {
|
|
expect(typeof db.select).toBe('function');
|
|
expect(typeof db.insert).toBe('function');
|
|
expect(typeof db.transaction).toBe('function');
|
|
expect(db.query).toBeDefined();
|
|
});
|
|
|
|
it('reports the relational query namespaces', () => {
|
|
expect(Object.keys(db.query)).toContain('jobs');
|
|
expect(Object.keys(db.query)).toContain('proProfiles');
|
|
});
|
|
|
|
it('supports the in operator', () => {
|
|
expect('select' in db).toBe(true);
|
|
expect('definitelyNotAMethod' in db).toBe(false);
|
|
});
|
|
|
|
it('returns the same instance across accesses', () => {
|
|
expect(db.select).toBe(db.select);
|
|
});
|
|
});
|