@aurabase/aurabase-js 0.3.0 → 0.4.0

package/packages/aurabase/tests/storage-backend-e2e.test.ts

@@ -1,481 +0,0 @@
-// ---------------------------------------------------------------------------
-// E2E réel (stack live) — Lot storage-backend : valide les 4 correctifs backend.
-// Réf. specs : docs/superpowers/specs/2026-07-13-storage-*-design.md
-//
-// Les méthodes SDK correspondantes (updateBucket, uploadToSignedUrl, copy/move
-// cross-bucket) ne sont pas encore ajoutées (lot storage-sdk) → on teste le
-// BACKEND via fetch REST direct (routes confirmées dans aura-storage/src/main.rs),
-// avec la même mécanique de skip gracieux que storage-transform-e2e.test.ts.
-//
-// Scénarios :
-//   1. img-transform-default : défaut déterministe = activé (plus de bascule
-//      autorisé→Forbidden à l'ouverture des settings).
-//   2. signed-upload-url : mint service_role → PUT signé fonctionnel (valide
-//      aussi l'assomption gateway : PUT signé sans apikey passe le data-plane) ;
-//      PUT sans sig → 401 ; mint anon → 403 (sécurité #1) ; mint _derivatives → 403.
-//   3. cache-hardening : x-aura-cache MISS→HIT + ETag stable ; overwrite source
-//      → nouveau rendu (clé versionnée etag) ; upload ?folder=_derivatives → 400.
-//   4. cross-bucket : copy/move a→b (bucket destination distinct) ; dst inconnu → 404.
-//
-// Gaté par RUN_E2E + credentials.
-// ---------------------------------------------------------------------------
-
-import { describe, it, expect } from 'vitest'
-import { deflateSync } from 'node:zlib'
-import { createAdminClient, createClient } from '../src/index'
-import type { AuraResponse } from '../src/index'
-
-const URL = process.env.AURA_E2E_URL
-const PROJECT = process.env.AURA_E2E_PROJECT
-const ANON = process.env.AURA_E2E_ANON_KEY
-const SERVICE = process.env.AURA_E2E_SERVICE_KEY
-const RUN = Boolean(process.env.RUN_E2E && URL && PROJECT && ANON && SERVICE)
-
-const TRANSIENT_STATUS = new Set([408, 429, 502, 503, 504])
-
-async function retryTransient<T>(fn: () => PromiseLike<AuraResponse<T>>): Promise<AuraResponse<T>> {
-  let res = await fn()
-  for (let i = 0; i < 10 && res.error && TRANSIENT_STATUS.has(res.error.status); i++) {
-    await new Promise((r) => setTimeout(r, 1000))
-    res = await fn()
-  }
-  return res
-}
-
-async function retryFetch(fn: () => Promise<Response>): Promise<Response> {
-  let res = await fn()
-  for (let i = 0; i < 10 && TRANSIENT_STATUS.has(res.status); i++) {
-    await new Promise((r) => setTimeout(r, 1000))
-    res = await fn()
-  }
-  return res
-}
-
-// ── Générateur PNG minimal (repris de storage-transform-e2e.test.ts) ──────────
-const CRC_TABLE: Uint32Array = (() => {
-  const table = new Uint32Array(256)
-  for (let n = 0; n < 256; n++) {
-    let c = n
-    for (let k = 0; k < 8; k++) c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1
-    table[n] = c >>> 0
-  }
-  return table
-})()
-function crc32(bytes: Uint8Array): number {
-  let c = 0xffffffff
-  for (let i = 0; i < bytes.length; i++) c = CRC_TABLE[(c ^ bytes[i]) & 0xff] ^ (c >>> 8)
-  return (c ^ 0xffffffff) >>> 0
-}
-function u32be(n: number): Uint8Array {
-  return new Uint8Array([(n >>> 24) & 0xff, (n >>> 16) & 0xff, (n >>> 8) & 0xff, n & 0xff])
-}
-function concatBytes(...parts: Uint8Array[]): Uint8Array {
-  const total = parts.reduce((s, p) => s + p.length, 0)
-  const out = new Uint8Array(total)
-  let off = 0
-  for (const p of parts) {
-    out.set(p, off)
-    off += p.length
-  }
-  return out
-}
-function pngChunk(type: string, data: Uint8Array): Uint8Array {
-  const typeBytes = new Uint8Array(type.split('').map((c) => c.charCodeAt(0)))
-  return concatBytes(u32be(data.length), typeBytes, data, u32be(crc32(concatBytes(typeBytes, data))))
-}
-function makePng(width: number, height: number, seedInit = 0x12345678): Uint8Array {
-  const SIGNATURE = new Uint8Array([137, 80, 78, 71, 13, 10, 26, 10])
-  const ihdr = pngChunk('IHDR', concatBytes(u32be(width), u32be(height), new Uint8Array([8, 2, 0, 0, 0])))
-  const stride = 1 + width * 3
-  const raw = new Uint8Array(stride * height)
-  let seed = seedInit
-  const nextByte = () => {
-    seed = (seed * 1103515245 + 12345) & 0x7fffffff
-    return (seed >>> 16) & 0xff
-  }
-  for (let y = 0; y < height; y++) {
-    const rowStart = y * stride
-    raw[rowStart] = 0
-    for (let x = 0; x < width; x++) {
-      const px = rowStart + 1 + x * 3
-      raw[px] = nextByte()
-      raw[px + 1] = nextByte()
-      raw[px + 2] = nextByte()
-    }
-  }
-  const compressed = deflateSync(raw)
-  const idat = pngChunk('IDAT', new Uint8Array(compressed.buffer, compressed.byteOffset, compressed.byteLength))
-  return concatBytes(SIGNATURE, ihdr, idat, pngChunk('IEND', new Uint8Array(0)))
-}
-function readPngWidth(bytes: Uint8Array): number {
-  return ((bytes[16] << 24) | (bytes[17] << 16) | (bytes[18] << 8) | bytes[19]) >>> 0
-}
-
-/** Lit `{ data: { url } }` OU `{ url }` selon l'enveloppe ApiResponse. */
-function extractUrl(json: unknown): string | undefined {
-  const j = json as { data?: { url?: string }; url?: string }
-  return j?.data?.url ?? j?.url
-}
-
-describe.runIf(RUN)('storage-backend E2E réel (stack live)', () => {
-  const suffix = () => process.env.AURA_E2E_SUFFIX ?? Math.random().toString(36).slice(2, 8)
-  const H_SERVICE = { apikey: SERVICE! } as Record<string, string>
-
-  // ── 1. img-transform-default : défaut déterministe activé ───────────────────
-  it(
-    'img_transform_enabled par défaut = activé : ouvrir les settings ne bascule pas transform en Forbidden',
-    async () => {
-      const admin = createAdminClient(URL!, PROJECT!, SERVICE!)
-      const bucket = `e2e-imgdef-${suffix()}`
-      let created = false
-      let uploadedKey = 'img.png'
-      try {
-        const createRes = await retryTransient(() =>
-          admin.storage.createBucket(bucket, { public: false, allowedMimeTypes: ['image/png'] }),
-        )
-        if (createRes.error && TRANSIENT_STATUS.has(createRes.error.status)) {
-          console.warn(`[storage-backend-e2e] SKIP img-default (createBucket ${createRes.error.status}).`)
-          return
-        }
-        expect(createRes.error).toBeNull()
-        created = true
-
-        const uploadRes = await admin.storage.upload(bucket, 'img.png', new Blob([makePng(120, 120)], { type: 'image/png' }), {
-          contentType: 'image/png',
-        })
-        expect(uploadRes.error).toBeNull()
-        uploadedKey = uploadRes.data?.key ?? 'img.png'
-
-        // GET /settings crée la ligne (avec le fix : DEFAULT true + INSERT explicite true).
-        const settingsRes = await retryFetch(() =>
-          fetch(`${admin.baseUrl}/v1/storage/${admin.projectId}/settings`, { headers: H_SERVICE }),
-        )
-        if (!settingsRes.ok) {
-          console.warn(`[storage-backend-e2e] SKIP img-default (GET settings ${settingsRes.status}).`)
-          return
-        }
-        const settingsJson = (await settingsRes.json()) as { data?: Record<string, unknown> }
-        const flag = (settingsJson.data ?? (settingsJson as Record<string, unknown>))['img_transform_enabled']
-        // Cœur du fix : après création de la ligne, le défaut est `true` (déterministe), donc pas
-        // de bascule autorisé→refusé. Sur le projet E2E partagé, un test concurrent peut avoir
-        // mis false explicitement → on n'assène l'assertion stricte que si le flag n'est pas false.
-        if (flag === false) {
-          console.warn('[storage-backend-e2e] img_transform_enabled=false (override explicite concurrent) — assertion défaut ignorée.')
-        } else {
-          expect(flag).toBe(true)
-        }
-
-        // Et une transformation doit réussir (autorisée), après avoir touché les settings.
-        const dl = await retryTransient(() => admin.storage.download(bucket, uploadedKey, { transform: { width: 40 } }))
-        if (dl.error && TRANSIENT_STATUS.has(dl.error.status)) {
-          console.warn(`[storage-backend-e2e] SKIP img-default (download transform ${dl.error.status}).`)
-          return
-        }
-        if (flag !== false) {
-          expect(dl.error).toBeNull()
-          const buf = new Uint8Array(await dl.data!.arrayBuffer())
-          expect(readPngWidth(buf)).toBe(40)
-        }
-      } finally {
-        if (created) {
-          try {
-            await admin.storage.remove(bucket, [uploadedKey])
-          } catch {
-            /* best-effort */
-          }
-          try {
-            await admin.storage.deleteBucket(bucket)
-          } catch {
-            /* best-effort */
-          }
-        }
-      }
-    },
-    120_000,
-  )
-
-  // ── 2. signed-upload-url : PUT signé + garde-fous sécurité ──────────────────
-  it(
-    'upload par URL signée : mint service_role → PUT fonctionnel ; PUT sans sig → 401 ; mint anon → 403 ; mint _derivatives → 403',
-    async () => {
-      const admin = createAdminClient(URL!, PROJECT!, SERVICE!)
-      const bucket = `e2e-signup-${suffix()}`
-      const key = `direct-${suffix()}.txt`
-      let created = false
-      try {
-        const createRes = await retryTransient(() =>
-          admin.storage.createBucket(bucket, { public: false, allowedMimeTypes: ['text/plain'] }),
-        )
-        if (createRes.error && TRANSIENT_STATUS.has(createRes.error.status)) {
-          console.warn(`[storage-backend-e2e] SKIP signed-upload (createBucket ${createRes.error.status}).`)
-          return
-        }
-        expect(createRes.error).toBeNull()
-        created = true
-
-        const mintUrl = `${admin.baseUrl}/v1/storage/${admin.projectId}/${bucket}/upload-url?key=${encodeURIComponent(key)}`
-
-        // (a) Mint avec ANON (non service_role) → 403 (finding #1).
-        const anonMint = await retryFetch(() => fetch(mintUrl, { headers: { apikey: ANON! } }))
-        if (!TRANSIENT_STATUS.has(anonMint.status)) {
-          expect(anonMint.status).toBe(403)
-        }
-
-        // (b) Mint pour une clé sous _derivatives/ (service_role) → 403.
-        const derivMint = await retryFetch(() =>
-          fetch(
-            `${admin.baseUrl}/v1/storage/${admin.projectId}/${bucket}/upload-url?key=${encodeURIComponent('_derivatives/x/y.txt')}`,
-            { headers: H_SERVICE },
-          ),
-        )
-        if (!TRANSIENT_STATUS.has(derivMint.status)) {
-          expect(derivMint.status).toBe(403)
-        }
-
-        // (c) Mint service_role → URL signée.
-        const mintRes = await retryFetch(() => fetch(mintUrl, { headers: H_SERVICE }))
-        if (TRANSIENT_STATUS.has(mintRes.status)) {
-          console.warn(`[storage-backend-e2e] SKIP signed-upload (mint ${mintRes.status}).`)
-          return
-        }
-        expect(mintRes.ok).toBe(true)
-        const signedUrl = extractUrl(await mintRes.json())
-        expect(signedUrl).toBeTruthy()
-
-        // (d) PUT du corps vers l'URL signée (SANS apikey) → 200. Valide l'assomption gateway.
-        const payload = `bonjour-${suffix()}`
-        const putRes = await retryFetch(() =>
-          fetch(signedUrl!, { method: 'PUT', headers: { 'content-type': 'text/plain' }, body: payload }),
-        )
-        if (TRANSIENT_STATUS.has(putRes.status)) {
-          console.warn(`[storage-backend-e2e] SKIP signed-upload (PUT ${putRes.status}).`)
-          return
-        }
-        expect(
-          putRes.ok,
-          `PUT vers l'URL signée a échoué (${putRes.status}) — si 401/403 sans transitoire, la gateway ` +
-            `data-plane bloque le PUT signé non-authentifié (assomption gateway à corriger côté aura-gateway).`,
-        ).toBe(true)
-
-        // (e) Contenu relu identique.
-        const dl = await retryTransient(() => admin.storage.download(bucket, key))
-        if (!(dl.error && TRANSIENT_STATUS.has(dl.error.status))) {
-          expect(dl.error).toBeNull()
-          expect(await dl.data!.text()).toBe(payload)
-        }
-
-        // (f) PUT sur le chemin objet SANS ?sig= → 401.
-        const noSig = await retryFetch(() =>
-          fetch(`${admin.baseUrl}/v1/storage/${admin.projectId}/${bucket}/${encodeURIComponent(key)}`, {
-            method: 'PUT',
-            headers: { 'content-type': 'text/plain', apikey: SERVICE! },
-            body: 'x',
-          }),
-        )
-        if (!TRANSIENT_STATUS.has(noSig.status)) {
-          expect(noSig.status).toBe(401)
-        }
-      } finally {
-        if (created) {
-          try {
-            await admin.storage.remove(bucket, [key])
-          } catch {
-            /* best-effort */
-          }
-          try {
-            await admin.storage.deleteBucket(bucket)
-          } catch {
-            /* best-effort */
-          }
-        }
-      }
-    },
-    120_000,
-  )
-
-  // ── 3. cache-hardening : ETag stable + overwrite + rejet _derivatives ───────
-  it(
-    'cache dérivés : MISS→HIT même ETag ; overwrite source → nouveau rendu ; upload ?folder=_derivatives → 400',
-    async () => {
-      const admin = createAdminClient(URL!, PROJECT!, SERVICE!)
-      const bucket = `e2e-cache-${suffix()}`
-      let created = false
-      let uploadedKey = 'img.png'
-      try {
-        const createRes = await retryTransient(() =>
-          admin.storage.createBucket(bucket, { public: false, allowedMimeTypes: ['image/png'] }),
-        )
-        if (createRes.error && TRANSIENT_STATUS.has(createRes.error.status)) {
-          console.warn(`[storage-backend-e2e] SKIP cache (createBucket ${createRes.error.status}).`)
-          return
-        }
-        expect(createRes.error).toBeNull()
-        created = true
-
-        const up = await admin.storage.upload(bucket, 'img.png', new Blob([makePng(150, 150, 0x1111)], { type: 'image/png' }), {
-          contentType: 'image/png',
-          upsert: true,
-        })
-        expect(up.error).toBeNull()
-        uploadedKey = up.data?.key ?? 'img.png'
-
-        const signedRes = await retryTransient(() => admin.storage.createSignedUrl(bucket, uploadedKey, 600, { transform: { width: 45 } }))
-        if (signedRes.error && TRANSIENT_STATUS.has(signedRes.error.status)) {
-          console.warn(`[storage-backend-e2e] SKIP cache (signedUrl ${signedRes.error.status}).`)
-          return
-        }
-        expect(signedRes.error).toBeNull()
-        const derivUrl = signedRes.data!.url
-
-        const f1 = await retryFetch(() => fetch(derivUrl))
-        if (TRANSIENT_STATUS.has(f1.status)) {
-          console.warn(`[storage-backend-e2e] SKIP cache (fetch1 ${f1.status}).`)
-          return
-        }
-        expect(f1.ok).toBe(true)
-        const etag1 = f1.headers.get('etag')
-        const cache1 = f1.headers.get('x-aura-cache')
-        await f1.arrayBuffer()
-
-        if (cache1 === 'MISS' && etag1) {
-          const f2 = await retryFetch(() => fetch(derivUrl))
-          if (!TRANSIENT_STATUS.has(f2.status)) {
-            expect(f2.headers.get('x-aura-cache')).toBe('HIT')
-            // ETag stable entre MISS et HIT (sous-finding c).
-            expect(f2.headers.get('etag')).toBe(etag1)
-            await f2.arrayBuffer()
-          }
-        } else {
-          console.warn(`[storage-backend-e2e] cache header x-aura-cache=${cache1} (non 'MISS') — assertion HIT/ETag ignorée.`)
-        }
-
-        // Sous-finding (d) : le préfixe réservé _derivatives/ n'est écrivable que via un handler
-        // qui exploite `?folder=`. upload_file (POST .../{bucket}) IGNORE `?folder=` (sa clé = le
-        // nom de fichier, l'objet n'atterrit jamais sous _derivatives/) — le VRAI vecteur est
-        // init_multipart, qui construit la clé `{folder}/{uuid}`. On teste donc celui-là.
-        const folderRes = await retryFetch(() =>
-          fetch(
-            `${admin.baseUrl}/v1/storage/${admin.projectId}/${bucket}/multipart/init?filename=x.png&folder=${encodeURIComponent('_derivatives')}`,
-            { method: 'POST', headers: H_SERVICE },
-          ),
-        )
-        if (!TRANSIENT_STATUS.has(folderRes.status)) {
-          expect(
-            folderRes.status,
-            `init_multipart ?folder=_derivatives devrait être rejeté (400), reçu ${folderRes.status}`,
-          ).toBe(400)
-        }
-      } finally {
-        if (created) {
-          try {
-            await admin.storage.remove(bucket, [uploadedKey])
-          } catch {
-            /* best-effort */
-          }
-          try {
-            await admin.storage.deleteBucket(bucket)
-          } catch {
-            /* best-effort */
-          }
-        }
-      }
-    },
-    120_000,
-  )
-
-  // ── 4. cross-bucket copy/move ───────────────────────────────────────────────
-  it(
-    'copy/move vers un bucket destination distinct ; dst_bucket inconnu → 404',
-    async () => {
-      const admin = createAdminClient(URL!, PROJECT!, SERVICE!)
-      const s = suffix()
-      const bucketA = `e2e-xb-a-${s}`
-      const bucketB = `e2e-xb-b-${s}`
-      let createdA = false
-      let createdB = false
-      let keyX = 'x.txt'
-      let keyY = 'y.txt'
-      try {
-        for (const [b, set] of [[bucketA, (v: boolean) => (createdA = v)], [bucketB, (v: boolean) => (createdB = v)]] as const) {
-          const r = await retryTransient(() => admin.storage.createBucket(b, { public: false, allowedMimeTypes: ['text/plain'] }))
-          if (r.error && TRANSIENT_STATUS.has(r.error.status)) {
-            console.warn(`[storage-backend-e2e] SKIP cross-bucket (createBucket ${b} ${r.error.status}).`)
-            return
-          }
-          expect(r.error).toBeNull()
-          set(true)
-        }
-
-        const upX = await admin.storage.upload(bucketA, 'x.txt', new Blob(['contenu-x'], { type: 'text/plain' }), { contentType: 'text/plain' })
-        expect(upX.error).toBeNull()
-        keyX = upX.data?.key ?? 'x.txt'
-        const upY = await admin.storage.upload(bucketA, 'y.txt', new Blob(['contenu-y'], { type: 'text/plain' }), { contentType: 'text/plain' })
-        expect(upY.error).toBeNull()
-        keyY = upY.data?.key ?? 'y.txt'
-
-        // COPY a→b : objet créé dans b, source intacte.
-        const copyRes = await retryFetch(() =>
-          fetch(`${admin.baseUrl}/v1/storage/${admin.projectId}/${bucketA}/copy`, {
-            method: 'POST',
-            headers: { ...H_SERVICE, 'content-type': 'application/json' },
-            body: JSON.stringify({ src_key: keyX, dst_key: 'copied.txt', dst_bucket: bucketB }),
-          }),
-        )
-        if (TRANSIENT_STATUS.has(copyRes.status)) {
-          console.warn(`[storage-backend-e2e] SKIP cross-bucket (copy ${copyRes.status}).`)
-          return
-        }
-        expect(copyRes.ok, `copy a→b devrait réussir, reçu ${copyRes.status}`).toBe(true)
-        const dlCopied = await retryTransient(() => admin.storage.download(bucketB, 'copied.txt'))
-        if (!(dlCopied.error && TRANSIENT_STATUS.has(dlCopied.error.status))) {
-          expect(dlCopied.error).toBeNull()
-          expect(await dlCopied.data!.text()).toBe('contenu-x')
-        }
-        const dlSrc = await retryTransient(() => admin.storage.download(bucketA, keyX))
-        if (!(dlSrc.error && TRANSIENT_STATUS.has(dlSrc.error.status))) {
-          expect(dlSrc.error, 'la source doit rester intacte après copy').toBeNull()
-        }
-
-        // MOVE a→b : objet dans b, absent de a.
-        const moveRes = await retryFetch(() =>
-          fetch(`${admin.baseUrl}/v1/storage/${admin.projectId}/${bucketA}/move`, {
-            method: 'POST',
-            headers: { ...H_SERVICE, 'content-type': 'application/json' },
-            body: JSON.stringify({ src_key: keyY, dst_key: 'moved.txt', dst_bucket: bucketB }),
-          }),
-        )
-        if (!TRANSIENT_STATUS.has(moveRes.status)) {
-          expect(moveRes.ok, `move a→b devrait réussir, reçu ${moveRes.status}`).toBe(true)
-          const dlMoved = await retryTransient(() => admin.storage.download(bucketB, 'moved.txt'))
-          if (!(dlMoved.error && TRANSIENT_STATUS.has(dlMoved.error.status))) {
-            expect(dlMoved.error).toBeNull()
-            expect(await dlMoved.data!.text()).toBe('contenu-y')
-          }
-        }
-
-        // dst_bucket inexistant → 404.
-        const badRes = await retryFetch(() =>
-          fetch(`${admin.baseUrl}/v1/storage/${admin.projectId}/${bucketA}/copy`, {
-            method: 'POST',
-            headers: { ...H_SERVICE, 'content-type': 'application/json' },
-            body: JSON.stringify({ src_key: keyX, dst_key: 'z.txt', dst_bucket: `nope-${s}` }),
-          }),
-        )
-        if (!TRANSIENT_STATUS.has(badRes.status)) {
-          expect(badRes.status, 'copy vers un bucket inconnu doit renvoyer 404').toBe(404)
-        }
-      } finally {
-        for (const [b, wasCreated] of [[bucketA, createdA], [bucketB, createdB]] as const) {
-          if (wasCreated) {
-            try {
-              await admin.storage.deleteBucket(b)
-            } catch {
-              /* best-effort */
-            }
-          }
-        }
-      }
-    },
-    120_000,
-  )
-})

package/packages/aurabase/tests/storage-sdk-parity-e2e.test.ts

@@ -1,104 +0,0 @@
-// ---------------------------------------------------------------------------
-// E2E réel (stack live) — Lot sdk-storage-gen / `storage-sdk-parity-quickwins`.
-// Réf. : docs/superpowers/specs/2026-07-13-storage-sdk-parity-quickwins-design.md
-//
-// Vérifie updateBucket (PATCH partiel), option upload `metadata` (relue via
-// getMetadata), createSignedUrls (batch fan-out). Gaté RUN_E2E, skip gracieux.
-//
-// NB clé : `upload_file` assigne une clé UUID et la RENVOIE (il n'utilise le
-// chemin client que pour l'extension). Les lectures (getMetadata/createSignedUrl)
-// DOIVENT donc utiliser `up.data.key`, jamais le chemin logique d'origine.
-// ---------------------------------------------------------------------------
-
-import { describe, it, expect } from 'vitest'
-import { createAdminClient } from '../src/index'
-import type { AuraResponse } from '../src/index'
-
-const URL = process.env.AURA_E2E_URL
-const PROJECT = process.env.AURA_E2E_PROJECT
-const SERVICE = process.env.AURA_E2E_SERVICE_KEY
-const RUN = Boolean(process.env.RUN_E2E && URL && PROJECT && SERVICE)
-const TRANSIENT = new Set([408, 429, 502, 503, 504])
-
-async function retry<T>(fn: () => Promise<AuraResponse<T>>): Promise<AuraResponse<T>> {
-  let r = await fn()
-  for (let i = 0; i < 8 && r.error && TRANSIENT.has(r.error.status); i++) {
-    await new Promise((res) => setTimeout(res, 1000))
-    r = await fn()
-  }
-  return r
-}
-
-describe.runIf(RUN)('storage SDK parity E2E réel (updateBucket / metadata / createSignedUrls)', () => {
-  it(
-    'updateBucket rend public ; upload metadata est relu ; createSignedUrls renvoie N URLs',
-    async () => {
-      const admin = createAdminClient(URL!, PROJECT!, SERVICE!)
-      const suffix = process.env.AURA_E2E_SUFFIX ?? Math.random().toString(36).slice(2, 8)
-      const bucket = `sbp${suffix}`
-      const tag = `v-${suffix}`
-      let created = false
-      const keys: string[] = []
-
-      try {
-        const cb = await retry(() => admin.storage.createBucket(bucket, { public: false }))
-        if (cb.error && TRANSIENT.has(cb.error.status)) {
-          console.warn(`[storage-sdk-parity-e2e] SKIP (createBucket ${cb.error.status}).`)
-          return
-        }
-        expect(cb.error, `createBucket: ${JSON.stringify(cb.error)}`).toBeNull()
-        created = true
-
-        // --- updateBucket (PATCH partiel) : privé → public -------------------
-        const ub = await retry(() =>
-          admin.storage.updateBucket(bucket, { public: true, fileSizeLimit: 5_000_000 }),
-        )
-        expect(ub.error, `updateBucket: ${JSON.stringify(ub.error)}`).toBeNull()
-        const gb = await retry(() => admin.storage.getBucket(bucket))
-        expect(gb.error).toBeNull()
-        expect((gb.data as { public?: boolean } | null)?.public, 'bucket doit être public après updateBucket').toBe(true)
-
-        // --- upload avec metadata → relue via getMetadata (clé RETOURNÉE) ----
-        const up = await retry(() =>
-          admin.storage.upload(bucket, 'f.txt', new Blob(['hello']), {
-            contentType: 'text/plain',
-            metadata: { tag },
-          }),
-        )
-        expect(up.error, `upload metadata: ${JSON.stringify(up.error)}`).toBeNull()
-        const keyF = (up.data as { key?: string } | null)?.key
-        expect(keyF, 'upload doit retourner la clé stockée').toBeTruthy()
-        keys.push(keyF!)
-
-        const gm = await retry(() => admin.storage.getMetadata(bucket, keyF!))
-        expect(gm.error, `getMetadata(${keyF}): ${JSON.stringify(gm.error)}`).toBeNull()
-        expect(JSON.stringify(gm.data ?? {}), 'la metadata custom (tag) doit être relue').toContain(tag)
-
-        // --- createSignedUrls (batch) sur les clés réelles ------------------
-        const up2 = await retry(() =>
-          admin.storage.upload(bucket, 'g.txt', new Blob(['g']), { contentType: 'text/plain' }),
-        )
-        expect(up2.error).toBeNull()
-        const keyG = (up2.data as { key?: string } | null)?.key
-        expect(keyG).toBeTruthy()
-        keys.push(keyG!)
-
-        const su = await retry(() => admin.storage.createSignedUrls(bucket, [keyF!, keyG!], 300))
-        expect(su.error, `createSignedUrls: ${JSON.stringify(su.error)}`).toBeNull()
-        const rows = su.data ?? []
-        expect(rows.length, 'createSignedUrls doit renvoyer 2 entrées').toBe(2)
-        expect(rows.every((r) => 'url' in r && typeof r.url === 'string' && r.url.length > 0), 'chaque entrée doit porter une URL').toBe(true)
-      } finally {
-        if (created) {
-          try {
-            if (keys.length) await admin.storage.remove(bucket, keys)
-            await admin.storage.deleteBucket(bucket)
-          } catch {
-            /* best-effort */
-          }
-        }
-      }
-    },
-    90_000,
-  )
-})