@jrpool/kilotest 47.0.1 → 49.0.0

package/index.test.ts

@@ -32,6 +32,7 @@ const {requestHandler, routes, serveError, startServer, runIfMain, isPathAllowed
 
 const port = 3997;
 const testRequestsPath = path.join(fixtureDBDir, 'jobs', 'testRequests.json');
+const metricsPath = path.join(fixtureDBDir, 'metrics.json');
 
 // SETUP AND TEARDOWN
 
@@ -146,6 +147,31 @@ const jsonBody = (res: any) => {
     return null;
   }
 };
+// Returns the current count for a metrics category and name, or 0 if the file or the
+// entry is absent (the file does not exist until the first metric is recorded).
+const getMetricCount = async (category: string, name: string): Promise<number> => {
+  let metricsJSON: string;
+  try {
+    metricsJSON = await fs.readFile(metricsPath, 'utf8');
+  }
+  catch {
+    return 0;
+  }
+  const metrics = JSON.parse(metricsJSON);
+  return metrics[category][name] ?? 0;
+};
+// Returns the current managerActivity ok/error count for a page name, or 0 if absent.
+const getManagerActivityCount = async (name: string, outcome: 'ok' | 'error'): Promise<number> => {
+  let metricsJSON: string;
+  try {
+    metricsJSON = await fs.readFile(metricsPath, 'utf8');
+  }
+  catch {
+    return 0;
+  }
+  const metrics = JSON.parse(metricsJSON);
+  return metrics.managerActivity[name]?.[outcome] ?? 0;
+};
 
 // TESTS: routes table
 
@@ -267,11 +293,13 @@ test('GET /favicon.ico serves the favicon as an icon', async () => {
   assert.ok(res.headers['content-type'].includes('image/x-icon'));
 });
 
-test('GET /api/listReports returns JSON with report data', async () => {
+test('GET /api/listReports returns JSON with report data and records an API-operation metric', async () => {
+  const countBefore = await getMetricCount('apiOperations', 'listReports');
   const res = await request('GET', '/api/listReports');
   assert.equal(res.statusCode, 200);
   const body = jsonBody(res);
   assert.equal(body['tool name'], 'listReports');
+  assert.equal(await getMetricCount('apiOperations', 'listReports'), countBefore + 1);
 });
 
 test('GET /api/listIssues/260101T0000/mix returns JSON with issue data', async () => {
@@ -466,13 +494,15 @@ test('POST /api/requestRetest/260202T0000/new with valid JSON returns a JSON res
   assert.ok(body['tool name'] || body['response content']);
 });
 
-test('POST /api/requestFeature with valid JSON returns a JSON response', async () => {
+test('POST /api/requestFeature with valid JSON returns a JSON response and records an API-operation metric', async () => {
+  const countBefore = await getMetricCount('apiOperations', 'requestFeature');
   const res = await request('POST', '/api/requestFeature', {
     feature: 'Add a dark mode toggle'
   });
   assert.equal(res.statusCode, 200);
   const body = jsonBody(res);
   assert.ok(body['tool name'] || body['response content']);
+  assert.equal(await getMetricCount('apiOperations', 'requestFeature'), countBefore + 1);
 });
 
 test('POST /api/invalidService returns an error', async () => {
@@ -616,35 +646,41 @@ test('serveError sends HTML for human requests (isHumanUser = true)', async () =
 
 // TESTS: requestAction.html
 
-test('POST /requestAction.html with invalid auth code returns an error', {timeout: 500}, async () => {
+test('POST /requestAction.html with invalid auth code returns an error and records a managerActivity failure', {timeout: 500}, async () => {
+  const countBefore = await getManagerActivityCount('requestAction.html', 'error');
   const res = await formRequest('POST', '/requestAction.html', {
     target: 'https://example.com\tTest Page',
     authCode: 'wrong-code'
   });
   assert.equal(res.statusCode, 400);
-  assert.ok(res.body.includes('Invalid test order'));
+  assert.ok(res.body.includes('Invalid request'));
+  assert.equal(await getManagerActivityCount('requestAction.html', 'error'), countBefore + 1);
 });
 
-test('POST /requestAction.html with valid auth code and rejection (no description) returns HTML', async () => {
+test('POST /requestAction.html with valid auth code and rejection (no description) returns HTML and records a managerActivity success', async () => {
   await formRequest('POST', '/requestTest.html', {
     description: `Reject Test Page ${uniqueStamp}`,
     url: `https://example.com/reject-${uniqueStamp}`,
     why: 'Because accessibility matters'
   });
+  const countBefore = await getManagerActivityCount('requestAction.html', 'ok');
   const res = await formRequest('POST', '/requestAction.html', {
     target: `https://example.com/reject-${uniqueStamp}`,
     authCode: 'test-auth-code'
   });
   assert.equal(res.statusCode, 200);
   assert.ok(res.headers['content-type'].includes('text/html'));
+  assert.equal(await getManagerActivityCount('requestAction.html', 'ok'), countBefore + 1);
 });
 
 // TESTS: tutorialWeb (web user tutorial)
 
-test('GET /tutorialWeb.html returns HTML', async () => {
+test('GET /tutorialWeb.html returns HTML and records a page-view metric', async () => {
+  const countBefore = await getMetricCount('pageViews', 'tutorialWeb');
   const res = await request('GET', '/tutorialWeb.html');
   assert.equal(res.statusCode, 200);
   assert.ok(res.headers['content-type'].includes('text/html'));
+  assert.equal(await getMetricCount('pageViews', 'tutorialWeb'), countBefore + 1);
 });
 
 test('POST /tutorialWebComment.html with content returns JSON', async () => {
@@ -678,14 +714,16 @@ test('POST /requestAction.html with valid auth code and approval returns HTML',
   assert.ok(res.headers['content-type'].includes('text/html'));
 });
 
-test('POST /reannotate.html with invalid auth code returns an error page', async () => {
+test('POST /reannotate.html with invalid auth code returns an error page and records a managerActivity failure', async () => {
+  const countBefore = await getManagerActivityCount('reannotate.html', 'error');
   const res = await formRequest('POST', '/reannotate.html', {
     authCode: 'wrong-code'
   });
   assert.ok(res.headers['content-type'].includes('text/html'));
+  assert.equal(await getManagerActivityCount('reannotate.html', 'error'), countBefore + 1);
 });
 
-test('POST /reannotate.html with valid auth code serves the answer page', async () => {
+test('POST /reannotate.html with valid auth code serves the answer page and records a managerActivity success', async () => {
   // Back up all fixture reports, because reannotation modifies them in place.
   const reportsDir = path.join(fixtureDBDir, 'reports');
   const reportFiles = await fs.readdir(reportsDir);
@@ -694,12 +732,14 @@ test('POST /reannotate.html with valid auth code serves the answer page', async
     backups[file] = await fs.readFile(path.join(reportsDir, file), 'utf8');
   }
   try {
+    const countBefore = await getManagerActivityCount('reannotate.html', 'ok');
     const res = await formRequest('POST', '/reannotate.html', {
       authCode: 'test-auth-code'
     });
     assert.equal(res.statusCode, 200);
     assert.ok(res.headers['content-type'].includes('text/html'));
     assert.ok(res.body.includes('Reannotation order'));
+    assert.equal(await getManagerActivityCount('reannotate.html', 'ok'), countBefore + 1);
   }
   finally {
     // Restore all fixture reports.
@@ -709,14 +749,16 @@ test('POST /reannotate.html with valid auth code serves the answer page', async
   }
 });
 
-test('POST /renewWCAG.html with invalid auth code returns an error page', async () => {
+test('POST /renewWCAG.html with invalid auth code returns an error page and records a managerActivity failure', async () => {
+  const countBefore = await getManagerActivityCount('renewWCAG.html', 'error');
   const res = await formRequest('POST', '/renewWCAG.html', {
     authCode: 'wrong-code'
   });
   assert.ok(res.headers['content-type'].includes('text/html'));
+  assert.equal(await getManagerActivityCount('renewWCAG.html', 'error'), countBefore + 1);
 });
 
-test('POST /renewWCAG.html with valid auth code serves the answer page', async () => {
+test('POST /renewWCAG.html with valid auth code serves the answer page and records a managerActivity success', async () => {
   // Mock fetch to avoid a network dependency.
   const originalFetch = global.fetch;
   const wcagMapPath = path.join(import.meta.dirname, 'wcagMap.json');
@@ -727,12 +769,14 @@ test('POST /renewWCAG.html with valid auth code serves the answer page', async (
     text: async () => '<a href="understanding/contrast-minimum"><span class="secno">1.4.3 </span>'
   });
   try {
+    const countBefore = await getManagerActivityCount('renewWCAG.html', 'ok');
     const res = await formRequest('POST', '/renewWCAG.html', {
       authCode: 'test-auth-code'
     });
     assert.equal(res.statusCode, 200);
     assert.ok(res.headers['content-type'].includes('text/html'));
     assert.ok(res.body.includes('WCAG map renewed'));
+    assert.equal(await getManagerActivityCount('renewWCAG.html', 'ok'), countBefore + 1);
   }
   finally {
     global.fetch = originalFetch;
@@ -902,6 +946,101 @@ test('POST /worker/job with a claimed job assigned to the worker returns an erro
   await fs.unlink(failedJobPath).catch(() => {});
 });
 
+test('POST /worker/job skips a claimed job file that disappears between the directory listing and the read', {timeout: 500}, async (t) => {
+  // Create a claimed job assigned to a different worker, so it does not match this
+  // worker and would otherwise just be skipped normally, then make the read of that
+  // specific file (not the directory listing) throw ENOENT, simulating the file
+  // vanishing between getJobNames listing the claimed directory and this loop's read
+  // of the file it found there (e.g. because a concurrent report submission completed
+  // the job just after the listing).
+  const claimedDir = path.join(fixtureDBDir, 'jobs', 'claimed');
+  const queueDir = path.join(fixtureDBDir, 'jobs', 'queue');
+  for (const dir of [claimedDir, queueDir]) {
+    await fs.mkdir(dir, {recursive: true});
+    const files = await fs.readdir(dir).catch(() => []);
+    for (const file of files) {
+      await fs.unlink(path.join(dir, file)).catch(() => {});
+    }
+  }
+  const jobFile = '260101T0000-mix.json';
+  const claimedJobPath = path.join(claimedDir, jobFile);
+  await fs.writeFile(claimedJobPath, JSON.stringify({
+    id: '260101T0000-mix',
+    target: {what: 'Test', url: 'https://example.com/test'},
+    sources: {worker: 'Worker Two'}
+  }));
+  const originalReadFile = fs.readFile;
+  t.mock.method(fs, 'readFile', async (filePath: any, ...rest: any[]) => {
+    if (String(filePath) === claimedJobPath) {
+      await fs.unlink(claimedJobPath);
+      const error: any = new Error('ENOENT: no such file or directory');
+      error.code = 'ENOENT';
+      throw error;
+    }
+    return (originalReadFile as any)(filePath, ...rest);
+  });
+  try {
+    const auth = Buffer.from('worker1:secret1').toString('base64');
+    const res = await request('POST', '/worker/job', {}, {
+      authorization: `Basic ${auth}`
+    });
+    // With no queued jobs and the claimed job having vanished mid-read, the worker
+    // should just get told there is no job, rather than a 500 error from an
+    // unhandled ENOENT.
+    assert.equal(res.statusCode, 200);
+    const body = jsonBody(res);
+    assert.ok(!body.error);
+  }
+  finally {
+    t.mock.reset();
+    await fs.unlink(claimedJobPath).catch(() => {});
+  }
+});
+
+test('POST /worker/job propagates a non-ENOENT failure to read a claimed job file', {timeout: 500}, async (t) => {
+  // The catch in processJobRequest's claimed-job loop rethrows any failure other than
+  // the file having vanished (ENOENT). This confirms that a different failure, such as
+  // a permissions error, is not swallowed alongside the expected race condition.
+  const claimedDir = path.join(fixtureDBDir, 'jobs', 'claimed');
+  const queueDir = path.join(fixtureDBDir, 'jobs', 'queue');
+  for (const dir of [claimedDir, queueDir]) {
+    await fs.mkdir(dir, {recursive: true});
+    const files = await fs.readdir(dir).catch(() => []);
+    for (const file of files) {
+      await fs.unlink(path.join(dir, file)).catch(() => {});
+    }
+  }
+  const jobFile = '260101T0000-mix.json';
+  const claimedJobPath = path.join(claimedDir, jobFile);
+  await fs.writeFile(claimedJobPath, JSON.stringify({
+    id: '260101T0000-mix',
+    target: {what: 'Test', url: 'https://example.com/test'},
+    sources: {worker: 'Worker Two'}
+  }));
+  const originalReadFile = fs.readFile;
+  t.mock.method(fs, 'readFile', async (filePath: any, ...rest: any[]) => {
+    if (String(filePath) === claimedJobPath) {
+      const error: any = new Error('EACCES: permission denied');
+      error.code = 'EACCES';
+      throw error;
+    }
+    return (originalReadFile as any)(filePath, ...rest);
+  });
+  try {
+    const auth = Buffer.from('worker1:secret1').toString('base64');
+    const res = await request('POST', '/worker/job', {}, {
+      authorization: `Basic ${auth}`
+    });
+    // The request should fail loudly rather than silently proceeding as if there
+    // were no claimed job.
+    assert.equal(res.statusCode, 500);
+  }
+  finally {
+    t.mock.reset();
+    await fs.unlink(claimedJobPath).catch(() => {});
+  }
+});
+
 test('POST /worker/job with a queued job assigns it to the worker', {timeout: 500}, async () => {
   // Clean up claimed and queue directories.
   const claimedDir = path.join(fixtureDBDir, 'jobs', 'claimed');
@@ -1036,16 +1175,20 @@ test('GET /style.css with a read error returns an error page', async () => {
   }
 });
 
-test('GET /requestTest.html returns an error page when called without arguments', async () => {
+// requestTest.html and requestRetest.html are POST-only routes (see the
+// `routes.POST` list above). They also match the generic '*.html*' GET pattern,
+// but the generic `pageName.endsWith('.html')` branch of the GET dispatcher
+// excludes any path that is POST-only, since such a path's answer handler
+// expects POST's argument list and performs no GET-appropriate rendering.
+
+test('GET /requestTest.html without arguments is rejected as an invalid GET request', async () => {
   const res = await request('GET', '/requestTest.html');
   assert.equal(res.statusCode, 400);
-  assert.ok(res.headers['content-type'].includes('text/html'));
 });
 
-test('GET /requestRetest.html/260202T0000/new returns an error page when called as GET', async () => {
+test('GET /requestRetest.html/260202T0000/new is rejected as an invalid GET request', async () => {
   const res = await request('GET', '/requestRetest.html/260202T0000/new');
   assert.equal(res.statusCode, 400);
-  assert.ok(res.headers['content-type'].includes('text/html'));
 });
 
 // TESTS: GET HTML page routing
@@ -1065,11 +1208,12 @@ const htmlPagePaths = [
   '/reannotateForm.html',
   '/renewWCAGForm.html',
   '/hideReportForm.html',
-  '/unhideReportForm.html',
+  '/showHiddenReportsForm.html',
   '/expungeReportsForm.html',
   '/pruneReportsForm.html',
   '/rewindReportsForm.html',
-  '/ai0BalanceForm.html'
+  '/ai0BalanceForm.html',
+  '/metrics.html'
 ];
 
 for (const pagePath of htmlPagePaths) {
@@ -1080,6 +1224,187 @@ for (const pagePath of htmlPagePaths) {
   });
 }
 
+test('POST /metrics.html with a valid authCode serves the usage-metrics table and records a managerActivity success', async () => {
+  const countBefore = await getManagerActivityCount('metrics', 'ok');
+  const res = await formRequest('POST', '/metrics.html', {authCode: 'test-auth-code'});
+  assert.equal(res.statusCode, 200);
+  assert.ok(res.headers['content-type'].includes('text/html'));
+  assert.equal(await getManagerActivityCount('metrics', 'ok'), countBefore + 1);
+});
+
+test('POST /metrics.html with a valid authCode sets a metrics-exclusion cookie', async () => {
+  const res = await formRequest('POST', '/metrics.html', {authCode: 'test-auth-code'});
+  const setCookie = res.headers['set-cookie']?.[0] ?? res.headers['set-cookie'];
+  assert.ok(setCookie);
+  assert.ok(setCookie.startsWith('kilotestExclude='));
+  assert.ok(setCookie.includes('Max-Age=2592000'));
+  assert.ok(setCookie.includes('HttpOnly'));
+});
+
+test('GET /metrics.html with a valid authCode in the query string does not set a cookie or show the counts', async () => {
+  const res = await request('GET', '/metrics.html?authCode=test-auth-code');
+  assert.equal(res.statusCode, 200);
+  assert.equal(res.headers['set-cookie'], undefined);
+  assert.ok(res.body.includes('Authorization code'));
+  assert.ok(!res.body.includes('Web page views'));
+});
+
+test('a request carrying the metrics-exclusion cookie does not record a pageViews or apiOperations metric', async () => {
+  const {getExclusionCookieValue} = await import('./util.ts');
+  const cookieHeader = `kilotestExclude=${getExclusionCookieValue()}`;
+  const pageViewCountBefore = await getMetricCount('pageViews', 'tutorialWeb');
+  const apiOperationCountBefore = await getMetricCount('apiOperations', 'listReports');
+  await request('GET', '/tutorialWeb.html', null, {cookie: cookieHeader});
+  await request('GET', '/api/listReports', null, {cookie: cookieHeader});
+  assert.equal(await getMetricCount('pageViews', 'tutorialWeb'), pageViewCountBefore);
+  assert.equal(await getMetricCount('apiOperations', 'listReports'), apiOperationCountBefore);
+});
+
+test('a request carrying an invalid exclusion cookie still records metrics normally', async () => {
+  const pageViewCountBefore = await getMetricCount('pageViews', 'tutorialWeb');
+  await request('GET', '/tutorialWeb.html', null, {cookie: 'kilotestExclude=wrong-value'});
+  assert.equal(await getMetricCount('pageViews', 'tutorialWeb'), pageViewCountBefore + 1);
+});
+
+test('a request with an unrelated cookie still records metrics normally', async () => {
+  const pageViewCountBefore = await getMetricCount('pageViews', 'tutorialWeb');
+  await request('GET', '/tutorialWeb.html', null, {cookie: 'someOtherCookie=1'});
+  assert.equal(await getMetricCount('pageViews', 'tutorialWeb'), pageViewCountBefore + 1);
+});
+
+test('GET / and GET /index.html record a pageViews metric under "index"', async () => {
+  const countBefore = await getMetricCount('pageViews', 'index');
+  await request('GET', '/');
+  await request('GET', '/index.html');
+  assert.equal(await getMetricCount('pageViews', 'index'), countBefore + 2);
+});
+
+test('POST /metrics.html with an invalid authCode is rejected and records a managerActivity failure', async () => {
+  const countBefore = await getManagerActivityCount('metrics', 'error');
+  const res = await formRequest('POST', '/metrics.html', {authCode: 'wrong'});
+  assert.equal(res.statusCode, 400);
+  assert.equal(await getManagerActivityCount('metrics', 'error'), countBefore + 1);
+});
+
+test('GET /hideReportForm.html records managerActivity, not a pageViews entry', async () => {
+  const managerCountBefore = await getManagerActivityCount('hideReportForm', 'ok');
+  const pageViewCountBefore = await getMetricCount('pageViews', 'hideReportForm');
+  const res = await request('GET', '/hideReportForm.html');
+  assert.equal(res.statusCode, 200);
+  assert.equal(await getManagerActivityCount('hideReportForm', 'ok'), managerCountBefore + 1);
+  assert.equal(await getMetricCount('pageViews', 'hideReportForm'), pageViewCountBefore);
+});
+
+// TESTS: hidden report list is never served on a direct GET, only via showHiddenReports
+
+test('GET /unhideReportForm.html is rejected, since the hidden-report list must not be disclosed without an authorization code', async () => {
+  const res = await request('GET', '/unhideReportForm.html');
+  assert.equal(res.statusCode, 400);
+  assert.ok(!res.body.includes('260101T0007-hid'));
+});
+
+test('GET /showHiddenReportsForm.html displays a bare authCode form, disclosing no report names', async () => {
+  const res = await request('GET', '/showHiddenReportsForm.html');
+  assert.equal(res.statusCode, 200);
+  assert.ok(res.body.includes('Authorization code'));
+  assert.ok(!res.body.includes('260101T0007-hid'));
+});
+
+test('POST /showHiddenReportsForm.html with a valid authCode serves the hidden-report list and records a managerActivity success', async () => {
+  const countBefore = await getManagerActivityCount('showHiddenReportsForm', 'ok');
+  const res = await formRequest('POST', '/showHiddenReportsForm.html', {authCode: 'test-auth-code'});
+  assert.equal(res.statusCode, 200);
+  assert.ok(res.body.includes('type="radio"'));
+  assert.equal(await getManagerActivityCount('showHiddenReportsForm', 'ok'), countBefore + 1);
+});
+
+test('POST /showHiddenReportsForm.html with an invalid authCode is rejected and records a managerActivity failure', async () => {
+  const countBefore = await getManagerActivityCount('showHiddenReportsForm', 'error');
+  const res = await formRequest('POST', '/showHiddenReportsForm.html', {authCode: 'wrong'});
+  assert.equal(res.statusCode, 400);
+  assert.equal(await getManagerActivityCount('showHiddenReportsForm', 'error'), countBefore + 1);
+});
+
+// TESTS: self-submitting manager pages now POST their own submissions (formerly GET)
+
+test('POST /ai0BalanceForm.html with a valid authCode records the balance and records a managerActivity success', async () => {
+  const countBefore = await getManagerActivityCount('ai0BalanceForm', 'ok');
+  const res = await formRequest('POST', '/ai0BalanceForm.html', {
+    newBalance: '42.50',
+    authCode: 'test-auth-code'
+  });
+  assert.equal(res.statusCode, 200);
+  assert.ok(res.headers['content-type'].includes('text/html'));
+  assert.ok(res.body.includes('$42.5'));
+  assert.equal(await getManagerActivityCount('ai0BalanceForm', 'ok'), countBefore + 1);
+});
+
+test('POST /ai0BalanceForm.html with an invalid authCode is rejected and records a managerActivity failure', async () => {
+  const countBefore = await getManagerActivityCount('ai0BalanceForm', 'error');
+  const res = await formRequest('POST', '/ai0BalanceForm.html', {
+    newBalance: '10',
+    authCode: 'wrong-code'
+  });
+  assert.equal(res.statusCode, 400);
+  assert.equal(await getManagerActivityCount('ai0BalanceForm', 'error'), countBefore + 1);
+});
+
+test('POST /hideReportForm.html with an invalid authCode is rejected and records a managerActivity failure', async () => {
+  const countBefore = await getManagerActivityCount('hideReportForm', 'error');
+  const res = await formRequest('POST', '/hideReportForm.html', {
+    report: '260101T0009-brd',
+    authCode: 'wrong-code'
+  });
+  assert.equal(res.statusCode, 400);
+  assert.equal(await getManagerActivityCount('hideReportForm', 'error'), countBefore + 1);
+});
+
+test('POST /unhideReportForm.html with an invalid authCode is rejected and records a managerActivity failure', async () => {
+  const countBefore = await getManagerActivityCount('unhideReportForm', 'error');
+  const res = await formRequest('POST', '/unhideReportForm.html', {
+    report: '260101T0009-brd',
+    authCode: 'wrong-code'
+  });
+  assert.equal(res.statusCode, 400);
+  assert.equal(await getManagerActivityCount('unhideReportForm', 'error'), countBefore + 1);
+});
+
+test('POST /expungeReportsForm.html with no selections shows the form and records a managerActivity success', async () => {
+  const countBefore = await getManagerActivityCount('expungeReportsForm', 'ok');
+  const res = await formRequest('POST', '/expungeReportsForm.html', {});
+  assert.equal(res.statusCode, 200);
+  assert.equal(await getManagerActivityCount('expungeReportsForm', 'ok'), countBefore + 1);
+});
+
+test('POST /pruneReportsForm.html with no selections shows the form and records a managerActivity success', async () => {
+  const countBefore = await getManagerActivityCount('pruneReportsForm', 'ok');
+  const res = await formRequest('POST', '/pruneReportsForm.html', {});
+  assert.equal(res.statusCode, 200);
+  assert.equal(await getManagerActivityCount('pruneReportsForm', 'ok'), countBefore + 1);
+});
+
+test('POST /rewindReportsForm.html with no selections shows the form and records a managerActivity success', async () => {
+  const countBefore = await getManagerActivityCount('rewindReportsForm', 'ok');
+  const res = await formRequest('POST', '/rewindReportsForm.html', {});
+  assert.equal(res.statusCode, 200);
+  assert.equal(await getManagerActivityCount('rewindReportsForm', 'ok'), countBefore + 1);
+});
+
+test('GET /pruneReportsForm.html records a managerActivity failure when a report file is corrupt', {timeout: 500}, async () => {
+  const reportPath = path.join(fixtureDBDir, 'reports', '260101T0001-ct.json');
+  const backup = await fs.readFile(reportPath, 'utf8');
+  const countBefore = await getManagerActivityCount('pruneReportsForm', 'error');
+  try {
+    await fs.writeFile(reportPath, 'not valid json');
+    const res = await request('GET', '/pruneReportsForm.html');
+    assert.equal(res.statusCode, 400);
+    assert.equal(await getManagerActivityCount('pruneReportsForm', 'error'), countBefore + 1);
+  }
+  finally {
+    await fs.writeFile(reportPath, backup);
+  }
+});
+
 test('GET /enqueueForm.html shows requests when testRequests.json has entries', async () => {
   await fs.writeFile(testRequestsPath, JSON.stringify({
     'https://example.com/enqueue-test': [
@@ -1186,34 +1511,38 @@ test('POST /mcp with a valid initialize request returns server info via SSE', as
 
 test('POST /requestTest.html with valid format but duplicate URL returns an answer error', {timeout: 500}, async () => {
   await fs.writeFile(testRequestsPath, '{}\n');
-  // First request to create the request.
+  // First request to create the request. processTestRequest treats a request as a
+  // duplicate only when description, URL, AND reason all match an existing pending
+  // request, so the reason must be identical between the two requests here.
   await formRequest('POST', '/requestTest.html', {
     description: `Dup Test Page ${uniqueStamp}`,
     url: `https://example.com/dup-${uniqueStamp}`,
     why: 'Because accessibility matters'
   });
-  // Second request with the same URL should get a duplicate error.
+  // Second, identical request should get a duplicate error.
   const res = await formRequest('POST', '/requestTest.html', {
     description: `Dup Test Page ${uniqueStamp}`,
     url: `https://example.com/dup-${uniqueStamp}`,
-    why: 'Because accessibility matters again'
+    why: 'Because accessibility matters'
   });
   assert.equal(res.statusCode, 400);
-  assert.ok(res.body.includes('Duplicate request'));
+  assert.ok(res.body.includes('Test request duplicates an already submitted request'));
 });
 
 test('POST /requestRetest.html with valid format but duplicate retest returns an answer error', {timeout: 500}, async () => {
   await fs.writeFile(testRequestsPath, '{}\n');
-  // First retest to create the recommendation.
+  // First retest to create the recommendation. As above, the reason must match
+  // exactly between the two requests for processTestRequest to treat the second as
+  // a duplicate rather than a second, independent (and thus also 'ok') request.
   await formRequest('POST', '/requestRetest.html/260202T0000/new', {
     why: 'Because the report is obsolete and needs refreshing'
   });
-  // Second retest with the same report should get a duplicate error.
+  // Second, identical retest of the same report should get a duplicate error.
   const res = await formRequest('POST', '/requestRetest.html/260202T0000/new', {
-    why: 'Because the report is obsolete and needs refreshing again'
+    why: 'Because the report is obsolete and needs refreshing'
   });
   assert.equal(res.statusCode, 400);
-  assert.ok(res.body.includes('Duplicate request'));
+  assert.ok(res.body.includes('Test request duplicates an already submitted request'));
 });
 
 test('POST /requestAction.html with valid auth code and approval of a duplicate returns an error', {timeout: 500}, async () => {
@@ -1250,7 +1579,7 @@ test('POST /requestAction.html with valid auth code and approval of an invalid U
     what: 'yes'
   });
   assert.equal(res.statusCode, 400);
-  assert.ok(res.body.includes('Invalid authorization code'));
+  assert.ok(res.body.includes('Invalid request'));
 });
 
 // UNIT TESTS FOR serveError