@luckystack/test-runner 0.8.3 → 0.8.5

package/CHANGELOG.md

@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- Test-only: the `runAllTests` characterization suite now mocks `@luckystack/login`, so it no longer cold-loads that package (and its dependency graph) on every `authToken` case. This removes a timeout-under-load flake and adds the first assertions for the CSRF-header branch of `buildAuthHeaders`, which previously degraded to a warning on every run. No runtime behaviour change.
+
+## [0.8.4] - 2026-08-17
+
+### Changed
+
+- Documented the fail-closed `/_test/reset` contract accurately: exact development/test mode plus required token, default Redis session namespaces only, and no application-DB or custom-SessionAdapter cleanup.
+
 ## [0.7.4] - 2026-07-22
 
 ### Added

package/CLAUDE.md

@@ -19,7 +19,7 @@ Generated-type-driven test layers voor LuckyStack APIs. Walkt elke endpoint uit
 - Voor unit tests van pure functions binnen `_api/*` — gebruik vitest/jest direct, niet deze runner.
 - Voor frontend-UI tests — gebruik Playwright/`webapp-testing` skill, deze runner is server-only.
 - Wanneer er geen generated `apiMethodMap` beschikbaar is (project gebruikt geen `@luckystack/devkit`).
-- Wanneer de target server productie is — fuzz/rate-limit layers maken honderden requests en `/_test/reset` is daar uit.
+- Wanneer de target server productie is — fuzz/rate-limit layers maken honderden requests en `/_test/reset` bestaat alleen bij exact `NODE_ENV=development|test` plus een verplicht `TEST_RESET_TOKEN`.
 - Voor sync-event testing via de auto-sweep — die walkt momenteel alleen API endpoints, niet de sync map (sync support voor de auto-layers staat op de roadmap maar is nog niet geleverd). Layer 5 (`runCustomTests` / `<name>_v<N>.tests.ts`) ondersteunt al wél sync routes via per-route testfiles naast `_sync/` sources.
 
 ## Function Index
@@ -39,7 +39,7 @@ Generated-type-driven test layers voor LuckyStack APIs. Walkt elke endpoint uit
 | `runRateLimitTests({ apiMethodMap, apiMetaMap, baseUrl, skip?, inputFor?, headers?, maxRateLimitToTest?, resetBetweenEndpoints?, resetToken?, onResult? })` | Sweep alle `rateLimit: N` endpoints | → docs/rate-limit-tests.md |
 | `runFuzzCheck({ endpoint, baseUrl, headers? })` | Single-endpoint crash-resistance fuzz | → docs/fuzz-tests.md |
 | `runFuzzTests({ apiMethodMap, baseUrl, skip?, headers?, onResult? })` | Sweep fuzz layer (nightly CI) | → docs/fuzz-tests.md |
-| `resetServerState({ baseUrl, token? })` | POST naar `/_test/reset` om DB+Redis schoon te maken | → docs/rate-limit-tests.md |
+| `resetServerState({ baseUrl, token? })` | POST naar `/_test/reset` om rate limits + standaard Redis-sessienamespaces te wissen; niet app-DB/custom adapters | → docs/rate-limit-tests.md |
 | `resolveTestBaseUrl({ cwd?, fallbackUrl? })` | Resolves `TEST_BASE_URL` → actually-bound dev port advertisement → caller fallback, so an auto-hop does not create false connection failures. | → docs/contract-tests.md |
 | `resolveTestEnvironment({ loadProjectConfig? })` | Laadt `.env`-lagen en resolveert optionele secret-manager-pointers in het testproces vóór DB/Redis-backed Layer-5 modules importeren. | → docs/contract-tests.md |
 | `sampleSchemaInput(schema, options?)` | Genereert Zod-valid sample payload uit een schema. `options.stringPrefix` tagt UNCONSTRAINED strings (finding #98) — format/checked strings blijven ongeprefixt zodat ze valid blijven. | → docs/contract-tests.md |
@@ -80,7 +80,7 @@ Generated-type-driven test layers voor LuckyStack APIs. Walkt elke endpoint uit
 
 - `TEST_BASE_URL` (env, test process) — explicit target override consumed first by `resolveTestBaseUrl`; otherwise it reads `node_modules/.luckystack/dev-server.json` and then uses the supplied config-derived fallback.
 - `RunAllTestsInput.loadProjectConfig` / `RunCustomTestsInput.loadProjectConfig` — verplichte lazy loader voor de default export van consumer `config.ts`. De runner laadt eerst `.env`/`.env.local`, leest daarna deze config en draait bij een niet-lege `secretManager.url` `initSecretManager({...config, source:'remote'})` vóór custom test imports. `runAllTests` doet dit één keer voor alle lagen; directe Layer-5-calls doen het zelf. Een ontbrekende loader of geconfigureerd-maar-ontbrekende secret-manager is een harde fout.
-- `NODE_ENV` (env, server-side) — `/_test/reset` is automatisch beschikbaar wanneer NIET `production`.
+- `NODE_ENV` (env, server-side) — `/_test/reset` is alleen beschikbaar bij exact `development` of `test`.
 - `TEST_RESET_TOKEN` (env, optional, server-side) — wanneer gezet moet `resetServerState({ token })` deze meesturen als `X-Test-Reset-Token`. Verplicht voor staging/preview deploys die het endpoint over het netwerk exposen.
 - `RunRateLimitTestsInput.maxRateLimitToTest` (default `50`) — endpoints met hogere `rateLimit` worden geskipt om duizenden requests in CI te vermijden.
 - `RunRateLimitTestsInput.resetBetweenEndpoints` (default `false`) — hit `/_test/reset` voor elke endpoint zodat het shared IP-bucket schoon is.
@@ -91,10 +91,10 @@ Generated-type-driven test layers voor LuckyStack APIs. Walkt elke endpoint uit
 
 ## Peer dependencies
 
-- **Required**: `zod@^4.0.0` (peer), `socket.io-client@^4.8.0` (peer — `streamWatcher.ts` opent een tweede socket voor `ctx.watchStream`), `@luckystack/core@^0.1.0` (dependency — levert de helpers die de runner consumeert: `tryCatch`/`tryCatchSync`, `getProjectConfig`/`getCsrfConfig`, `getSrcDir` (default src-dir voor custom-test discovery in `customTests.ts`), `getPrismaClient` (Layer-5 `ctx.prisma`) en `clearAllRateLimits`. De `apiMethodMap` zelf wordt door de consumer als argument doorgegeven, niet uit een pad gelezen).
-- **Required server-side**: `@luckystack/server` met `/_test/reset` endpoint gemount (default ingebouwd, gated op `NODE_ENV !== 'production'`).
+- **Required**: `zod@^4.0.0` (peer), `socket.io-client@^4.8.0` (peer — `streamWatcher.ts` opent een tweede socket voor `ctx.watchStream`), `@luckystack/core` (direct runtime dependency — levert de helpers die de runner consumeert: `tryCatch`/`tryCatchSync`, `getProjectConfig`/`getCsrfConfig`, `getSrcDir` (default src-dir voor custom-test discovery in `customTests.ts`), `getPrismaClient` (Layer-5 `ctx.prisma`) en `clearAllRateLimits`. De `apiMethodMap` zelf wordt door de consumer als argument doorgegeven, niet uit een pad gelezen).
+- **Required server-side**: `@luckystack/server` met `/_test/reset` gemount, exact `NODE_ENV=development|test`, en een niet-lege `TEST_RESET_TOKEN`.
 - **Required generated artefact**: `apiMethodMap.generated.ts` (en `apiMetaMap.generated.ts` voor de auth/rate-limit layers), geproduceerd door `@luckystack/devkit`.
-- **Optional**: `@luckystack/secret-manager@^0.7.3` (optional peer) — alleen dynamisch geladen wanneer `loadProjectConfig` een niet-lege `config.secretManager.url` teruggeeft. Zonder secret-managerconfig blijft de runner een gewone lokale-env flow.
+- **Optional**: `@luckystack/secret-manager@^0.8.4` (optional peer) — alleen dynamisch geladen wanneer `loadProjectConfig` een niet-lege `config.secretManager.url` teruggeeft. Zonder secret-managerconfig blijft de runner een gewone lokale-env flow.
 
 ## Related
 

package/README.md

@@ -52,7 +52,7 @@ The fuzz layer is intentionally exhaustive and slow — wire it into nightly CI
 
 ## Server hooks it depends on
 
-- `/_test/reset` endpoint — served by `@luckystack/server` outside production (gated on `NODE_ENV !== 'production'` and an optional `TEST_RESET_TOKEN`). Used by `resetServerState` to clear DB + Redis between layers. Make sure `TEST_RESET_TOKEN` is set in any non-prod environment that is reachable over the network.
+- `/_test/reset` endpoint — served by `@luckystack/server` only when `NODE_ENV` is exactly `development` or `test`, and always gated by a non-empty `TEST_RESET_TOKEN`. `resetServerState` clears framework rate-limit state plus the default Redis session/active-user namespaces; it does not clear application database rows or custom `SessionAdapter` stores.
 - `apiMethodMap.generated.ts` — produced by `@luckystack/devkit` from your `_api/*` files. Defaults are read via `getApiMethodMapPath()` from `@luckystack/core`.
 
 ## Public API

package/docs/rate-limit-tests.md

@@ -69,7 +69,7 @@ Behavior notes:
 
 ### `resetServerState(input)`
 
-POST to the server's `/_test/reset` endpoint. Used between rate-limit probes and at the start of a CI run to ensure a clean slate.
+POST to the server's `/_test/reset` endpoint. Used between rate-limit probes and at CI bookends to clear framework-owned limiter/default-session state; it is not a general application-database reset.
 
 Signature:
 
@@ -84,7 +84,7 @@ interface ResetServerStateInput {
 
 Returns `true` when the server responds 2xx, `false` on network error, parse error, or non-2xx. The error is swallowed deliberately — the most common reason for `false` is "the route is disabled in this environment", and the caller usually wants to proceed anyway.
 
-URL: `${baseUrl}/_test/reset` (POST). When `token` is set, the request includes `X-Test-Reset-Token: ${token}`. The header name is part of the server contract.
+URL: `${baseUrl}/_test/reset` (POST). Supply `token` (normally `TEST_RESET_TOKEN`); the request sends it as `X-Test-Reset-Token`. The server always requires a non-empty matching value.
 
 ## `/_test/reset` server contract
 
@@ -98,7 +98,7 @@ Gating, in order:
 What it clears (when both gates pass):
 
 - **All rate-limit buckets** via `clearAllRateLimits()` from `@luckystack/core`. Every key under the rate-limit Redis namespace is dropped. Always cleared.
-- **All sessions** under `${projectName}-session:*` and active-user records under `${projectName}-activeUsers:*`. Scanned in batches of 200 keys via `redis.scan + redis.del`. Project name comes from `getProjectName()` for consistency across `session.ts`, `rateLimiter.ts`, and this endpoint.
+- **Default Redis session namespaces** matching `formatKey('-session', '') + ':*'` and `formatKey('-activeUsers', '') + ':*'`. They are scanned in batches of 200 and follow the registered Redis key formatter.
 - **Registered runtime hooks** when `?include=hooks` is in the query string. NOT included by default because framework-internal handlers (e.g. presence postLogout) register at boot — clearing them would require a server restart to recover.
 
 Response:
@@ -109,6 +109,8 @@ Response:
 
 The `cleared` array reflects what actually had keys to drop. It is informational; `runRateLimitTests` only checks `response.ok`.
 
+> **Storage boundary:** the endpoint does not call `SessionAdapter`. A custom DynamoDB/Postgres/in-memory session store survives this reset, as do application database rows. Tests using custom storage must clear it explicitly in their own setup/teardown.
+
 ## Types
 
 ```ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@luckystack/test-runner",
-  "version": "0.8.3",
+  "version": "0.8.5",
   "private": false,
   "publishConfig": {
     "access": "public",
@@ -54,11 +54,11 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@luckystack/core": "^0.8.3"
+    "@luckystack/core": "^0.8.5"
   },
   "peerDependencies": {
-    "@luckystack/login": "^0.8.3",
-    "@luckystack/secret-manager": "^0.8.3",
+    "@luckystack/login": "^0.8.5",
+    "@luckystack/secret-manager": "^0.8.5",
     "socket.io-client": "^4.8.0",
     "zod": "^4.0.0"
   },