@remit/backend 0.0.93 → 0.0.94

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/backend",
-  "version": "0.0.93",
+  "version": "0.0.94",
   "description": "Remit Mail Inspector API backend",
   "license": "MIT",
   "author": "",

package/src/handlers/system-update.test.ts

@@ -10,8 +10,9 @@ import {
 import { join } from "node:path";
 import { after, afterEach, before, beforeEach, describe, it } from "node:test";
 import { fileURLToPath } from "node:url";
-import type { APIGatewayProxyEvent } from "aws-lambda";
+import type { APIGatewayProxyEvent, APIGatewayProxyResult } from "aws-lambda";
 import type { Context } from "openapi-backend";
+import { normalizeRequest } from "../request.js";
 import { SystemOperations } from "./system-update.js";
 
 const tmpRoot = join(
@@ -415,3 +416,35 @@ describe("POST /system/update", () => {
 		assert.ok(stamped >= before - 1000 && stamped <= after + 1000);
 	});
 });
+
+describe("GET /system/update through the whole request pipeline", () => {
+	it("records the check for ?refresh=true off the wire", async () => {
+		// The rest of this file hands the handler a query the validator has already
+		// coerced. Here the query arrives as API Gateway delivers it — every value a
+		// string — and goes through the real built spec, which is where the press
+		// was being answered with 400 instead of reaching the handler at all.
+		writeState(okState);
+		const { api } = await import("../index.js");
+
+		const event = {
+			httpMethod: "GET",
+			path: "/system/update",
+			queryStringParameters: { refresh: "true" },
+			headers: {},
+			requestContext: { authorizer: { claims: { sub: USER } } },
+		} as unknown as APIGatewayProxyEvent;
+
+		const result = (await api.handleRequest(
+			normalizeRequest(event),
+			event,
+			{} as never,
+		)) as APIGatewayProxyResult;
+
+		assert.equal(result.statusCode, 200);
+		assert.deepEqual(
+			JSON.parse(readFileSync(join(controlDir, "check-request.json"), "utf8")),
+			{},
+		);
+		assert.deepEqual(JSON.parse(result.body), okState);
+	});
+});

package/src/openapi-spec.test.ts

@@ -0,0 +1,44 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { OpenAPISpec } from "./index.js";
+
+type Parameter = {
+	name: string;
+	in: string;
+	explode?: boolean;
+};
+
+const queryParameters = (): Array<{
+	operationId: string;
+	param: Parameter;
+}> => {
+	const found: Array<{ operationId: string; param: Parameter }> = [];
+	for (const item of Object.values(OpenAPISpec.paths ?? {})) {
+		for (const operation of Object.values(item ?? {})) {
+			const { operationId, parameters } = operation as {
+				operationId?: string;
+				parameters?: Parameter[];
+			};
+			if (!operationId || !parameters) continue;
+			for (const param of parameters) {
+				if (param.in === "query") found.push({ operationId, param });
+			}
+		}
+	}
+	return found;
+};
+
+describe("the built OpenAPI spec", () => {
+	it("declares every query parameter exploded", () => {
+		// openapi-backend splits a non-exploded query value on commas before it
+		// validates, so `?refresh=true` arrives at the validator as `["true"]` and
+		// is refused as "must be boolean" — the handler never runs. Exploded is the
+		// wire-identical form for a scalar, so every `@query` in main.tsp carries
+		// `#{ explode: true }`.
+		const offenders = queryParameters()
+			.filter(({ param }) => param.explode === false)
+			.map(({ operationId, param }) => `${operationId}.${param.name}`);
+
+		assert.deepEqual(offenders, []);
+	});
+});