@saluzi/saluzi-edu 0.2.11 → 0.2.13

package/packages/remote-control-server/src/__tests__/route-mounting.test.ts

@@ -0,0 +1,212 @@
+import { describe, test, expect, beforeEach, mock } from 'bun:test'
+import { mockConfigModule } from './helpers/mock-config'
+
+// Mock config before any imports
+mock.module('../config', () => mockConfigModule())
+
+import { Hono } from 'hono'
+import type { MiddlewareHandler } from 'hono/types'
+import { resetDbSingleton, getDb } from '../db/sqlite'
+
+// Dummy serveStatic — returns a middleware.
+// When `path: 'index.html'` is set, serves SPA fallback HTML.
+// Otherwise, passes through (simulates "file not found" so downstream routes handle it).
+const serveStatic: (opts: Record<string, unknown>) => MiddlewareHandler = (
+  opts: Record<string, unknown>,
+) => {
+  const path = opts.path as string | undefined
+  if (path === 'index.html') {
+    return c => c.html('<!DOCTYPE html><html><body>SPA</body></html>')
+  }
+  return async (_c, next) => {
+    await next()
+  }
+}
+
+// Dummy upgradeWebSocket
+const upgradeWebSocket = (() => {
+  return () => (c: import('hono').Context, next: import('hono').Next) =>
+    next()
+}) as import('hono/ws').UpgradeWebSocket<unknown>
+
+import { registerRoutes } from '../registerRoutes'
+
+function createApp(): Hono {
+  const app = new Hono()
+  registerRoutes(app, serveStatic, upgradeWebSocket)
+  return app
+}
+
+function setupTestDb(): void {
+  resetDbSingleton()
+  // Force init with an in-memory-like temp path
+  getDb()
+}
+
+describe('Route mounting integration', () => {
+  let app: Hono
+
+  beforeEach(() => {
+    setupTestDb()
+    app = createApp()
+  })
+
+  // -------------------------------------------------------------------------
+  // Task 1: auth-routes mounted at /web/auth
+  // -------------------------------------------------------------------------
+  describe('auth-routes mounted at /web/auth', () => {
+    test('GET /web/auth/me returns 401 (not 404) when unauthenticated', async () => {
+      const res = await app.request('/web/auth/me', { method: 'GET' })
+      // Should NOT be 404 — route is mounted. 401 because no auth token.
+      expect(res.status).not.toBe(404)
+      expect(res.status).toBe(401)
+    })
+
+    test('POST /web/auth/login returns 400 (not 404) for empty body', async () => {
+      const res = await app.request('/web/auth/login', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({}),
+      })
+      // Route exists → should not 404. Missing fields → 400.
+      expect(res.status).not.toBe(404)
+      expect(res.status).toBe(400)
+    })
+
+    test('GET /web/auth/setup-status returns 200 (not 404)', async () => {
+      const res = await app.request('/web/auth/setup-status', {
+        method: 'GET',
+      })
+      expect(res.status).not.toBe(404)
+      expect(res.status).toBe(200)
+    })
+  })
+
+  // -------------------------------------------------------------------------
+  // Task 1: shares mounted at /web
+  // -------------------------------------------------------------------------
+  describe('shares routes mounted at /web', () => {
+    test('POST /web/sessions/test/share returns 401 (not 404)', async () => {
+      const res = await app.request('/web/sessions/test/share', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({}),
+      })
+      // Route mounted → not 404. No auth → 401.
+      expect(res.status).not.toBe(404)
+      expect(res.status).toBe(401)
+    })
+
+    test('GET /web/sessions/s/test-token returns 401 (not 404)', async () => {
+      const res = await app.request('/web/sessions/s/test-token', {
+        method: 'GET',
+      })
+      // Route mounted → not 404. No auth → 401.
+      expect(res.status).not.toBe(404)
+      expect(res.status).toBe(401)
+    })
+  })
+
+  // -------------------------------------------------------------------------
+  // Task 1: teams mounted at /web
+  // -------------------------------------------------------------------------
+  describe('teams routes mounted at /web', () => {
+    test('GET /web/teams returns 401 (not 404)', async () => {
+      const res = await app.request('/web/teams', { method: 'GET' })
+      // Route mounted → not 404. No auth → 401.
+      expect(res.status).not.toBe(404)
+      expect(res.status).toBe(401)
+    })
+
+    test('POST /web/teams returns 401 (not 404)', async () => {
+      const res = await app.request('/web/teams', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ name: 'test', slug: 'test-team' }),
+      })
+      expect(res.status).not.toBe(404)
+      expect(res.status).toBe(401)
+    })
+  })
+
+  // -------------------------------------------------------------------------
+  // Existing /web/bind stub still works
+  // -------------------------------------------------------------------------
+  describe('legacy /web/bind stub preserved', () => {
+    test('POST /web/bind returns 410 Gone', async () => {
+      const res = await app.request('/web/bind', { method: 'POST' })
+      expect(res.status).toBe(410)
+    })
+  })
+})
+
+describe('SPA fallback', () => {
+  let app: Hono
+
+  beforeEach(() => {
+    setupTestDb()
+    app = createApp()
+  })
+
+  test('GET /login serves index.html (SPA fallback)', async () => {
+    const res = await app.request('/login', { method: 'GET' })
+    expect(res.status).toBe(200)
+    const text = await res.text()
+    expect(text).toContain('SPA')
+  })
+
+  test('GET /setup serves index.html', async () => {
+    const res = await app.request('/setup', { method: 'GET' })
+    expect(res.status).toBe(200)
+    const text = await res.text()
+    expect(text).toContain('SPA')
+  })
+
+  test('GET /join serves index.html', async () => {
+    const res = await app.request('/join', { method: 'GET' })
+    expect(res.status).toBe(200)
+    const text = await res.text()
+    expect(text).toContain('SPA')
+  })
+
+  test('GET /settings serves index.html', async () => {
+    const res = await app.request('/settings', { method: 'GET' })
+    expect(res.status).toBe(200)
+    const text = await res.text()
+    expect(text).toContain('SPA')
+  })
+
+  test('GET /teams serves index.html', async () => {
+    const res = await app.request('/teams', { method: 'GET' })
+    expect(res.status).toBe(200)
+    const text = await res.text()
+    expect(text).toContain('SPA')
+  })
+
+  test('GET /teams/some-id serves index.html', async () => {
+    const res = await app.request('/teams/some-id', { method: 'GET' })
+    expect(res.status).toBe(200)
+    const text = await res.text()
+    expect(text).toContain('SPA')
+  })
+
+  test('SPA fallback does NOT intercept /web/auth/me', async () => {
+    const res = await app.request('/web/auth/me', { method: 'GET' })
+    // Should be 401 from the auth route, not 200 from SPA fallback
+    expect(res.status).toBe(401)
+  })
+
+  test('SPA fallback does NOT intercept /v1/sessions', async () => {
+    const res = await app.request('/v1/sessions', { method: 'GET' })
+    // Should not be SPA fallback — expect a real API response (likely 401)
+    const text = await res.text()
+    expect(text).not.toContain('SPA')
+  })
+
+  test('Existing /code fallback still works', async () => {
+    const res = await app.request('/code', { method: 'GET' })
+    expect(res.status).toBe(200)
+    const text = await res.text()
+    expect(text).toContain('SPA')
+  })
+})

package/packages/remote-control-server/src/__tests__/routes.test.ts

@@ -539,61 +539,22 @@ describe('Web Auth Routes', () => {
     app = createApp()
   })
 
-  test('POST /web/bind — binds session to UUID', async () => {
-    // Create session first
-    const sessRes = await app.request('/v1/sessions', {
-      method: 'POST',
-      headers: { ...AUTH_HEADERS, 'Content-Type': 'application/json' },
-      body: JSON.stringify({}),
-    })
-    const { id } = await sessRes.json()
-
-    const bindRes = await app.request('/web/bind?uuid=test-uuid', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ sessionId: id }),
-    })
-    expect(bindRes.status).toBe(200)
-    const body = await bindRes.json()
-    expect(body.ok).toBe(true)
-  })
-
-  test('POST /web/bind — binds compat code session ID to UUID', async () => {
-    const sessRes = await app.request('/v1/code/sessions', {
-      method: 'POST',
-      headers: { ...AUTH_HEADERS, 'Content-Type': 'application/json' },
-      body: JSON.stringify({}),
-    })
-    const body = await sessRes.json()
-    const compatId = toWebSessionId(body.session.id)
-
-    const bindRes = await app.request('/web/bind?uuid=test-uuid', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ sessionId: compatId }),
-    })
-    expect(bindRes.status).toBe(200)
-    const bindBody = await bindRes.json()
-    expect(bindBody.ok).toBe(true)
-    expect(bindBody.sessionId).toBe(compatId)
-  })
-
-  test('POST /web/bind — 404 for unknown session', async () => {
+  test('POST /web/bind — returns 410 Gone (endpoint removed)', async () => {
     const res = await app.request('/web/bind?uuid=test-uuid', {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ sessionId: 'nope' }),
+      body: JSON.stringify({ sessionId: 'ses_123' }),
     })
-    expect(res.status).toBe(404)
+    expect(res.status).toBe(410)
   })
 
-  test('POST /web/bind — 400 when missing params', async () => {
+  test('POST /web/bind — returns 410 for missing params too', async () => {
     const res = await app.request('/web/bind', {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({}),
     })
-    expect(res.status).toBe(400)
+    expect(res.status).toBe(410)
   })
 })