@stardeck-customer-apps/testing 0.22.0 → 0.23.0

package/SKILL.md

@@ -218,6 +218,13 @@ const integrations = createIntegrationsClient();
 await integrations.line.push("U123", { type: "text", text: "Your order shipped" });
 expect(app.messages.channel("line").to("U123")[0].body.text).toMatch(/shipped/i);
 
+// Signed in through LINE (a shop's LINE MINI App): the session carries the
+// person's shop-provider LINE user ID. Push to the ID on the SESSION.
+app.asUser({ id: "buyer-1", lineUserId: "Ushop-provider-1" });
+// route under test: const s = await getSession(); await integrations.line.push(s.user.lineUserId, ...)
+await callRoute(POST);
+expect(app.messages.channel("line").to("Ushop-provider-1")).toHaveLength(1);
+
 // LINE Flex card — the simulator preserves the complete LINE-native container.
 const card = {
   type: "bubble" as const,
@@ -322,7 +329,18 @@ expect(app.edge.latestDisplay()?.action).toBe("show");
   or the platform's test-run deadline.
 
 - `app.asUser(partial?)` — sign in a test user; `getSession()` in app code
-  resolves to it. `app.signOut()` clears.
+  resolves to it. `app.signOut()` clears. Pass `lineUserId` to sign in as a
+  person who came through LINE sign-in inside the shop's LINE MINI App; it is
+  the same field production sets, so app code reads `session.user.lineUserId`.
+  `issueSession({ lineUserId })` carries it through cookie auth and the real
+  `/api/auth/me` route too.
+- `app.setLiffId(id | null)` / `createTestApp({ liffId })` — the LIFF ID the
+  platform forwards to the app (`null` by default = no LINE MINI App). The real
+  project-auth `/api/auth/me` returns it as `liffId` on every response, signed
+  in or not, which is what makes `useLiff()` start LIFF. `reset()` restores the
+  `createTestApp` value. The simulator does not run LIFF sign-in itself
+  (`POST /api/auth/liff` needs a real LINE ID token), so seed the signed-in
+  state with `asUser`/`issueSession` instead.
 - `app.issueSession(partial?)` — mint access/refresh tokens for cookie-based
   auth flows (`__stardeck:sess`).
 - `app.inbox` — emails sent through the email-sdk: `.latest(addr?)`,
@@ -619,6 +637,20 @@ per-field validation (unit-test the route), login/logout (platform-provided).
   never `waitForTimeout` (web-first assertions auto-wait), every test
   independent of other tests' data and ordering.
 
+## Testing LINE flows
+
+- Sign in as a LINE person with `app.asUser({ lineUserId: "U..." })` and call
+  the route with `callRoute`; assert the push with
+  `app.messages.channel("line").to("U...")`. Cover the person with no LINE
+  identity too (`asUser()` without `lineUserId`): the route must send nothing.
+- The recipient of a LINE push comes from `session.user.lineUserId` on the
+  server, never from a request body, query string or client-side value. A
+  `lineUserId` a browser sends can be forged to message any friend of the shop's
+  LINE Official Account. Do not write a route that takes one, and do not write a
+  test that posts one to make a push happen; sign in with `lineUserId` instead.
+- Whether the person is a friend of the shop's OA is a client concern
+  (`useLiff().isFriend`); a server route checks only that `lineUserId` exists.
+
 ## Rules
 
 - Test **business logic and route handlers**, not framework plumbing. Focus on

package/dist/index.d.mts

@@ -38,6 +38,12 @@ interface TestUser {
     projectId?: string | null;
     /** Cross-app customer ownership key returned by the platform identity resolver. */
     identityId?: string | null;
+    /**
+     * The person's LINE user ID under the shop's own LINE provider. Set it to sign in
+     * as someone who came through LINE sign-in inside the shop's LINE MINI App; app
+     * code reads it from `session.user.lineUserId` and pushes to it.
+     */
+    lineUserId?: string | null;
 }
 interface CapturedEmail {
     resendId: string;
@@ -615,6 +621,12 @@ interface TestStarlens {
     get count(): number;
 }
 interface TestAppOptions {
+    /**
+     * The LIFF ID the platform forwards to the app for a LINE MINI App shop. It is
+     * what `GET /api/auth/me` returns as `liffId` and what makes `useLiff()` start
+     * LIFF. Defaults to `null` (the app has no LINE MINI App). Restored by `reset()`.
+     */
+    liffId?: string | null;
     /** Data stores exposed through the production-shaped STARDECK_DATA_STORES manifest. */
     dataStores?: TestDataStoreInput[];
     /**
@@ -669,6 +681,11 @@ interface TestApp {
     asUser(user?: Partial<TestUser>): TestUser;
     /** Clear the active test user. */
     signOut(): void;
+    /**
+     * Set (or clear with `null`) the LIFF ID the platform forwards to the app, for
+     * the rest of the test. The real project-auth `me` route returns it as `liffId`.
+     */
+    setLiffId(liffId: string | null): void;
     /**
      * Mint access/refresh tokens for cookie-based auth flows. The simulated
      * control-plane verify endpoint resolves these tokens back to the user.

package/dist/index.d.ts

@@ -38,6 +38,12 @@ interface TestUser {
     projectId?: string | null;
     /** Cross-app customer ownership key returned by the platform identity resolver. */
     identityId?: string | null;
+    /**
+     * The person's LINE user ID under the shop's own LINE provider. Set it to sign in
+     * as someone who came through LINE sign-in inside the shop's LINE MINI App; app
+     * code reads it from `session.user.lineUserId` and pushes to it.
+     */
+    lineUserId?: string | null;
 }
 interface CapturedEmail {
     resendId: string;
@@ -615,6 +621,12 @@ interface TestStarlens {
     get count(): number;
 }
 interface TestAppOptions {
+    /**
+     * The LIFF ID the platform forwards to the app for a LINE MINI App shop. It is
+     * what `GET /api/auth/me` returns as `liffId` and what makes `useLiff()` start
+     * LIFF. Defaults to `null` (the app has no LINE MINI App). Restored by `reset()`.
+     */
+    liffId?: string | null;
     /** Data stores exposed through the production-shaped STARDECK_DATA_STORES manifest. */
     dataStores?: TestDataStoreInput[];
     /**
@@ -669,6 +681,11 @@ interface TestApp {
     asUser(user?: Partial<TestUser>): TestUser;
     /** Clear the active test user. */
     signOut(): void;
+    /**
+     * Set (or clear with `null`) the LIFF ID the platform forwards to the app, for
+     * the rest of the test. The real project-auth `me` route returns it as `liffId`.
+     */
+    setLiffId(liffId: string | null): void;
     /**
      * Mint access/refresh tokens for cookie-based auth flows. The simulated
      * control-plane verify endpoint resolves these tokens back to the user.

package/dist/index.js

@@ -310,6 +310,7 @@ var TEST_ENV_DEFAULTS = {
   DEPLOYMENT_ID: "00000000-0000-4000-8000-00000000000c",
   STORAGE_URL: STORAGE_TEST_URL
 };
+var LIFF_ID_HEADER = "x-stardeck-liff-id";
 var DEFAULT_TEST_USER = {
   id: "test-user-1",
   email: "test-user@example.com",
@@ -324,6 +325,7 @@ var state = globalSingleton("state", () => ({
   db: null,
   lastHarnessDataStoreManifest: null,
   currentUser: null,
+  liffId: null,
   sessions: /* @__PURE__ */ new Map(),
   refreshSessions: /* @__PURE__ */ new Map(),
   emails: [],
@@ -2066,6 +2068,9 @@ async function callRoute(handler, options = {}) {
   if (user && !headers.has("x-stardeck-user")) {
     headers.set("x-stardeck-user", JSON.stringify(user));
   }
+  if (state.liffId && !headers.has(LIFF_ID_HEADER)) {
+    headers.set(LIFF_ID_HEADER, state.liffId);
+  }
   if (options.body !== void 0 && !headers.has("Content-Type")) {
     headers.set("Content-Type", "application/json");
   }
@@ -3856,6 +3861,8 @@ async function createTestApp(options = {}) {
   }
   applyTestEnv(options);
   state.allowNetwork = options.allowNetwork ?? false;
+  const initialLiffId = options.liffId ?? null;
+  state.liffId = initialLiffId;
   installFetchRouter();
   const schemaSql = loadSchemaSql(options) ?? "";
   const db = await bootWithSchema(schemaSql);
@@ -3908,6 +3915,9 @@ async function createTestApp(options = {}) {
     signOut() {
       state.currentUser = null;
     },
+    setLiffId(liffId) {
+      state.liffId = liffId;
+    },
     issueSession(user) {
       const fullUser = buildUser(user);
       const tokens = {
@@ -3930,6 +3940,7 @@ async function createTestApp(options = {}) {
         }
       }
       state.currentUser = null;
+      state.liffId = initialLiffId;
       state.sessions.clear();
       state.refreshSessions.clear();
       state.emails = [];
@@ -3944,6 +3955,7 @@ async function createTestApp(options = {}) {
     async close() {
       state.db = null;
       state.currentUser = null;
+      state.liffId = null;
       state.sessions.clear();
       state.refreshSessions.clear();
       state.emails = [];

package/dist/index.mjs

@@ -271,6 +271,7 @@ var TEST_ENV_DEFAULTS = {
   DEPLOYMENT_ID: "00000000-0000-4000-8000-00000000000c",
   STORAGE_URL: STORAGE_TEST_URL
 };
+var LIFF_ID_HEADER = "x-stardeck-liff-id";
 var DEFAULT_TEST_USER = {
   id: "test-user-1",
   email: "test-user@example.com",
@@ -285,6 +286,7 @@ var state = globalSingleton("state", () => ({
   db: null,
   lastHarnessDataStoreManifest: null,
   currentUser: null,
+  liffId: null,
   sessions: /* @__PURE__ */ new Map(),
   refreshSessions: /* @__PURE__ */ new Map(),
   emails: [],
@@ -2027,6 +2029,9 @@ async function callRoute(handler, options = {}) {
   if (user && !headers.has("x-stardeck-user")) {
     headers.set("x-stardeck-user", JSON.stringify(user));
   }
+  if (state.liffId && !headers.has(LIFF_ID_HEADER)) {
+    headers.set(LIFF_ID_HEADER, state.liffId);
+  }
   if (options.body !== void 0 && !headers.has("Content-Type")) {
     headers.set("Content-Type", "application/json");
   }
@@ -3817,6 +3822,8 @@ async function createTestApp(options = {}) {
   }
   applyTestEnv(options);
   state.allowNetwork = options.allowNetwork ?? false;
+  const initialLiffId = options.liffId ?? null;
+  state.liffId = initialLiffId;
   installFetchRouter();
   const schemaSql = loadSchemaSql(options) ?? "";
   const db = await bootWithSchema(schemaSql);
@@ -3869,6 +3876,9 @@ async function createTestApp(options = {}) {
     signOut() {
       state.currentUser = null;
     },
+    setLiffId(liffId) {
+      state.liffId = liffId;
+    },
     issueSession(user) {
       const fullUser = buildUser(user);
       const tokens = {
@@ -3891,6 +3901,7 @@ async function createTestApp(options = {}) {
         }
       }
       state.currentUser = null;
+      state.liffId = initialLiffId;
       state.sessions.clear();
       state.refreshSessions.clear();
       state.emails = [];
@@ -3905,6 +3916,7 @@ async function createTestApp(options = {}) {
     async close() {
       state.db = null;
       state.currentUser = null;
+      state.liffId = null;
       state.sessions.clear();
       state.refreshSessions.clear();
       state.emails = [];

package/dist/next/headers-shim.js

@@ -28,6 +28,12 @@ __export(headers_shim_exports, {
 module.exports = __toCommonJS(headers_shim_exports);
 var import_node_async_hooks = require("async_hooks");
 
+// src/constants.ts
+var DATA_STORE_TEST_HOST = "db.stardeck.test";
+var DATA_STORE_TEST_URL = `postgresql://test:test@${DATA_STORE_TEST_HOST}/main`;
+var APP_TEST_ORIGIN = "http://localhost:3333";
+var LIFF_ID_HEADER = "x-stardeck-liff-id";
+
 // src/global-singleton.ts
 function globalSingleton(key, create) {
   const symbol = /* @__PURE__ */ Symbol.for(`stardeck-testing.${key}`);
@@ -36,16 +42,12 @@ function globalSingleton(key, create) {
   return holder[symbol];
 }
 
-// src/constants.ts
-var DATA_STORE_TEST_HOST = "db.stardeck.test";
-var DATA_STORE_TEST_URL = `postgresql://test:test@${DATA_STORE_TEST_HOST}/main`;
-var APP_TEST_ORIGIN = "http://localhost:3333";
-
 // src/state.ts
 var state = globalSingleton("state", () => ({
   db: null,
   lastHarnessDataStoreManifest: null,
   currentUser: null,
+  liffId: null,
   sessions: /* @__PURE__ */ new Map(),
   refreshSessions: /* @__PURE__ */ new Map(),
   emails: [],
@@ -105,6 +107,7 @@ function ambientScope() {
   if (state.currentUser) {
     headers2.set("x-stardeck-user", JSON.stringify(state.currentUser));
   }
+  if (state.liffId) headers2.set(LIFF_ID_HEADER, state.liffId);
   return { headers: headers2, cookies: /* @__PURE__ */ new Map() };
 }
 function currentScope() {

package/dist/next/headers-shim.mjs

@@ -1,6 +1,12 @@
 // src/next/headers-shim.ts
 import { AsyncLocalStorage } from "async_hooks";
 
+// src/constants.ts
+var DATA_STORE_TEST_HOST = "db.stardeck.test";
+var DATA_STORE_TEST_URL = `postgresql://test:test@${DATA_STORE_TEST_HOST}/main`;
+var APP_TEST_ORIGIN = "http://localhost:3333";
+var LIFF_ID_HEADER = "x-stardeck-liff-id";
+
 // src/global-singleton.ts
 function globalSingleton(key, create) {
   const symbol = /* @__PURE__ */ Symbol.for(`stardeck-testing.${key}`);
@@ -9,16 +15,12 @@ function globalSingleton(key, create) {
   return holder[symbol];
 }
 
-// src/constants.ts
-var DATA_STORE_TEST_HOST = "db.stardeck.test";
-var DATA_STORE_TEST_URL = `postgresql://test:test@${DATA_STORE_TEST_HOST}/main`;
-var APP_TEST_ORIGIN = "http://localhost:3333";
-
 // src/state.ts
 var state = globalSingleton("state", () => ({
   db: null,
   lastHarnessDataStoreManifest: null,
   currentUser: null,
+  liffId: null,
   sessions: /* @__PURE__ */ new Map(),
   refreshSessions: /* @__PURE__ */ new Map(),
   emails: [],
@@ -78,6 +80,7 @@ function ambientScope() {
   if (state.currentUser) {
     headers2.set("x-stardeck-user", JSON.stringify(state.currentUser));
   }
+  if (state.liffId) headers2.set(LIFF_ID_HEADER, state.liffId);
   return { headers: headers2, cookies: /* @__PURE__ */ new Map() };
 }
 function currentScope() {

package/dist/setup.js

@@ -52,6 +52,7 @@ var state = globalSingleton("state", () => ({
   db: null,
   lastHarnessDataStoreManifest: null,
   currentUser: null,
+  liffId: null,
   sessions: /* @__PURE__ */ new Map(),
   refreshSessions: /* @__PURE__ */ new Map(),
   emails: [],

package/dist/setup.mjs

@@ -28,6 +28,7 @@ var state = globalSingleton("state", () => ({
   db: null,
   lastHarnessDataStoreManifest: null,
   currentUser: null,
+  liffId: null,
   sessions: /* @__PURE__ */ new Map(),
   refreshSessions: /* @__PURE__ */ new Map(),
   emails: [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stardeck-customer-apps/testing",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "description": "Vitest test harness for Stardeck customer apps — in-process Postgres (PGlite) plus a control-plane simulator so the real Stardeck SDKs run unmodified in tests",
   "main": "dist/index.js",
   "module": "dist/index.mjs",