backend-manager 5.2.17 → 5.2.18

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "backend-manager",
-  "version": "5.2.17",
+  "version": "5.2.18",
   "description": "Quick tools for developing Firebase functions",
   "main": "src/manager/index.js",
   "bin": {

package/test/routes/user/signup.js

@@ -446,11 +446,20 @@ module.exports = {
       async run({ http, firestore, assert, accounts }) {
         const uid = accounts['signup-merge'].uid;
 
-        // Seed real/custom state that the signup write must NOT clobber, plus a deliberately
-        // PARTIAL attribution (only affiliate.code) to prove leaves get filled, not replaced-away.
+        // Capture the REAL api keys onCreate generated — the signup write must preserve these
+        // exactly (regenerating them would break the user's API access AND this test's auth,
+        // since http.as() authenticates with api.privateKey). We assert against the real values,
+        // NOT a seeded fake (seeding a fake privateKey would 401 the request).
+        const before = await firestore.get(`users/${uid}`);
+        const realClientId = before?.api?.clientId;
+        const realPrivateKey = before?.api?.privateKey;
+        const realAffiliateCode = before?.affiliate?.code;
+
+        // Seed adversarial NON-auth state the signup write must NOT clobber: a paid subscription,
+        // admin role, a custom non-schema field, and a deliberately PARTIAL attribution (only
+        // affiliate.code) to prove leaves get filled, not replaced-away. We do NOT touch api.* —
+        // that's the auth credential and is asserted-preserved via the captured real values.
         await firestore.set(`users/${uid}`, {
-          api: { clientId: 'REAL-CLIENT-ID', privateKey: 'REAL-PRIVATE-KEY' },
-          affiliate: { code: 'REALAFFILIATECODE', referrals: [{ uid: 'someone' }] },
           subscription: { product: { id: 'pro', name: 'Pro' }, status: 'active' },
           roles: { admin: true, betaTester: false, developer: false },
           attribution: { affiliate: { code: 'PARTIALONLY' } },
@@ -466,9 +475,9 @@ module.exports = {
         const doc = await firestore.get(`users/${uid}`);
 
         // (b) Existing real values must survive untouched — NOT regenerated/reset by the schema layer.
-        assert.equal(doc?.api?.clientId, 'REAL-CLIENT-ID', 'api.clientId must be preserved (not regenerated)');
-        assert.equal(doc?.api?.privateKey, 'REAL-PRIVATE-KEY', 'api.privateKey must be preserved (not regenerated)');
-        assert.equal(doc?.affiliate?.code, 'REALAFFILIATECODE', 'affiliate.code must be preserved (not regenerated)');
+        assert.equal(doc?.api?.clientId, realClientId, 'api.clientId must be preserved (not regenerated)');
+        assert.equal(doc?.api?.privateKey, realPrivateKey, 'api.privateKey must be preserved (not regenerated)');
+        assert.equal(doc?.affiliate?.code, realAffiliateCode, 'affiliate.code must be preserved (not regenerated)');
         assert.equal(doc?.subscription?.product?.id, 'pro', 'subscription must be preserved (not reset to basic)');
         assert.equal(doc?.roles?.admin, true, 'roles.admin must be preserved (not reset to false)');