By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.
Description
Adds a comprehensive Vitest-based API testing suite with 254 tests across 9 test files covering schema validation, utility/library functions, and bug regression documentation.
All schema tests validate strictObject rejection of unexpected fields, email lowercasing, boundary conditions, and required vs. optional field behavior.
Schema tests re-define Zod schemas inline rather than importing from handler files to avoid pulling in transitive config/db/session dependencies that require a running server
IP utility tests mock @server/lib/config, @server/db, and @server/logger at the module level since ip.ts imports them at top-level even though the tested functions are pure
No test touches the database, config files, email, or network — the entire suite runs in ~400ms
How to test?
# Run all tests
npm test# Run with watch mode
npm run test:watch
# Run with coverage report
npm run test:coverage
# Verify build is unaffected
npm run build
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/fosrl/pangolin/pull/2807
Author: @jbelke
Created: 4/7/2026
Status: 🔄 Open
Base:
dev← Head:test-api-full-suite📝 Commits (2)
da73b19test: add comprehensive API testing suite with 254 tests39f86edMerge branch 'fosrl:main' into test-api-full-suite📊 Changes
13 files changed (+3270 additions, -28 deletions)
View changed files
➕
.github/CODEOWNERS(+1 -0)📝
package-lock.json(+955 -26)📝
package.json(+6 -2)➕
test/bugs/identified-bugs.test.ts(+169 -0)➕
test/lib/ip.test.ts(+249 -0)➕
test/lib/passwordSchema.test.ts(+71 -0)➕
test/lib/sanitize.test.ts(+86 -0)➕
test/lib/utilities.test.ts(+86 -0)➕
test/lib/validators.test.ts(+279 -0)➕
test/schemas/auth.test.ts(+480 -0)➕
test/schemas/resource-org-site-role.test.ts(+488 -0)➕
test/schemas/user.test.ts(+361 -0)➕
vitest.config.ts(+39 -0)📄 Description
Community Contribution License Agreement
By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.
Description
Adds a comprehensive Vitest-based API testing suite with 254 tests across 9 test files covering schema validation, utility/library functions, and bug regression documentation.
What's included
Schema validation tests (Zod):
All schema tests validate
strictObjectrejection of unexpected fields, email lowercasing, boundary conditions, and required vs. optional field behavior.Library/utility tests:
validators— isValidCIDR, isValidIP, isValidDomain, isSecondLevelDomain, isValidUrlGlobPattern, isUrlValid, isTargetValid, validateHeadersip— cidrToRange, findNextAvailableCidr, isIpInCidr, doCidrsOverlap, parseEndpoint, formatEndpoint, portRangeStringSchema, parsePortRangeStringsanitize— null byte stripping, C0 control character removal, lone UTF-16 surrogate replacementpasswordSchema— all strength requirements (upper, lower, digit, special), min/max length boundariesnormalizePostAuthPath— open redirect prevention (//,:rejection), whitespace trimmingstoi— string-to-integer pass-through behaviorBug regression tests documenting 6 issues found during code review:
signup.ts:4emailnamed import fromzod— will break on Zod v4signup.ts:272SqliteErrorfor unique constraint — PostgreSQL duplicate signups get a 500 instead of "user already exists"resetPassword.ts:174ResetPasswordResponsebutdata: nullis set on successexternal.ts:970GET /idp/:idpIdroute registration (dead code)external.ts:1251-1284enable,request,disable) all usesignup:key prefix — rate limit bucket collisionexternal.ts:1235get-tokenrate limiter keys onreq.body.newtIdinstead ofreq.body.olmId(copy-paste from newt endpoint)These are documented as tests only; source fixes are intentionally deferred to a follow-up PR.
Infrastructure:
vitest.config.tswith v8 coverage provider and path aliasespackage.json: addedvitestdevDependency,test,test:watch,test:coveragescriptsDesign notes
@server/lib/config,@server/db, and@server/loggerat the module level sinceip.tsimports them at top-level even though the tested functions are pureHow to test?
Expected output:
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.