test: key-token round-trip and path validation coverage#15
Draft
cursor[bot] wants to merge 1 commit intomainfrom
Draft
test: key-token round-trip and path validation coverage#15cursor[bot] wants to merge 1 commit intomainfrom
cursor[bot] wants to merge 1 commit intomainfrom
Conversation
- Round-trip URL-safe base64 for object keys (used by token hashing and query params) - Assert collection slug, relative path, root prefix, and full key split behavior for CI file API
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds Vitest coverage for shared helpers used on high-blast-radius paths (S3 key encoding, collection slug / relative path validation, root prefix).
Risky behavior now covered
encodeObjectKeyToken/decodeObjectKeyToken): used for token digests and query-safe key material; regressions break lookups or leak malformed keys.assertValidCollectionSlug,assertSafeRelativePath,assertKeyUnderRoot,fullObjectKey,splitObjectKeyAfterRoot): same rules enforced by the CI file API before S3 reads; catches traversal, wrong roots, and invalid secret paths.Test files added/updated
src/lib/key-token.test.ts(new)src/lib/paths.test.ts(new)Why this reduces regression risk
These utilities are small but shared: a bad base64 padding or alphabet change, or a loosened slug/path check, can affect authz boundaries and object resolution across the app. The tests pin expected round-trips and rejection cases without coupling to HTTP or Prisma, so they stay fast and deterministic.
Validation
npm run test(Vitest): all tests pass.