119 lines
4.9 KiB
JavaScript
119 lines
4.9 KiB
JavaScript
// A1 Session 10 — public ledger profiles: /u/[handle] page + OG card +
|
|
// settings claim/publish UI + proxies + migration. The .tsx surfaces are
|
|
// asserted against source (plain-JS Jest, no TS transform) — same pattern as
|
|
// vyndrAppShell/socialPreview.
|
|
|
|
const fs = require('fs');
|
|
const path = require('path');
|
|
|
|
const ROOT = path.join(__dirname, '..', '..');
|
|
const WEB = path.join(ROOT, 'web', 'src');
|
|
const read = (rel) => fs.readFileSync(path.join(WEB, rel), 'utf8');
|
|
const exists = (rel) => fs.existsSync(path.join(WEB, rel));
|
|
|
|
const routes = require('../../web/src/lib/routes');
|
|
|
|
describe('/u routing — the share surface stays public', () => {
|
|
it('never gates /u (a public record must load anonymous)', () => {
|
|
expect(routes.isGatedRoute('/u')).toBe(false);
|
|
expect(routes.isGatedRoute('/u/kev')).toBe(false);
|
|
});
|
|
it('declares /u in OPEN_ROUTES', () => {
|
|
expect(routes.OPEN_ROUTES).toContain('/u');
|
|
});
|
|
});
|
|
|
|
describe('/u/[handle] server shell', () => {
|
|
const src = read('app/u/[handle]/page.tsx');
|
|
it('carries the CLV-verified metadata title', () => {
|
|
expect(src).toContain('CLV-verified record — @');
|
|
expect(src).toContain('· VYNDR');
|
|
});
|
|
it('renders the client record component', () => {
|
|
expect(src).toContain('PublicProfile');
|
|
expect(exists('app/u/[handle]/PublicProfile.tsx')).toBe(true);
|
|
});
|
|
});
|
|
|
|
describe('/u/[handle] client record', () => {
|
|
const src = read('app/u/[handle]/PublicProfile.tsx');
|
|
it('honors the n-gate: RECORD BUILDING under min_sample, never a small-sample %', () => {
|
|
expect(src).toContain('RECORD BUILDING');
|
|
expect(src).toMatch(/settled >= minSample/);
|
|
});
|
|
it('shows outcome + CLV chips on settled rows (ledger card patterns)', () => {
|
|
expect(src).toContain('✓ HIT');
|
|
expect(src).toContain('✕ MISS');
|
|
expect(src).toContain('BEAT CLOSE');
|
|
expect(src).toContain('clv_result');
|
|
});
|
|
it('states the uncurated contract and one not-found state for unknown AND unpublished', () => {
|
|
expect(src).toContain('Nothing curated');
|
|
expect(src).toContain('private by default');
|
|
expect(src).toMatch(/notfound/);
|
|
});
|
|
it('fetches through the Next proxy (S25 rule)', () => {
|
|
expect(src).toContain('/api/profiles/');
|
|
});
|
|
});
|
|
|
|
describe('/u/[handle] OG image', () => {
|
|
const og = read('app/u/[handle]/opengraph-image.tsx');
|
|
it('is a 1200x630 PNG record card', () => {
|
|
expect(og).toContain('width: 1200, height: 630');
|
|
expect(og).toContain("contentType = 'image/png'");
|
|
expect(og).toContain('PUBLIC LEDGER');
|
|
expect(og).toContain('misses included');
|
|
});
|
|
it('does NOT use the edge runtime (self-hosted standalone, S53 rule)', () => {
|
|
expect(og).not.toContain("runtime = 'edge'");
|
|
});
|
|
});
|
|
|
|
describe('settings — claim handle + publish toggle', () => {
|
|
const src = read('app/settings/page.tsx');
|
|
it('carries the explicit private-by-default publish copy verbatim', () => {
|
|
expect(src).toContain('Publishing puts your ENTIRE settled record on a public page — wins and misses. Private by default.');
|
|
});
|
|
it('reads and writes /api/profiles/me with the bearer token', () => {
|
|
expect(src).toContain("fetch('/api/profiles/me'");
|
|
expect(src).toMatch(/method: 'POST'[\s\S]*?\/api\/profiles\/me|\/api\/profiles\/me[\s\S]*?method: 'POST'/);
|
|
});
|
|
it('sanitizes the handle input to the API shape (a-z 0-9 _ , max 20)', () => {
|
|
expect(src).toContain("replace(/[^a-z0-9_]/g, '')");
|
|
expect(src).toContain('.slice(0, 20)');
|
|
});
|
|
});
|
|
|
|
describe('Next proxies (S25 rule — Express is not browser-reachable)', () => {
|
|
it('me proxy forwards GET/POST with Authorization', () => {
|
|
const src = read('app/api/profiles/me/route.ts');
|
|
expect(src).toContain('BACKEND_URL');
|
|
expect(src).toContain('/api/profiles/me');
|
|
expect(src).toContain('authorization');
|
|
expect(src).toContain('export async function POST');
|
|
});
|
|
it('handle proxy forwards the public read and passes the 404 through untouched', () => {
|
|
const src = read('app/api/profiles/[handle]/route.ts');
|
|
expect(src).toContain('BACKEND_URL');
|
|
expect(src).toContain('/api/profiles/');
|
|
expect(src).toContain('status: upstream.status');
|
|
});
|
|
});
|
|
|
|
describe('migration 022 — public_profiles (committed, applied by the founder)', () => {
|
|
const sql = fs.readFileSync(path.join(ROOT, 'supabase', 'migrations', '022_public_profiles.sql'), 'utf8');
|
|
it('creates the table with the handle CHECK + private-by-default published', () => {
|
|
expect(sql).toContain('public.public_profiles');
|
|
expect(sql).toContain("handle ~ '^[a-z0-9_]{3,20}$'");
|
|
expect(sql).toMatch(/published\s+boolean NOT NULL DEFAULT false/);
|
|
expect(sql).toContain('REFERENCES auth.users');
|
|
});
|
|
it('RLS: published rows readable by anyone, own row by owner, writes service-role only', () => {
|
|
expect(sql).toContain('ENABLE ROW LEVEL SECURITY');
|
|
expect(sql).toContain('USING (published = true)');
|
|
expect(sql).toContain('USING (user_id = auth.uid())');
|
|
expect(sql).not.toMatch(/FOR (INSERT|UPDATE|DELETE)/);
|
|
});
|
|
});
|