joshuaandClaude Opus 5.5
b134f87326
tokens.ts validates link tokens (32 hex chars) before any DB query. check:rls proves the anon key cannot read or insert on any table, and fails loudly if the migration has not been applied. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
27 lines
926 B
TypeScript
27 lines
926 B
TypeScript
import { describe, expect, it } from "vitest";
|
|
|
|
import { idSchema, tokenSchema } from "./tokens";
|
|
|
|
describe("tokenSchema", () => {
|
|
it("accepts 32 lowercase hex chars", () => {
|
|
expect(tokenSchema.safeParse("0123456789abcdef0123456789abcdef").success).toBe(true);
|
|
});
|
|
|
|
it.each([
|
|
["too short", "abc123"],
|
|
["too long", "0123456789abcdef0123456789abcdef0"],
|
|
["uppercase", "0123456789ABCDEF0123456789ABCDEF"],
|
|
["non-hex", "0123456789abcdef0123456789abcdeg"],
|
|
["injection attempt", "0123456789abcdef0123456789abcde'"],
|
|
["empty", ""],
|
|
])("rejects %s", (_label, value) => {
|
|
expect(tokenSchema.safeParse(value).success).toBe(false);
|
|
});
|
|
});
|
|
|
|
describe("idSchema", () => {
|
|
it("accepts a uuid and rejects anything else", () => {
|
|
expect(idSchema.safeParse("3f2b8c1e-9d4a-4e6f-8b7a-1c2d3e4f5a6b").success).toBe(true);
|
|
expect(idSchema.safeParse("not-a-uuid").success).toBe(false);
|
|
});
|
|
}); |