hahachait
ff9da4d324
- Cookie-based auth via backend proxy (httpOnly JWTs) - Supabase Postgres persistence for sessions/messages/profiles + RLS - Fix cross-user session leak (token cache keyed by full token, not 50-char prefix) - Fix missing table grants (42501) via migration; auto-provision profiles on user creation - Chat validation, ownership checks, rate limiting, /api/chat/sessions route ordering - Frontend auth-state reset + credentials include - OpenRouter AI provider (OpenAI-compatible base URL, reasoning disabled) - Tests: chatValidation, appState
21 lines
1.0 KiB
JavaScript
21 lines
1.0 KiB
JavaScript
import test from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import { validateChatInput, isOwnedSession } from "../src/routes/chatValidation.js";
|
|
|
|
test("accepts a valid chat request", () => {
|
|
assert.deepEqual(validateChatInput({ text: "hello", grade: "Grade 10", subject: "math" }), { ok: true });
|
|
});
|
|
|
|
test("rejects invalid metadata and oversized messages", () => {
|
|
assert.equal(validateChatInput({ text: "hello", grade: "invalid" }).error, "Invalid grade");
|
|
assert.equal(validateChatInput({ text: "hello", subject: "invalid" }).error, "Invalid subject");
|
|
assert.equal(validateChatInput({ text: "" }).error, "Message text is required");
|
|
assert.equal(validateChatInput({ text: "x".repeat(10001) }).error, "Message too long (max 10000 characters)");
|
|
});
|
|
|
|
test("only the owning user can access a session", () => {
|
|
assert.equal(isOwnedSession({ user_id: "user-a" }, "user-a"), true);
|
|
assert.equal(isOwnedSession({ user_id: "user-a" }, "user-b"), false);
|
|
assert.equal(isOwnedSession(null, "user-a"), false);
|
|
});
|