test: exercise real route handlers instead of hand-copied stubs, close major coverage gaps - #12
Merged
Conversation
…e major coverage gaps
Rewrites 7 API test files that previously reimplemented route logic
in-test ("Replicate route logic") rather than importing and exercising
the actual src/app/api/**/route.ts handlers, so real bugs in sanitize
calls, Prisma queries, or auth wiring could ship undetected:
- auth-login.test.ts, auth-register.test.ts: real login/register routes
with mocked db/password/rate-limit, incl. legacy-hash auto-upgrade
- assessments.test.ts, interview-session.test.ts (+ session complete),
profile-dashboard.test.ts, resume-coverletter.test.ts, questions.test.ts:
same treatment for their routes
Along the way this surfaced two real discrepancies between the old stub
tests and shipped behavior, now captured as passing assertions:
- POST /api/cover-letter returns truthFlags as a raw JSON string (GET/PUT
by id parse it back out, POST does not)
- GET /api/questions?difficulty=all unexpectedly trips the auth-required
branch (the gate excludes only 'beginner', not 'all')
Also adds coverage for previously-untested areas:
- src/middleware.ts (Edge rate limiter) — was untested; only the separate
DB-backed rate-limit.ts had coverage
- src/lib/password.ts — bcrypt + legacy SHA-256 migration path
- src/lib/ai/{coach,resume,cover-letter,assessment}.ts — validation,
prompt building, and fallback behavior, plus assertions that the
required truthfulness/no-fabrication guardrail language is present
in each system prompt (docs/07-guardrails.md)
- src/lib/ai/client.ts (ZAIProvider/completeJson) — timeout, abort,
JSON extraction, via a mocked z-ai-web-dev-sdk
- src/lib/email-verification.ts, src/lib/subscription-guard.ts
- AdminPanel, CoverLetterStudio, DashboardView components (previously
the only tested feature components were MockInterview, OnboardingQuiz,
ResumeLab)
Fixes 4 pre-existing stale assertions in types-constants.test.ts that
checked AI route files for a literal 'getUserFromRequest' string; those
routes were refactored onto the createAIHandler factory (which enforces
auth internally) and no longer contain that literal.
__tests__/setup.ts: polyfill scrollIntoView/pointer-capture APIs jsdom
lacks, needed once component tests started driving Radix Select/Tabs.
bun run test / tsc --noEmit / lint / build all pass; the only test
failures are the 4 live-server-only integration files (auth.test.ts,
resources.test.ts, questions-interview-ai.test.ts, user-paths.test.ts),
which fail identically at baseline with no server running — unchanged,
by design (CI runs them against a live build separately).The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Warning Review limit reached
Next review available in:55 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (18)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Analysis CompleteGenerated ECC bundle from 1 commits | Confidence: 60% View Pull Request #13Repository Profile
Changed Files (18)
Top hotspots
Top directories
Analysis Depth Readiness (commit-history, 21%)ECC Tools uses this to decide whether recommendations should stay at commit-history/setup guidance or expand into CI, security, harness, reference-set, AI-routing, and team backlog work.
Reference Set Readiness (0/7, 0%)
Likely Future Issues (3)
Suggested Follow-up Work (3)
Copy-ready bodies test: add integration coverage for tests/api/assessments.test.ts + tests/api/auth-login.test.ts ## Summary- Add integration or end-to-end coverage for the recently changed API surface.
## Why- Backfill integration or end-to-end coverage for the changed API surface before more contract changes land.
## Touched paths-`__tests__/api/assessments.test.ts`-`__tests__/api/auth-login.test.ts`## Validation- Add or extend integration / e2e coverage for the changed API, route, or contract surface.
- Exercise the touched endpoints or route handlers against realistic request / response flows.docs: sync API contract for tests/api/assessments.test.ts + tests/api/auth-login.test.ts ## Summary- Update the API contract artifact that should reflect the recently changed implementation surface.
## Why- Backfill the missing API contract or spec update before another implementation change lands on top of the same surface.
## Touched paths-`__tests__/api/assessments.test.ts`-`__tests__/api/auth-login.test.ts`## Validation- Update the relevant OpenAPI, GraphQL, or contract/spec artifact used by this repo.
- Run the contract validation, docs generation, or API verification flow that depends on that artifact.test: add browser coverage for tests/components/admin-panel.test.tsx + tests/components/cover-letter-studio.test.tsx ## Summary- Add browser or end-to-end coverage for the recently changed user-facing surface.
## Why- Backfill browser coverage before another user-facing UI change lands on the touched surface.
## Touched paths-`__tests__/components/admin-panel.test.tsx`-`__tests__/components/cover-letter-studio.test.tsx`## Validation- Add or extend browser / e2e coverage for the changed component, page, or flow.
- Exercise the visible user journey that depends on the touched UI surface.Review Activity (1 reviews, 0 inline comments, 0 unresolved threads)
Latest reviewer states
Review Follow-up Signals (1)
Recommended next actions
Generated Instincts (10)
After merging, import with: Files
|
…f hardcoding defaults CI's audit job sets API_RATE_LIMIT_MAX=100000 and AUTH_RATE_LIMIT_MAX=1000 at the job level (to relax limits for the live-server integration suite), which also applies to the plain "Unit tests" step. middleware.test.ts assumed the un-overridden defaults (60/10), so it never actually tripped the limiter in CI and failed with 200 instead of 429. Mirror middleware.ts's own `Number(process.env.X) || default` fallback in the test so the loop count always matches whatever threshold is actually configured, in CI or locally.
Uh oh!
There was an error while loading. Please reload this page.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
A coverage analysis found that most of the API test suite (11 of 13 files in
__tests__/api/) never imported or executed the realsrc/app/api/**/route.tshandlers. Instead they hand-copied a parallel reimplementation of each route's logic into the test file itself ("Replicate route logic") and tested that. This meant real bugs in sanitize calls, Prisma queries, or auth wiring could ship with a fully green suite. Several other modules (middleware.ts,password.ts, the AI prompt-builder configs,ai/client.ts,email-verification.ts,subscription-guard.ts) and most feature components (notably the 849-lineAdminPanel) had no tests at all.Solution
auth-login,auth-register,assessments,interview-session+ session completion,profile-dashboard,resume-coverletter,questions) to import and exercise the real route handlers with mockeddb/auth-helpers/etc., following the pattern already used correctly inquestions-count.test.tsandauth-verify-email.test.ts.src/middleware.ts(Edge rate limiter),src/lib/password.ts(bcrypt + legacy SHA-256 migration),src/lib/ai/{coach,resume,cover-letter,assessment}.ts(validation/prompt-building/fallbacks, plus assertions that each system prompt actually contains the required truthfulness/no-fabrication guardrail language perdocs/07-guardrails.md),src/lib/ai/client.ts(timeout/abort/JSON extraction),src/lib/email-verification.ts,src/lib/subscription-guard.ts.AdminPanel,CoverLetterStudio,DashboardView(previously onlyMockInterview,OnboardingQuiz,ResumeLabhad coverage).types-constants.test.tsthat checked AI route files for a literalgetUserFromRequeststring; those routes were refactored onto thecreateAIHandlerfactory (which enforces auth internally) and no longer contain that literal.__tests__/setup.ts: polyfilledscrollIntoView/pointer-capture APIs jsdom lacks, needed once component tests started driving Radix Select/Tabs.Along the way this surfaced two real discrepancies between the old stub tests and shipped behavior, now captured as passing assertions rather than silently missed:
POST /api/cover-letterreturnstruthFlagsas a raw JSON string (GET/PUT by id parse it back out, POST does not).GET /api/questions?difficulty=allunexpectedly trips the auth-required branch — the gate excludes only'beginner', not'all'. (Documented as-is; not changed, since this PR is test-only.)Scope
Included: test files only (
__tests__/**), plus the jsdom polyfills in__tests__/setup.ts.Excluded: no application code in
src/was changed. Thedifficulty=allauth quirk noted above is documented in a test comment but intentionally left as-is — a behavior change belongs in a separate PR.Acceptance criteria
src/changes, so app behavior is unchangedsubscription-guard.test.tslocks in the always-allow no-op contract)Validation
bun run lint— 0 errors, only pre-existing warnings unrelated to this changebunx tsc --noEmit— cleanbun run test— 411 passed (up from 319 onmain), 0 unexpected failures. The only failures are the 4 live-server-only integration files (auth.test.ts,resources.test.ts,questions-interview-ai.test.ts,user-paths.test.ts), which fail identically onmainwith no server running locally — by design, CI runs those separately against a live build (TEST_BASE_URL=http://localhost:3000)bun run test:api— same result as abovebun run build— succeedsRisk and rollback
Test-only change; no production code, schema, or environment variables touched. No deployment or data risk. Revert is a plain
git revertif needed.Documentation
No documentation changes needed — this is test coverage only, no behavior or API surface changed.
🤖 Generated with Claude Code
https://claude.ai/code/session_01GY57BayVeQkrRKqTmvNuKZ
Generated by Claude Code