test(app): cover missing query context paths

This commit is contained in:
vsxd 2026-03-20 11:25:50 +08:00 committed by Xudong Sun
parent ef7332d520
commit a17deb9b7f
4 changed files with 102 additions and 0 deletions

View file

@ -145,6 +145,44 @@ class JpaGovernanceQueryRepositoryTest {
assertThat(responses.get(0).subtitle()).isEqualTo("Spam");
}
@Test
void getReviewInboxItems_toleratesMissingVersionContext() {
ReviewTask task = new ReviewTask(101L, 11L, "submitter");
setField(task, "id", 4L);
setField(task, "submittedAt", Instant.parse("2026-03-20T04:00:00Z"));
given(skillVersionRepository.findByIdIn(List.of(101L))).willReturn(List.of());
var responses = repository.getReviewInboxItems(List.of(task));
assertThat(responses).hasSize(1);
assertThat(responses.get(0).type()).isEqualTo("REVIEW");
assertThat(responses.get(0).title()).isEqualTo("Unknown target");
assertThat(responses.get(0).namespace()).isNull();
assertThat(responses.get(0).skillSlug()).isNull();
assertThat(responses.get(0).subtitle()).isEqualTo("Pending review");
}
@Test
void getPromotionInboxItems_toleratesMissingSourceAndTargetContext() {
PromotionRequest request = new PromotionRequest(201L, 101L, 12L, "submitter");
setField(request, "id", 5L);
setField(request, "submittedAt", Instant.parse("2026-03-20T05:00:00Z"));
given(skillRepository.findByIdIn(List.of(201L))).willReturn(List.of());
given(skillVersionRepository.findByIdIn(List.of(101L))).willReturn(List.of());
given(namespaceRepository.findByIdIn(List.of(12L))).willReturn(List.of());
var responses = repository.getPromotionInboxItems(List.of(request));
assertThat(responses).hasSize(1);
assertThat(responses.get(0).type()).isEqualTo("PROMOTION");
assertThat(responses.get(0).title()).isEqualTo("Unknown target");
assertThat(responses.get(0).namespace()).isNull();
assertThat(responses.get(0).skillSlug()).isNull();
assertThat(responses.get(0).subtitle()).isEqualTo("Pending promotion");
}
private void setField(Object target, String fieldName, Object value) {
try {
java.lang.reflect.Field field = target.getClass().getDeclaredField(fieldName);

View file

@ -109,4 +109,27 @@ class JpaMySkillQueryRepositoryTest {
assertThat(responses.get(0).ownerPreviewVersion()).isNull();
assertThat(responses.get(0).headlineVersion().status()).isEqualTo("PUBLISHED");
}
@Test
void getSkillSummaries_disablesPromotionWhenNamespaceContextIsMissing() {
Skill skill = new Skill(101L, "orphan-skill", "user-1", SkillVisibility.PUBLIC);
skill.setDisplayName("Orphan Skill");
ReflectionTestUtils.setField(skill, "id", 4L);
SkillVersion publishedVersion = new SkillVersion(4L, "1.0.0", "user-1");
publishedVersion.setStatus(SkillVersionStatus.PUBLISHED);
ReflectionTestUtils.setField(publishedVersion, "id", 44L);
ReflectionTestUtils.setField(publishedVersion, "createdAt", Instant.parse("2026-03-15T10:30:00Z"));
given(namespaceRepository.findByIdIn(List.of(101L))).willReturn(List.of());
given(skillVersionRepository.findBySkillIdAndStatus(4L, SkillVersionStatus.PUBLISHED)).willReturn(List.of(publishedVersion));
given(skillVersionRepository.findBySkillId(4L)).willReturn(List.of(publishedVersion));
var responses = repository.getSkillSummaries(List.of(skill), "user-1");
assertThat(responses).hasSize(1);
assertThat(responses.get(0).namespace()).isNull();
assertThat(responses.get(0).publishedVersion()).isNotNull();
assertThat(responses.get(0).canSubmitPromotion()).isFalse();
}
}

View file

@ -81,4 +81,28 @@ class JpaProfileReviewQueryRepositoryTest {
assertThat(response.get(0).currentDisplayName()).isNull();
assertThat(response.get(0).requestedDisplayName()).isEqualTo("NewName");
}
@Test
void getProfileReviewSummaries_toleratesInvalidSnapshotJson() {
ProfileChangeRequest request = new ProfileChangeRequest(
"user-2",
"{invalid",
"{also-invalid",
ProfileChangeStatus.PENDING,
"PASS",
null
);
ReflectionTestUtils.setField(request, "id", 3L);
ReflectionTestUtils.setField(request, "createdAt", Instant.parse("2026-03-19T08:00:00Z"));
UserAccount submitter = new UserAccount("user-2", "Current Name", "user2@example.com", null);
given(userAccountRepository.findByIdIn(List.of("user-2"))).willReturn(List.of(submitter));
var response = repository.getProfileReviewSummaries(List.of(request));
assertThat(response).hasSize(1);
assertThat(response.get(0).username()).isEqualTo("Current Name");
assertThat(response.get(0).currentDisplayName()).isEqualTo("Current Name");
assertThat(response.get(0).requestedDisplayName()).isNull();
}
}

View file

@ -47,4 +47,21 @@ class OAuthLoginFlowServiceTest {
assertThat(redirect).isEqualTo("/access-denied");
}
@Test
void consumeReturnTo_clearsUnsafeSessionValue() {
OAuthLoginFlowService service = new OAuthLoginFlowService(
List.of(),
mock(AccessPolicy.class),
mock(IdentityBindingService.class)
);
MockHttpServletRequest request = new MockHttpServletRequest();
HttpSession session = request.getSession(true);
session.setAttribute(OAuthLoginRedirectSupport.SESSION_RETURN_TO_ATTRIBUTE, "https://evil.example");
String returnTo = service.consumeReturnTo(session);
assertThat(returnTo).isNull();
assertThat(session.getAttribute(OAuthLoginRedirectSupport.SESSION_RETURN_TO_ATTRIBUTE)).isNull();
}
}