bvandeusen
47d2f61161
Six findings from the 2026-06-02 multi-system drift audit (Scribe parent task #552): - **#553 (web)** Tailwind class fix: web admin playback-errors Delete confirm button was using `bg-action-danger`, an undefined token — swap to `bg-action-destructive` to match every other destructive button. Restored the Oxblood signal that distinguishes Delete from Cancel. - **#555 (web)** Type the `source` field on `play_started` in the EventRequest discriminated union. Server's eventRequest accepts it; web's TS type was missing the slot, so a "drop extra properties" refactor could silently strip the source tag and break system- playlist rotation attribution. - **#556 + #557 (server)** Coverage rollup whitelist was pinned to ('sidecar','embedded','mbcaa','theaudiodb'); migration 0020 added 'deezer' and 'lastfm' as valid cover_art_source values but those never got wired in, so albums with art from those providers silently counted as MISSING in the admin Coverage dashboard. The rollup test was seeding only the pre-0020 sources, masking the gap in CI. Extend the query to include deezer + lastfm; seed the test with one row per valid source (regression-guards future additions). - **#558 (web)** Auth gate was blocking /forgot-password and /reset-password/<token> — both are entered without a session by definition, so the email-link reset flow was bouncing signed-out users to /login. Add /forgot-password to the public set and a /reset-password/ prefix matcher. New tests assert both routes reach their pages without redirect. - **#571 (server)** Library scanner was indexing only .mp3/.m4a/.flac /.ogg while the stream handler (media.go) had been extended to serve .opus, .aac, and .wav. A user with .opus files in their library never saw them in artist/album listings because the scanner skipped indexing — silent data loss. Aligned the scanner to match the media handler. Scribe statuses updated to in_progress; flipping to done after the push since these are mechanical and verified directly against the cited file:lines.
52 lines
1.9 KiB
TypeScript
52 lines
1.9 KiB
TypeScript
import { describe, expect, test } from 'vitest';
|
|
import { isPublicRoute } from './publicRoutes';
|
|
|
|
describe('isPublicRoute', () => {
|
|
test('/login is public — login form must render to unauthenticated visitors', () => {
|
|
expect(isPublicRoute('/login')).toBe(true);
|
|
});
|
|
|
|
// Regression guard for #376: /register was previously bounced to /login
|
|
// by the layout guard, breaking bootstrap-admin self-registration on
|
|
// fresh deployments. Do NOT remove /register from the public set unless
|
|
// you have a deliberate replacement (e.g. invite-only landing page).
|
|
test('/register is public — bootstrap admin must reach the form', () => {
|
|
expect(isPublicRoute('/register')).toBe(true);
|
|
});
|
|
|
|
test('/ is gated', () => {
|
|
expect(isPublicRoute('/')).toBe(false);
|
|
});
|
|
|
|
test('/admin/users is gated', () => {
|
|
expect(isPublicRoute('/admin/users')).toBe(false);
|
|
});
|
|
|
|
test('/settings is gated', () => {
|
|
expect(isPublicRoute('/settings')).toBe(false);
|
|
});
|
|
|
|
test('paths that merely start with /login are not public', () => {
|
|
expect(isPublicRoute('/login/extra')).toBe(false);
|
|
expect(isPublicRoute('/loginx')).toBe(false);
|
|
});
|
|
|
|
// Regression guard for drift #558: /forgot-password and the
|
|
// /reset-password/<token> deep links must be reachable without a
|
|
// session — the reset flow is entered by clicking an email link
|
|
// while signed out, so the auth gate redirecting to /login broke
|
|
// account recovery.
|
|
test('/forgot-password is public', () => {
|
|
expect(isPublicRoute('/forgot-password')).toBe(true);
|
|
});
|
|
|
|
test('/reset-password/<token> is public', () => {
|
|
expect(isPublicRoute('/reset-password/abc-123')).toBe(true);
|
|
expect(isPublicRoute('/reset-password/')).toBe(true);
|
|
});
|
|
|
|
test('/reset-password (no trailing slash) is NOT public — only the token sub-path', () => {
|
|
expect(isPublicRoute('/reset-password')).toBe(false);
|
|
});
|
|
});
|