mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-26 09:52:11 +03:00
* chore(release): continue v3.8.25 development cycle after main code-sync (r5) main fast-forwarded to release/v3.8.25 (#3863): unblocked Build+Docker via #3864, plus #3837 (mimocode proxy) and #3862 (trivy bump). This marker re-opens the umbrella PR for further v3.8.25 work. No version bump. * fix(db): persist the Keep-latest-backups retention setting (#3834) (#3867) * fix(oauth): clear GitLab Duo setup message instead of 500 (#3861) (#3868) * test(oauth): prove refresh_token preserved on real gemini-cli/antigravity dispatch (#3850) (#3869) * feat(compression-ui): unified compression config UI — per-engine pages + combos editor + menu + WS default-on (#3860) Integrated into release/v3.8.25 — feat(compression-ui): unified compression configuration UI (Compression Hub + per-engine Lite/Aggressive/Ultra pages + combos editor + sidebar entry + live-WS default-on). File-size re-baselined for sidebarVisibility.ts/chatCore.ts growth; orphan ws test relocated to a collected path. * docs(changelog): complete the v3.8.25 release notes + credit all contributors Audited every commit since v3.8.24 and filled the gaps the [3.8.25] section was missing: a New Features section (compression engines + Compression Studios #3848, compression UI #3860, injection-guard #3857, kiro discovery #3836, Veo #3839, mimocode proxy #3837, Arena ELO flag #3821), 9 more Fixed entries (#3811/#3807/#3759/#3849/#3838/#3835/#3814/#3820/#3819), a Security section (CCR IDOR #3859, supply-chain #3824), and an Internal/Quality section. Every contributor and issue reporter is now credited. * docs(changelog): restore + complete the v3.8.25 release notes Re-adds CHANGELOG.md (a prior server-side commit accidentally dropped it) with the complete, audited [3.8.25] section: New Features, the full Fixed list, Security & Hardening, and Internal/Quality — every contributor and issue reporter credited. * chore(release): finalize v3.8.25 — reconcile CHANGELOG + i18n mirrors, document OMNIROUTE_MAX_PENDING_MIGRATIONS, green the unit suite Release-gate reconciliation for v3.8.25: - CHANGELOG: dated 2026-06-14, linked #3826, rolled up file-size re-baselines (#3823/#3833), recorded the test-greening; re-synced all 41 i18n CHANGELOG mirrors. - Documented OMNIROUTE_MAX_PENDING_MIGRATIONS (#3416) in .env.example + ENVIRONMENT.md. - Greened the unit suite (was merged red on 4 CI shards): aligned 10 stale tests to this cycle's intended behavior (#3838/#3822/#3501/SOCKS5/Vertex-Express/Antigravity) and the same-provider 503 fall-through test; de-flaked the compression benchmark reproducibility and ServiceSupervisor crash tests. No production code changed. * ci(security): clear OpenSSF Scorecard code-scanning noise + harden workflow token permissions The Security tab held 155 open alerts, ALL from the advisory OpenSSF Scorecard tool (#3824) — supply-chain/posture scores, not code vulnerabilities — which drowned out real CodeQL findings. - scorecard.yml: stop uploading SARIF to the code-scanning tab (drop the upload-sarif step + the now-unused security-events: write). The run still produces the OpenSSF badge (publish_results) and a downloadable SARIF artifact. - TokenPermissions hardening (the high-severity, genuinely-valuable subset): set each workflow's top-level token to read-only and grant the exact writes at the job level that needs them — npm-publish (id-token/packages on publish jobs), docker-publish (packages on build), electron-release (contents on build/release, id-token/packages on publish-npm), build-fork (packages on build), claude (empty top-level; job grants its own). The 155 existing alerts were dismissed. Not adopting repo-wide SHA-pinning (143 PinnedDependencies advisories) — declined. * test(integration): align stale wiring/socks5 integration tests to this cycle's behavior These were red on the CI Integration job (pre-existing). No production code changed: - integration-wiring: the combos page no longer renders a per-page EmailPrivacyToggle (#3822 consolidated it into Settings → Appearance); the provider-detail test-result masking and upstream-proxy copy moved to decomposed components (#3501 BatchTestResultsModal / UpstreamProxyCard) — assertions now read the owning files. - api-routes-critical: SOCKS5 is now enabled by default (opt-out), so the disabled- rejection test must set ENABLE_SOCKS5_PROXY=false explicitly (an unset env now means enabled). (The ~32 live-Gemini integration tests are gated on OMNIROUTE_API_KEY and skip in CI; they only 'fail' locally when that key is present without a running server.)
215 lines
8.8 KiB
TypeScript
215 lines
8.8 KiB
TypeScript
/**
|
|
* tests/unit/quota-email-privacy.test.ts
|
|
*
|
|
* Source-scan assertions for the email-privacy feature on the Quota Share screen.
|
|
* Mirrors the pattern from mask-email.test.ts and providers-page-utils.test.ts.
|
|
*
|
|
* Checks that every display component that can show an email:
|
|
* 1. Imports `useEmailPrivacyStore` from the store
|
|
* 2. Imports `maskEmailLikeValue` (or `pickDisplayValue`) from the mask utility
|
|
* 3. References `emailsVisible` in its body
|
|
*
|
|
* Also verifies the email-privacy control is consolidated into Settings → Appearance
|
|
* (#3822: the per-page toggle was removed in favor of a single global switch) while
|
|
* QuotaSharePageClient still consumes the store for masking.
|
|
*/
|
|
|
|
import test from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import fs from "node:fs";
|
|
import path from "node:path";
|
|
import { fileURLToPath } from "node:url";
|
|
|
|
const __dirname = path.dirname(fileURLToPath(import.meta.url));
|
|
const root = path.resolve(__dirname, "../../");
|
|
|
|
function readSrc(relPath: string): string {
|
|
return fs.readFileSync(path.join(root, relPath), "utf8");
|
|
}
|
|
|
|
const quotaShareDir = "src/app/(dashboard)/dashboard/costs/quota-share";
|
|
|
|
// ── File contents loaded once ─────────────────────────────────────────────────
|
|
|
|
const pageClientSrc = readSrc(`${quotaShareDir}/QuotaSharePageClient.tsx`);
|
|
const poolCardSrc = readSrc(`${quotaShareDir}/components/PoolCard.tsx`);
|
|
const accountQuotaRowSrc = readSrc(`${quotaShareDir}/components/AccountQuotaRow.tsx`);
|
|
const poolWizardSrc = readSrc(`${quotaShareDir}/components/PoolWizard.tsx`);
|
|
|
|
const settingsDir = "src/app/(dashboard)/dashboard/settings/components";
|
|
const appearanceTabSrc = readSrc(`${settingsDir}/AppearanceTab.tsx`);
|
|
const accountEmailVisibilitySrc = readSrc(`${settingsDir}/AccountEmailVisibilitySetting.tsx`);
|
|
|
|
// ── Global consolidation (#3822) ──────────────────────────────────────────────
|
|
|
|
test("email-privacy control is consolidated into Settings → Appearance (#3822)", () => {
|
|
assert.ok(
|
|
appearanceTabSrc.includes("AccountEmailVisibilitySetting"),
|
|
"Expected AppearanceTab to render the global AccountEmailVisibilitySetting"
|
|
);
|
|
assert.ok(
|
|
accountEmailVisibilitySrc.includes("setEmailsVisible") &&
|
|
accountEmailVisibilitySrc.includes("useEmailPrivacyStore"),
|
|
"Expected the global setting to drive emailsVisible via the store"
|
|
);
|
|
});
|
|
|
|
test("QuotaSharePageClient imports useEmailPrivacyStore", () => {
|
|
assert.ok(
|
|
pageClientSrc.includes('import useEmailPrivacyStore from "@/store/emailPrivacyStore"'),
|
|
"Expected useEmailPrivacyStore import in QuotaSharePageClient"
|
|
);
|
|
});
|
|
|
|
test("QuotaSharePageClient imports maskEmailLikeValue", () => {
|
|
assert.ok(
|
|
pageClientSrc.includes("maskEmailLikeValue"),
|
|
"Expected maskEmailLikeValue import/usage in QuotaSharePageClient"
|
|
);
|
|
});
|
|
|
|
test("QuotaSharePageClient consumes emailsVisible from store", () => {
|
|
assert.ok(
|
|
pageClientSrc.includes("emailsVisible"),
|
|
"Expected emailsVisible consumption in QuotaSharePageClient"
|
|
);
|
|
});
|
|
|
|
test("QuotaSharePageClient no longer renders a per-page email-privacy toggle (#3822)", () => {
|
|
assert.ok(
|
|
!pageClientSrc.includes("<EmailPrivacyToggle"),
|
|
"QuotaSharePageClient must not render its own EmailPrivacyToggle — the control is now global in Settings → Appearance"
|
|
);
|
|
});
|
|
|
|
test("QuotaSharePageClient masks connLabel output with emailsVisible gate", () => {
|
|
// connLabel must call maskEmailLikeValue and guard with emailsVisible
|
|
assert.ok(
|
|
pageClientSrc.includes("emailsVisible ? raw : maskEmailLikeValue(raw)") ||
|
|
(pageClientSrc.includes("emailsVisible") &&
|
|
pageClientSrc.includes("maskEmailLikeValue(raw)")),
|
|
"Expected connLabel to mask raw value when emailsVisible is false"
|
|
);
|
|
});
|
|
|
|
// ── PoolCard ──────────────────────────────────────────────────────────────────
|
|
|
|
test("PoolCard imports useEmailPrivacyStore", () => {
|
|
assert.ok(
|
|
poolCardSrc.includes('import useEmailPrivacyStore from "@/store/emailPrivacyStore"'),
|
|
"Expected useEmailPrivacyStore import in PoolCard"
|
|
);
|
|
});
|
|
|
|
test("PoolCard imports maskEmailLikeValue", () => {
|
|
assert.ok(
|
|
poolCardSrc.includes("maskEmailLikeValue"),
|
|
"Expected maskEmailLikeValue import/usage in PoolCard"
|
|
);
|
|
});
|
|
|
|
test("PoolCard consumes emailsVisible from store", () => {
|
|
assert.ok(poolCardSrc.includes("emailsVisible"), "Expected emailsVisible usage in PoolCard");
|
|
});
|
|
|
|
test("PoolCard uses displayName instead of raw pool.name in header", () => {
|
|
// The masked variable must be rendered, not the raw pool.name directly
|
|
assert.ok(
|
|
poolCardSrc.includes("displayName"),
|
|
"Expected displayName masking variable in PoolCard"
|
|
);
|
|
assert.ok(
|
|
poolCardSrc.includes("displayConnectionLabel"),
|
|
"Expected displayConnectionLabel masking variable in PoolCard"
|
|
);
|
|
});
|
|
|
|
test("PoolCard header renders displayName and displayConnectionLabel (not raw values)", () => {
|
|
// The raw `{pool.name} · {connectionLabel}` must NOT appear unmasked
|
|
assert.ok(
|
|
!poolCardSrc.includes("{pool.name} · {connectionLabel}"),
|
|
"PoolCard must not render raw {pool.name} · {connectionLabel} — use masked variables"
|
|
);
|
|
});
|
|
|
|
// ── AccountQuotaRow ───────────────────────────────────────────────────────────
|
|
|
|
test("AccountQuotaRow imports useEmailPrivacyStore", () => {
|
|
assert.ok(
|
|
accountQuotaRowSrc.includes('import useEmailPrivacyStore from "@/store/emailPrivacyStore"'),
|
|
"Expected useEmailPrivacyStore import in AccountQuotaRow"
|
|
);
|
|
});
|
|
|
|
test("AccountQuotaRow imports maskEmailLikeValue", () => {
|
|
assert.ok(
|
|
accountQuotaRowSrc.includes("maskEmailLikeValue"),
|
|
"Expected maskEmailLikeValue import/usage in AccountQuotaRow"
|
|
);
|
|
});
|
|
|
|
test("AccountQuotaRow consumes emailsVisible from store", () => {
|
|
assert.ok(
|
|
accountQuotaRowSrc.includes("emailsVisible"),
|
|
"Expected emailsVisible usage in AccountQuotaRow"
|
|
);
|
|
});
|
|
|
|
// ── PoolWizard ────────────────────────────────────────────────────────────────
|
|
|
|
test("PoolWizard imports useEmailPrivacyStore", () => {
|
|
assert.ok(
|
|
poolWizardSrc.includes('import useEmailPrivacyStore from "@/store/emailPrivacyStore"'),
|
|
"Expected useEmailPrivacyStore import in PoolWizard"
|
|
);
|
|
});
|
|
|
|
test("PoolWizard imports maskEmailLikeValue", () => {
|
|
assert.ok(
|
|
poolWizardSrc.includes("maskEmailLikeValue"),
|
|
"Expected maskEmailLikeValue import/usage in PoolWizard"
|
|
);
|
|
});
|
|
|
|
test("PoolWizard consumes emailsVisible from store", () => {
|
|
assert.ok(poolWizardSrc.includes("emailsVisible"), "Expected emailsVisible usage in PoolWizard");
|
|
});
|
|
|
|
test("PoolWizard connLabel masks detail with emailsVisible gate", () => {
|
|
assert.ok(
|
|
poolWizardSrc.includes("maskedDetail"),
|
|
"Expected maskedDetail variable in PoolWizard connLabel"
|
|
);
|
|
});
|
|
|
|
// ── EditAllocationsModal retired (Task 6) ────────────────────────────────────
|
|
// EditAllocationsModal was retired in Task 6 — edit mode now opens the full
|
|
// PoolWizard (which already has comprehensive email-privacy coverage above).
|
|
|
|
// ── maskEmailLikeValue helper behaviour (regression) ─────────────────────────
|
|
|
|
const { maskEmailLikeValue, pickDisplayValue } =
|
|
await import("../../src/shared/utils/maskEmail.ts");
|
|
|
|
test("maskEmailLikeValue masks email embedded in a pool name", () => {
|
|
const poolName = "codex / gael.martins@example.com";
|
|
// The full string contains @ so the whole thing gets treated as email — however
|
|
// maskEmailLikeValue only masks when the *trimmed* value contains @.
|
|
// The label is NOT just the email here, it contains a slash prefix.
|
|
// Verify: values with @ get masked, plain names stay plain.
|
|
assert.ok(maskEmailLikeValue("gael.martins@example.com").includes("***"), "email gets masked");
|
|
assert.equal(maskEmailLikeValue("Work Account"), "Work Account", "plain name is unchanged");
|
|
assert.equal(maskEmailLikeValue(null), "", "null returns empty string");
|
|
assert.equal(maskEmailLikeValue(undefined), "", "undefined returns empty string");
|
|
});
|
|
|
|
test("pickDisplayValue respects emailsVisible toggle for quota labels", () => {
|
|
const email = "gael.martins@example.com";
|
|
assert.equal(
|
|
pickDisplayValue([email], false, ""),
|
|
maskEmailLikeValue(email),
|
|
"when hidden: returns masked value"
|
|
);
|
|
assert.equal(pickDisplayValue([email], true, ""), email, "when visible: returns raw value");
|
|
});
|