2 Commits

Include renames

Author	SHA1	Message	Date
thepraandClaude Opus 5.5	125a49a1a0	T4: nothing answers 500 ... NeverFiveHundredTests walks every endpoint the server maps and fills each route parameter with junk ('x', zeroed and random ObjectIds, a dot-dot segment, 5000 characters). It calls each one anonymously, as a persona, and with a junk token, and asserts that nothing answers 5xx or throws, and that every /api error carries a Mastodon error body. It found two bugs: - A junk 'Authorization: Bearer' on any non-/api route, anonymous ones included (/build.json, /peasants/*, inboxes), broke the response. JwtEvents.AuthenticationFailed wrote a body during authentication and the endpoint then wrote its own. The 401 body now comes from the Challenge event, which runs only when an endpoint needs a user. - /api answered 401, 404 and 429 with no body. UseMastodonErrorBodies gives any /api error that leaves without a body Mastodon's {"error": ...}. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ELjqpznMFMNrJoJUj6K5p2	2026-10-03 10:46:20 +02:00
thepraandClaude Opus 5.5	5e34517e73	T3: the whole server under test ... PrivaPubHost is a WebApplicationFactory<Program> on the fixture's database, configured only through UseSetting (visible before Build, unlike ConfigureAppConfiguration). It drops the background workers so tests run the jobs they queue (Jobs.Run, RunInbox), gives each client its own address for the rate limiter, and has a SecureMode variant. Accounts signs up roots, adds personas and gets Mastodon tokens through the real /oauth code flow. RemoteActor signs HttpRequestMessages for the real /peasants routes; Peer records bodies and headers and serves files with ranges and text pages. Program registers the Guid serializer with TryRegisterSerializer, so a second host in one process starts; the fixture runs the migrations in production's order before any test. HostBootTests: the host shares the fixture database; the harness handles exactly the activities the server registers; every job kind has one handler; every controller and page model can be made; the service graph validates with ValidateOnBuild and ValidateScopes; Swagger is 404 outside Development; a persona's token never names its root; a signed DM through the real /mouth route is queued, processed and stored. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ELjqpznMFMNrJoJUj6K5p2	2026-10-03 10:43:03 +02:00