archetech / archon / 30709433971

94%

push

github

test(drawbridge): cover the L402 auth primitives (#817)

* test(drawbridge): cover the L402 auth primitives

l402-auth.ts and errors.ts were already at 100%, but the auth machinery
underneath the middleware had no tests: macaroon minting and
verification, route pricing, the subscription header, and the rate
limiter were all uninstrumented and therefore invisible to coverage.

macaroon.ts is exercised against real macaroons.js crypto rather than
mocks: caveat encode/decode round-trips, all six isCaveatSatisfied
branches (including the constant-time payment_hash comparison and its
length-mismatch guard), rejection of unsatisfiable caveat sets, malformed
macaroon handling, and verifyMacaroon under a wrong DID, an expired
clock, and a different root secret — the last of which is what actually
proves signature verification works.

pricing.ts covers exact and parameterized route matching, trailing-slash
normalization, wrong-method rejection, and env loading. One asymmetry is
pinned by test rather than smoothed over: createDID validates `>= 0` so a
free createDID is accepted, while resolveDID validates `> 0` so a zero
price is silently dropped.

drawbridge/server goes from 2 files instrumented to 6, at 99.4%
(316/318). The two remaining lines are unreachable defensive branches: a
re-throw that requires a deterministic deserialize to fail on its second
call, and a digest-length check where both buffers are always 32 bytes.
Repo total 96.58% -> 96.63%.

drawbridge-api.ts is untouched — it builds its Express app at module
scope, so covering it needs a router-factory refactor rather than a
test-only change.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* build: declare macaroons.js as a root devDependency for tests

tests/drawbridge/macaroon.test.ts passed locally but failed CI with
"Cannot find module 'macaroons.js'". Root `workspaces` is `packages/*`
only, so services/drawbridge/server is not a workspace and `npm ci` never
installs its d... (continued)

3090 of 3607 branches covered (85.67%)

Branch coverage included in aggregate %.

7300 of 7556 relevant lines covered (96.61%)

752.78 hits per line