archetech / archon / 30770397419

94%

push

github

test(herald): cover the inbound-email webhook secret and Tor routing (#831)

routes.ts 81.9% -> 86.5% branches (35 -> 26 missed), lines 89.7%.

Two clusters were env-gated: WEBHOOK_SECRET and TOR_PROXY are read from
config at module-evaluation time, so they need their own file with the
env set before the dynamic import — the main routes suite requires them
unset, or every inbound-email test would have to thread a secret and the
LNURLp fetch path would change for all of them.

Webhook secret: rejects a missing secret, rejects a mismatched one,
accepts the configured one, and asserts the secret is checked BEFORE the
body is parsed, so an unauthenticated caller never reaches the parser.

Tor routing: an .onion endpoint gets a SOCKS dispatcher attached and a
clearnet endpoint does not — the branch that decides whether a payment
request leaves over clearnet.

Fallbacks on both inbound paths: an unparseable From header falling back
to the raw header, and an empty body substituting placeholder text.

One of my own bugs is worth recording. The `bridge(over)` helper built its
object but never spread `over` into it, so the reply-path overrides were
silently discarded and the test exercised the unsolicited path while
claiming to test the reply path. It surfaced only because the assertion
was specific enough to fail on `createDmail` being called zero times; a
looser "did not throw" assertion would have passed against the wrong
branch. That is the third helper-level mistake this session that produced
a green test proving nothing, and all three were caught by asserting on
concrete call arguments rather than on absence of failure.

Repo branches 86.06% -> 86.46%, lines 96.67%.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

3598 of 4060 branches covered (88.62%)

Branch coverage included in aggregate %.

8227 of 8511 relevant lines covered (96.66%)

687.17 hits per line