solidjs / solid / 33303943461

72%

main: 89%

push

github

test(web): pin three server-function invariants that nothing guards (#3111)

* test(web): pin three server-function invariants that nothing guards

The origin gate, the redirect mask's status set, and the error header's
bound each came from a recent fix, and each can be undone today without
a test failing.

- The gate has six branches; two were exercised. Sec-Fetch-Site is
  authoritative when present, so same-site and none are refused outright
  and never reach the trusted-origin matcher — loosening same-site is the
  natural-looking repair for a broken subdomain deployment. Without
  Sec-Fetch-Site, Origin decides and then Referer; a matcher that
  answered true for a non-matching origin would fail open unnoticed, and
  the Referer branch was unexercised entirely.

- The mask covers the statuses fetch follows, but only 302 was tested.
  Narrowing the set to {302, 303} leaves a scripted caller a real 307
  that fetch chases before the transport can read it.

- The error header's bound is applied by re-encoding a shrinking slice of
  the SOURCE; cutting the encoded form instead severs a percent escape
  and the value stops decoding. One message cannot tell the two apart —
  a naive slice survives whichever padding lands on an escape boundary —
  so the test sweeps six.

Each was checked by mutating the built runtime: loosening same-site
fails 1, narrowing the redirect set fails 3, slicing the encoding fails
5 of the 6 paddings. Tests only; no runtime change, so no changeset.

* test(web): drop a duplicated case, correct a comment, cover two matchers

Review of the first commit:

- The parameterised redirect test repeated 302, which the file already
  covers as "a returned redirect envelope: masked for scripted, real for
  unscripted". Narrowed to the four statuses nothing exercised, and the
  describe now carries its issue reference like its neighbours.

- The padding sweep's comment was wrong. Measured against a naive
  `encode(message).slice(0, LIMI... (continued)

517 of 789 branches covered (65.53%)

Branch coverage included in aggregate %.

767 of 1003 relevant lines covered (76.47%)

14.53 hits per line