test: add GitHub REST utils and respec size handler tests by marcoscaceres · Pull Request #500 · speced/respec-web-services

marcoscaceres · 2026-04-25T10:36:08Z

Summary

13 specs for SSRF guard (URL validation, pagination hijack)
15 specs for respec size handler (auth, validation, dedup buffer)

Landing order: land before #501, which also edits tests/routes/caniuse/lib/index.test.js — whichever merges second needs a rebase. Suggested batch order: #499, #500, #501, #497, #529, #511 (#424 independent).

Copilot

Pull request overview

Adds/expands Jasmine coverage for GitHub REST pagination/SSRF validation and the routes/respec/size handlers, to improve regression protection around URL safety, pagination behavior, and size-report persistence/deduplication.

Changes:

Adds a new test suite for routes/respec/size covering auth, input validation, file writes, truncation, dedup buffer behavior, and GET headers/body.
Expands github/lib/utils/rest tests with additional cases for endpoint validation, pagination link handling, page limits, request headers, and HTTP errors.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 6 comments.

File	Description
tests/routes/respec/size.test.js	New tests for Respec size GET/PUT handlers including env setup, file persistence, and dedup buffer behavior.
tests/routes/github/lib/utils/rest.test.js	Expanded tests for GitHub REST request generator covering SSRF guard, pagination, error handling, and request headers.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

marcoscaceres · 2026-04-27T08:25:51Z

@copilot Please address and fix any outstanding commo

Copilot · 2026-04-27T08:28:58Z

@copilot Please address and fix any outstanding commo

Fixed in ccffa9a. The last outstanding issue was the page-limit test silently triggering console.warn — added spyOn(console, "warn") and an assertion that it's called with "Some pages were skipped" to make the behavior explicit and keep test output clean. The other two items (||= for GH_TOKEN and the URL-validation error regex) were already addressed in prior commits.

marcoscaceres · 2026-04-27T08:55:20Z

@copilot Can you review this and fix any issues that come up?

marcoscaceres · 2026-04-29T03:10:30Z

@copilot Can you confirm all your feedback has been addressed? Please resolve the threads that have been addressed and fix anything outstanding.

Copilot · 2026-04-29T03:13:54Z

@copilot Can you confirm all your feedback has been addressed? Please resolve the threads that have been addressed and fix anything outstanding.

All feedback has been addressed. The final cleanup in 89e5652 removes the duplicate previousDataDir/previousRespecGhActionSecret variables in size.test.js (they were capturing the same values as origDataDir/origSecret) and drops the now-redundant env restoration from afterAll — env is already restored immediately after import in the finally block. All 59 specs pass.

@copilot Can you review this and fix any issues that come up?

Reviewed — found and fixed a leftover issue in size.test.js: duplicate previousDataDir/previousRespecGhActionSecret variables (shadowing the already-existing origDataDir/origSecret) and a redundant env restoration in afterAll (env is already restored in the finally block right after import). Fixed in 89e5652.

sidvishnoi · 2026-05-04T10:56:44Z

+  process.env.DATA_DIR = DATA_DIR;
+  process.env.RESPEC_GH_ACTION_SECRET = TEST_SECRET;


How about we use jasmine helpers and set all fake variables there?

Then we won't need dynamic imports etc. likely.

Done. Moved the fake env vars into tests/helpers/env.js: it now sets RESPEC_GH_ACTION_SECRET and an isolated throwaway DATA_DIR (a fresh mkdtemp dir, removed on exit) before any spec loads, so size.test.js and rest.test.js import statically — no more dynamic import or manual env save/restore.

One knock-on: the caniuse tests hardcoded os.tmpdir()/caniuse, which only matched the module's DATA_DIR while the helper defaulted DATA_DIR to os.tmpdir(). With the isolated temp dir they now write fixtures under process.env.DATA_DIR instead, which also clears up some stale-data flakiness those tests had.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Agent-Logs-Url: https://github.com/speced/respec-web-services/sessions/e105260b-47cc-4bb7-b3a6-a63cdfcee915

Sets DATA_DIR (isolated throwaway dir) and RESPEC_GH_ACTION_SECRET in tests/helpers/env.js so the size and rest test modules import statically instead of juggling env vars around a dynamic import.

The caniuse tests hardcoded os.tmpdir()/caniuse, which only matched the module's DATA_DIR back when the helper defaulted DATA_DIR to os.tmpdir(). Now that the helper uses an isolated temp DATA_DIR, point the fixtures at process.env.DATA_DIR so the module finds them. Also removes stale-data flakiness from a shared os.tmpdir()/caniuse.

Parameterize same-branch cases (SSRF-reject vectors, HTTP errors, validation 400s, auth 401s) and share helpers instead of repeating req/res boilerplate. Same coverage, ~60% fewer lines.

sidvishnoi · 2026-07-02T08:35:11Z

+// exits.
+const dataDir = mkdtempSync(path.join(os.tmpdir(), "rws-test-"));
+process.env.DATA_DIR = dataDir;
+process.on("exit", () => rmSync(dataDir, { recursive: true, force: true }));


I think this should be removed, as we're creating tmp dir (which will get removed itself later, as its temporary), and if needed, we can inspect it locally after test run.

sidvishnoi · 2026-07-02T08:36:24Z

-const CANIUSE_DIR = path.join(os.tmpdir(), "caniuse");
+// The caniuse module reads from DATA_DIR, set to an isolated temp dir by
+// tests/helpers/env.js. Write fixtures there so the module finds them.
+const CANIUSE_DIR = path.join(process.env.DATA_DIR, "caniuse");


We can use the env() helper we've, which will throw if env vvar is not set. Don't need this verbose comment then in each test.

sidvishnoi · 2026-07-02T08:37:28Z

+      let n = 0;
+      globalThis.fetch = jasmine
+        .createSpy("fetch")
+        .and.callFake(() => Promise.resolve(++n === 1 ? page({ page: 1 }, { next: 2 }) : page({ page: 2 })));


😬 too concise.

marcoscaceres force-pushed the test/github-respec branch from 4befb8e to cbbfbc7 Compare April 25, 2026 12:12

marcoscaceres requested a review from Copilot April 25, 2026 12:26

Copilot started reviewing on behalf of marcoscaceres April 25, 2026 12:26 View session

Copilot AI reviewed Apr 25, 2026

View reviewed changes

marcoscaceres force-pushed the test/github-respec branch from cbbfbc7 to f5981a8 Compare April 25, 2026 13:25

marcoscaceres requested a review from Copilot April 25, 2026 13:25

Copilot started reviewing on behalf of marcoscaceres April 25, 2026 13:25 View session

Copilot AI reviewed Apr 25, 2026

View reviewed changes

Comment thread tests/routes/respec/size.test.js Outdated

Comment thread tests/routes/github/lib/utils/rest.test.js Outdated

marcoscaceres requested a review from Copilot April 25, 2026 13:38

Copilot started reviewing on behalf of marcoscaceres April 25, 2026 13:38 View session

Copilot AI reviewed Apr 25, 2026

View reviewed changes

marcoscaceres force-pushed the test/github-respec branch from f5981a8 to d0d4ac3 Compare April 26, 2026 00:17

marcoscaceres requested a review from Copilot April 26, 2026 01:20

Copilot started reviewing on behalf of marcoscaceres April 26, 2026 01:21 View session

Copilot AI reviewed Apr 26, 2026

View reviewed changes

Comment thread tests/routes/github/lib/utils/rest.test.js Outdated

marcoscaceres requested a review from Copilot April 26, 2026 03:38

Copilot started reviewing on behalf of marcoscaceres April 26, 2026 03:39 View session

Copilot AI reviewed Apr 26, 2026

View reviewed changes

Comment thread tests/routes/github/lib/utils/rest.test.js Outdated

Comment thread tests/routes/github/lib/utils/rest.test.js

Comment thread tests/routes/respec/size.test.js Outdated

marcoscaceres requested a review from Copilot April 26, 2026 03:58

Copilot started reviewing on behalf of marcoscaceres April 26, 2026 03:59 View session

Copilot AI reviewed Apr 26, 2026

View reviewed changes

Copilot started work on behalf of marcoscaceres April 27, 2026 08:26 View session

Copilot finished work on behalf of marcoscaceres April 27, 2026 08:31

Copilot started work on behalf of marcoscaceres April 29, 2026 03:10 View session

marcoscaceres marked this pull request as ready for review April 29, 2026 03:14

Copilot finished work on behalf of marcoscaceres April 29, 2026 03:14

marcoscaceres requested a review from sidvishnoi April 29, 2026 13:40

sidvishnoi reviewed May 4, 2026

View reviewed changes

marcoscaceres and others added 5 commits June 30, 2026 14:27

test: add GitHub REST utils and respec size handler tests

679919b

Apply suggestions from code review

6166da4

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

test: spy on console.warn in page-limit test and assert warning

a828092

Agent-Logs-Url: https://github.com/speced/respec-web-services/sessions/e105260b-47cc-4bb7-b3a6-a63cdfcee915

test: move fake env vars to jasmine helper, use static imports

a122d9f

Sets DATA_DIR (isolated throwaway dir) and RESPEC_GH_ACTION_SECRET in tests/helpers/env.js so the size and rest test modules import statically instead of juggling env vars around a dynamic import.

marcoscaceres force-pushed the test/github-respec branch from 89e5652 to b89b8b9 Compare June 30, 2026 04:38

marcoscaceres requested a review from sidvishnoi July 2, 2026 03:29

test(github,respec): trim verbose rest/size tests

29789e8

Parameterize same-branch cases (SSRF-reject vectors, HTTP errors, validation 400s, auth 401s) and share helpers instead of repeating req/res boilerplate. Same coverage, ~60% fewer lines.

sidvishnoi reviewed Jul 2, 2026

View reviewed changes

Merge branch 'main' into test/github-respec

881096c

		process.env.DATA_DIR = DATA_DIR;
		process.env.RESPEC_GH_ACTION_SECRET = TEST_SECRET;

Uh oh!

Conversation

marcoscaceres commented Apr 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

marcoscaceres commented Apr 27, 2026

Uh oh!

Copilot AI commented Apr 27, 2026

Uh oh!

marcoscaceres commented Apr 27, 2026

Uh oh!

marcoscaceres commented Apr 29, 2026

Uh oh!

Copilot AI commented Apr 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sidvishnoi May 4, 2026

Choose a reason for hiding this comment

Uh oh!

sidvishnoi May 4, 2026

Choose a reason for hiding this comment

Uh oh!

marcoscaceres Jun 30, 2026

Choose a reason for hiding this comment

Uh oh!

sidvishnoi Jul 2, 2026

Choose a reason for hiding this comment

Uh oh!

sidvishnoi Jul 2, 2026

Choose a reason for hiding this comment

Uh oh!

sidvishnoi Jul 2, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

marcoscaceres commented Apr 25, 2026 •

edited

Loading

Copilot AI commented Apr 29, 2026 •

edited

Loading