From 87335d3080609022148295d8f0442a0c6d1be596 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Fri, 16 Oct 2026 02:59:48 +0200 Subject: [PATCH] test(managed-profiles): compare the guardian refusals without the request id Every error envelope now carries a fresh meta.requestId. The unknown-id and the not-yours refusal still have to match byte for byte on everything else; compare them through the shared helper, as the other enumeration checks do. --- .../integration/managed-profile-surface.test.ts | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/tests/integration/managed-profile-surface.test.ts b/tests/integration/managed-profile-surface.test.ts index 253db33a0..1758a5a52 100644 --- a/tests/integration/managed-profile-surface.test.ts +++ b/tests/integration/managed-profile-surface.test.ts @@ -22,6 +22,7 @@ import { cookieJar, headerJar, queuedSessionIds } from "./mock-next-headers"; import { getPrismaClient, switchSessionTo, truncateAllTables } from "./setup"; import { createManagedProfile } from "@/lib/managed-profiles/create"; import { acceptGrant, inviteGrant } from "@/lib/sharing/grants"; +import { bodyWithoutRequestId } from "@/__tests__/helpers/error-envelope"; process.env.API_TOKEN_HMAC_KEY ??= "test-hmac-key-managed-profile-surface-32-bytes-min-1234509876"; @@ -294,9 +295,18 @@ describe("who looks after a managed profile (real Postgres)", () => { const stranger = await person("stranger"); signIn(stranger); - const refused = await (await listGuardians(profile.id)).json(); - const unknown = await (await listGuardians("does-not-exist")).json(); - expect(unknown).toEqual(refused); + // `meta.requestId` is a fresh id per request and says nothing about the + // profile; every other byte has to match. + const refusedRes = await listGuardians(profile.id); + const unknownRes = await listGuardians("does-not-exist"); + expect(unknownRes.status).toBe(refusedRes.status); + const refused = await refusedRes.clone().json(); + const unknown = await unknownRes.clone().json(); + expect(typeof refused.meta?.requestId).toBe("string"); + expect(typeof unknown.meta?.requestId).toBe("string"); + expect(await bodyWithoutRequestId(unknownRes)).toBe( + await bodyWithoutRequestId(refusedRes), + ); }); it.each(["READ", "WRITE", "MANAGE"] as const)(