mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-09 04:50:59 +00:00
test(api): batch-workout integration + race + size-cap coverage
Unit + integration coverage for POST /api/workouts/batch. Unit (database-free, mocks the Prisma layer): - 401 on unauthenticated calls - 413 when Content-Length exceeds the 5 MB ceiling, with the documented workout.batch.payload_too_large error code - 429 when the rate-limit gate blocks the call - 400 when the workouts array exceeds the 100-entry cap - 400 when the Zod schema rejects the payload - 400 when a route exceeds the 20 000-point cap - Fresh entries marked inserted - Pre-existing entries flagged duplicate without re-inserting - Race-reconciliation downgrades inserted statuses to duplicate when createMany.count is below the attempted-row count - WorkoutRoute rows attached by FK after the workout createMany Integration (real Postgres in a testcontainer): - Happy-path single workout with nested route lands as a Workout row + WorkoutRoute row + 1:1 FK + computed durationSec - 100-workout batch with mixed routes lands all 100 workouts and exactly the expected number of route rows - Over-cap batch (101 workouts) returns 400 with workout.batch.too_large - Over-cap route (20 001 points) returns 400 with workout.batch.invalid - Re-posted batch surfaces as duplicates without inserting twice - Idempotency-Key replays the cached envelope and sets the X-Idempotent-Replay header - Pre-seeded rate-limit row triggers 429 and writes nothing - Narrow-scope Bearer token admitted on a route that declares no required permission (the W10 fix-C correctness fix the iOS narrow-scope sync depends on)
This commit is contained in:
Marc-André Bombeck committed
1 parent
6ed925fee8
commit
caf2371c77
2 files changed
+760
No files matched your search
@@ -0,0 +1,351 @@
|
||||
/**
|
||||
* Unit suite for `POST /api/workouts/batch`.
|
||||
*
|
||||
* Database-free coverage of the surface that doesn't require a real
|
||||
* Postgres — the per-entry status envelope, the rate-limit gate, the
|
||||
* payload-size ceiling, the Zod-parse short-circuits, and the
|
||||
* race-reconciliation downgrade pass. Full request-lifecycle assertions
|
||||
* (idempotency replay, real-DB dedup, concurrent-write race) live in
|
||||
* the matching `tests/integration/workout-batch-create.test.ts`.
|
||||
*/
|
||||
import { describe, expect, it, vi, beforeEach } from "vitest";
|
||||
import { NextRequest } from "next/server";
|
||||
|
||||
vi.mock("@/lib/db", () => ({
|
||||
prisma: {
|
||||
workout: {
|
||||
findMany: vi.fn(),
|
||||
createMany: vi.fn(),
|
||||
findFirst: vi.fn(),
|
||||
},
|
||||
workoutRoute: {
|
||||
createMany: vi.fn(),
|
||||
},
|
||||
$transaction: vi.fn(async (fn: unknown) => {
|
||||
// Same shape as the real Prisma client — invoke the supplied
|
||||
// callback with the mocked client itself so `tx.workout.createMany`
|
||||
// calls land on the same vi.fn instances.
|
||||
if (typeof fn === "function") {
|
||||
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
||||
return (fn as any)((prisma as unknown as { workout: unknown }));
|
||||
}
|
||||
}),
|
||||
},
|
||||
}));
|
||||
|
||||
vi.mock("@/lib/auth/session", () => ({ getSession: vi.fn() }));
|
||||
|
||||
vi.mock("@/lib/auth/audit", () => ({
|
||||
auditLog: vi.fn().mockResolvedValue(undefined),
|
||||
}));
|
||||
|
||||
vi.mock("@/lib/logging/transports", () => ({ emitIfSampled: vi.fn() }));
|
||||
|
||||
vi.mock("@/lib/db-compat", () => ({
|
||||
ensureDbCompatibility: vi.fn().mockResolvedValue(undefined),
|
||||
}));
|
||||
|
||||
vi.mock("@/lib/rate-limit", () => ({
|
||||
checkRateLimit: vi.fn(),
|
||||
}));
|
||||
|
||||
vi.mock("next/headers", () => ({
|
||||
headers: vi.fn(async () => ({ get: () => null })),
|
||||
cookies: vi.fn(async () => ({
|
||||
get: () => undefined,
|
||||
set: () => {},
|
||||
delete: () => {},
|
||||
})),
|
||||
}));
|
||||
|
||||
import { POST } from "../batch/route";
|
||||
import { prisma } from "@/lib/db";
|
||||
import { getSession } from "@/lib/auth/session";
|
||||
import { checkRateLimit } from "@/lib/rate-limit";
|
||||
|
||||
const SESSION_OK = {
|
||||
session: { id: "sess-1", expiresAt: new Date(Date.now() + 3_600_000) },
|
||||
user: { id: "user-1", username: "marc", role: "USER" as const },
|
||||
};
|
||||
|
||||
function makeRequest(
|
||||
body: unknown,
|
||||
opts: {
|
||||
contentLength?: number | null;
|
||||
headers?: Record<string, string>;
|
||||
} = {},
|
||||
): NextRequest {
|
||||
const baseHeaders: Record<string, string> = {
|
||||
"content-type": "application/json",
|
||||
...(opts.headers ?? {}),
|
||||
};
|
||||
const serialized = JSON.stringify(body);
|
||||
if (opts.contentLength !== null) {
|
||||
baseHeaders["content-length"] = String(
|
||||
opts.contentLength ?? serialized.length,
|
||||
);
|
||||
}
|
||||
return new NextRequest("http://localhost/api/workouts/batch", {
|
||||
method: "POST",
|
||||
headers: baseHeaders,
|
||||
body: serialized,
|
||||
});
|
||||
}
|
||||
|
||||
function validWorkout(externalId: string, overrides: Record<string, unknown> = {}) {
|
||||
return {
|
||||
sportType: "running",
|
||||
startedAt: "2026-05-14T06:30:00.000Z",
|
||||
endedAt: "2026-05-14T07:15:00.000Z",
|
||||
source: "APPLE_HEALTH",
|
||||
externalId,
|
||||
...overrides,
|
||||
};
|
||||
}
|
||||
|
||||
beforeEach(() => {
|
||||
vi.resetAllMocks();
|
||||
vi.mocked(getSession).mockResolvedValue(SESSION_OK as never);
|
||||
vi.mocked(checkRateLimit).mockResolvedValue({
|
||||
allowed: true,
|
||||
remaining: 60,
|
||||
resetAt: Date.now() + 60_000,
|
||||
});
|
||||
vi.mocked(prisma.workout.findMany).mockResolvedValue([]);
|
||||
vi.mocked(prisma.workout.createMany).mockResolvedValue({ count: 0 });
|
||||
vi.mocked(prisma.workout.findFirst).mockResolvedValue(null);
|
||||
vi.mocked(prisma.workoutRoute.createMany).mockResolvedValue({ count: 0 });
|
||||
});
|
||||
|
||||
describe("POST /api/workouts/batch — auth + size + rate-limit", () => {
|
||||
it("returns 401 when unauthenticated", async () => {
|
||||
vi.mocked(getSession).mockResolvedValue(null);
|
||||
const res = await POST(makeRequest({ workouts: [validWorkout("a")] }));
|
||||
expect(res.status).toBe(401);
|
||||
});
|
||||
|
||||
it("returns 413 when Content-Length exceeds the 5 MB ceiling", async () => {
|
||||
const res = await POST(
|
||||
makeRequest(
|
||||
{ workouts: [validWorkout("uuid-1")] },
|
||||
{ contentLength: 6 * 1024 * 1024 },
|
||||
),
|
||||
);
|
||||
expect(res.status).toBe(413);
|
||||
const body = (await res.json()) as {
|
||||
error: string;
|
||||
meta?: { errorCode?: string };
|
||||
};
|
||||
expect(body.meta?.errorCode).toBe("workout.batch.payload_too_large");
|
||||
});
|
||||
|
||||
it("returns 429 when the rate-limit gate blocks the call", async () => {
|
||||
vi.mocked(checkRateLimit).mockResolvedValue({
|
||||
allowed: false,
|
||||
remaining: 0,
|
||||
resetAt: Date.now() + 60_000,
|
||||
});
|
||||
const res = await POST(makeRequest({ workouts: [validWorkout("uuid-1")] }));
|
||||
expect(res.status).toBe(429);
|
||||
// We must NOT have queried Prisma after a rate-limit miss — the
|
||||
// gate's whole point is to short-circuit before the DB.
|
||||
expect(prisma.workout.createMany).not.toHaveBeenCalled();
|
||||
});
|
||||
});
|
||||
|
||||
describe("POST /api/workouts/batch — validation", () => {
|
||||
it("returns 400 when the workouts array exceeds the per-batch cap", async () => {
|
||||
const workouts = Array.from({ length: 101 }, (_, i) =>
|
||||
validWorkout(`uuid-${i}`),
|
||||
);
|
||||
const res = await POST(makeRequest({ workouts }));
|
||||
expect(res.status).toBe(400);
|
||||
const body = (await res.json()) as {
|
||||
error: string;
|
||||
meta?: { errorCode?: string };
|
||||
};
|
||||
expect(body.meta?.errorCode).toBe("workout.batch.too_large");
|
||||
});
|
||||
|
||||
it("returns 400 when the Zod schema rejects the payload", async () => {
|
||||
const res = await POST(
|
||||
makeRequest({
|
||||
workouts: [
|
||||
{
|
||||
// Missing required fields — Zod must reject.
|
||||
sportType: "running",
|
||||
},
|
||||
],
|
||||
}),
|
||||
);
|
||||
expect(res.status).toBe(400);
|
||||
const body = (await res.json()) as {
|
||||
error: string;
|
||||
meta?: { errorCode?: string };
|
||||
};
|
||||
expect(body.meta?.errorCode).toBe("workout.batch.invalid");
|
||||
});
|
||||
|
||||
it("returns 400 when a route exceeds the 20 000-point cap", async () => {
|
||||
// 20 001 points — schema must reject before the handler reaches
|
||||
// its DB layer. We assert no Prisma query fires.
|
||||
const coordinates: [number, number][] = [];
|
||||
for (let i = 0; i < 20_001; i++) {
|
||||
coordinates.push([11 + i * 1e-7, 49 + i * 1e-7]);
|
||||
}
|
||||
const res = await POST(
|
||||
makeRequest(
|
||||
{
|
||||
workouts: [
|
||||
validWorkout("uuid-route-cap", {
|
||||
route: { geometry: { type: "LineString", coordinates } },
|
||||
}),
|
||||
],
|
||||
},
|
||||
// Skip the Content-Length check — 20k coordinates serialised
|
||||
// is well under 5 MB and the request as built has the real
|
||||
// header anyway. The test asserts that the SCHEMA cap fires
|
||||
// even when the byte cap doesn't.
|
||||
{ contentLength: null },
|
||||
),
|
||||
);
|
||||
expect(res.status).toBe(400);
|
||||
expect(prisma.workout.createMany).not.toHaveBeenCalled();
|
||||
});
|
||||
});
|
||||
|
||||
describe("POST /api/workouts/batch — per-entry status envelope", () => {
|
||||
it("marks every fresh entry as inserted", async () => {
|
||||
vi.mocked(prisma.workout.createMany).mockResolvedValue({ count: 2 });
|
||||
const res = await POST(
|
||||
makeRequest({
|
||||
workouts: [
|
||||
validWorkout("uuid-fresh-1"),
|
||||
validWorkout("uuid-fresh-2"),
|
||||
],
|
||||
}),
|
||||
);
|
||||
expect(res.status).toBe(200);
|
||||
const body = (await res.json()) as {
|
||||
data: {
|
||||
processed: number;
|
||||
inserted: number;
|
||||
duplicates: number;
|
||||
entries: Array<{ status: string }>;
|
||||
};
|
||||
};
|
||||
expect(body.data.processed).toBe(2);
|
||||
expect(body.data.inserted).toBe(2);
|
||||
expect(body.data.duplicates).toBe(0);
|
||||
expect(body.data.entries.every((e) => e.status === "inserted")).toBe(true);
|
||||
});
|
||||
|
||||
it("flags entries already in the DB as duplicate without re-inserting", async () => {
|
||||
vi.mocked(prisma.workout.findMany).mockResolvedValue([
|
||||
{ source: "APPLE_HEALTH", externalId: "uuid-existing" },
|
||||
] as never);
|
||||
vi.mocked(prisma.workout.createMany).mockResolvedValue({ count: 1 });
|
||||
const res = await POST(
|
||||
makeRequest({
|
||||
workouts: [
|
||||
validWorkout("uuid-existing"),
|
||||
validWorkout("uuid-fresh"),
|
||||
],
|
||||
}),
|
||||
);
|
||||
expect(res.status).toBe(200);
|
||||
const body = (await res.json()) as {
|
||||
data: {
|
||||
inserted: number;
|
||||
duplicates: number;
|
||||
entries: Array<{ index: number; status: string }>;
|
||||
};
|
||||
};
|
||||
expect(body.data.inserted).toBe(1);
|
||||
expect(body.data.duplicates).toBe(1);
|
||||
expect(body.data.entries[0]?.status).toBe("duplicate");
|
||||
expect(body.data.entries[1]?.status).toBe("inserted");
|
||||
});
|
||||
|
||||
it("downgrades inserted statuses to duplicate when createMany.count < attempted (race)", async () => {
|
||||
// Pre-flight findMany returns empty (no obvious duplicates), so
|
||||
// every entry is initially marked "inserted". createMany then
|
||||
// returns count=1 — the other batch already won the race for one
|
||||
// row. The race-reconciliation block must downgrade exactly one
|
||||
// "inserted" status to "duplicate" so the envelope sums match the
|
||||
// aggregate counts (the v1.4.25 W10 fix-C invariant).
|
||||
vi.mocked(prisma.workout.findMany).mockResolvedValue([]);
|
||||
vi.mocked(prisma.workout.createMany).mockResolvedValue({ count: 1 });
|
||||
const res = await POST(
|
||||
makeRequest({
|
||||
workouts: [
|
||||
validWorkout("uuid-race-1"),
|
||||
validWorkout("uuid-race-2"),
|
||||
],
|
||||
}),
|
||||
);
|
||||
expect(res.status).toBe(200);
|
||||
const body = (await res.json()) as {
|
||||
data: {
|
||||
inserted: number;
|
||||
duplicates: number;
|
||||
entries: Array<{ status: string }>;
|
||||
};
|
||||
};
|
||||
const insertedEntries = body.data.entries.filter(
|
||||
(e) => e.status === "inserted",
|
||||
).length;
|
||||
const duplicateEntries = body.data.entries.filter(
|
||||
(e) => e.status === "duplicate",
|
||||
).length;
|
||||
expect(insertedEntries).toBe(body.data.inserted);
|
||||
expect(duplicateEntries).toBe(body.data.duplicates);
|
||||
expect(body.data.inserted).toBe(1);
|
||||
expect(body.data.duplicates).toBe(1);
|
||||
});
|
||||
});
|
||||
|
||||
describe("POST /api/workouts/batch — nested route attachment", () => {
|
||||
it("creates a WorkoutRoute row for a workout that ships a route", async () => {
|
||||
vi.mocked(prisma.workout.createMany).mockResolvedValue({ count: 1 });
|
||||
// Post-insert lookup returns the newly-inserted workout id so the
|
||||
// route can be attached by FK.
|
||||
vi.mocked(prisma.workout.findMany).mockImplementation((async (args: {
|
||||
select?: { id?: true; source?: true; externalId?: true };
|
||||
}) => {
|
||||
if (args.select?.id) {
|
||||
return [
|
||||
{
|
||||
id: "wkt-fresh-id",
|
||||
source: "APPLE_HEALTH",
|
||||
externalId: "uuid-with-route",
|
||||
},
|
||||
];
|
||||
}
|
||||
return [];
|
||||
}) as never);
|
||||
|
||||
const res = await POST(
|
||||
makeRequest({
|
||||
workouts: [
|
||||
validWorkout("uuid-with-route", {
|
||||
route: {
|
||||
geometry: {
|
||||
type: "LineString",
|
||||
coordinates: [
|
||||
[11.077, 49.452],
|
||||
[11.078, 49.453],
|
||||
],
|
||||
},
|
||||
},
|
||||
}),
|
||||
],
|
||||
}),
|
||||
);
|
||||
expect(res.status).toBe(200);
|
||||
expect(prisma.workoutRoute.createMany).toHaveBeenCalledTimes(1);
|
||||
const call = vi.mocked(prisma.workoutRoute.createMany).mock.calls[0]?.[0];
|
||||
const rows = (call as { data: Array<{ workoutId: string }> }).data;
|
||||
expect(rows[0]?.workoutId).toBe("wkt-fresh-id");
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,409 @@
|
||||
/**
|
||||
* Integration suite for `POST /api/workouts/batch` — the v1.5 iOS
|
||||
* HealthKit ingest endpoint and the deferred Withings activity sync
|
||||
* target. Asserts the contract the iOS client relies on against a real
|
||||
* Postgres in a testcontainer:
|
||||
*
|
||||
* - Mixed batches with nested routes succeed end-to-end
|
||||
* - Re-posting the same batch yields per-entry duplicates
|
||||
* - Over-cap batches return 400 with the documented error code
|
||||
* - Over-cap routes return 400 with the documented error code
|
||||
* - Idempotency-Key replay returns the cached envelope
|
||||
* - Rate-limit kicks in at the documented ceiling
|
||||
* - Narrow-scope Bearer tokens are admitted (W10 fix-C parity)
|
||||
*
|
||||
* A separate file at this directory carries the concurrent-write race
|
||||
* test so the contention assertion stays focused on the invariant that
|
||||
* was the original target of the W10 fix-C reconciliation.
|
||||
*/
|
||||
import { NextRequest } from "next/server";
|
||||
import { beforeEach, describe, expect, it, vi } from "vitest";
|
||||
|
||||
import { cookieJar, headerJar } from "./mock-next-headers";
|
||||
import { getPrismaClient, truncateAllTables } from "./setup";
|
||||
|
||||
// The HMAC key must be present before any module that touches
|
||||
// `@/lib/auth/hmac` is imported — `hashToken()` reads it lazily but
|
||||
// only the first call's process state is exercised here.
|
||||
process.env.API_TOKEN_HMAC_KEY ??=
|
||||
"test-hmac-key-workout-batch-integration-32-bytes-min-1234567890";
|
||||
|
||||
const { hashToken } = await import("@/lib/auth/hmac");
|
||||
|
||||
const TEST_USER_ID = "user-workout-batch-test";
|
||||
|
||||
vi.mock("next/headers", async () => {
|
||||
const { cookieJar, headerJar } = await import("./mock-next-headers");
|
||||
return {
|
||||
headers: vi.fn(async () => ({
|
||||
get: (name: string) => headerJar.get(name.toLowerCase()) ?? null,
|
||||
})),
|
||||
cookies: vi.fn(async () => ({
|
||||
get: (name: string) => {
|
||||
const value = cookieJar.get(name);
|
||||
return value ? { name, value } : undefined;
|
||||
},
|
||||
set: (name: string, value: string) => {
|
||||
cookieJar.set(name, value);
|
||||
},
|
||||
delete: (name: string) => {
|
||||
cookieJar.delete(name);
|
||||
},
|
||||
})),
|
||||
};
|
||||
});
|
||||
|
||||
vi.mock("@/lib/db-compat", () => ({
|
||||
ensureDbCompatibility: vi.fn().mockResolvedValue(undefined),
|
||||
}));
|
||||
|
||||
beforeEach(async () => {
|
||||
await truncateAllTables(getPrismaClient());
|
||||
cookieJar.clear();
|
||||
headerJar.clear();
|
||||
await getPrismaClient().user.create({
|
||||
data: {
|
||||
id: TEST_USER_ID,
|
||||
username: "workout-batch",
|
||||
email: "workout-batch@example.test",
|
||||
},
|
||||
});
|
||||
const session = await getPrismaClient().session.create({
|
||||
data: {
|
||||
userId: TEST_USER_ID,
|
||||
expiresAt: new Date(Date.now() + 60 * 60 * 1000),
|
||||
},
|
||||
});
|
||||
cookieJar.set("healthlog_session", session.id);
|
||||
});
|
||||
|
||||
interface WorkoutFixture {
|
||||
sportType?: string;
|
||||
startedAt?: string;
|
||||
endedAt?: string;
|
||||
totalEnergyKcal?: number;
|
||||
totalDistanceM?: number;
|
||||
avgHeartRate?: number;
|
||||
maxHeartRate?: number;
|
||||
minHeartRate?: number;
|
||||
stepCount?: number;
|
||||
elevationM?: number;
|
||||
pauseDurationSec?: number;
|
||||
source?: string;
|
||||
externalId?: string;
|
||||
externalSourceVersion?: string;
|
||||
metadata?: Record<string, unknown>;
|
||||
route?: {
|
||||
geometry: { type: "LineString"; coordinates: [number, number][] };
|
||||
sampleTimestamps?: Array<{ t: string; speedMs?: number; hr?: number }>;
|
||||
};
|
||||
}
|
||||
|
||||
function makeRequest(
|
||||
body: { workouts: WorkoutFixture[] },
|
||||
opts: {
|
||||
idempotencyKey?: string;
|
||||
bearer?: string;
|
||||
contentLength?: number | null;
|
||||
} = {},
|
||||
): NextRequest {
|
||||
const headers: Record<string, string> = {
|
||||
"content-type": "application/json",
|
||||
};
|
||||
if (opts.idempotencyKey) {
|
||||
headers["idempotency-key"] = opts.idempotencyKey;
|
||||
}
|
||||
if (opts.bearer) {
|
||||
headers["authorization"] = `Bearer ${opts.bearer}`;
|
||||
}
|
||||
if (opts.contentLength !== null && opts.contentLength !== undefined) {
|
||||
headers["content-length"] = String(opts.contentLength);
|
||||
}
|
||||
const serialized = JSON.stringify(body);
|
||||
return new NextRequest("http://localhost/api/workouts/batch", {
|
||||
method: "POST",
|
||||
headers,
|
||||
body: serialized,
|
||||
});
|
||||
}
|
||||
|
||||
function baseWorkout(
|
||||
externalId: string,
|
||||
overrides: WorkoutFixture = {},
|
||||
): WorkoutFixture {
|
||||
return {
|
||||
sportType: "running",
|
||||
startedAt: "2026-05-14T06:30:00.000Z",
|
||||
endedAt: "2026-05-14T07:15:00.000Z",
|
||||
source: "APPLE_HEALTH",
|
||||
externalId,
|
||||
...overrides,
|
||||
};
|
||||
}
|
||||
|
||||
describe("POST /api/workouts/batch (real Postgres)", () => {
|
||||
it("inserts a single workout with a nested route", async () => {
|
||||
const { POST } = await import("@/app/api/workouts/batch/route");
|
||||
|
||||
const body = {
|
||||
workouts: [
|
||||
baseWorkout("hk-uuid-route-001", {
|
||||
totalEnergyKcal: 412,
|
||||
totalDistanceM: 7800,
|
||||
avgHeartRate: 154,
|
||||
route: {
|
||||
geometry: {
|
||||
type: "LineString",
|
||||
coordinates: [
|
||||
[11.077, 49.452],
|
||||
[11.078, 49.453],
|
||||
[11.079, 49.454],
|
||||
],
|
||||
},
|
||||
sampleTimestamps: [
|
||||
{ t: "2026-05-14T06:30:00.000Z", speedMs: 3.2, hr: 142 },
|
||||
{ t: "2026-05-14T06:30:05.000Z", speedMs: 3.3, hr: 144 },
|
||||
{ t: "2026-05-14T06:30:10.000Z", speedMs: 3.1, hr: 146 },
|
||||
],
|
||||
},
|
||||
}),
|
||||
],
|
||||
};
|
||||
|
||||
const res = await POST(makeRequest(body));
|
||||
expect(res.status).toBe(200);
|
||||
const json = (await res.json()) as {
|
||||
data: { processed: number; inserted: number; duplicates: number };
|
||||
};
|
||||
expect(json.data.processed).toBe(1);
|
||||
expect(json.data.inserted).toBe(1);
|
||||
|
||||
const workouts = await getPrismaClient().workout.findMany({
|
||||
where: { userId: TEST_USER_ID },
|
||||
include: { route: true },
|
||||
});
|
||||
expect(workouts).toHaveLength(1);
|
||||
expect(workouts[0]?.sportType).toBe("running");
|
||||
expect(workouts[0]?.totalDistanceM).toBe(7800);
|
||||
expect(workouts[0]?.route).not.toBeNull();
|
||||
expect(workouts[0]?.durationSec).toBe(45 * 60);
|
||||
});
|
||||
|
||||
it("inserts a 100-workout batch with a mix of routed and routeless entries", async () => {
|
||||
const { POST } = await import("@/app/api/workouts/batch/route");
|
||||
|
||||
const workouts: WorkoutFixture[] = Array.from({ length: 100 }, (_, i) => {
|
||||
const offsetMin = i * 60;
|
||||
const start = new Date(2026, 4, 1, 6, offsetMin).toISOString();
|
||||
const end = new Date(2026, 4, 1, 6, offsetMin + 30).toISOString();
|
||||
const hasRoute = i % 5 === 0;
|
||||
return baseWorkout(`hk-uuid-batch-${i}`, {
|
||||
startedAt: start,
|
||||
endedAt: end,
|
||||
...(hasRoute
|
||||
? {
|
||||
route: {
|
||||
geometry: {
|
||||
type: "LineString",
|
||||
coordinates: [
|
||||
[11.077 + i * 1e-4, 49.452],
|
||||
[11.078 + i * 1e-4, 49.453],
|
||||
],
|
||||
},
|
||||
},
|
||||
}
|
||||
: {}),
|
||||
});
|
||||
});
|
||||
|
||||
const res = await POST(makeRequest({ workouts }));
|
||||
expect(res.status).toBe(200);
|
||||
const json = (await res.json()) as {
|
||||
data: { processed: number; inserted: number };
|
||||
};
|
||||
expect(json.data.processed).toBe(100);
|
||||
expect(json.data.inserted).toBe(100);
|
||||
|
||||
const storedWorkouts = await getPrismaClient().workout.count({
|
||||
where: { userId: TEST_USER_ID },
|
||||
});
|
||||
expect(storedWorkouts).toBe(100);
|
||||
const storedRoutes = await getPrismaClient().workoutRoute.count({
|
||||
where: { workout: { userId: TEST_USER_ID } },
|
||||
});
|
||||
expect(storedRoutes).toBe(20);
|
||||
});
|
||||
|
||||
it("returns 400 with workout.batch.too_large when workouts exceed the cap", async () => {
|
||||
const { POST } = await import("@/app/api/workouts/batch/route");
|
||||
|
||||
const workouts = Array.from({ length: 101 }, (_, i) =>
|
||||
baseWorkout(`hk-uuid-cap-${i}`),
|
||||
);
|
||||
|
||||
const res = await POST(makeRequest({ workouts }));
|
||||
expect(res.status).toBe(400);
|
||||
const body = (await res.json()) as {
|
||||
error: string;
|
||||
meta?: { errorCode?: string };
|
||||
};
|
||||
expect(body.meta?.errorCode).toBe("workout.batch.too_large");
|
||||
|
||||
const stored = await getPrismaClient().workout.count({
|
||||
where: { userId: TEST_USER_ID },
|
||||
});
|
||||
expect(stored).toBe(0);
|
||||
});
|
||||
|
||||
it("returns 400 when a single route exceeds the 20 000-point cap", async () => {
|
||||
const { POST } = await import("@/app/api/workouts/batch/route");
|
||||
|
||||
const coordinates: [number, number][] = [];
|
||||
for (let i = 0; i < 20_001; i++) {
|
||||
coordinates.push([11 + i * 1e-7, 49 + i * 1e-7]);
|
||||
}
|
||||
|
||||
const res = await POST(
|
||||
makeRequest(
|
||||
{
|
||||
workouts: [
|
||||
baseWorkout("hk-uuid-route-cap", {
|
||||
route: { geometry: { type: "LineString", coordinates } },
|
||||
}),
|
||||
],
|
||||
},
|
||||
// Skip the Content-Length pre-flight — the test wants to
|
||||
// exercise the schema cap, not the byte cap.
|
||||
{ contentLength: null },
|
||||
),
|
||||
);
|
||||
expect(res.status).toBe(400);
|
||||
const body = (await res.json()) as {
|
||||
error: string;
|
||||
meta?: { errorCode?: string };
|
||||
};
|
||||
expect(body.meta?.errorCode).toBe("workout.batch.invalid");
|
||||
|
||||
const stored = await getPrismaClient().workout.count({
|
||||
where: { userId: TEST_USER_ID },
|
||||
});
|
||||
expect(stored).toBe(0);
|
||||
});
|
||||
|
||||
it("dedupes a re-posted batch into duplicate status without inserting twice", async () => {
|
||||
const { POST } = await import("@/app/api/workouts/batch/route");
|
||||
|
||||
const body = {
|
||||
workouts: [
|
||||
baseWorkout("hk-uuid-dup-1"),
|
||||
baseWorkout("hk-uuid-dup-2"),
|
||||
],
|
||||
};
|
||||
|
||||
const first = await POST(makeRequest(body));
|
||||
expect(first.status).toBe(200);
|
||||
const firstJson = (await first.json()) as { data: { inserted: number } };
|
||||
expect(firstJson.data.inserted).toBe(2);
|
||||
|
||||
const second = await POST(makeRequest(body));
|
||||
expect(second.status).toBe(200);
|
||||
const secondJson = (await second.json()) as {
|
||||
data: {
|
||||
inserted: number;
|
||||
duplicates: number;
|
||||
entries: Array<{ status: string }>;
|
||||
};
|
||||
};
|
||||
expect(secondJson.data.inserted).toBe(0);
|
||||
expect(secondJson.data.duplicates).toBe(2);
|
||||
expect(secondJson.data.entries.every((e) => e.status === "duplicate")).toBe(
|
||||
true,
|
||||
);
|
||||
|
||||
const stored = await getPrismaClient().workout.count({
|
||||
where: { userId: TEST_USER_ID },
|
||||
});
|
||||
expect(stored).toBe(2);
|
||||
});
|
||||
|
||||
it("replays a cached response when the same Idempotency-Key is reused", async () => {
|
||||
const { POST } = await import("@/app/api/workouts/batch/route");
|
||||
|
||||
const body = {
|
||||
workouts: [baseWorkout("hk-uuid-idem-1")],
|
||||
};
|
||||
|
||||
const key = "ios-workout-batch-12345678";
|
||||
const first = await POST(makeRequest(body, { idempotencyKey: key }));
|
||||
expect(first.status).toBe(200);
|
||||
const firstJson = (await first.json()) as { data: { inserted: number } };
|
||||
expect(firstJson.data.inserted).toBe(1);
|
||||
|
||||
const second = await POST(makeRequest(body, { idempotencyKey: key }));
|
||||
expect(second.status).toBe(200);
|
||||
expect(second.headers.get("X-Idempotent-Replay")).toBe("true");
|
||||
const secondJson = (await second.json()) as { data: { inserted: number } };
|
||||
// Same envelope as the first call — even though it would otherwise
|
||||
// have surfaced as a duplicate.
|
||||
expect(secondJson.data.inserted).toBe(1);
|
||||
|
||||
const stored = await getPrismaClient().workout.count({
|
||||
where: { userId: TEST_USER_ID, externalId: "hk-uuid-idem-1" },
|
||||
});
|
||||
expect(stored).toBe(1);
|
||||
});
|
||||
|
||||
it("rate-limits a user at 60 batches per minute", async () => {
|
||||
const { POST } = await import("@/app/api/workouts/batch/route");
|
||||
|
||||
const cap = 60;
|
||||
const resetAt = new Date(Date.now() + 60 * 1000);
|
||||
await getPrismaClient().$executeRaw`
|
||||
INSERT INTO rate_limits (key, count, reset_at)
|
||||
VALUES (${`workouts:batch:${TEST_USER_ID}`}, ${cap}, ${resetAt})
|
||||
`;
|
||||
|
||||
const res = await POST(
|
||||
makeRequest({ workouts: [baseWorkout("hk-uuid-rate-limit-1")] }),
|
||||
);
|
||||
expect(res.status).toBe(429);
|
||||
const json = (await res.json()) as { error: string };
|
||||
expect(json.error).toMatch(/too many/i);
|
||||
|
||||
const stored = await getPrismaClient().workout.count({
|
||||
where: { userId: TEST_USER_ID },
|
||||
});
|
||||
expect(stored).toBe(0);
|
||||
});
|
||||
|
||||
it("admits a narrow-scope Bearer token (W10 fix-C parity)", async () => {
|
||||
const { POST } = await import("@/app/api/workouts/batch/route");
|
||||
|
||||
// Drop the cookie session so the Bearer path is the ONLY auth in
|
||||
// play. A narrow-scope token (no wildcard) MUST still admit on a
|
||||
// route that declares no required permission — that's the W10
|
||||
// fix-C correctness fix the iOS narrow-scope sync depends on.
|
||||
cookieJar.delete("healthlog_session");
|
||||
|
||||
const rawToken = "hlk_narrow_scope_workout_ingest_token_value_a1b2c3d4e5";
|
||||
await getPrismaClient().apiToken.create({
|
||||
data: {
|
||||
userId: TEST_USER_ID,
|
||||
name: "narrow-scope-workouts",
|
||||
tokenHash: hashToken(rawToken),
|
||||
permissions: ["workouts:ingest"], // NO wildcard
|
||||
},
|
||||
});
|
||||
headerJar.set("authorization", `Bearer ${rawToken}`);
|
||||
|
||||
const res = await POST(
|
||||
makeRequest(
|
||||
{ workouts: [baseWorkout("hk-uuid-narrow-1")] },
|
||||
{ bearer: rawToken },
|
||||
),
|
||||
);
|
||||
expect(res.status).toBe(200);
|
||||
const json = (await res.json()) as { data: { inserted: number } };
|
||||
expect(json.data.inserted).toBe(1);
|
||||
});
|
||||
});
|
||||
Reference in new issue
Block a user