From dd3a7915d6d0c2e33772d4be8628114410b7faaa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Tue, 28 Jul 2026 00:09:22 +0200 Subject: [PATCH] test(backup): cover the assembly a custom cycle symptom has to cross Both ends of this defect had passing tests for the whole time it was broken. The section builder returned the symptoms, the wire schema declared them, the restore read them, and each of those three was covered on its own. Nothing covered the object literal in between, which copied section keys out one at a time and never listed `customSymptoms`. So the test spans the seam and asserts on rows. It populates an account with a symptom of its own on a day-log, builds the file through the real `buildFullBackupPayload`, serialises it, parses it back through the real `parseBackupPayload`, and drives the real admin restore. Asserting that the payload carries the field would only re-test the writer that was already green. Deleting the symptom row before the restore is the case the field exists for, not a contrivance: `restoreCycleData` clears day-logs, cycles, and the profile but never the symptom catalogue, so a restore onto the same instance still finds the row sitting there. That is why the older round-trip test stayed green through the whole thing. Mutation check: hand-pick the cycle section's keys again and the restore answers 500 on `Unknown cycle symptom keys: custom:sacroiliac-ache`, which is the production failure verbatim. --- ...ackup-custom-cycle-symptom-restore.test.ts | 214 ++++++++++++++++++ 1 file changed, 214 insertions(+) create mode 100644 tests/integration/backup-custom-cycle-symptom-restore.test.ts diff --git a/tests/integration/backup-custom-cycle-symptom-restore.test.ts b/tests/integration/backup-custom-cycle-symptom-restore.test.ts new file mode 100644 index 000000000..be4709966 --- /dev/null +++ b/tests/integration/backup-custom-cycle-symptom-restore.test.ts @@ -0,0 +1,214 @@ +/** + * The seam between the backup writer and the backup reader. + * + * Custom cycle symptoms had a green test on every end and shipped broken + * anyway. `buildCycleBackupSection` returned them, `backupPayloadSchema` + * declared them, `restoreCycleData` read them, and each of those three was + * covered. What nothing covered was the assembly in between: the payload was + * built as an object literal that copied section keys out one at a time, and + * `customSymptoms` was never on that list. Every backup written carried an + * empty array, so an account whose day-log referenced a symptom it had created + * itself could not be restored at all — the restore threw on a key nothing had + * written back and the route answered 500. + * + * So this test asserts on ROWS, never on the payload object. Asserting the + * payload carries `customSymptoms` would re-test the writer, which was already + * passing while production was broken. The account is populated, the REAL + * `buildFullBackupPayload` produces the file, the file is serialised and parsed + * back through the REAL `parseBackupPayload`, the account's own symptom row is + * removed so the file is the only place it survives, and the REAL admin restore + * has to put the row and its day-log link back. + * + * Removing the symptom row before restoring is the point, not a contrivance: + * `restoreCycleData` wipes day-logs, cycles, and the profile, but never the + * symptom catalogue. Restore onto the same instance and the row is still + * sitting there to resolve against, which is exactly why the older round-trip + * test stayed green. The file has to carry the symptom for the case the + * `customSymptoms` field exists for: a restore onto an instance that never had + * it. + * + * Mutation check: hand-pick the cycle section's keys in + * `buildFullBackupPayload` instead of spreading it, and this test reproduces + * the production failure — restore answers 500 on + * `Unknown cycle symptom keys: custom:sacroiliac-ache`. + */ +import { beforeEach, describe, expect, it, vi } from "vitest"; + +process.env.ENCRYPTION_KEY = + "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"; + +import { decrypt, encrypt } from "@/lib/crypto"; +import { buildFullBackupPayload } from "@/lib/export/full-backup-payload"; +import { parseBackupPayload } from "@/lib/validations/backup"; +import { POST } from "@/app/api/admin/backups/[id]/restore/route"; +import { invalidateUserData } from "@/lib/cache/invalidate"; + +import { cookieJar, headerJar } from "./mock-next-headers"; +import { getPrismaClient, truncateAllTables } from "./setup"; + +vi.mock("next/headers", async () => { + const { cookieJar, headerJar } = await import("./mock-next-headers"); + return { + headers: vi.fn(async () => ({ + get: (name: string) => headerJar.get(name.toLowerCase()) ?? null, + })), + cookies: vi.fn(async () => ({ + get: (name: string) => { + const value = cookieJar.get(name); + return value ? { name, value } : undefined; + }, + set: (name: string, value: string) => cookieJar.set(name, value), + delete: (name: string) => cookieJar.delete(name), + })), + }; +}); + +vi.mock("@/lib/db-compat", () => ({ + ensureDbCompatibility: vi.fn().mockResolvedValue(undefined), +})); + +vi.mock("@/lib/cache/invalidate", () => ({ + invalidateUserData: vi.fn(), +})); + +/** The user's own words for the symptom, as they are held at rest. */ +const SYMPTOM_LABEL = "Sacroiliac ache"; +const SYMPTOM_KEY = "custom:sacroiliac-ache"; + +beforeEach(async () => { + await truncateAllTables(getPrismaClient()); + cookieJar.clear(); + headerJar.clear(); + vi.mocked(invalidateUserData).mockClear(); +}); + +function makeRequest(id: string) { + return new Request(`http://localhost/api/admin/backups/${id}/restore`, { + method: "POST", + headers: { "content-type": "application/json" }, + body: JSON.stringify({ confirm: "RESTORE" }), + }); +} + +describe("a backup of an account with its own cycle symptom", () => { + it("restores the symptom and its day-log link onto an instance without it", async () => { + const prisma = getPrismaClient(); + + // The restore writes into the backup's owner, and the route refuses a + // payload whose declared owner differs from the backup row. Owner and + // operator are the same account here so the fixture stays about the + // symptom rather than about the ownership guard. + const owner = await prisma.user.create({ + data: { + username: "cycle-symptom-owner", + email: "cycle-symptom-owner@example.test", + role: "ADMIN", + }, + }); + const session = await prisma.session.create({ + data: { userId: owner.id, expiresAt: new Date(Date.now() + 60_000) }, + }); + cookieJar.set("healthlog_session", session.id); + + const category = await prisma.cycleSymptomCategory.findFirstOrThrow(); + const symptom = await prisma.cycleSymptom.create({ + data: { + userId: owner.id, + categoryId: category.id, + key: SYMPTOM_KEY, + labelKey: "cycle.symptom.custom", + labelEncrypted: encrypt(SYMPTOM_LABEL), + sortOrder: 3, + }, + }); + await prisma.cycleProfile.create({ + data: { + userId: owner.id, + goal: "GENERAL_HEALTH", + cycleTrackingEnabled: true, + typicalCycleLength: 29, + }, + }); + const cycle = await prisma.menstrualCycle.create({ + data: { + userId: owner.id, + startDate: "2026-07-01", + periodEndDate: "2026-07-05", + tz: "Europe/Berlin", + }, + }); + const dayLog = await prisma.cycleDayLog.create({ + data: { + userId: owner.id, + cycleId: cycle.id, + date: "2026-07-03", + flow: "MEDIUM", + source: "MANUAL", + tz: "Europe/Berlin", + symptomLinks: { create: { symptomId: symptom.id } }, + }, + }); + + // The real writer, the real wire format, the real reader. Nothing is + // asserted about `built` — the writer was green through the whole defect. + const { payload: built } = await buildFullBackupPayload(prisma, owner.id, { + purpose: "disaster-recovery", + }); + const parsed = parseBackupPayload(JSON.stringify(built)); + const backup = await prisma.dataBackup.create({ + data: { + userId: owner.id, + type: "CUSTOM_CYCLE_SYMPTOM_ROUND_TRIP", + data: encrypt(JSON.stringify(parsed)), + }, + }); + + // Model the instance the `customSymptoms` field exists for: one that never + // had this account's own symptom. The restore clears day-logs, cycles, and + // the profile itself, but never the symptom catalogue, so the row has to go + // before the restore runs or the file is not what resolves the link. + await prisma.cycleDayLog.deleteMany({ where: { userId: owner.id } }); + await prisma.menstrualCycle.deleteMany({ where: { userId: owner.id } }); + await prisma.cycleProfile.deleteMany({ where: { userId: owner.id } }); + await prisma.cycleSymptom.deleteMany({ where: { userId: owner.id } }); + expect( + await prisma.cycleSymptom.count({ where: { key: SYMPTOM_KEY } }), + ).toBe(0); + + const response = await POST( + makeRequest(backup.id) as unknown as Parameters[0], + { params: Promise.resolve({ id: backup.id }) }, + ); + + expect(response.status).toBe(200); + + // Rows, not payload keys. + const restoredSymptom = await prisma.cycleSymptom.findUniqueOrThrow({ + where: { key: SYMPTOM_KEY }, + }); + expect(restoredSymptom).toEqual( + expect.objectContaining({ + userId: owner.id, + categoryId: category.id, + labelKey: "cycle.symptom.custom", + sortOrder: 3, + isActive: true, + }), + ); + // The label is ciphertext on the wire and stays readable after the trip: + // a restored symptom whose label came back empty is the same lost data in + // a quieter form. + expect(decrypt(restoredSymptom.labelEncrypted!)).toBe(SYMPTOM_LABEL); + + const restoredDayLog = await prisma.cycleDayLog.findUniqueOrThrow({ + where: { id: dayLog.id }, + }); + expect(restoredDayLog.date).toBe("2026-07-03"); + expect( + await prisma.cycleSymptomLink.findMany({ + where: { dayLogId: restoredDayLog.id }, + select: { symptomId: true }, + }), + ).toEqual([{ symptomId: restoredSymptom.id }]); + }); +});