refactor: enforce frontend view model boundaries
Frontend verify / commits (pull_request) Successful in 28s
Frontend verify / security (pull_request) Successful in 10s
Frontend verify / verify (pull_request) Successful in 8m19s

This commit is contained in:
2026-09-28 18:48:23 +03:00
parent 5b69003516
commit ca0ad4f824
287 changed files with 8558 additions and 4538 deletions
+15 -2
View File
@@ -9,14 +9,18 @@ import { apiClient, configureAuthClient } from "./client";
describe("apiClient authentication", () => {
it("refreshes once and retries an unauthorized protected request", async () => {
let token = "expired";
const refresh = vi.fn(() => {
token = "fresh";
return Promise.resolve(true);
});
const authorization: string[] = [];
server.use(
http.get("*/api/v1/brokerage-accounts", ({ request }) => {
authorization.push(request.headers.get("Authorization") ?? "");
return authorization.length === 1
? HttpResponse.json({ code: "UNAUTHORIZED" }, { status: 401 })
: HttpResponse.json(resource([]));
@@ -50,10 +54,14 @@ describe("apiClient authentication", () => {
});
it("does not attach Bearer auth to authentication endpoints", async () => {
let authorization: null | string = /* eslint-disable-line unicorn/no-null -- Exercise the explicit null returned by the production API/DOM contract. */ null;
let authorization: null | string
// eslint-disable-next-line unicorn/no-null -- Exercise the explicit null returned by the production API/DOM contract.
= null;
server.use(
http.post("*/api/v1/auth/refresh", ({ request }) => {
authorization = request.headers.get("Authorization");
return HttpResponse.json({ code: "UNAUTHORIZED" }, { status: 401 });
}),
);
@@ -71,12 +79,15 @@ describe("apiClient authentication", () => {
let generation = 0;
let calls = 0;
const { promise: pending, resolve: release } = Promise.withResolvers<void>();
const { promise: pending, resolve: release }
= Promise.withResolvers<void>();
server.use(
http.get("*/api/v1/brokerage-accounts", async () => {
if (++calls === 1)
return HttpResponse.json({ code: "UNAUTHORIZED" }, { status: 401 });
await pending;
return HttpResponse.json(resource([{ id: "previous-user-account" }]));
}),
);
@@ -86,10 +97,12 @@ describe("apiClient authentication", () => {
generation: () => generation,
refresh: () => Promise.resolve(true),
});
// eslint-disable-next-line vitest/valid-expect -- Attach rejection handling before releasing the request; the assertion is awaited below.
const response = expect(
apiClient.GET("/api/v1/brokerage-accounts"),
).rejects.toMatchObject({ name: "AbortError" });
await vi.waitFor(() => expect(calls).toBe(2));
generation += 1;
release();