aglinxinyuan opened a new pull request, #7384:
URL: https://github.com/apache/texera/pull/7384
### What changes were proposed in this PR?
Three of the four API clients under `agent-service/src/api` had no spec.
`auth-api.ts` is the one that decides whether a request is authenticated at
all, and none of its decisions were pinned.
Adds 30 tests across three spec files, following the `fetch`-spy pattern
already established by `compile-api.spec.ts`.
**auth-api** — several of these are policy choices that read like
oversights, so the tests state the intent rather than just the behaviour:
| Input | Result |
|---|---|
| token with no `exp` | valid — tokens minted without an expiry never expire
|
| malformed token | invalid — the decode error is swallowed and reported as
expired, not thrown |
| payload with no `role` | `REGULAR`, so absent means least privilege |
| `bearer` / `BEARER` | accepted; the scheme is matched case-insensitively |
| two-segment token whose payload parses | rejected |
**workflow-api** — the workflow `content` round-trips as a nested JSON
**string**: the request sends `JSON.stringify(content)` and the response is
re-parsed when it comes back as a string. Sending the object directly is the
obvious-looking mistake and the backend rejects it, so both directions are
pinned, along with the empty-description default and the error text on a
refused save or a missing workflow.
**backend-api** — the endpoint set, the defensive copy of the module-level
config, and the two failure paths of the metadata fetch.
**Verified by mutation**, all reverted (production diff empty):
| Mutation | Result |
|---|---|
| default a missing role to `ADMIN` | red |
| remove the three-segment check | red |
| treat a token with no `exp` as expired | red |
| compare `exp` as milliseconds instead of seconds | red |
| make the Bearer scheme case-sensitive | red |
| report a malformed token as valid | red |
| send `content` as a nested object | red |
| drop the empty-description default | red |
| stop re-parsing a stringified response `content` | red |
| drop the wid from the retrieve URL | red |
| return the shared config by reference | red |
The three-segment mutation initially **survived**: the test used
`"only.two"`, whose payload fails `JSON.parse` regardless, so the segment check
was never actually exercised. Replaced with a two-segment token carrying a
valid payload — an unsigned token — which is the case the check exists for.
No production file is touched.
### Any related issues, documentation, discussions?
Closes #7381
### How was this PR tested?
```
bun test
```
```
232 pass
0 fail
Ran 232 tests across 18 files.
```
`bun run typecheck` and `bun run format:check` both pass.
### Was this PR authored or co-authored using generative AI tooling?
Generated-by: Claude Code (Opus 5)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
