test: add integration and frontend test suite with search limit validation

Author: clean6378-max-it

.coverage

@@ -14,10 +14,14 @@ jobs:
   prod-install-smoke:
     name: Verify prod requirements.txt is sufficient
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.12"
           cache: pip
@@ -41,10 +45,14 @@ jobs:
 
   pytest:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.12"
           cache: pip
@@ -61,10 +69,15 @@ jobs:
   integration-tests:
     name: API integration tests + coverage
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.12"
           cache: pip
@@ -75,21 +88,26 @@ jobs:
       - name: Install dev dependencies
         run: pip install -r requirements-dev.txt
 
+      # Subset run: skip fail-under (full suite enforces 60% in pytest job).
       - name: Run integration tests with coverage
-        run: pytest tests/test_api_integration.py tests/test_search.py -v --cov=api --cov-report=xml
+        run: pytest tests/test_api_integration.py tests/test_search.py -v --cov=api --cov-report=xml --cov-fail-under=0
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: coverage-report
           path: coverage.xml
 
   js-tests:
     name: Frontend unit tests (vitest)
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "20"
           cache: npm

.github/workflows/ci.yml

@@ -16,10 +16,10 @@
 
 def _parse_limit(raw: str | None) -> int:
     """Parse positive integer limit query param; raise ValueError if invalid."""
-    if raw is None or raw == "":
+    if raw is None or raw.strip() == "":
         return _DEFAULT_LIMIT
     try:
-        n = int(raw)
+        n = int(raw.strip())
     except ValueError:
         raise ValueError("limit must be a positive integer") from None
     if n < 1:

api/search.py

@@ -1,6 +1,9 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import { cleanContent, renderMarkdown } from './markdown.js';
 
+const _origMarked = globalThis.marked;
+const _origDOMPurify = globalThis.DOMPurify;
+
 describe('cleanContent', () => {
     it('strips system-reminder blocks', () => {
         const raw = 'Hello<system-reminder>secret</system-reminder> world';
@@ -22,6 +25,12 @@ describe('renderMarkdown', () => {
         };
     });
 
+    afterEach(() => {
+        vi.restoreAllMocks();
+        globalThis.marked = _origMarked;
+        globalThis.DOMPurify = _origDOMPurify;
+    });
+
     it('sanitizes script tags from parsed output', () => {
         globalThis.marked.parse.mockReturnValue('<p>ok</p><script>alert(1)</script>');
         const html = renderMarkdown('# Hello');

static/js/shared/markdown.test.js

@@ -1,7 +1,14 @@
-import { describe, it, expect } from 'vitest';
+import { describe, it, expect, afterEach } from 'vitest';
 import { state } from './state.js';
 
 describe('state', () => {
+    afterEach(() => {
+        state.currentProject = null;
+        state.cachedSessions = [];
+        state.projectDisplayNames = {};
+        state.navInProgress = false;
+    });
+
     it('initializes with null current project', () => {
         expect(state.currentProject).toBeNull();
     });
@@ -13,6 +20,5 @@ describe('state', () => {
     it('allows updating currentProject', () => {
         state.currentProject = 'test-project';
         expect(state.currentProject).toBe('test-project');
-        state.currentProject = null;
     });
 });

static/js/shared/state.test.js

@@ -45,6 +45,23 @@ def test_limit_default(client):
     assert resp.status_code == 200
 
 
+def test_limit_whitespace_defaults(client):
+    resp = client.get("/api/search?q=Hello&limit=%20%20%20")
+    assert resp.status_code == 200
+
+
+def test_limit_zero(client):
+    resp = client.get("/api/search?q=Hello&limit=0")
+    assert resp.status_code == 400
+    assert "error" in resp.get_json()
+
+
+def test_limit_negative(client):
+    resp = client.get("/api/search?q=Hello&limit=-1")
+    assert resp.status_code == 400
+    assert "error" in resp.get_json()
+
+
 def test_empty_query(client):
     resp = client.get("/api/search?q=")
     assert resp.status_code == 200