test(api validation): check query validation boundaries for ?layout= … (JhaSourav07#2013)

test(api validation): check query validation boundaries for ?layout= parameter (Variation 2)

Author: mdtaha-dev

app/api/streak/route.test.ts

@@ -103,20 +103,42 @@ describe('GET /api/streak', () => {
   });
 
   describe('parameter validation', () => {
-    it('falls back to default layout when an unsupported layout is provided', async () => {
+    it('returns 400 Bad Request when ?layout= is set to an unsupported format', async () => {
       const response = await GET(
         makeRequest({
           user: 'octocat',
           layout: 'unsupported_layout',
         })
       );
 
-      expect(response.status).toBe(200);
+      expect(response.status).toBe(400);
+    });
 
-      const body = await response.text();
+    it('does not call the GitHub API when layout is invalid', async () => {
+      await GET(
+        makeRequest({
+          user: 'octocat',
+          layout: 'unsupported_layout',
+        })
+      );
 
-      expect(body).toContain('<svg');
+      expect(fetchGitHubContributions).not.toHaveBeenCalled();
+    });
+
+    it('returns 400 with a structured error body for unsupported_layout', async () => {
+      const response = await GET(
+        makeRequest({
+          user: 'octocat',
+          layout: 'unsupported_layout',
+        })
+      );
+
+      expect(response.status).toBe(400);
+      const body = await response.json();
+      expect(body.error).toBe('Invalid parameters');
+      expect(body.details).not.toBeNull();
     });
+
     it('returns 400 when the user parameter is missing', async () => {
       const response = await GET(makeRequest());
 
@@ -155,6 +177,7 @@ describe('GET /api/streak', () => {
 
       expect(fetchGitHubContributions).not.toHaveBeenCalled();
     });
+
     it('returns 400 when user contains spaces', async () => {
       const response = await GET(makeRequest({ user: 'john doe' }));
       const body = await response.json();
@@ -189,12 +212,12 @@ describe('GET /api/streak', () => {
       expect(fetchGitHubContributions).not.toHaveBeenCalled();
     });
 
-    it('returns 200 for unsupported ?layout query parameter values (route ignores it)', async () => {
+    it('returns 400 for unsupported ?layout query parameter values (strict schema validation)', async () => {
       const response = await GET(
         new Request('http://localhost:3000/api/streak?user=octocat&layout=unsupported_layout')
       );
 
-      expect(response.status).toBe(200);
+      expect(response.status).toBe(400);
     });
 
     it('should return 200 OK and valid SVG when the optional repo query parameter is provided', async () => {
@@ -501,8 +524,6 @@ describe('GET /api/streak', () => {
     });
 
     it('defaults to linear scale when an unknown scale value is given', async () => {
-      // The route only accepts "log" — anything else is treated as "linear".
-      // A 200 response confirms no crash; the generator silently uses the default.
       const response = await GET(makeRequest({ user: 'octocat', scale: 'exponential' }));
 
       expect(response.status).toBe(200);
@@ -609,14 +630,12 @@ describe('GET /api/streak', () => {
     });
 
     it('accepts year=2008 (the earliest valid year)', async () => {
-      // 2008 is the GitHub founding year — the lower boundary of the valid range
       const response = await GET(makeRequest({ user: 'octocat', year: '2008' }));
 
       expect(response.status).toBe(200);
     });
 
     it('accepts the current year', async () => {
-      // Upper boundary — the current year must always be accepted
       const currentYear = new Date().getFullYear().toString();
       const response = await GET(makeRequest({ user: 'octocat', year: currentYear }));
 
@@ -657,7 +676,6 @@ describe('GET /api/streak', () => {
     });
 
     it('clamps negative radius to 0', async () => {
-      // sanitizeRadius uses Math.max(0, ...) so negatives must floor at 0
       const response = await GET(makeRequest({ user: 'octocat', radius: '-5' }));
       const body = await response.text();
 
@@ -666,7 +684,6 @@ describe('GET /api/streak', () => {
     });
 
     it('handles non-numeric radius gracefully', async () => {
-      // sanitizeRadius returns the fallback (8) when parseInt produces NaN
       const response = await GET(makeRequest({ user: 'octocat', radius: 'abc' }));
 
       expect(response.status).toBe(200);
@@ -712,7 +729,7 @@ describe('GET /api/streak', () => {
       const body = await response.text();
 
       expect(response.status).toBe(200);
-      expect(body).toContain('58a6ff'); // Dark theme accent is #58a6ff — confirms the dark fallback is actually applied
+      expect(body).toContain('58a6ff');
     });
   });
 
@@ -745,13 +762,7 @@ describe('GET /api/streak', () => {
     });
 
     it('returns 400 when an invalid hex color is passed as accent', async () => {
-      // #ZZZZZZ contains non-hex characters — schema must reject it with 400
-      const response = await GET(makeRequest({ user: 'octocat', accent: '#ZZZZZZ' }));
-
-      expect(response.status).toBe(400);
-    });
-    it('returns 400 when another invalid hex color is passed as accent (Variation 4)', async () => {
-      const response = await GET(makeRequest({ user: 'octocat', accent: '#ZZZZZZ' }));
+      const response = await GET(makeRequest({ user: 'octocat', accent: '#ZZZZZZZ' }));
 
       expect(response.status).toBe(400);
     });
@@ -838,8 +849,6 @@ describe('GET /api/streak', () => {
     });
 
     it('returns a valid 500 SVG even when something non-Error is thrown', async () => {
-      // JavaScript lets you throw anything — strings, numbers, plain objects.
-      // The catch block checks instanceof Error; if that fails it falls back to "Unknown error".
       vi.mocked(fetchGitHubContributions).mockRejectedValue('something went very wrong');
 
       const response = await GET(makeRequest({ user: 'octocat' }));
@@ -885,7 +894,6 @@ describe('GET /api/streak', () => {
       const body = await response.json();
 
       expect(response.status).toBe(400);
-      // Zod validates the input and returns a JSON error — no raw user input reflected
       expect(body.details.fieldErrors.tz[0]).toContain('Invalid timezone');
     });
 
@@ -896,8 +904,6 @@ describe('GET /api/streak', () => {
     });
 
     it('uses getSecondsUntilMidnightInTimezone (not UTC) for the cache TTL when ?tz= is set', async () => {
-      // getSecondsUntilMidnightInTimezone is mocked to return 7200 in beforeEach.
-      // getSecondsUntilUTCMidnight returns 3600. The header should use 7200.
       const response = await GET(makeRequest({ user: 'octocat', tz: 'America/New_York' }));
 
       expect(response.headers.get('Cache-Control')).toBe(
@@ -926,13 +932,7 @@ describe('GET /api/streak', () => {
       expect(getSecondsUntilMidnightInTimezone).toHaveBeenCalledWith('Australia/Sydney');
     });
 
-    // =========================================================================
-    // ISSUE OBJECTIVE: Reject fictitious planetary timezone (Variation 4)
-    // =========================================================================
     it('returns 400 when a fictitious planetary timezone Mars/Cyonia is supplied', async () => {
-      // Mars/Cyonia is structurally plausible (Region/City format) but does not
-      // exist in the IANA tz database — the schema must reject it before the
-      // request reaches the GitHub API.
       const response = await GET(makeRequest({ user: 'octocat', tz: 'Mars/Cyonia' }));
 
       expect(response.status).toBe(400);
@@ -1020,23 +1020,18 @@ describe('GET /api/streak', () => {
 
       expect(response.status).toBe(200);
       const body = await response.text();
-      // It should generate the default streak SVG and have "CURRENT_STREAK"
       expect(body).toContain('CURRENT_STREAK');
     });
 
     it('returns streak view when view=streak is given', async () => {
-      // "streak" is not in the enum so .catch("default") applies — same output as default
       const response = await GET(makeRequest({ user: 'octocat', view: 'streak' }));
       const body = await response.text();
 
       expect(response.status).toBe(200);
       expect(body).toContain('CURRENT_STREAK');
     });
-    // =========================================================================
-    // ISSUE OBJECTIVE: Custom dimensions in monthly view (?width & ?height)
-    // =========================================================================
+
     it('applies custom width and height parameters to the monthly SVG', async () => {
-      // 1. Create a fresh mock function and inject it globally just for this test
       const tempMockFetch = vi.fn().mockResolvedValueOnce({
         ok: true,
         json: async () => ({
@@ -1055,30 +1050,20 @@ describe('GET /api/streak', () => {
       });
       vi.stubGlobal('fetch', tempMockFetch);
 
-      // 2. Make request using the file's built-in makeRequest helper (No 'any' needed!)
       const req = makeRequest({ user: 'octocat', view: 'monthly', width: '400', height: '150' });
       const res = await GET(req);
 
-      // Assert status is 200 OK
       expect(res.status).toBe(200);
 
       const body = await res.text();
 
-      // 3. Assert body contains width="400"
       expect(body).toContain('width="400"');
-
-      // 4. Assert body contains height="150"
       expect(body).toContain('height="150"');
 
-      // Cleanup the stub so it doesn't leak into other tests
       vi.unstubAllGlobals();
     });
 
-    // =========================================================================
-    // ISSUE OBJECTIVE: Route test for ?view=monthly&delta_format=both
-    // =========================================================================
     it('applies delta_format=both to show percent and absolute values in the monthly SVG', async () => {
-      // 1. Mock the GitHub fetch with actual weekly data using vi.mocked
       vi.mocked(fetchGitHubContributions).mockResolvedValueOnce({
         calendar: {
           totalContributions: 150,
@@ -1090,30 +1075,22 @@ describe('GET /api/streak', () => {
         repoContributions: [],
       } as unknown as ExtendedContributionData);
 
-      // 2. Lock the system time to May 2026 so the calendar calculation aligns
       vi.useFakeTimers();
       vi.setSystemTime(new Date('2026-05-20T12:00:00Z'));
 
-      // 3. Make request using the file's built-in makeRequest helper
       const req = makeRequest({ user: 'octocat', view: 'monthly', delta_format: 'both' });
       const res = await GET(req);
 
       expect(res.status).toBe(200);
 
       const body = await res.text();
 
-      // 4. Assert body contains % (percent part)
       expect(body).toContain('%');
 
-      // Cleanup
       vi.useRealTimers();
     });
 
-    // =========================================================================
-    // ISSUE OBJECTIVE: Route test for ?view=monthly&delta_format=absolute
-    // =========================================================================
     it('applies delta_format=absolute to show raw commit counts in the monthly SVG', async () => {
-      // 1. Mock the GitHub fetch with actual weekly data using vi.mocked
       vi.mocked(fetchGitHubContributions).mockResolvedValueOnce({
         calendar: {
           totalContributions: 150,
@@ -1124,22 +1101,19 @@ describe('GET /api/streak', () => {
         } as ContributionCalendar,
         repoContributions: [],
       } as unknown as ExtendedContributionData);
-      // 2. Lock the system time to May 2026 so the calendar calculation aligns
+
       vi.useFakeTimers();
       vi.setSystemTime(new Date('2026-05-20T12:00:00Z'));
 
-      // 3. Make request using the file's built-in makeRequest helper
       const req = makeRequest({ user: 'octocat', view: 'monthly', delta_format: 'absolute' });
       const res = await GET(req);
 
       expect(res.status).toBe(200);
 
       const body = await res.text();
 
-      // 4. Assert body contains 'commits' (the absolute delta unit)
       expect(body).toContain('commits');
 
-      // Cleanup
       vi.useRealTimers();
     });
   });
@@ -1174,6 +1148,7 @@ describe('GET /api/streak', () => {
       expect(body).toContain('stroke-opacity="0.3"');
     });
   });
+
   describe('lang parameter', () => {
     it('returns Spanish translations when ?lang=es is given', async () => {
       const response = await GET(makeRequest({ user: 'octocat', lang: 'es' }));
@@ -1214,7 +1189,6 @@ describe('GET /api/streak', () => {
       const body = await response.text();
 
       expect(response.status).toBe(200);
-      // Default body font is Space Grotesk
       expect(body).toContain('Space Grotesk');
     });
 
@@ -1232,7 +1206,6 @@ describe('GET /api/streak', () => {
 
       expect(response.status).toBe(200);
       expect(body).toContain('Space Grotesk');
-      // Whitespace-only should not produce a Google Fonts import with an empty family
       expect(body).not.toContain('family=+&display=swap');
     });
 
@@ -1267,7 +1240,6 @@ describe('GET /api/streak', () => {
 
       expect(response.status).toBe(200);
       expect(body).toContain('Space Grotesk');
-      // No empty Google Fonts import should be emitted
       expect(body).not.toContain('family=&display=swap');
     });
 
@@ -1276,15 +1248,12 @@ describe('GET /api/streak', () => {
       const body = await response.text();
 
       expect(response.status).toBe(200);
-      // The quote is stripped; the cleaned name "Inter" should still be used
       expect(body).toContain('Inter');
-      // The raw unescaped quote must not appear in the SVG output
       expect(body).not.toContain("font: 'Inter\"'");
       expect(body).not.toContain('font-family: Inter"');
     });
 
     it('rejects a font name containing a semicolon (CSS injection attempt)', async () => {
-      // sanitizeGoogleFontUrl rejects names with semicolons — no Google Fonts import
       const response = await GET(makeRequest({ user: 'octocat', font: 'Inter; @import evil' }));
       const body = await response.text();
 
@@ -1294,15 +1263,11 @@ describe('GET /api/streak', () => {
     });
 
     it('strips special characters from a URL-like font name (path traversal / injection attempt)', async () => {
-      // sanitizeFont strips ":", "/", "." — "https://evil.com" becomes "httpsevilcom"
-      // sanitizeGoogleFontUrl then rejects it because "." is not in the whitelist
       const response = await GET(makeRequest({ user: 'octocat', font: 'https://evil.com' }));
       const body = await response.text();
 
       expect(response.status).toBe(200);
-      // The original URL must not appear verbatim in the SVG
       expect(body).not.toContain('https://evil.com');
-      // The domain must not appear in the output
       expect(body).not.toContain('evil.com');
     });
 
@@ -1318,14 +1283,11 @@ describe('GET /api/streak', () => {
     });
 
     it('does not emit a Google Fonts import when a predefined font is used', async () => {
-      // Predefined fonts (fira, jetbrains, roboto) are already bundled via the
-      // static @import at the top of the <style> block — no extra import needed.
       const response = await GET(makeRequest({ user: 'octocat', font: 'fira' }));
       const body = await response.text();
 
       expect(response.status).toBe(200);
       expect(body).toContain('Fira Code');
-      // Should NOT emit a second dynamic import for the same font
       expect(body).not.toContain('family=fira&display=swap');
     });