Merge branch 'main' into test-non-serializable-json-payload

Author: Aamod007

app/api/streak/route.test.ts

@@ -672,6 +672,14 @@ describe('GET /api/streak', () => {
         expect(response.status).toBe(400);
         expect(body.details.fieldErrors.date[0]).toContain('Invalid "date" format');
       });
+
+      it('returns 400 when an invalid ISO8601 calendar date format like "2026-15-40" is supplied (Variation 4)', async () => {
+        const response = await GET(makeRequest({ user: 'octocat', date: '2026-15-40' }));
+        const body = await response.json();
+
+        expect(response.status).toBe(400);
+        expect(body.details.fieldErrors.date[0]).toContain('Invalid "date" format. Use ISO 8601.');
+      });
     });
   });
 

app/api/streak/route.ts

@@ -16,6 +16,7 @@ import { getSecondsUntilUTCMidnight, getSecondsUntilMidnightInTimezone } from '@
 import type { BadgeParams } from '@/types';
 import { themes } from '@/lib/svg/themes';
 import { streakParamsSchema } from '@/lib/validations';
+import { sanitizeHexColor } from '@/lib/svg/sanitizer';
 
 const SVG_CSP_HEADER =
   "default-src 'none'; style-src 'unsafe-inline' https://fonts.googleapis.com; font-src https://fonts.gstatic.com; connect-src https://fonts.gstatic.com;";
@@ -299,15 +300,15 @@ function buildErrorResponse(error: unknown, parseResult: ParseResult): NextRespo
     message.toLowerCase().includes('validation') ||
     message.toLowerCase().includes('strictly for organizations');
 
-  const errBg = `#${(parseResult.success && parseResult.data.bg) || '0d1117'}`;
-  const errAccent = `#${
+  const errBg = `#${sanitizeHexColor(parseResult.success ? parseResult.data.bg : undefined, '0d1117')}`;
+  const errAccentRaw =
     (parseResult.success &&
       (Array.isArray(parseResult.data.accent)
         ? parseResult.data.accent[parseResult.data.accent.length - 1]
         : parseResult.data.accent)) ||
-    '58a6ff'
-  }`;
-  const errText = `#${(parseResult.success && parseResult.data.text) || 'c9d1d9'}`;
+    undefined;
+  const errAccent = `#${sanitizeHexColor(errAccentRaw, '58a6ff')}`;
+  const errText = `#${sanitizeHexColor(parseResult.success ? parseResult.data.text : undefined, 'c9d1d9')}`;
   const errRadius = parseResult.success
     ? (() => {
         const r = Number(parseResult.data.radius);

app/components/navbar.test.tsx

@@ -58,9 +58,17 @@ vi.mock('lucide-react', () => ({
 
 describe('Navbar mobile menu', () => {
   beforeEach(() => {
+    Object.defineProperty(window, 'localStorage', {
+      value: {
+        getItem: vi.fn(),
+        setItem: vi.fn(),
+        clear: vi.fn(),
+      },
+      writable: true,
+    });
     window.innerWidth = 500;
     mockMatchMedia(false);
-    window.localStorage.clear();
+    window.localStorage?.clear();
     document.documentElement.className = '';
   });
 
@@ -106,8 +114,16 @@ describe('Navbar mobile menu', () => {
 
 describe('Navbar responsive breakpoints', () => {
   beforeEach(() => {
+    Object.defineProperty(window, 'localStorage', {
+      value: {
+        getItem: vi.fn(),
+        setItem: vi.fn(),
+        clear: vi.fn(),
+      },
+      writable: true,
+    });
     window.innerWidth = 500;
-    window.localStorage.clear();
+    window.localStorage?.clear();
     document.documentElement.className = '';
   });
 

app/page.test.tsx

@@ -29,6 +29,10 @@ vi.mock('next/link', () => ({
   ),
 }));
 
+vi.mock('@/utils/tracking', () => ({
+  trackUser: vi.fn(),
+}));
+
 // Mock GSAP so FeatureCards don't break in JSDOM
 vi.mock('gsap', () => {
   const tween = { kill: vi.fn() };

lib/calculate.test.ts

@@ -735,6 +735,37 @@ describe('calculateStreak', () => {
     expect(result.longestStreak).toBe(15);
   });
 
+  it('verify streak formulas for different starting days of the week timeline (Variation 3)', () => {
+    // Week 1: 0, 0, 0, 0, 1, 1, 1 (Starts on Friday, 3 days)
+    // Week 2: 1, 1, 1, 1, 1, 1, 1 (7 days)
+    // Week 3: 1, 1, 1, 1, 1        // Ends on Friday (5 days)
+    // Total continuous streak = 15 days, ending on the last day.
+    const calendar = buildCalendar([
+      0,
+      0,
+      0,
+      0,
+      1,
+      1,
+      1, // Week 1 (Starts Fri)
+      1,
+      1,
+      1,
+      1,
+      1,
+      1,
+      1, // Week 2
+      1,
+      1,
+      1,
+      1,
+      1, // Week 3 (Ends Fri)
+    ]);
+    const result = calculateStreak(calendar);
+    expect(result.currentStreak).toBe(15);
+    expect(result.longestStreak).toBe(15);
+  });
+
   it('verify streak formulas for multiple weeks gaps timeline (Variation 3)', () => {
     // Streak 1: 5 days
     // Gap 1: 14 days (2 weeks of zeros)

lib/github.test.ts

@@ -24,6 +24,8 @@ import {
 } from './github';
 import type { ContributionCalendar } from '../types';
 
+vi.mock('server-only', () => ({}));
+
 const mockCalendar: ContributionCalendar = {
   totalContributions: 42,
   weeks: [

lib/github.ts

@@ -12,6 +12,8 @@ import { DistributedCache } from '@/lib/cache';
 import { LANGUAGE_COLORS } from '@/lib/svg/languageColors';
 import { CONTRIBUTION_MILESTONES, STREAK_MILESTONES } from './svg/constants';
 
+import 'server-only';
+
 interface GitHubRepo {
   name: string;
   stargazers_count: number;

lib/validations.test.ts

@@ -1090,3 +1090,31 @@ describe('streakParamsSchema user maxLength validation boundaries (Variation 3)'
     expect(parseResult.success).toBe(true);
   });
 });
+
+/* ==========================================================================
+ * DATE PARAMETER — QUERY VALIDATION BOUNDARIES (VARIATION 4)
+ * ========================================================================== */
+
+describe('streakParamsSchema — date query validation boundaries (Variation 4)', () => {
+  it('rejects an invalid date format like "2026-15-40"', () => {
+    const result = streakParamsSchema.safeParse({
+      user: 'octocat',
+      date: '2026-15-40',
+    });
+
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      const messages = result.error.issues.map((i) => i.message).join(' ');
+      expect(messages).toContain('Invalid "date" format. Use ISO 8601.');
+    }
+  });
+
+  it('accepts a valid ISO8601 date', () => {
+    const result = streakParamsSchema.safeParse({
+      user: 'octocat',
+      date: '2026-05-30',
+    });
+
+    expect(result.success).toBe(true);
+  });
+});