test: cover four untested behaviors and drop five tests that cannot fail

Adds coverage that goes red when the behavior is reverted:

- `rejectDuplicateQueryValues` through `parseRequest`, not just the pure
  helper — the existing blank-query tests stay green even when parseRequest
  ignores the flag entirely.
- `failUndispatchedDocumentProcessing`'s pending + not-deleted WHERE guard,
  asserted on the condition tree so removing it fails.
- The widened `present(result, request)` signature, so dropping the second
  argument stops being a silent no-op.
- The NUL scan on `readFormDataWithLimit`'s content-length branch — the
  branch every ordinary browser and curl upload takes, and the one the
  existing multipart tests never reached.

Removes tests verified incapable of failing: the credentials projection row
(the outbound `.parse()` strips unknown keys either way), the per-document
413 sweep (vacuous on two of three documents, subsumed by the sweep in
scripts/openapi/documents.test.ts), the two upload-session rows that assert
their own `generateWorkspaceFileKey` stub, the storage-key row whose 20-byte
name never reaches the budget, and the views-lock assertion against a
function `views/service.ts` does not import.

Author: waleedlatif1

apps/sim/app/api/v2/credentials/route.test.ts

@@ -201,32 +201,6 @@ describe('GET /api/v2/credentials', () => {
     expect(JSON.stringify(body)).not.toContain('createdBy')
   })
 
-  /**
-   * The projection is an explicit field-by-field copy, which is what makes a
-   * column added to the credential table later inert here: a field nobody wrote
-   * into `toV2Credential` is simply never read. The outbound response `.parse()`
-   * strips whatever survives, so a leak needs two independent mistakes. This
-   * pins the pairing against a row carrying a column the projection has never
-   * heard of.
-   */
-  it('withholds a credential column the projection was never taught to publish', async () => {
-    mocks.execute.mockResolvedValueOnce({
-      credentials: [{ ...credential, encryptedFutureSecret: 'MUST_NOT_LEAK_EITHER' }],
-      nextCursorKeys: null,
-      sortBy: 'createdAt',
-      sortOrder: 'desc',
-    })
-
-    const response = await GET(
-      new NextRequest(`http://localhost:3000/api/v2/credentials?workspaceId=${WORKSPACE_ID}`)
-    )
-    const body = await response.json()
-
-    expect(response.status).toBe(200)
-    expect(JSON.stringify(body)).not.toContain('encryptedFutureSecret')
-    expect(JSON.stringify(body)).not.toContain('MUST_NOT_LEAK_EITHER')
-  })
-
   it('hides repository errors that may contain secret details', async () => {
     mocks.execute.mockRejectedValueOnce(new Error('encryptedServiceAccountKey failed'))
 

apps/sim/lib/api/contracts/v2/openapi/resources.test.ts

@@ -1,9 +1,17 @@
 /**
  * @vitest-environment node
  */
+import { NextRequest } from 'next/server'
 import { describe, expect, it } from 'vitest'
-import { blankQueryValueValidationError } from '@/lib/api/server/blank-query-values'
+import { z } from 'zod'
+import { defineRouteContract } from '@/lib/api/contracts'
+import {
+  blankQueryValueValidationError,
+  duplicateQueryValueValidationError,
+} from '@/lib/api/server/blank-query-values'
 import { V2_PARSE_DEFAULTS } from '@/lib/api/server/routes/v2-json-route'
+import { parseRequest } from '@/lib/api/server/validation'
+import { v2ValidationError } from '@/app/api/v2/lib/response'
 
 /**
  * A query parameter that is present but blank is a different request from one
@@ -51,3 +59,71 @@ describe('blank query values', () => {
     expect(V2_PARSE_DEFAULTS.rejectBlankQueryValues).toBe(true)
   })
 })
+
+const listContract = defineRouteContract({
+  method: 'GET',
+  path: '/api/v2/widgets',
+  query: z.object({ workspaceId: z.string().min(1, 'Workspace ID is required') }),
+  response: { mode: 'json', schema: z.object({ data: z.array(z.string()) }) },
+})
+
+function listRequest(search: string): NextRequest {
+  return new NextRequest(`http://localhost/api/v2/widgets?${search}`, { method: 'GET' })
+}
+
+async function parseListRequest(search: string) {
+  return parseRequest(
+    listContract,
+    listRequest(search),
+    {},
+    {
+      ...V2_PARSE_DEFAULTS,
+      validationErrorResponse: v2ValidationError,
+    }
+  )
+}
+
+/**
+ * A repeated parameter reaches the schema as an array, and no v2 query param is
+ * declared as one — so without this rule the caller is told the param is
+ * *missing* for a request that plainly sent it twice.
+ */
+describe('duplicate query values', () => {
+  it('names the duplication rather than the schema type failure', () => {
+    const error = duplicateQueryValueValidationError({ workspaceId: ['w-1', 'w-1'] })
+
+    expect(error?.issues[0]).toMatchObject({
+      path: ['workspaceId'],
+      message: 'workspaceId was sent 2 times; send it at most once',
+    })
+  })
+
+  it('accepts a query where every parameter appears once', () => {
+    expect(duplicateQueryValueValidationError({ workspaceId: 'w-1', limit: '10' })).toBeNull()
+  })
+
+  it('rejects a repeated parameter through parseRequest under the v2 defaults', async () => {
+    const parsed = await parseListRequest('workspaceId=w-1&workspaceId=w-1')
+
+    expect(parsed.success).toBe(false)
+    if (parsed.success) return
+    expect(parsed.response.status).toBe(400)
+    await expect(parsed.response.json()).resolves.toMatchObject({
+      error: expect.objectContaining({
+        message: expect.stringContaining('workspaceId was sent 2 times; send it at most once'),
+      }),
+    })
+  })
+
+  it('lets a query sending each parameter once through parseRequest', async () => {
+    const parsed = await parseListRequest('workspaceId=w-1')
+
+    expect(parsed.success).toBe(true)
+    if (!parsed.success) return
+    expect(parsed.data.query).toEqual({ workspaceId: 'w-1' })
+  })
+
+  it('is on for every v2 route through the shared parse defaults', () => {
+    expect(V2_PARSE_DEFAULTS.rejectDuplicateQueryValues).toBe(true)
+  })
+})

apps/sim/lib/api/server/blank-query-values.test.ts

@@ -644,3 +644,73 @@ describe('defineV2JsonRoute HEAD on a route that is not head-safe', () => {
     ).rejects.toThrow(/authorize/)
   })
 })
+
+const presenterContract = defineRouteContract({
+  method: 'POST',
+  path: '/api/v2/widgets/[widgetId]/pages',
+  params: z.object({ widgetId: z.string() }).strict(),
+  query: z.object({ sort: z.string(), workspaceId: z.string() }).strict(),
+  body: z.object({ value: z.string() }).strict(),
+  response: {
+    mode: 'json',
+    status: 201,
+    schema: z.object({ data: z.object({ value: z.string() }), nextCursor: z.string() }),
+  },
+})
+
+/**
+ * A `nextCursor` is stamped with the sort and filters the page was read under,
+ * and those live in the request rather than the domain result — so a presenter
+ * that cannot see the parsed request forces the use case to carry an HTTP
+ * cursor-encoding concern back out.
+ */
+describe('defineV2JsonRoute presentation', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    v2RouteMocks.authenticate.mockResolvedValue(auth)
+    v2RouteMocks.gate.mockResolvedValue(null)
+    v2RouteMocks.preauthRate.mockResolvedValue({ allowed: true, remaining: 599, resetAt })
+    v2RouteMocks.operationRate.mockResolvedValue(allowedRate)
+  })
+
+  it('hands the presenter the parsed request alongside the result', async () => {
+    const present = vi.fn((result: Result, parsed: ParsedRequest<typeof presenterContract>) => ({
+      data: result,
+      nextCursor: `${parsed.params.widgetId}:${parsed.query.sort}:${parsed.body.value}`,
+    }))
+
+    const handler = defineV2JsonRoute({
+      contract: presenterContract,
+      auth: v2ApiKeyAuth,
+      operation,
+      rateLimit: v2RateLimits.publicApi,
+      errorPolicy: v2OrchestrationErrorPolicy,
+      mapInput: ({ body }) => body,
+      useCase: { operation, execute: async ({ input }) => input },
+      present,
+    })
+
+    const response = await handler(
+      new NextRequest('http://localhost/api/v2/widgets/widget-1/pages?sort=asc&workspaceId=ws-1', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', 'x-api-key': 'secret' },
+        body: JSON.stringify({ value: 'ok' }),
+      }),
+      { params: Promise.resolve({ widgetId: 'widget-1' }) }
+    )
+
+    expect(response.status).toBe(201)
+    await expect(response.json()).resolves.toEqual({
+      data: { value: 'ok' },
+      nextCursor: 'widget-1:asc:ok',
+    })
+    expect(present).toHaveBeenCalledWith(
+      { value: 'ok' },
+      expect.objectContaining({
+        params: { widgetId: 'widget-1' },
+        query: { sort: 'asc', workspaceId: 'ws-1' },
+        body: { value: 'ok' },
+      })
+    )
+  })
+})

apps/sim/lib/api/server/routes/v2-json-route.test.ts

@@ -36,20 +36,37 @@ function streamFromChunks(chunks: Uint8Array[]): ReadableStream<Uint8Array> {
  * a filename on serialization, so a hand-written part is the only way to put
  * the byte on the wire exactly as a real client can.
  */
-function multipartRequest(disposition: string, value: string): Request {
+function multipartRequest(
+  disposition: string,
+  value: string,
+  options: { declareContentLength?: boolean } = {}
+): Request {
   const boundary = 'streamlimitsboundary'
   const body =
     `--${boundary}\r\n` +
     `Content-Disposition: form-data; ${disposition}\r\n` +
     `Content-Type: text/plain\r\n\r\n${value}\r\n` +
     `--${boundary}--\r\n`
+  const bytes = new TextEncoder().encode(body)
+  const requestHeaders = new Headers({
+    'content-type': `multipart/form-data; boundary=${boundary}`,
+  })
+  if (options.declareContentLength) {
+    requestHeaders.set('content-length', String(bytes.byteLength))
+  }
   return new Request('http://localhost/upload', {
     method: 'POST',
-    headers: { 'content-type': `multipart/form-data; boundary=${boundary}` },
-    body: new TextEncoder().encode(body),
+    headers: requestHeaders,
+    body: bytes,
   })
 }
 
+const NUL_MULTIPART_PARTS = [
+  ['a NUL in a file name', 'name="file"; filename="apitest_\u0000x.txt"', 'hello'],
+  ['a NUL in a text field value', 'name="label"', 'apitest_\u0000x'],
+  ['a NUL in a field name', 'name="apitest_\u0000x"', 'hello'],
+] as const
+
 function headers(contentLength?: string): Headers {
   const headers = new Headers()
   if (contentLength !== undefined) headers.set('content-length', contentLength)
@@ -217,18 +234,33 @@ describe('stream limits', () => {
     expect(formData.get('name')).toBe('example')
   })
 
-  it.each([
-    ['a NUL in a file name', 'name="file"; filename="apitest_\u0000x.txt"', 'hello'],
-    ['a NUL in a text field value', 'name="label"', 'apitest_\u0000x'],
-    ['a NUL in a field name', 'name="apitest_\u0000x"', 'hello'],
-  ])('rejects multipart form data carrying %s', async (_label, disposition, value) => {
-    await expect(
-      readFormDataWithLimit(multipartRequest(disposition, value), {
-        maxBytes: 1024 * 1024,
-        label: 'multipart body',
-      })
-    ).rejects.toBeInstanceOf(MultipartFieldValidationError)
-  })
+  it.each(NUL_MULTIPART_PARTS)(
+    'rejects a streamed multipart body carrying %s',
+    async (_label, disposition, value) => {
+      await expect(
+        readFormDataWithLimit(multipartRequest(disposition, value), {
+          maxBytes: 1024 * 1024,
+          label: 'multipart body',
+        })
+      ).rejects.toBeInstanceOf(MultipartFieldValidationError)
+    }
+  )
+
+  /**
+   * A declared `content-length` takes the reader's other branch — the one every
+   * ordinary browser and curl upload takes — and it scans fields separately.
+   */
+  it.each(NUL_MULTIPART_PARTS)(
+    'rejects a content-length multipart body carrying %s',
+    async (_label, disposition, value) => {
+      const request = multipartRequest(disposition, value, { declareContentLength: true })
+      expect(request.headers.get('content-length')).not.toBeNull()
+
+      await expect(
+        readFormDataWithLimit(request, { maxBytes: 1024 * 1024, label: 'multipart body' })
+      ).rejects.toBeInstanceOf(MultipartFieldValidationError)
+    }
+  )
 
   it('rejects multipart streams without content-length once bytes exceed the limit', async () => {
     const request = new Request('http://localhost/upload', {