import { describe, expect, mock, test } from "bun:test"; import type { Viewer } from "~/lib/types"; type Handler = (input: { data: Record; context: { viewer: Viewer | null } }) => Promise; type Builder = { middleware: () => Builder; validator: () => Builder; handler: (fn: Handler) => Handler }; function builder(): Builder { const self: Builder = { middleware: () => self, validator: () => self, handler: (fn) => fn }; return self; } class StubEntrypoint {} mock.module("cloudflare:workers", () => ({ env: { PUBLIC_URL: "https://forge.example.com" }, waitUntil: () => undefined, WorkflowEntrypoint: StubEntrypoint, DurableObject: StubEntrypoint, WorkerEntrypoint: StubEntrypoint, })); mock.module("@tanstack/react-start", () => ({ createServerFn: () => builder(), createMiddleware: () => builder() })); mock.module("./middleware", () => ({ viewerMiddleware: {}, requireViewer: (viewer: Viewer) => viewer })); const actualLimits = await import("~/server/limits"); mock.module("~/server/limits", () => ({ ...actualLimits, limitBrowse: async () => undefined })); const takenDown = { id: "evil", name: "evil", kind: "user", avatar_key: "evil-abc", disabled_at: 5, disabled_reason: "admin", show: 0, followers: 0, repos: 0, created_at: 0, }; const actualDb = await import("~/server/db"); mock.module("~/server/db", () => ({ ...actualDb, first: async (sql: string) => (/FROM accounts/.test(sql) ? takenDown : null), all: async () => [], })); const { getAccountPage } = await import("./account"); const { getProfileExtras, listFollows } = await import("./profile"); const { getContributions } = await import("./contributions"); const { getHovercard } = await import("./hovercards"); const { avatarTakenDown } = await import("~/server/avatars"); const visitor: Viewer = { id: "v", name: "v", displayName: null, email: "v@x", isAdmin: false, emailVerified: true }; async function status(fn: unknown, data: Record, viewer: Viewer | null): Promise { try { await (fn as Handler)({ data, context: { viewer } }); return "ok"; } catch (error) { return (error as { status: number }).status; } } describe("taken-down accounts", () => { test("profile, org page, followers, activity and contributions 404 for anonymous and signed-in visitors", async () => { for (const viewer of [null, visitor]) { expect(await status(getAccountPage, { name: "evil", tab: "repositories" }, viewer)).toBe(404); expect(await status(getProfileExtras, { name: "evil" }, viewer)).toBe(404); expect(await status(listFollows, { name: "evil", direction: "followers" }, viewer)).toBe(404); expect(await status(getContributions, { name: "evil", year: 2026 }, viewer)).toBe(404); } }); test("hovercards are empty and avatars stop serving", async () => { expect( await (getHovercard as unknown as Handler)({ data: { kind: "user", ref: "evil" }, context: { viewer: visitor } }), ).toBe(null); expect(await avatarTakenDown("evil-abc")).toBe(true); }); test("site admins can still review the profile", async () => { expect( await status( listFollows, { name: "evil", direction: "followers" }, { ...visitor, isAdmin: true, emailVerified: true }, ), ).toBe("ok"); }); });