ckochandClaude Opus 5
130921cf89
The API had no tests. These run against the real application through WebApplicationFactory — same pipeline, same Identity configuration, same JWT validation — with only the SQLite file, upload folder and signing key swapped, so a passing test says something about what ships. The ownership tests pin the rule the old PHP API got wrong: a second user sees an empty library, gets 404 (not 403, which would confirm the id exists) when reading, updating or deleting someone else's game, and cannot reassign ownership by putting ownerId or userId in the request body. Also covered: the password policy, that login is indistinguishable between a wrong password and an absent user, that the availability endpoint leaks no row data, that a token signed with an untrusted key is refused, that the sort parameter is allow-listed rather than interpolated, and that uploads must decode as an image regardless of extension or content type. 36 tests, ~1s. Program is now declared public partial so the test host can reach it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
9 lines
235 B
XML
9 lines
235 B
XML
<Solution>
|
|
<Folder Name="/src/">
|
|
<Project Path="src/LudosData.Api/LudosData.Api.csproj" />
|
|
</Folder>
|
|
<Folder Name="/tests/">
|
|
<Project Path="tests/LudosData.Api.Tests/LudosData.Api.Tests.csproj" />
|
|
</Folder>
|
|
</Solution>
|