Merge branch 'main' into fix/carousel-vertical-arrow-keys-8308

Author: loopover-orb[bot]

apps/loopover-ui/src/components/site/snapshot-replay.test.tsx

@@ -0,0 +1,125 @@
+import { fireEvent, render, screen } from "@testing-library/react";
+import { describe, expect, it } from "vitest";
+
+import { SnapshotReplay, SnapshotReplayCard } from "@/components/site/snapshot-replay";
+import type { SnapshotReplayView } from "@/lib/snapshot-replay";
+
+// (#8386) Component coverage for the audience toggle + missing/withheld footers on snapshot replay.
+
+const PRIVATE_REASON = "AUTHENTICATED_ONLY_REASON_TEXT";
+
+function baseView(overrides: Partial<SnapshotReplayView> = {}): SnapshotReplayView {
+  return {
+    status: "populated",
+    viewer: "authenticated",
+    snapshotId: "snap-ui-1",
+    actionType: "comment",
+    target: { repoFullName: "Acme/Widget", pullNumber: 1, issueNumber: null },
+    generatedAt: "2026-06-01T12:00:00.000Z",
+    scoringModelId: "model-1",
+    confidence: "high",
+    freshness: "fresh",
+    sources: [],
+    evidenceGaps: [],
+    evidenceComplete: true,
+    staleReasons: [],
+    counterfactuals: [
+      {
+        repoFullName: "Acme/Widget",
+        recommendation: "approve",
+        alternatives: [
+          {
+            alternative: "request_changes",
+            group: "verdict",
+            publicSummary: "Public summary visible to both audiences.",
+            reason: PRIVATE_REASON,
+            facts: ["secret-fact"],
+            assumptions: ["secret-assumption"],
+          },
+        ],
+      },
+    ],
+    withheldPrivateFields: [],
+    notice: "All replayed evidence is fresh and complete.",
+    ...overrides,
+  };
+}
+
+describe("SnapshotReplayCard audience toggle (#8386)", () => {
+  it("defaults to the authenticated view and switches to publicSafe without leaking private reason text", () => {
+    const authenticated = baseView({ viewer: "authenticated" });
+    const publicSafe = baseView({
+      viewer: "public",
+      counterfactuals: [
+        {
+          repoFullName: "Acme/Widget",
+          recommendation: "approve",
+          alternatives: [
+            {
+              alternative: "request_changes",
+              group: "verdict",
+              publicSummary: "Public summary visible to both audiences.",
+              reason: null,
+              facts: [],
+              assumptions: [],
+            },
+          ],
+        },
+      ],
+      withheldPrivateFields: ["counterfactual_detail"],
+      notice: "Public-safe notice copy.",
+    });
+
+    render(<SnapshotReplayCard authenticated={authenticated} publicSafe={publicSafe} />);
+
+    expect(screen.getByRole("button", { name: "Authenticated" }).getAttribute("aria-pressed")).toBe(
+      "true",
+    );
+    expect(screen.getByText(PRIVATE_REASON)).toBeTruthy();
+    expect(screen.getByText("Public summary visible to both audiences.")).toBeTruthy();
+
+    fireEvent.click(screen.getByRole("button", { name: "Public-safe" }));
+
+    expect(screen.getByRole("button", { name: "Public-safe" }).getAttribute("aria-pressed")).toBe(
+      "true",
+    );
+    expect(screen.queryByText(PRIVATE_REASON)).toBeNull();
+    expect(screen.getByText("Public summary visible to both audiences.")).toBeTruthy();
+    expect(screen.getByText(/Private detail withheld for this context/)).toBeTruthy();
+    expect(screen.getByText(/counterfactual_detail/)).toBeTruthy();
+  });
+});
+
+describe("SnapshotReplay rendering (#8386)", () => {
+  it("renders only the notice for missing status — no detail sections", () => {
+    render(
+      <SnapshotReplay
+        view={baseView({
+          status: "missing",
+          notice: "No decision snapshot is available to replay.",
+          counterfactuals: [],
+          withheldPrivateFields: ["counterfactual_detail"],
+        })}
+      />,
+    );
+
+    const root = screen.getByTestId("snapshot-replay");
+    expect(root.getAttribute("data-status")).toBe("missing");
+    expect(screen.getByText("No decision snapshot is available to replay.")).toBeTruthy();
+    expect(screen.queryByText("Action")).toBeNull();
+    expect(screen.queryByText("Why not the alternatives")).toBeNull();
+    expect(screen.queryByText(/Private detail withheld/)).toBeNull();
+  });
+
+  it("renders the withheldPrivateFields footer only when the array is non-empty", () => {
+    const { rerender } = render(<SnapshotReplay view={baseView({ withheldPrivateFields: [] })} />);
+    expect(screen.queryByText(/Private detail withheld for this context/)).toBeNull();
+
+    rerender(
+      <SnapshotReplay view={baseView({ withheldPrivateFields: ["counterfactual_detail"] })} />,
+    );
+    expect(
+      screen.getByText(/Private detail withheld for this context: counterfactual_detail/),
+    ).toBeTruthy();
+  });
+});

apps/loopover-ui/src/lib/analytics-proxy.test.ts

@@ -0,0 +1,136 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { handleAnalyticsProxy } from "./analytics-proxy";
+
+// #8387: the analytics proxy is the cookieless-beacon relay to the Umami-compatible upstream. Its four
+// security behaviors (strict allowlist, cookie strip, cf-connecting-ip-only x-forwarded-for, set-cookie
+// strip) had zero coverage. These pin each one against a stubbed upstream fetch.
+
+const UPSTREAM = "https://tasty.aethereal.dev";
+
+type ForwardedCall = { url: string; method: string; headers: Headers };
+
+/** Stub global fetch to return `response`, recording each forwarded request in a typed, inspectable list. */
+function stubUpstream(response: Response) {
+  const calls: ForwardedCall[] = [];
+  const fetchMock = vi.fn(
+    async (url: string | URL, init?: { method?: string; headers?: HeadersInit }) => {
+      calls.push({
+        url: String(url),
+        method: init?.method ?? "GET",
+        headers: new Headers(init?.headers),
+      });
+      return response;
+    },
+  );
+  vi.stubGlobal("fetch", fetchMock);
+  return { fetchMock, calls };
+}
+
+function send(init: RequestInit & { path?: string; query?: string } = {}) {
+  const { path = "/stats/api/send", query = "", ...rest } = init;
+  return new Request(`https://loopover.ai${path}${query}`, { method: "POST", ...rest });
+}
+
+afterEach(() => {
+  vi.unstubAllGlobals();
+});
+
+describe("handleAnalyticsProxy", () => {
+  it("forwards an allowed POST to the upstream collect endpoint, preserving the query and relaying the response", async () => {
+    const { fetchMock, calls } = stubUpstream(
+      new Response("ok-body", { status: 202, statusText: "Accepted" }),
+    );
+
+    const response = await handleAnalyticsProxy(
+      send({ query: "?v=2&cache=abc", body: "beacon-payload" }),
+    );
+
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    // /stats prefix stripped, path + query preserved onto the real upstream host.
+    expect(calls[0]!.url).toBe(`${UPSTREAM}/api/send?v=2&cache=abc`);
+    expect(calls[0]!.method).toBe("POST");
+    // Upstream status/statusText/body are relayed back untouched.
+    expect(response).toBeInstanceOf(Response);
+    expect(response!.status).toBe(202);
+    expect(response!.statusText).toBe("Accepted");
+    expect(await response!.text()).toBe("ok-body");
+  });
+
+  it("rejects a disallowed method with 405 + an allow header, without ever calling fetch (method gate)", async () => {
+    const { fetchMock } = stubUpstream(new Response("should not be used"));
+
+    const response = await handleAnalyticsProxy(send({ method: "GET" }));
+
+    expect(response!.status).toBe(405);
+    expect(response!.headers.get("allow")).toBe("POST");
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it("returns undefined (falls through to SSR) and never fetches for a path outside the allowlist", async () => {
+    const { fetchMock } = stubUpstream(new Response("should not be used"));
+
+    // The admin/auth API lives on the same upstream origin as the collect endpoint -- must NOT be proxied.
+    expect(await handleAnalyticsProxy(send({ path: "/stats/admin" }))).toBeUndefined();
+    expect(await handleAnalyticsProxy(send({ path: "/stats/api/collect" }))).toBeUndefined();
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it("strips the visitor's first-party cookie before forwarding (cookieless guarantee, #597)", async () => {
+    const { calls } = stubUpstream(new Response(null, { status: 200 }));
+
+    await handleAnalyticsProxy(
+      send({ headers: { cookie: "session=secret; theme=dark", "x-keep": "yes" } }),
+    );
+
+    expect(calls[0]!.headers.get("cookie")).toBeNull();
+    // Non-stripped headers still pass through, so this isn't just dropping everything.
+    expect(calls[0]!.headers.get("x-keep")).toBe("yes");
+  });
+
+  it("re-derives x-forwarded-for from the trusted cf-connecting-ip and drops any client-supplied value (no geo spoofing)", async () => {
+    const { calls } = stubUpstream(new Response(null, { status: 200 }));
+
+    await handleAnalyticsProxy(
+      send({ headers: { "cf-connecting-ip": "203.0.113.7", "x-forwarded-for": "66.66.66.66" } }),
+    );
+
+    expect(calls[0]!.headers.get("x-forwarded-for")).toBe("203.0.113.7");
+    // The trusted-IP header itself is not leaked upstream.
+    expect(calls[0]!.headers.get("cf-connecting-ip")).toBeNull();
+  });
+
+  it("does not set x-forwarded-for when there is no cf-connecting-ip", async () => {
+    const { calls } = stubUpstream(new Response(null, { status: 200 }));
+
+    await handleAnalyticsProxy(send({ headers: { "x-forwarded-for": "66.66.66.66" } }));
+
+    expect(calls[0]!.headers.get("x-forwarded-for")).toBeNull();
+  });
+
+  it("strips set-cookie from the upstream response before relaying it to the browser", async () => {
+    stubUpstream(
+      new Response("ok", {
+        status: 200,
+        headers: { "set-cookie": "umami=1; Path=/", "x-app": "v1" },
+      }),
+    );
+
+    const response = await handleAnalyticsProxy(send());
+
+    expect(response!.headers.get("set-cookie")).toBeNull();
+    expect(response!.headers.get("x-app")).toBe("v1"); // unrelated response headers are still relayed
+  });
+
+  it("fails quietly with 502 when the upstream fetch throws (analytics must never take the page down)", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(async () => {
+        throw new Error("network down");
+      }),
+    );
+
+    const response = await handleAnalyticsProxy(send({ body: "beacon" }));
+
+    expect(response!.status).toBe(502);
+  });
+});