testing/integration_helpers.ts

Field names that must not appear in non-admin HTTP response bodies.

Assert that an error response contains no leaky field values.

Checks both field names and string values for patterns indicating stack traces, SQL, or internal paths.

Assert that a parsed JSON body contains no fields from the given blocklist.

Assert that a 429 response includes a valid Retry-After header matching the JSON body's retry_after field.

Validate a response body against the route spec's declared schemas.

For 2xx responses, validates against spec.output. For error responses, validates against the merged error schema for that status code. Throws with details on mismatch.

Assert that an error response body contains no unexpected fields.

Error schemas use z.looseObject (intentional — multiple producers), but test responses should be checked for fields that could leak information. Flags any field not in the known-safe set.

Recursively collect all key names from a parsed JSON value.

Walks objects and arrays to find every property name at any nesting depth.

Create an expired test cookie — validly signed but with an expiry timestamp in 1970.

Find an auth route by suffix and method.

Useful for discovering login/logout/verify/revoke paths regardless of consumer prefix (/api/account/login, /api/auth/login, etc.).

Find a route spec matching the given method and path.

Supports both exact matches and parameterized paths (:param segments).

Field names that must never appear in any HTTP response body.