testing/integration_helpers.ts

Field names that must not appear in non-admin HTTP response bodies.

Assert that an error response contains no leaky field values.

Checks both field names and string values for patterns indicating stack traces, SQL, or internal paths. Accepts unknown so callers pass response bodies / nested envelope fields directly without intermediate as casts; non-object bodies skip the field-name check.

Assert that a parsed JSON body contains no fields from the given blocklist.

Assert that a 429 response includes a valid Retry-After header matching the JSON body's retry_after field.

Validate a response body against the route spec's declared schemas.

For 2xx responses, validates against spec.output. For error responses, validates against the merged error schema for that status code.

List the fields in an error response body that are not in the known-safe set.

Error schemas use z.looseObject (intentional — multiple producers), but test responses should be checked for fields that could leak information.

Recursively collect all key names from a parsed JSON value.

Walks objects and arrays to find every property name at any nesting depth.

Create an expired test cookie — validly signed but with an expiry timestamp in 1970.

Find a REST auth route by suffix and method.

Decouples tests from consumer route prefix (/api/account/login, /api/auth/login, etc.). suffix must be one of REST_AUTH_ROUTE_SUFFIXES — throws otherwise so a post-migration RPC method name (e.g. /sessions/revoke-all) fails loudly at the call site instead of silently returning undefined.

Find a route spec matching the given method and path.

Supports both exact matches and parameterized paths (:param segments).

Pick request headers matching a route spec's auth requirement.

Maps RouteAuth onto a test account's credentials: - none — origin headers only - authenticated — the authed account's session cookie - role: admin — the admin account's session cookie - role: <other> — the test app's bootstrapped keeper session - keeper — the test app's daemon token

REST auth route suffixes on the account/bootstrap surface — the only routes still REST. find_auth_route rejects any other suffix at runtime; session/token CRUD, admin operations, and role_grant flows live on the RPC surface and should be reached via rpc_call.

Field names that must never appear in any HTTP response body.