loc-via-git/tests/app.test.js

import test from "node:test";
import assert from "node:assert/strict";
import request from "supertest";

import { createApp } from "../dist/app.js";

const baseConfig = {
  allowedGitHosts: ["example.com"],
  apiKey: "",
  cacheSweepIntervalMs: 300000,
  cacheTtlMs: 300000,
  cloneTimeoutMs: 45000,
  defaultSshKeyName: "loc_via_git_ed25519",
  generateSshKeyIfMissing: false,
  maxConcurrentScans: 4,
  maxFilesPerScan: 20000,
  maxFileSizeBytes: 5 * 1024 * 1024,
  maxScanBytes: 100 * 1024 * 1024,
  port: 3000,
  rateLimitMax: 30,
  rateLimitWindowMs: 300000,
  sshKeysDir: "/tmp/keys",
  tempRoot: "/tmp/loc-via-git",
  trustProxy: false
};

test("GET /loc returns count metadata", async () => {
  const app = createApp(baseConfig, {
    getHealth: () => ({ cacheEntries: 1, inFlight: 0, maxConcurrentScans: 4, activeScans: 0, queuedScans: 0 }),
    getPublicKey: async () => "ssh-ed25519 AAAA",
    getDefaultKeyName: () => "loc_via_git_ed25519",
    count: async (requestInput) => ({
      commit: "abc123",
      repo: requestInput.repo,
      ref: requestInput.ref,
      sshKey: requestInput.sshKey,
      cached: false,
      lineCount: 12,
      fileCount: 3,
      languages: [{ language: "TypeScript", files: 3, lines: 12 }],
      scannedAt: "2026-01-01T00:00:00.000Z",
      durationMs: 123
    })
  });

  const response = await request(app).get("/loc?repo=https://example.com/repo.git");

  assert.equal(response.status, 200);
  assert.equal(response.body.lineCount, 12);
  assert.equal(response.body.languages[0].language, "TypeScript");
});

test("GET /ssh/public-key returns text without auth", async () => {
  const app = createApp({ ...baseConfig, apiKey: "secret" }, {
    getHealth: () => ({ cacheEntries: 0, inFlight: 0, maxConcurrentScans: 4, activeScans: 0, queuedScans: 0 }),
    getPublicKey: async () => "ssh-ed25519 AAAAB3 key",
    getDefaultKeyName: () => "loc_via_git_ed25519",
    count: async () => {
      throw new Error("not used");
    }
  });

  const response = await request(app).get("/ssh/public-key");

  assert.equal(response.status, 200);
  assert.equal(response.text, "ssh-ed25519 AAAAB3 key");
});

test("GET /loc enforces api key when configured", async () => {
  const app = createApp({ ...baseConfig, apiKey: "secret" }, {
    getHealth: () => ({ cacheEntries: 0, inFlight: 0, maxConcurrentScans: 4, activeScans: 0, queuedScans: 0 }),
    getPublicKey: async () => "ssh-ed25519 AAAA",
    getDefaultKeyName: () => "loc_via_git_ed25519",
    count: async () => {
      throw new Error("not used");
    }
  });

  const response = await request(app).get("/loc?repo=https://example.com/repo.git");

  assert.equal(response.status, 401);
});

test("GET /loc accepts api_key query param as an unsafe fallback", async () => {
  const app = createApp({ ...baseConfig, apiKey: "secret" }, {
    getHealth: () => ({ cacheEntries: 0, inFlight: 0, maxConcurrentScans: 4, activeScans: 0, queuedScans: 0 }),
    getPublicKey: async () => "ssh-ed25519 AAAA",
    getDefaultKeyName: () => "loc_via_git_ed25519",
    count: async (requestInput) => ({
      commit: "abc123",
      repo: requestInput.repo,
      ref: requestInput.ref,
      sshKey: requestInput.sshKey,
      cached: false,
      lineCount: 5,
      fileCount: 1,
      languages: [{ language: "Plain Text", files: 1, lines: 5 }],
      scannedAt: "2026-01-01T00:00:00.000Z",
      durationMs: 10
    })
  });

  const response = await request(app).get("/loc?repo=https://example.com/repo.git&api_key=secret");

  assert.equal(response.status, 200);
  assert.equal(response.body.lineCount, 5);
});

test("GET /metrics is authenticated and exposes Prometheus counters", async () => {
  const app = createApp({ ...baseConfig, apiKey: "secret" }, {
    getHealth: () => ({ cacheEntries: 0, inFlight: 0, maxConcurrentScans: 4, activeScans: 0, queuedScans: 0 }),
    getPublicKey: async () => "ssh-ed25519 AAAA",
    getDefaultKeyName: () => "loc_via_git_ed25519",
    count: async () => {
      throw new Error("not used");
    }
  });

  const unauthenticated = await request(app).get("/metrics");
  const authenticated = await request(app).get("/metrics").set("x-api-key", "secret");

  assert.equal(unauthenticated.status, 401);
  assert.equal(authenticated.status, 200);
  assert.match(authenticated.text, /loc_via_git_http_requests_total/);
  assert.match(authenticated.text, /loc_via_git_scans_total 0/);
});

test("GET /loc/diff returns aggregate and language deltas", async () => {
  const app = createApp(baseConfig, {
    getHealth: () => ({ cacheEntries: 0, inFlight: 0, maxConcurrentScans: 4, activeScans: 0, queuedScans: 0 }),
    getPublicKey: async () => "ssh-ed25519 AAAA",
    getDefaultKeyName: () => "loc_via_git_ed25519",
    count: async (requestInput) => ({
      commit: requestInput.ref === "base" ? "base123" : "head456",
      repo: requestInput.repo,
      ref: requestInput.ref,
      sshKey: requestInput.sshKey,
      cached: false,
      lineCount: requestInput.ref === "base" ? 10 : 17,
      fileCount: requestInput.ref === "base" ? 2 : 3,
      languages: requestInput.ref === "base"
        ? [{ language: "TypeScript", files: 2, lines: 10 }]
        : [{ language: "TypeScript", files: 2, lines: 12 }, { language: "Python", files: 1, lines: 5 }],
      scannedAt: "2026-01-01T00:00:00.000Z",
      durationMs: 10
    })
  });

  const response = await request(app).get("/loc/diff?repo=https://example.com/repo.git&base=base&head=head");

  assert.equal(response.status, 200);
  assert.equal(response.body.delta.lineCount, 7);
  assert.deepEqual(response.body.delta.languages, [
    { language: "Python", files: 1, lines: 5 },
    { language: "TypeScript", files: 0, lines: 2 }
  ]);
});