Test the remaining branches & guard the secret - #44
Merged
Merged
Conversation
Branch coverage sat at 87.88%. The empty comma-separated header parts,
the `indexOf('=') === -1` fallbacks in both halves of the header, and
the default leeway of 5 minutes all went unexercised. Mutation testing
turned up more: changing the default leeway to 60, or dropping it
outright, left the whole suite green.
A missing `secret` also threw a raw `TypeError` out of `createHmac`
rather than the `TruepicWebhookVerifierError` that the JSDoc and the
type declarations promise, and a non-string `header` died on
`header.split`. Both now throw the documented error, which means an
empty secret reports "Secret is missing or empty" where it used to
report "Signature is not valid". No existing message changed.
Coverage is now 100% line and branch across both files.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Branch coverage sat at 87.88%, and mutation testing showed the gaps were real rather than cosmetic: changing the default leeway from 5 minutes to 60, or removing it outright, left all 19 tests green. So did dropping either empty-part check in the header parser. This adds the tests that close those gaps, plus a test file for the error class, taking both files to 100% line and branch coverage.
Two small source changes come with it. A missing
secretthrew a rawTypeErrorout ofcreateHmacrather than theTruepicWebhookVerifierErrorthat both the JSDoc andmain.d.tspromise — the likely trigger being an unset env var — and a non-stringheaderdied onheader.split. Both now throw the documented error.That makes this a minor release rather than a patch: an empty secret now reports "Secret is missing or empty" where it previously reported "Signature is not valid". No existing message changed, and both paths failed closed before and after.
Deliberately left out:
main.d.tsstill isn't type-checked in CI, which is its own change.🤖 Generated with Claude Code