test(storage): verify image()/file() reject malformed write shapes end-to-end by borisno2 · Pull Request #795 · OpenSaasAU/stack

borisno2 · 2026-07-21T11:48:59Z

Summary

Adds packages/storage/tests/opensaas-image-file-write-validation.test.ts, an integration-style test that exercises the REAL image()/file() field pipeline pieces in the order the Hook Pipeline runs them: field resolveInput → built-in field validation (via the same validateWithZod core's validateFieldRules wraps) → splitColumns.
Covers db.columns: 'keystone' (multi-column) mode for both image() and file():
- The legacy Keystone GraphQL { upload: File } wrapper shape (neither File-like nor already-shaped metadata) now throws a real ValidationError instead of being silently split into null/undefined physical columns — and asserts splitColumns is never reached once validation rejects the value.
- The three legitimate shapes (null, an already-shaped metadata object with no re-upload, and a File-like value that triggers an upload via a mocked storage provider) all persist correctly with the expected per-part columns.
Covers the default single-column (JSON) mode as a comparison baseline for both fields, confirming the same malformed shape already throws today (closing the "we didn't verify single-column mode" gap called out in the downstream report).
Adds a patch changeset for @opensaas/stack-storage (test coverage only, no behavior change).

This proves the #789 fix (Hook Pipeline validates a multi-column field's logical value before splitting it) holds end-to-end for the real image()/file() fields, pinning it as a regression guard in both directions.

Test plan

pnpm test passes in packages/storage (158/158 tests, including 10 new tests)
pnpm lint passes on the new test file
pnpm format / prettier check passes
pnpm manypkg fix run (no changes needed)
Changeset added

Closes #790

Generated by Claude Code

…d-to-end Adds integration-style tests exercising the real resolveInput -> validate -> splitColumns pipeline for image()/file() in both db.columns: 'keystone' (multi-column) and default single-column (JSON) modes, pinning the #789 fix as a regression guard against silent data corruption. Closes #790 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Q1GQboF8Ym1c4egaAzxkq5

vercel · 2026-07-21T11:49:01Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
stack-docs	Ready	Preview, Comment	Jul 21, 2026 11:49am

changeset-bot · 2026-07-21T11:49:14Z

🦋 Changeset detected

Latest commit: 81f1520

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 9 packages

Name	Type
@opensaas/stack-storage	Patch
@opensaas/stack-storage-s3	Patch
@opensaas/stack-storage-vercel	Patch
@opensaas/stack-auth	Patch
@opensaas/stack-cli	Patch
@opensaas/stack-core	Patch
@opensaas/stack-rag	Patch
@opensaas/stack-tiptap	Patch
@opensaas/stack-ui	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

borisno2 · 2026-07-21T11:49:48Z

Code Review

Overview

This PR is purely additive (2 new files, no production code touched): a new integration test file for packages/storage and a patch changeset. It exercises the real image()/file() field pipeline (resolveInput → validation via the same validateWithZod core's validateFieldRules wraps → splitColumns) to prove the #789 fix holds end-to-end, per issue #790's acceptance criteria.

Code quality & conventions

Follows the existing multi-column-fields.test.ts conventions closely (same fakeFile/makeContext helper shapes).
Stays within package boundaries: rather than reaching into packages/core/src/hooks internals (not importable cross-package), it uses the already-public validateWithZod export from @opensaas/stack-core/internal and a small local runValidateFieldRules wrapper that mirrors core's real validateFieldRules formatting exactly — a good way to test the real validation path without requiring new core exports or touching core at all.
Malformed-shape assertions correctly assert a thrown ValidationError (.rejects.toThrow(ValidationError) / expect(() => ...).toThrow(ValidationError)), not just a different return value, per the issue's explicit acceptance criterion.
The splitColumns spy (vi.spyOn(field, 'splitColumns') + expect(splitSpy).not.toHaveBeenCalled()) is a nice touch — it directly proves the regression mechanism (silent split-before-validate) can't recur, rather than only inferring it from the throw.
Legitimate-shape cases (null, existing metadata, File-like upload) assert actual persisted column values, matching multi-column-read-write.test.ts's style, not just mock call arguments.
Single-column (JSON) mode baseline is included and documented as "unaffected by Hook Pipeline: validate multi-column fields before splitting into physical columns #789", closing the gap the downstream report flagged.

Minor notes (non-blocking)

context: any in resolveValidateAndSplit and the as any casts on hook-call args are consistent with the pre-existing test file's own patterns (same eslint-disable style), so this isn't a new deviation.
ImageMetadata/FileMetadata object literals are duplicated across a few tests (e.g. the "existing" fixtures) rather than factored into shared constants — very minor, and matches the existing file's own repetition style.

Test coverage

All acceptance criteria from storage: image()/file() reject unrecognised write shapes end-to-end in keystone multi-column mode #790 are covered: multi-column malformed-shape rejection (both fields), all 3 legitimate shapes in multi-column mode (both fields), and single-column baseline rejection (both fields).
158/158 tests pass in packages/storage, including the 10 new tests. Lint and prettier both pass on the new file.

Risk

None — no production code changes; this is test-only, matching the patch changeset description.

No changes requested.

Generated by Claude Code

github-actions · 2026-07-21T11:55:31Z