test: strengthen Garmin webhook coverage

Author: JeffOtano

convex/garmin/webhookSignature.test.ts

@@ -5,19 +5,53 @@ import { garminWebhookFailureStatus, verifyGarminWebhookSignature } from "./webh
 class TrackingRequest extends Request {
   bodyWasRead = false;
 
-  override async text(): Promise<string> {
+  private trackBodyRead(): void {
     this.bodyWasRead = true;
+  }
+
+  override get body() {
+    this.trackBodyRead();
+    return super.body;
+  }
+
+  override async arrayBuffer(): Promise<ArrayBuffer> {
+    this.trackBodyRead();
+    return await super.arrayBuffer();
+  }
+
+  override async blob(): Promise<Blob> {
+    this.trackBodyRead();
+    return await super.blob();
+  }
+
+  override clone(): Request {
+    this.trackBodyRead();
+    return super.clone();
+  }
+
+  override async formData(): Promise<FormData> {
+    this.trackBodyRead();
+    return await super.formData();
+  }
+
+  override async json(): Promise<unknown> {
+    this.trackBodyRead();
+    return await super.json();
+  }
+
+  override async text(): Promise<string> {
+    this.trackBodyRead();
     return await super.text();
   }
 }
 
-async function runGarminRoute(req: Request): Promise<Response> {
+async function runGarminRoute(req: Request, ctx: object = {}): Promise<Response> {
   const route = http.lookup(new URL(req.url).pathname, "POST");
   if (!route) throw new Error("Expected Garmin path-secret route");
   const handler = route[0] as unknown as {
     _handler: (ctx: object, request: Request) => Promise<Response>;
   };
-  return await handler._handler({}, req);
+  return await handler._handler(ctx, req);
 }
 
 describe("Garmin path-secret webhook routes", () => {
@@ -31,6 +65,35 @@ describe("Garmin path-secret webhook routes", () => {
     expect(pathSecretRoute).not.toBeNull();
   });
 
+  it("processes an authenticated path-secret delivery through the registered handler", async () => {
+    vi.stubEnv("GARMIN_WEBHOOK_SECRET", "secret-1");
+    const store = vi.fn().mockResolvedValue("storage-1");
+    const runMutation = vi.fn().mockResolvedValue("event-1");
+    const runAfter = vi.fn().mockResolvedValue(undefined);
+    const req = new Request("https://example.com/garmin/webhook/activities/secret-1", {
+      method: "POST",
+      body: '{"activities":[]}',
+    });
+
+    const response = await runGarminRoute(req, {
+      storage: { store },
+      runMutation,
+      scheduler: { runAfter },
+    });
+
+    expect(response.status).toBe(200);
+    expect(store).toHaveBeenCalledOnce();
+    expect(runMutation).toHaveBeenCalledWith(expect.anything(), {
+      eventType: "activities",
+      rawPayloadStorageId: "storage-1",
+    });
+    expect(runAfter).toHaveBeenCalledWith(0, expect.anything(), {
+      eventId: "event-1",
+      eventType: "activities",
+      rawPayloadStorageId: "storage-1",
+    });
+  });
+
   it("does not route path-secret requests for unsupported event types", () => {
     const req = new TrackingRequest("https://example.com/garmin/webhook/notSupported/secret-1", {
       method: "POST",
@@ -89,6 +152,13 @@ describe("verifyGarminWebhookSignature", () => {
     await expect(verifyGarminWebhookSignature(req, "{}")).resolves.toEqual({ valid: true });
   });
 
+  it("decodes the path secret before comparing it", async () => {
+    vi.stubEnv("GARMIN_WEBHOOK_SECRET", "secret/1");
+    const req = new Request("https://example.com/garmin/webhook/activities/secret%2F1");
+
+    await expect(verifyGarminWebhookSignature(req, "{}")).resolves.toEqual({ valid: true });
+  });
+
   it("rejects a valid secret when the path contains an extra segment", async () => {
     vi.stubEnv("GARMIN_WEBHOOK_SECRET", "secret-1");
     const req = new Request("https://example.com/garmin/webhook/activities/extra/secret-1");