init

tests/Privilege.test.ts

@@ -1,6 +1,9 @@
+import type { UserMeResponse } from "../src/core/ApiSchemas";
 import {
+  clanExistsByTag,
   createMatcher,
   PrivilegeCheckerImpl,
+  resolveClanTag,
   shadowNames,
 } from "../src/server/Privilege";
 
@@ -519,3 +522,122 @@ describe("Skin validation", () => {
     });
   });
 });
+
+const okResponse = (status: number): Response =>
+  ({ status }) as unknown as Response;
+
+const userWithClans = (tags: string[]): UserMeResponse =>
+  ({
+    user: {},
+    player: {
+      publicId: "p1",
+      adfree: false,
+      flares: [],
+      achievements: { singleplayerMap: [] },
+      friends: [],
+      subscription: null,
+      clans: tags.map((tag) => ({
+        tag,
+        name: tag,
+        role: "member" as const,
+        joinedAt: new Date().toISOString(),
+        memberCount: 1,
+      })),
+    },
+  }) as UserMeResponse;
+
+describe("clanExistsByTag", () => {
+  const deps = (fetcher: () => Promise<Response>) => ({
+    baseUrl: "https://auth.example",
+    fetcher: fetcher as unknown as typeof fetch,
+  });
+
+  it("returns true on HTTP 200", async () => {
+    const result = await clanExistsByTag(
+      "ABC",
+      deps(async () => okResponse(200)),
+    );
+    expect(result).toBe(true);
+  });
+
+  it("returns false on HTTP 404", async () => {
+    const result = await clanExistsByTag(
+      "XYZ",
+      deps(async () => okResponse(404)),
+    );
+    expect(result).toBe(false);
+  });
+
+  it("returns null on unexpected status (fail-closed)", async () => {
+    const result = await clanExistsByTag(
+      "ABC",
+      deps(async () => okResponse(503)),
+    );
+    expect(result).toBeNull();
+  });
+
+  it("returns null on transport error (fail-closed)", async () => {
+    const result = await clanExistsByTag(
+      "ABC",
+      deps(async () => {
+        throw new Error("offline");
+      }),
+    );
+    expect(result).toBeNull();
+  });
+
+  it("uppercases the tag in the request URL", async () => {
+    const fetcher = vi.fn(async () => okResponse(200));
+    await clanExistsByTag("abc", deps(fetcher));
+    const calledUrl = (fetcher.mock.calls[0] as unknown[])[0] as string;
+    expect(calledUrl).toContain("/public/clan/ABC/exists");
+  });
+});
+
+describe("resolveClanTag", () => {
+  it("passes a null tag through unchanged", async () => {
+    const probe = vi.fn();
+    const result = await resolveClanTag(null, null, probe);
+    expect(result).toEqual({ tag: null, dropped: false });
+    expect(probe).not.toHaveBeenCalled();
+  });
+
+  it("accepts a tag when the user is a member (case-insensitive)", async () => {
+    const probe = vi.fn();
+    const me = userWithClans(["abc"]);
+    const result = await resolveClanTag("ABC", me, probe);
+    expect(result).toEqual({ tag: "ABC", dropped: false });
+    expect(probe).not.toHaveBeenCalled();
+  });
+
+  it("drops a tag belonging to a real clan the user does not belong to", async () => {
+    const probe = vi.fn(async () => true);
+    const me = userWithClans(["other"]);
+    const result = await resolveClanTag("ABC", me, probe);
+    expect(result).toEqual({ tag: null, dropped: true, reason: "exists" });
+  });
+
+  it("keeps a tag that does not match any real clan (fictional)", async () => {
+    const probe = vi.fn(async () => false);
+    const result = await resolveClanTag("ABC", null, probe);
+    expect(result).toEqual({ tag: "ABC", dropped: false });
+  });
+
+  it("drops the tag on inconclusive existence check (fail-closed)", async () => {
+    const probe = vi.fn(async () => null);
+    const result = await resolveClanTag("ABC", null, probe);
+    expect(result).toEqual({
+      tag: null,
+      dropped: true,
+      reason: "inconclusive",
+    });
+  });
+
+  it("treats anonymous users as members of no clans", async () => {
+    const probe = vi.fn(async () => true);
+    const result = await resolveClanTag("ABC", null, probe);
+    expect(result.tag).toBeNull();
+    expect(result.dropped).toBe(true);
+    expect(probe).toHaveBeenCalledWith("ABC");
+  });
+});

tests/client/clan/ClanApiQueries.test.ts

@@ -2,20 +2,45 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 
 vi.mock("../../../src/client/Api", () => ({
   getApiBase: vi.fn(() => "http://localhost:3000"),
+  getUserMe: vi.fn(),
 }));
 
 vi.mock("../../../src/client/Auth", () => ({
   getAuthHeader: vi.fn(async () => "Bearer test-token"),
 }));
 
+import { getUserMe } from "../../../src/client/Api";
 import {
+  checkClanTagOwnership,
   fetchClanDetail,
+  fetchClanExists,
   fetchClanGames,
   fetchClanLeaderboard,
   fetchClanMembers,
   fetchClanRequests,
   fetchClans,
 } from "../../../src/client/ClanApi";
+import type { UserMeResponse } from "../../../src/core/ApiSchemas";
+
+const userWithClans = (tags: string[]): UserMeResponse =>
+  ({
+    user: {},
+    player: {
+      publicId: "p1",
+      adfree: false,
+      flares: [],
+      achievements: { singleplayerMap: [] },
+      friends: [],
+      subscription: null,
+      clans: tags.map((tag) => ({
+        tag,
+        name: tag,
+        role: "member" as const,
+        joinedAt: "2024-01-01T00:00:00.000Z",
+        memberCount: 1,
+      })),
+    },
+  }) as unknown as UserMeResponse;
 
 const okJson = (data: unknown, status = 200) => ({
   ok: true,
@@ -37,6 +62,104 @@ beforeEach(() => {
   vi.clearAllMocks();
 });
 
+describe("fetchClanExists", () => {
+  const status = (s: number) => ({ status: s });
+
+  it("returns true on HTTP 200", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(() => Promise.resolve(status(200))),
+    );
+    await expect(fetchClanExists("ABC")).resolves.toBe(true);
+  });
+
+  it("returns false on HTTP 404", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(() => Promise.resolve(status(404))),
+    );
+    await expect(fetchClanExists("XYZ")).resolves.toBe(false);
+  });
+
+  it("returns null on unexpected status (5xx)", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(() => Promise.resolve(status(503))),
+    );
+    await expect(fetchClanExists("ABC")).resolves.toBeNull();
+  });
+
+  it("returns null on transport error", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(() => Promise.reject(new Error("offline"))),
+    );
+    await expect(fetchClanExists("ABC")).resolves.toBeNull();
+  });
+
+  it("uppercases and URL-encodes the tag in the request URL", async () => {
+    const fetchSpy = vi.fn(
+      (_input: string | URL | Request, _init?: RequestInit) =>
+        Promise.resolve(status(200)),
+    );
+    vi.stubGlobal("fetch", fetchSpy);
+    await fetchClanExists("abc");
+    const calledUrl = fetchSpy.mock.calls[0]![0] as string;
+    expect(calledUrl).toContain("/public/clan/ABC/exists");
+  });
+});
+
+describe("checkClanTagOwnership", () => {
+  const status = (s: number) => ({ status: s });
+
+  it("accepts a tag the user is a member of without probing existence", async () => {
+    vi.mocked(getUserMe).mockResolvedValue(userWithClans(["abc"]));
+    const fetchSpy = vi.fn(() => Promise.resolve(status(200)));
+    vi.stubGlobal("fetch", fetchSpy);
+    await expect(checkClanTagOwnership("ABC")).resolves.toEqual({
+      tag: "ABC",
+      error: null,
+    });
+    expect(fetchSpy).not.toHaveBeenCalled();
+  });
+
+  it("accepts a fictional tag (clan does not exist)", async () => {
+    vi.mocked(getUserMe).mockResolvedValue(userWithClans(["other"]));
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(() => Promise.resolve(status(404))),
+    );
+    await expect(checkClanTagOwnership("ABC")).resolves.toEqual({
+      tag: "ABC",
+      error: null,
+    });
+  });
+
+  it("rejects a real clan the user does not belong to", async () => {
+    vi.mocked(getUserMe).mockResolvedValue(false);
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(() => Promise.resolve(status(200))),
+    );
+    await expect(checkClanTagOwnership("ABC")).resolves.toEqual({
+      tag: null,
+      error: "username.tag_not_member",
+    });
+  });
+
+  it("rejects on an inconclusive existence check", async () => {
+    vi.mocked(getUserMe).mockResolvedValue(false);
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(() => Promise.resolve(status(503))),
+    );
+    await expect(checkClanTagOwnership("ABC")).resolves.toEqual({
+      tag: null,
+      error: "username.tag_check_failed",
+    });
+  });
+});
+
 describe("fetchClanLeaderboard", () => {
   const leaderboardData = {
     start: "2024-01-01T00:00:00.000Z",

tests/core/ApiSchemas.test.ts

@@ -0,0 +1,9 @@
+import { describe, expect, it } from "vitest";
+import { clanExistsApiPath } from "../../src/core/ApiSchemas";
+
+describe("clanExistsApiPath", () => {
+  it("uppercases and URL-encodes the tag", () => {
+    expect(clanExistsApiPath("abc")).toBe("/public/clan/ABC/exists");
+    expect(clanExistsApiPath("a/b")).toBe("/public/clan/A%2FB/exists");
+  });
+});