Skip to content

test: migrate API tests from callback style to async/await - #41636

Merged
dionisio-bot[bot] merged 2 commits into
developfrom
chore/api-tests-async-await
Aug 3, 2026
Merged

test: migrate API tests from callback style to async/await#41636
dionisio-bot[bot] merged 2 commits into
developfrom
chore/api-tests-async-await

Conversation

@ricardogarim

@ricardogarim ricardogarim commented Jul 30, 2026

Copy link
Copy Markdown
Member

Proposed changes (including videos or screenshots)

Issue(s)

Steps to test or reproduce

Further comments

Review in cubic

Summary by CodeRabbit

  • Tests
    • Modernized broad end-to-end API coverage with more consistent asynchronous request handling.
    • Strengthened validation of success responses, error messages, permissions, status codes, pagination, and response formats across messaging, rooms, users, teams, integrations, and other API areas.
    • Improved coverage for authentication, authorization, invalid input, and edge-case scenarios.
    • No end-user-facing behavior changes.

@dionisio-bot

dionisio-bot Bot commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

Looks like this PR is ready to merge! 🎉
If you have any trouble, please check the PR guidelines

@coderabbitai

coderabbitai Bot commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f8db4840-2fba-435d-bf35-8b65e111f92f

📥 Commits

Reviewing files that changed from the base of the PR and between d077b02 and 1af86eb.

📒 Files selected for processing (3)
  • apps/meteor/tests/end-to-end/api/channels.ts
  • apps/meteor/tests/end-to-end/api/direct-message.ts
  • apps/meteor/tests/end-to-end/api/groups.ts
🚧 Files skipped from review as they are similar to previous changes (3)
  • apps/meteor/tests/end-to-end/api/groups.ts
  • apps/meteor/tests/end-to-end/api/direct-message.ts
  • apps/meteor/tests/end-to-end/api/channels.ts
📜 Recent review details
⏰ Context from checks skipped due to timeout. (2)
  • GitHub Check: cubic · AI code reviewer
  • GitHub Check: Hacktron Security Check

Walkthrough

Changes

The pull request modernizes a large set of Meteor end-to-end API tests. Callback-based Supertest flows now use async/await, awaited responses, explicit status checks, and direct response-body assertions. Existing coverage is preserved across messaging, rooms, users, administration, integrations, media, and settings.

Estimated code review effort: 4 (Complex) | ~60 minutes

Possibly related PRs

Suggested labels: type: chore

Suggested reviewers: tassoevan

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely describes the main change: migrating API tests from callback-based handling to async/await.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

Warning

Review ran into problems

🔥 Problems

Errors were encountered while retrieving linked issues.

Errors (1)
  • CORE-2502: Request failed with status code 401

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@changeset-bot

changeset-bot Bot commented Jul 30, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 1af86eb

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@codecov

codecov Bot commented Jul 30, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.75%. Comparing base (a18df96) to head (1af86eb).
⚠️ Report is 12 commits behind head on develop.

Additional details and impacted files

Impacted file tree graph

@@             Coverage Diff             @@
##           develop   #41636      +/-   ##
===========================================
+ Coverage    68.72%   68.75%   +0.03%     
===========================================
  Files         4151     4151              
  Lines       159513   159513              
  Branches     27988    27981       -7     
===========================================
+ Hits        109621   109681      +60     
+ Misses       44721    44655      -66     
- Partials      5171     5177       +6     
Flag Coverage Δ
e2e 58.83% <ø> (-0.02%) ⬇️
e2e-api 45.96% <ø> (+0.28%) ⬆️
unit 70.71% <ø> (+0.02%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

🧹 Nitpick comments (5)
apps/meteor/tests/end-to-end/api/channels.ts (1)

1854-1859: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Redundant count assertion.

Line 1856 already asserts count equals 1; line 1858 re-checks mere presence.

♻️ Proposed cleanup
 			expect(res.body).to.have.property('count', 1);
 			expect(res.body.members[0]._id).to.be.equal(testUser._id);
-			expect(res.body).to.have.property('count');
 			expect(res.body).to.have.property('total');
 			expect(res.body).to.have.property('offset');
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@apps/meteor/tests/end-to-end/api/channels.ts` around lines 1854 - 1859,
Remove the redundant count-presence assertion from the test block, keeping the
existing count-equals-1 assertion and the total-property assertion unchanged.
apps/meteor/tests/end-to-end/api/groups.ts (1)

2715-2717: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Leftover callback-style test in an otherwise migrated suite.

♻️ Proposed conversion
-		it('should fail to convert group without the required parameters', (done) => {
-			void request.post(api('groups.convertToTeam')).set(credentials).send({}).expect(400).end(done);
-		});
+		it('should fail to convert group without the required parameters', async () => {
+			const res = await request.post(api('groups.convertToTeam')).set(credentials).send({}).expect(400);
+
+			expect(res.body).to.have.property('success', false);
+		});
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@apps/meteor/tests/end-to-end/api/groups.ts` around lines 2715 - 2717, Convert
the callback-style test around “should fail to convert group without the
required parameters” to the suite’s async/await pattern: remove the done
parameter and await the request assertion while preserving the existing
credentials, empty payload, and expected 400 response.
apps/meteor/tests/end-to-end/api/rooms.ts (1)

1955-1955: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

async on a describe callback is a no-op.

Mocha ignores the returned promise for suite callbacks; drop it to avoid implying async setup.

♻️ Proposed cleanup
-		describe('it should create a *private* discussion if the parent channel is public and inside a private team', async () => {
+		describe('it should create a *private* discussion if the parent channel is public and inside a private team', () => {
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@apps/meteor/tests/end-to-end/api/rooms.ts` at line 1955, Remove the async
modifier from the describe callback for “it should create a private discussion
if the parent channel is public and inside a private team”; keep the test body
and any async individual hooks or tests unchanged.
apps/meteor/tests/end-to-end/api/cors.ts (1)

50-52: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Stale/misleading comment: code doesn't fetch the root page.

The comment says "First get the root page to extract the hash," but the test never calls the getHash() helper (lines 7-17) — it just sends a hardcoded invalidHash. Remove or correct the comment to avoid confusing future readers about the test's actual behavior.

As per coding guidelines, "Avoid code comments in the implementation."

✏️ Proposed fix
 it('should return 404 when hash does not match', async () => {
-			// First get the root page to extract the hash
 			await request.get('/meteor_runtime_config.js').query({ hash: 'invalidHash' }).expect(404);
 });
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@apps/meteor/tests/end-to-end/api/cors.ts` around lines 50 - 52, Remove the
misleading comment immediately before the request in the “should return 404 when
hash does not match” test; the test uses the hardcoded invalidHash value and
does not call getHash(), so no replacement comment is needed.

Source: Coding guidelines

apps/meteor/tests/end-to-end/api/users.ts (1)

2378-2380: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Leftover done callback in an otherwise migrated suite.

♻️ Convert to async/await
-			it('should return 401 unauthorized when user is not logged in', (done) => {
-				void request.get(api('users.getAvatarSuggestion')).expect('Content-Type', 'application/json').expect(401).end(done);
-			});
+			it('should return 401 unauthorized when user is not logged in', async () => {
+				await request.get(api('users.getAvatarSuggestion')).expect('Content-Type', 'application/json').expect(401);
+			});
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@apps/meteor/tests/end-to-end/api/users.ts` around lines 2378 - 2380, Convert
the “should return 401 unauthorized when user is not logged in” test to
async/await by removing the done parameter and awaiting the request assertion
chain. Preserve the existing endpoint, JSON content-type check, and 401 status
expectation.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@apps/meteor/tests/end-to-end/api/channels.ts`:
- Around line 3257-3274: Make the fixture requests assert successful responses
instead of relying on awaited Supertest resolution: add status 200 and
success-body assertions to channels.invite, channels.addModerator, and
channels.addLeader in apps/meteor/tests/end-to-end/api/channels.ts#L3257-L3274,
and apply the same assertions to the corresponding groups endpoints in
apps/meteor/tests/end-to-end/api/groups.ts#L2470-L2487 and `#L2544-L2555`.

In `@apps/meteor/tests/end-to-end/api/direct-message.ts`:
- Around line 1052-1063: Update the users.update request in the “should update
user's name” test to assert HTTP status 200 before accessing res.body.user,
preserving the existing name property assertion after the status check.

In `@apps/meteor/tests/end-to-end/api/users.ts`:
- Around line 5495-5497: Await the getUserStatus assertion in the affected test
so the busy-status mismatch fails within the test; replace the floating
void/getUserStatus(...).then(...) pattern at both occurrences, including the
matching block around the second referenced location.

---

Nitpick comments:
In `@apps/meteor/tests/end-to-end/api/channels.ts`:
- Around line 1854-1859: Remove the redundant count-presence assertion from the
test block, keeping the existing count-equals-1 assertion and the total-property
assertion unchanged.

In `@apps/meteor/tests/end-to-end/api/cors.ts`:
- Around line 50-52: Remove the misleading comment immediately before the
request in the “should return 404 when hash does not match” test; the test uses
the hardcoded invalidHash value and does not call getHash(), so no replacement
comment is needed.

In `@apps/meteor/tests/end-to-end/api/groups.ts`:
- Around line 2715-2717: Convert the callback-style test around “should fail to
convert group without the required parameters” to the suite’s async/await
pattern: remove the done parameter and await the request assertion while
preserving the existing credentials, empty payload, and expected 400 response.

In `@apps/meteor/tests/end-to-end/api/rooms.ts`:
- Line 1955: Remove the async modifier from the describe callback for “it should
create a private discussion if the parent channel is public and inside a private
team”; keep the test body and any async individual hooks or tests unchanged.

In `@apps/meteor/tests/end-to-end/api/users.ts`:
- Around line 2378-2380: Convert the “should return 401 unauthorized when user
is not logged in” test to async/await by removing the done parameter and
awaiting the request assertion chain. Preserve the existing endpoint, JSON
content-type check, and 401 status expectation.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 7e6159ba-a53c-48fd-97d5-4b8594192bdf

📥 Commits

Reviewing files that changed from the base of the PR and between cb7c5c2 and d077b02.

📒 Files selected for processing (26)
  • apps/meteor/tests/end-to-end/api/assets2.ts
  • apps/meteor/tests/end-to-end/api/autotranslate.ts
  • apps/meteor/tests/end-to-end/api/banners.ts
  • apps/meteor/tests/end-to-end/api/channels.ts
  • apps/meteor/tests/end-to-end/api/chat.ts
  • apps/meteor/tests/end-to-end/api/commands.ts
  • apps/meteor/tests/end-to-end/api/cors.ts
  • apps/meteor/tests/end-to-end/api/custom-sounds.ts
  • apps/meteor/tests/end-to-end/api/custom-user-status.ts
  • apps/meteor/tests/end-to-end/api/direct-message.ts
  • apps/meteor/tests/end-to-end/api/emoji-custom.ts
  • apps/meteor/tests/end-to-end/api/groups.ts
  • apps/meteor/tests/end-to-end/api/incoming-integrations.ts
  • apps/meteor/tests/end-to-end/api/invites.ts
  • apps/meteor/tests/end-to-end/api/licenses.ts
  • apps/meteor/tests/end-to-end/api/methods.ts
  • apps/meteor/tests/end-to-end/api/miscellaneous.ts
  • apps/meteor/tests/end-to-end/api/oauthapps.ts
  • apps/meteor/tests/end-to-end/api/permissions.ts
  • apps/meteor/tests/end-to-end/api/rooms.ts
  • apps/meteor/tests/end-to-end/api/settings.ts
  • apps/meteor/tests/end-to-end/api/statistics.ts
  • apps/meteor/tests/end-to-end/api/subscriptions.ts
  • apps/meteor/tests/end-to-end/api/teams.ts
  • apps/meteor/tests/end-to-end/api/users.ts
  • apps/meteor/tests/end-to-end/api/webdav.ts
📜 Review details
⏰ Context from checks skipped due to timeout. (6)
  • GitHub Check: 🔨 Test UI (CE) / MongoDB 8.0 (4/4)
  • GitHub Check: 🔨 Test UI (CE) / MongoDB 8.0 (1/4)
  • GitHub Check: 🔨 Test UI (EE) / MongoDB 8.0 coverage (4/5)
  • GitHub Check: 🔨 Test UI (EE) / MongoDB 8.0 coverage (3/5)
  • GitHub Check: 🔨 Test UI (EE) / MongoDB 8.0 coverage (2/5)
  • GitHub Check: 🔨 Test UI (EE) / MongoDB 8.0 coverage (5/5)
🧰 Additional context used
📓 Path-based instructions (1)
**/*.{ts,tsx,js}

📄 CodeRabbit inference engine (.cursor/rules/playwright.mdc)

**/*.{ts,tsx,js}: Write concise, technical TypeScript/JavaScript with accurate typing in Playwright tests
Avoid code comments in the implementation

Files:

  • apps/meteor/tests/end-to-end/api/cors.ts
  • apps/meteor/tests/end-to-end/api/oauthapps.ts
  • apps/meteor/tests/end-to-end/api/banners.ts
  • apps/meteor/tests/end-to-end/api/licenses.ts
  • apps/meteor/tests/end-to-end/api/custom-user-status.ts
  • apps/meteor/tests/end-to-end/api/invites.ts
  • apps/meteor/tests/end-to-end/api/webdav.ts
  • apps/meteor/tests/end-to-end/api/statistics.ts
  • apps/meteor/tests/end-to-end/api/assets2.ts
  • apps/meteor/tests/end-to-end/api/permissions.ts
  • apps/meteor/tests/end-to-end/api/custom-sounds.ts
  • apps/meteor/tests/end-to-end/api/commands.ts
  • apps/meteor/tests/end-to-end/api/subscriptions.ts
  • apps/meteor/tests/end-to-end/api/settings.ts
  • apps/meteor/tests/end-to-end/api/groups.ts
  • apps/meteor/tests/end-to-end/api/direct-message.ts
  • apps/meteor/tests/end-to-end/api/teams.ts
  • apps/meteor/tests/end-to-end/api/emoji-custom.ts
  • apps/meteor/tests/end-to-end/api/miscellaneous.ts
  • apps/meteor/tests/end-to-end/api/incoming-integrations.ts
  • apps/meteor/tests/end-to-end/api/autotranslate.ts
  • apps/meteor/tests/end-to-end/api/channels.ts
  • apps/meteor/tests/end-to-end/api/methods.ts
  • apps/meteor/tests/end-to-end/api/rooms.ts
  • apps/meteor/tests/end-to-end/api/chat.ts
  • apps/meteor/tests/end-to-end/api/users.ts
🧠 Learnings (3)
📚 Learning: 2026-02-26T19:25:44.063Z
Learnt from: gabriellsh
Repo: RocketChat/Rocket.Chat PR: 38778
File: packages/ui-voip/src/providers/useMediaSession.ts:192-192
Timestamp: 2026-02-26T19:25:44.063Z
Learning: In the Rocket.Chat repository, do not reference Biome lint rules in code review feedback. Biome is not used even if biome.json exists; only reference Biome rules if there is explicit, project-wide usage documented. For TypeScript files, review lint implications without Biome guidance unless the project enables Biome rules.

Applied to files:

  • apps/meteor/tests/end-to-end/api/cors.ts
  • apps/meteor/tests/end-to-end/api/oauthapps.ts
  • apps/meteor/tests/end-to-end/api/banners.ts
  • apps/meteor/tests/end-to-end/api/licenses.ts
  • apps/meteor/tests/end-to-end/api/custom-user-status.ts
  • apps/meteor/tests/end-to-end/api/invites.ts
  • apps/meteor/tests/end-to-end/api/webdav.ts
  • apps/meteor/tests/end-to-end/api/statistics.ts
  • apps/meteor/tests/end-to-end/api/assets2.ts
  • apps/meteor/tests/end-to-end/api/permissions.ts
  • apps/meteor/tests/end-to-end/api/custom-sounds.ts
  • apps/meteor/tests/end-to-end/api/commands.ts
  • apps/meteor/tests/end-to-end/api/subscriptions.ts
  • apps/meteor/tests/end-to-end/api/settings.ts
  • apps/meteor/tests/end-to-end/api/groups.ts
  • apps/meteor/tests/end-to-end/api/direct-message.ts
  • apps/meteor/tests/end-to-end/api/teams.ts
  • apps/meteor/tests/end-to-end/api/emoji-custom.ts
  • apps/meteor/tests/end-to-end/api/miscellaneous.ts
  • apps/meteor/tests/end-to-end/api/incoming-integrations.ts
  • apps/meteor/tests/end-to-end/api/autotranslate.ts
  • apps/meteor/tests/end-to-end/api/channels.ts
  • apps/meteor/tests/end-to-end/api/methods.ts
  • apps/meteor/tests/end-to-end/api/rooms.ts
  • apps/meteor/tests/end-to-end/api/chat.ts
  • apps/meteor/tests/end-to-end/api/users.ts
📚 Learning: 2026-02-26T19:25:44.063Z
Learnt from: gabriellsh
Repo: RocketChat/Rocket.Chat PR: 38778
File: packages/ui-voip/src/providers/useMediaSession.ts:192-192
Timestamp: 2026-02-26T19:25:44.063Z
Learning: In this repository (RocketChat/Rocket.Chat), Biome lint rules are not used even if a biome.json exists. When reviewing TypeScript files (e.g., packages/ui-voip/src/providers/useMediaSession.ts), ensure lint suggestions do not reference Biome-specific rules. Rely on general ESLint/TypeScript lint rules and project conventions instead.

Applied to files:

  • apps/meteor/tests/end-to-end/api/cors.ts
  • apps/meteor/tests/end-to-end/api/oauthapps.ts
  • apps/meteor/tests/end-to-end/api/banners.ts
  • apps/meteor/tests/end-to-end/api/licenses.ts
  • apps/meteor/tests/end-to-end/api/custom-user-status.ts
  • apps/meteor/tests/end-to-end/api/invites.ts
  • apps/meteor/tests/end-to-end/api/webdav.ts
  • apps/meteor/tests/end-to-end/api/statistics.ts
  • apps/meteor/tests/end-to-end/api/assets2.ts
  • apps/meteor/tests/end-to-end/api/permissions.ts
  • apps/meteor/tests/end-to-end/api/custom-sounds.ts
  • apps/meteor/tests/end-to-end/api/commands.ts
  • apps/meteor/tests/end-to-end/api/subscriptions.ts
  • apps/meteor/tests/end-to-end/api/settings.ts
  • apps/meteor/tests/end-to-end/api/groups.ts
  • apps/meteor/tests/end-to-end/api/direct-message.ts
  • apps/meteor/tests/end-to-end/api/teams.ts
  • apps/meteor/tests/end-to-end/api/emoji-custom.ts
  • apps/meteor/tests/end-to-end/api/miscellaneous.ts
  • apps/meteor/tests/end-to-end/api/incoming-integrations.ts
  • apps/meteor/tests/end-to-end/api/autotranslate.ts
  • apps/meteor/tests/end-to-end/api/channels.ts
  • apps/meteor/tests/end-to-end/api/methods.ts
  • apps/meteor/tests/end-to-end/api/rooms.ts
  • apps/meteor/tests/end-to-end/api/chat.ts
  • apps/meteor/tests/end-to-end/api/users.ts
📚 Learning: 2026-05-06T12:21:44.083Z
Learnt from: juliajforesti
Repo: RocketChat/Rocket.Chat PR: 40256
File: apps/meteor/client/components/CreateDiscussion/CreateDiscussion.tsx:121-149
Timestamp: 2026-05-06T12:21:44.083Z
Learning: Field wrappers in rocket.chat/fuselage-forms (Field, FieldLabel, FieldRow, FieldError, FieldHint) auto-create htmlFor/id associations, aria-describedby, and role="alert" for errors. Do not manually set htmlFor, id, aria-describedby, or role attributes when using these wrappers. This automatic wiring does not apply to plain rocket.chat/fuselage components, which require explicit ID wiring per the accessibility docs. In code reviews, prefer using fuselage-forms wrappers for form fields and verify there is no unnecessary manual ID/aria wiring in files that use these wrappers. If a component uses plain fuselage components, ensure proper id wiring as per docs.

Applied to files:

  • apps/meteor/tests/end-to-end/api/cors.ts
  • apps/meteor/tests/end-to-end/api/oauthapps.ts
  • apps/meteor/tests/end-to-end/api/banners.ts
  • apps/meteor/tests/end-to-end/api/licenses.ts
  • apps/meteor/tests/end-to-end/api/custom-user-status.ts
  • apps/meteor/tests/end-to-end/api/invites.ts
  • apps/meteor/tests/end-to-end/api/webdav.ts
  • apps/meteor/tests/end-to-end/api/statistics.ts
  • apps/meteor/tests/end-to-end/api/assets2.ts
  • apps/meteor/tests/end-to-end/api/permissions.ts
  • apps/meteor/tests/end-to-end/api/custom-sounds.ts
  • apps/meteor/tests/end-to-end/api/commands.ts
  • apps/meteor/tests/end-to-end/api/subscriptions.ts
  • apps/meteor/tests/end-to-end/api/settings.ts
  • apps/meteor/tests/end-to-end/api/groups.ts
  • apps/meteor/tests/end-to-end/api/direct-message.ts
  • apps/meteor/tests/end-to-end/api/teams.ts
  • apps/meteor/tests/end-to-end/api/emoji-custom.ts
  • apps/meteor/tests/end-to-end/api/miscellaneous.ts
  • apps/meteor/tests/end-to-end/api/incoming-integrations.ts
  • apps/meteor/tests/end-to-end/api/autotranslate.ts
  • apps/meteor/tests/end-to-end/api/channels.ts
  • apps/meteor/tests/end-to-end/api/methods.ts
  • apps/meteor/tests/end-to-end/api/rooms.ts
  • apps/meteor/tests/end-to-end/api/chat.ts
  • apps/meteor/tests/end-to-end/api/users.ts
🪛 ast-grep (0.45.0)
apps/meteor/tests/end-to-end/api/custom-sounds.ts

[error] 438-446: Avoid SQL injection
Context: request
.get(api('custom-sounds.list'))
.set(credentials)
.expect(200)
.query({
name: ${fileName}-2,
count: 5,
offset: 0,
})
Note: [CWE-89] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection').

(sql-injection-typescript)

apps/meteor/tests/end-to-end/api/emoji-custom.ts

[error] 279-284: Avoid SQL injection
Context: request
.get(api('emoji-custom.all'))
.set(credentials)
.query({
name: ${customEmojiName}-without-aliases,
})
Note: [CWE-89] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection').

(sql-injection-typescript)

apps/meteor/tests/end-to-end/api/miscellaneous.ts

[error] 435-439: Avoid SQL injection
Context: request
.get(api('spotlight'))
.query({
query: @${adminUsername},
})
Note: [CWE-89] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection').

(sql-injection-typescript)


[error] 453-457: Avoid SQL injection
Context: request
.get(api('spotlight'))
.query({
query: #${testChannel.name},
})
Note: [CWE-89] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection').

(sql-injection-typescript)


[error] 470-474: Avoid SQL injection
Context: request
.get(api('spotlight'))
.query({
query: ${testTeam.name},
})
Note: [CWE-89] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection').

(sql-injection-typescript)


[error] 488-492: Avoid SQL injection
Context: request
.get(api('spotlight'))
.query({
query: #${fnameSpecialCharsRoom},
})
Note: [CWE-89] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection').

(sql-injection-typescript)


[error] 505-510: Avoid SQL injection
Context: request
.get(api('spotlight'))
.query({
query: ${adminUsername},
type: JSON.stringify({ users: false, rooms: true }),
})
Note: [CWE-89] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection').

(sql-injection-typescript)


[error] 537-541: Avoid SQL injection
Context: request
.get(api('spotlight'))
.query({
query: #${testChannel.name},
})
Note: [CWE-89] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection').

(sql-injection-typescript)

apps/meteor/tests/end-to-end/api/users.ts

[error] 4077-4082: Avoid SQL injection
Context: request
.get(api('users.checkUsernameAvailability'))
.set(userCredentials)
.query({
username: ${targetUser.username}-${+new Date()},
})
Note: [CWE-89] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection').

(sql-injection-typescript)

🔇 Additional comments (27)
apps/meteor/tests/end-to-end/api/channels.ts (1)

87-192: LGTM!

Also applies to: 237-314, 419-431, 519-531, 557-597, 798-843, 853-933, 942-949, 1412-1438, 1448-1489, 1513-1670, 1679-1682, 1807-1825, 2614-2625, 2647-2670, 2766-2776, 3210-3227, 3236-3242, 3665-3707, 3886-3897, 3938-3941, 3991-4018

apps/meteor/tests/end-to-end/api/chat.ts (1)

61-112: LGTM!

Also applies to: 439-594, 625-670, 736-888, 905-918, 1075-1112, 1215-1229, 1626-1745, 2115-2147, 2407-2448, 2728-2791, 2860-2967, 3040-3181, 3191-3396, 3513-3675, 3710-3801, 3819-3876, 3901-3952, 4162-4364, 4398-4506, 4543-4604, 4733-4842, 4876-5049

apps/meteor/tests/end-to-end/api/direct-message.ts (1)

119-235: LGTM!

Also applies to: 340-355, 409-467, 490-507, 668-679, 973-983, 1037-1050, 1066-1130, 1168-1214, 1249-1277, 1316-1353, 1369-1392

apps/meteor/tests/end-to-end/api/groups.ts (1)

779-870: LGTM!

Also applies to: 1054-1173, 1278-1347, 1478-1484, 1605-1637, 1904-1961, 2176-2187, 2209-2220, 2488-2513, 2556-2568, 2605-2655, 2685-2712, 2719-2722, 2772-2786

apps/meteor/tests/end-to-end/api/rooms.ts (1)

47-66: LGTM!

Also applies to: 78-95, 425-458, 891-952, 966-1008, 1040-1052, 1247-1288, 1344-1406, 1651-1713, 1829-1952, 1956-2001, 2028-2032, 2048-2059, 2095-2153, 2162-2195, 2213-2312, 2351-2374, 2416-2552, 2827-2863, 2927-2949

apps/meteor/tests/end-to-end/api/subscriptions.ts (1)

23-77: LGTM!

Also applies to: 149-255, 369-429

apps/meteor/tests/end-to-end/api/teams.ts (1)

70-84: LGTM!

Also applies to: 172-185, 690-715, 778-797, 1721-1801, 1920-2031, 2381-2415, 2763-2797, 2981-2993, 3004-3016

apps/meteor/tests/end-to-end/api/incoming-integrations.ts (1)

65-104: LGTM!

Also applies to: 182-201, 233-286, 636-647, 679-691, 709-719, 758-774, 790-811, 820-830, 849-859, 883-906, 933-945, 1023-1050, 1059-1071, 1080-1091, 1104-1115

apps/meteor/tests/end-to-end/api/webdav.ts (1)

10-36: LGTM!

apps/meteor/tests/end-to-end/api/commands.ts (1)

18-51: LGTM!

Also applies to: 55-79, 104-209, 497-506, 532-541, 569-578

apps/meteor/tests/end-to-end/api/methods.ts (1)

89-128: LGTM!

Also applies to: 543-629, 862-998, 1068-1181, 1238-1301, 1303-1343, 1345-1413, 1483-1607, 1609-1653, 1716-1740, 1871-2007, 2417-2462, 3039-3055, 3075-3080

apps/meteor/tests/end-to-end/api/miscellaneous.ts (2)

24-122: LGTM!

Also applies to: 226-399, 429-548, 623-661


577-614: 🎯 Functional Correctness

No change needed.

apps/meteor/tests/end-to-end/api/oauthapps.ts (1)

25-41: LGTM!

apps/meteor/tests/end-to-end/api/permissions.ts (1)

18-47: LGTM!

Also applies to: 65-135

apps/meteor/tests/end-to-end/api/banners.ts (1)

10-51: LGTM!

apps/meteor/tests/end-to-end/api/cors.ts (1)

26-31: LGTM!

apps/meteor/tests/end-to-end/api/custom-sounds.ts (1)

419-453: LGTM!

Also applies to: 530-564

apps/meteor/tests/end-to-end/api/custom-user-status.ts (1)

47-98: LGTM!

apps/meteor/tests/end-to-end/api/settings.ts (1)

13-83: LGTM!

Also applies to: 311-315, 368-379

apps/meteor/tests/end-to-end/api/statistics.ts (1)

14-42: LGTM!

Also applies to: 46-84

apps/meteor/tests/end-to-end/api/invites.ts (1)

17-165: LGTM!

Also applies to: 227-258

apps/meteor/tests/end-to-end/api/licenses.ts (1)

25-64: LGTM!

Also applies to: 68-97

apps/meteor/tests/end-to-end/api/users.ts (1)

310-328: LGTM!

Also applies to: 858-938, 1320-1445, 1477-1491, 1652-1663, 1714-1742, 1946-1953, 2164-2246, 2268-2342, 2357-2374, 2382-2392, 2421-2533, 2572-2621, 2643-2840, 2906-2941, 3217-3367, 3924-3971, 4027-4099, 4127-4137, 4409-4655, 4698-4771, 4983-5043, 5083-5119, 5290-5340, 5360-5410, 5426-5443, 5465-5546, 5584-5593, 5820-5836, 5874-5893

apps/meteor/tests/end-to-end/api/assets2.ts (1)

16-39: LGTM!

Also applies to: 43-67

apps/meteor/tests/end-to-end/api/autotranslate.ts (1)

35-64: LGTM!

Also applies to: 108-183, 192-238, 257-269, 292-343, 388-398, 445-483

apps/meteor/tests/end-to-end/api/emoji-custom.ts (1)

23-203: LGTM!

Also applies to: 207-348, 375-409

Comment thread apps/meteor/tests/end-to-end/api/channels.ts
Comment thread apps/meteor/tests/end-to-end/api/direct-message.ts
Comment thread apps/meteor/tests/end-to-end/api/users.ts
@ricardogarim ricardogarim added this to the 8.8.0 milestone Aug 3, 2026
@ricardogarim
ricardogarim marked this pull request as ready for review August 3, 2026 12:50
@ricardogarim
ricardogarim requested a review from a team as a code owner August 3, 2026 12:50

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

1 issue found across 26 files

Not reviewed (too large): apps/meteor/tests/end-to-end/api/users.ts (~2,334 lines), apps/meteor/tests/end-to-end/api/chat.ts (~2,158 lines) - if these are generated or fixture files, add them to ignored paths to exclude them from future reviews.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/meteor/tests/end-to-end/api/custom-user-status.ts">

<violation number="1" location="apps/meteor/tests/end-to-end/api/custom-user-status.ts:79">
P3: This test is named "should return empty array ... with an existing name param" but asserts `statuses` has `lengthOf(1)` and `total` equal to 1 for an existing name. The name is a copy-paste leftover from the "unknown name" case and directly contradicts the PR's goal of clearer validations — a reader scanning test names would misread what this case covers. Rename it to something like "should return one custom user status when requested with an existing name param".</violation>
</file>

Reply with feedback, questions, or to request a fix.

Re-trigger cubic

Comment thread apps/meteor/tests/end-to-end/api/custom-user-status.ts
Comment thread apps/meteor/tests/end-to-end/api/teams.ts
@ricardogarim ricardogarim added the stat: QA assured Means it has been tested and approved by a company insider label Aug 3, 2026
@dionisio-bot dionisio-bot Bot added the stat: ready to merge PR tested and approved waiting for merge label Aug 3, 2026
@dionisio-bot
dionisio-bot Bot added this pull request to the merge queue Aug 3, 2026
Merged via the queue into develop with commit 6ce2488 Aug 3, 2026
56 checks passed
@dionisio-bot
dionisio-bot Bot deleted the chore/api-tests-async-await branch August 3, 2026 17:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

stat: QA assured Means it has been tested and approved by a company insider stat: ready to merge PR tested and approved waiting for merge type: chore

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants