✔ health checks seeded database and sample mode (47.069023ms)
✔ sample station contract preserves null diesel and known geography (2.829032ms)
✔ accepted report persists and appears on independent client reads (4.855548ms)
✔ retry with request ID is idempotent; changed payload conflicts (5.569234ms)
✔ concurrent identical retries return the same persisted report (4.074112ms)
✔ an earlier observed report cannot overwrite a newer price (2.744842ms)
✔ validates report station_id=parkside' OR 1=1 (1.582333ms)
✔ validates report fuel_type=water (1.363681ms)
✔ validates report price_milli=499 (1.28067ms)
✔ validates report price_milli=4000 (1.426332ms)
✔ validates report price_milli=12.3 (1.458702ms)
✔ validates report price_milli=1429 (1.445122ms)
✔ validates report client_id= (1.23021ms)
✔ validates report unexpected=value (1.042358ms)
✔ unknown station does not create a report (1.32423ms)
✔ body size is bounded even without content-length (1.900375ms)
✔ per-install SQL limit prevents further price mutations (15.601983ms)
✔ edge rate limit rejects reports (1.213079ms)
✔ CORS preflight permits native/browser report contract (1.2865ms)
✔ HEAD has no body; assets bypass database (2.761282ms)
✔ query filters reject unknown and duplicated parameters (5.031119ms)
✔ serves static assets without contacting DB (32.675329ms)
✔ health requires no database (1.19086ms)
✔ rejects public POST (0.659485ms)
✔ rejects public PUT (0.336752ms)
✔ rejects public DELETE (0.572065ms)
✔ rejects public PATCH (0.532574ms)
✔ rejects ?region=bad%27sql (0.685555ms)
✔ rejects ?fuel=gasoline (0.403083ms)
✔ rejects ?latitude=45 (0.407713ms)
✔ rejects ?region=a&region=b (1.728884ms)
✔ rejects ?limit=201 (0.532954ms)
✔ rejects ?limit=-1 (0.292653ms)
✔ rejects ?cursor=1.2 (0.185541ms)
✔ rejects ?payment=free (0.218761ms)
✔ rejects missing/privileged/placeholder key  (0.408164ms)
✔ rejects missing/privileged/placeholder key sb_secret_do (0.227162ms)
✔ rejects missing/privileged/placeholder key eyJhbGciOiJh (0.193522ms)
✔ rejects missing/privileged/placeholder key sb_publishab (0.435453ms)
✔ fixed RPC and no client credentials forwarded (1.2912ms)
✔ non-public upstream fields stripped (0.702446ms)
✔ private response bodies never reflected (0.621045ms)
✔ network failure is bounded generic failure (0.384123ms)
✔ invalid returned price rejected (0.528194ms)
✔ oversized responses rejected (3.82243ms)
✔ invalid upstream domain fails closed (0.370573ms)
✔ regions allowlist (1.383281ms)
✔ unknown API path is JSON 404 not HTML SPA (0.225412ms)
✔ preflight never contacts upstream (0.298823ms)
✔ HEAD has no body (0.558194ms)
✔ loopback local anonymous key works only in development (1.3339ms)
✔ loopback dev key rejected in staging (0.423853ms)
✔ loopback dev key rejected in production (0.274272ms)
✔ local service role key is rejected too (0.320822ms)
✔ local auth key cannot be redirected to a different host (0.249862ms)
✔ local modern publishable key is accepted without an admin key (0.639385ms)
ℹ tests 56
ℹ suites 0
ℹ pass 56
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 210.222624
