test(api): 32 edge-case tests + fix(notifications): add test/verify endpoint for notification channels

[farrasrayhand]

Summary

Follow-up to PR #193 (merged). Adds edge-case tests to help stabilize the codebase.

Refs #216, Refs #148

Tests Added (27 tests)

1. compose-parser.test.ts — 5 tests

• ${VAR:?error} / ${VAR?error} operators: unset, empty, happy path

2. terminal-helpers.test.ts — 12 tests (new file)

• safeWsSend, safeWsClose, safeShellWrite, safeShellClose

3. ssrf-guard.test.ts — 10 tests (new file)

• Covers existing ssrf-guard.ts: isPrivateIp, isBlockedHostname, assertPublicHostLiteral, assertPublicUrlLiteral
• Aligns with the existing SSRF guard used across the codebase

Refactor

• Replaced custom assertPublicWebhookUrl in notification-workers with the codebase-standard assertPublicUrlLiteral from ssrf-guard.ts

Running

cd apps/api && npx vitest run test/lib/compose-parser.test.ts test/lib/terminal-helpers.test.ts test/lib/ssrf-guard.test.ts

[Hydralerne]

i have pr that needs to refactor these test cases, please refactor the tests to match the new webhook design

[farrasrayhand]

i have pr that needs to refactor these test cases, please refactor the tests to match the new webhook design

Done! Refactored to use the existing ssrf-guard infrastructure:

• Removed custom webhook-url.ts + webhook-url.test.ts
• Replaced with ssrf-guard.ts that safeFetch already uses internally for SSRF
• Removed the redundant pre-check call in sendWebhook — safeFetch already validates via assertPublicUrl/assertPublicHost
• Added ssrf-guard.test.ts with 10 tests covering isPrivateIp, isBlockedHostname, assertPublicHostLiteral, assertPublicUrlLiteral

Let me know if you need any adjustments!

[Hydralerne]

is this safe to merge after all updates now ?

[farrasrayhand]

is this safe to merge after all updates now ?

I'll review this as soon as possible and let you know.

[farrasrayhand]

@Hydralerne Yes, it's safe to merge now