From 58ed2b64ea311e1fb65c7eb596df640c99a8c769 Mon Sep 17 00:00:00 2001 From: Nicky Leach Date: Sat, 5 Sep 2026 08:41:37 -0700 Subject: [PATCH] test(server): remove a concurrent-import race in the approval routes suite (#12876) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work > - Approval routes use server tests to protect access and idempotency behavior > - The approval routes test suite loaded mocked modules at the same time > - Concurrent module loading could lose a service mock and produce a false test failure > - This pull request loads the shared module graph once and reuses it across the suite > - The benefit is stable approval route tests with unchanged coverage ## Linked Issues or Issue Description **What happened?** The approval routes test suite loaded two mocked modules in one concurrent import. A module interleaving could remove the approval service mock. The route then returned HTTP 404 instead of the expected HTTP 403. **Expected behavior** The suite must keep the approval service mock when it loads the route modules. The access test must return HTTP 403 on every run. **Steps to reproduce** 1. Run `npx vitest run server/src/__tests__/approval-routes-idempotency.test.ts`. 2. Repeat the test command while the test runner loads the module graph. 3. Observe a false HTTP 404 result when the module mock interleaves. **Paperclip version or commit** Current `master` at the base commit of this pull request. **Deployment mode** Built from source with the server test runner. ## What Changed - Reused the existing `hoistModuleGraph` helper for the approval route modules. - Loaded the route modules once in sequence instead of in one concurrent import. - Kept per-test mock behavior, Express app setup, database doubles, test names, and assertions unchanged. ## Verification - `npx vitest run server/src/__tests__/approval-routes-idempotency.test.ts` — 11 of 11 tests passed. - Ten repeat runs passed. - `npx tsc --noEmit -p server` produced no new errors against the base branch. - All Paperclip CI checks passed. - Greptile reported 5/5 with no open findings. ## Risks This change affects test module setup only. It does not change production code or test coverage. Risk is low. ## Model Used OpenAI Codex with the `gpt-5` model family. The serving snapshot and context-window size are not exposed. The agent used reasoning, repository tools, code execution, and test execution. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and found no duplicate for this test race - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes: #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge Co-authored-by: Paperclip --- .../approval-routes-idempotency.test.ts | 23 ++++++++----------- 1 file changed, 9 insertions(+), 14 deletions(-) diff --git a/server/src/__tests__/approval-routes-idempotency.test.ts b/server/src/__tests__/approval-routes-idempotency.test.ts index 676ae4ebbd..3937b0499a 100644 --- a/server/src/__tests__/approval-routes-idempotency.test.ts +++ b/server/src/__tests__/approval-routes-idempotency.test.ts @@ -1,6 +1,7 @@ import express from "express"; import request from "supertest"; import { beforeEach, describe, expect, it, vi } from "vitest"; +import { hoistModuleGraph } from "./helpers/hoist-module-graph.js"; const mockApprovalService = vi.hoisted(() => ({ list: vi.fn(), @@ -43,11 +44,14 @@ function registerModuleMocks() { })); } +const routeModules = hoistModuleGraph(registerModuleMocks, async () => { + const { errorHandler } = await import("../middleware/index.js"); + const { approvalRoutes } = await import("../routes/approvals.js"); + return { errorHandler, approvalRoutes }; +}); + async function createApp(actorOverrides: Record = {}) { - const [{ errorHandler }, { approvalRoutes }] = await Promise.all([ - import("../middleware/index.js"), - import("../routes/approvals.js"), - ]); + const { errorHandler, approvalRoutes } = routeModules.value; const app = express(); app.use(express.json()); app.use((req, _res, next) => { @@ -87,10 +91,7 @@ function createRouteDb(contextSnapshot: Record = {}, runId = "r } async function createAgentApp(options: { runId?: string; contextSnapshot?: Record } = {}) { - const [{ errorHandler }, { approvalRoutes }] = await Promise.all([ - import("../middleware/index.js"), - import("../routes/approvals.js"), - ]); + const { errorHandler, approvalRoutes } = routeModules.value; const app = express(); app.use(express.json()); app.use((req, _res, next) => { @@ -111,12 +112,6 @@ async function createAgentApp(options: { runId?: string; contextSnapshot?: Recor describe("approval routes idempotent retries", () => { beforeEach(() => { - vi.resetModules(); - vi.doUnmock("../services/index.js"); - vi.doUnmock("../routes/approvals.js"); - vi.doUnmock("../routes/authz.js"); - vi.doUnmock("../middleware/index.js"); - registerModuleMocks(); vi.clearAllMocks(); mockApprovalService.list.mockReset(); mockApprovalService.getById.mockReset();