Harden bot, storage and web API

test/musicQueue.test.js

@@ -0,0 +1,52 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+Object.assign(process.env, {
+  NODE_ENV: "test",
+  DISCORD_GUILD_ID: "1",
+  SHINUWA_USER_ID: "1",
+  WEB_SERVER_PORT: "3000",
+  WEB_API_KEY: "test-key",
+  DISCORD_APPLICATION_ID: "1",
+  DISCORD_TOKEN: "test-token",
+  VOICE_CHANNEL_ID: "1",
+  TEXT_CHANNEL_ID: "1",
+  GAME_SERVERS_MESSAGE_ID: "1",
+});
+
+const { MusicQueue } = await import("../src/music/queue.js");
+
+test("playNext shares one in-flight operation", async () => {
+  const queue = Object.create(MusicQueue.prototype);
+  queue.playNextPromise = null;
+  let calls = 0;
+  let resolveOperation;
+  queue.runPlayNext = () => {
+    calls += 1;
+    return new Promise((resolve) => {
+      resolveOperation = resolve;
+    });
+  };
+
+  const first = queue.playNext();
+  const second = queue.playNext();
+  assert.equal(first, second);
+  assert.equal(calls, 1);
+
+  resolveOperation();
+  await first;
+  assert.equal(queue.playNextPromise, null);
+});
+
+test("queue snapshots do not expose filesystem paths", () => {
+  const queue = Object.create(MusicQueue.prototype);
+  queue.currentTrack = { id: "current", path: "/private/current.mp3" };
+  queue.queue = [{ id: "next", path: "/private/next.mp3" }];
+  queue.playbackStatus = "playing";
+
+  assert.deepEqual(queue.snapshot(), {
+    current: { id: "current" },
+    upcoming: [{ id: "next" }],
+    status: "playing",
+  });
+});