Harden bot, storage and web API

test/serializers.test.js

@@ -0,0 +1,21 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { serializeTrack, serializeTracks } from "../src/web/serializers.js";
+
+test("serializeTrack removes internal filesystem fields", () => {
+  const result = serializeTrack({
+    id: "track-1",
+    title: "Test",
+    path: "/private/storage/test.mp3",
+    storedName: "test.mp3",
+  });
+
+  assert.deepEqual(result, { id: "track-1", title: "Test" });
+});
+
+test("serializeTracks handles an array and null tracks", () => {
+  assert.deepEqual(serializeTracks([{ id: "1", path: "/tmp/1" }]), [
+    { id: "1" },
+  ]);
+  assert.equal(serializeTrack(null), null);
+});