fix(test): match getSession URL by suffix, not /getSession path

The PDS endpoint URL is /xrpc/com.atproto.server.getSession —
those are dots before getSession, not slashes, so the previous
includes("/getSession") filter never matched and the Authorization
header assertion silently short-circuited via optional chaining.

.gitea/workflows/ci.yml

@@ -14,6 +14,8 @@ jobs:
       - uses: denoland/setup-deno@v2
         with:
           deno-version: v2.x
+          cache: true
+          cache-hash: ${{ hashFiles('deno.lock') }}
 
       - name: Format check
         run: deno fmt --check
@@ -22,7 +24,7 @@ jobs:
         run: deno lint
 
       - name: Type check
-        run: deno check jetstream.ts server.ts scripts/*.ts src/migrations/init.ts
+        run: deno check jetstream.ts server.ts scripts/*.ts src/migrations/init.ts tests/
 
       - name: Test
-        run: deno test --allow-all --permit-no-files
+        run: deno test --allow-all tests/

deno.json

@@ -20,6 +20,7 @@
     "@oak/oak": "jsr:@oak/oak@^17.2.0",
     "@opensearch-project/opensearch": "npm:@opensearch-project/opensearch@^3.6.0",
     "@skyware/jetstream": "npm:@skyware/jetstream@^0.2.5",
-    "@std/assert": "jsr:@std/assert@1"
+    "@std/assert": "jsr:@std/assert@1",
+    "@std/testing": "jsr:@std/testing@1"
   }
 }

deno.lock

@@ -7,8 +7,10 @@
     "jsr:@oak/commons@1": "1.0.0",
     "jsr:@oak/oak@^17.2.0": "17.2.0",
     "jsr:@std/assert@1": "1.0.18",
+    "jsr:@std/async@^1.4.0": "1.4.0",
     "jsr:@std/bytes@1": "1.0.4",
     "jsr:@std/crypto@1": "1.0.3",
+    "jsr:@std/data-structures@^1.1.0": "1.1.0",
     "jsr:@std/encoding@1": "1.0.6",
     "jsr:@std/encoding@^1.0.5": "1.0.6",
     "jsr:@std/fmt@1": "1.0.9",
@@ -20,6 +22,7 @@
     "jsr:@std/path@1": "1.1.4",
     "jsr:@std/path@1.0": "1.0.9",
     "jsr:@std/path@^1.1.1": "1.1.4",
+    "jsr:@std/testing@1": "1.0.19",
     "npm:@opensearch-project/opensearch@3": "3.6.0",
     "npm:@opensearch-project/opensearch@^3.6.0": "3.6.0",
     "npm:@skyware/jetstream@~0.2.5": "0.2.5",
@@ -71,12 +74,18 @@
         "jsr:@std/internal@^1.0.12"
       ]
     },
+    "@std/async@1.4.0": {
+      "integrity": "4d70b008634f571cff9b554090d628c76141c32613aae0ff283fd5fa23d0c379"
+    },
     "@std/bytes@1.0.4": {
       "integrity": "11a0debe522707c95c7b7ef89b478c13fb1583a7cfb9a85674cd2cc2e3a28abc"
     },
     "@std/crypto@1.0.3": {
       "integrity": "a2a32f51ddef632d299e3879cd027c630dcd4d1d9a5285d6e6788072f4e51e7f"
     },
+    "@std/data-structures@1.1.0": {
+      "integrity": "c35ae4ad5d8e41a38573c2fe3e19b18ea2505f63cfea201edcb8720aca1f7f58"
+    },
     "@std/encoding@1.0.6": {
       "integrity": "ca87122c196e8831737d9547acf001766618e78cd8c33920776c7f5885546069"
     },
@@ -110,6 +119,13 @@
       "dependencies": [
         "jsr:@std/internal@^1.0.12"
       ]
+    },
+    "@std/testing@1.0.19": {
+      "integrity": "f4236172365b216728dc3cc8b5e80a9f4c33083d1e4ede7613d5b25b4014898e",
+      "dependencies": [
+        "jsr:@std/async",
+        "jsr:@std/data-structures"
+      ]
     }
   },
   "npm": {
@@ -231,6 +247,7 @@
       "jsr:@db/sqlite@0.13",
       "jsr:@oak/oak@^17.2.0",
       "jsr:@std/assert@1",
+      "jsr:@std/testing@1",
       "npm:@opensearch-project/opensearch@^3.6.0",
       "npm:@skyware/jetstream@~0.2.5"
     ]

src/search/opensearch.ts

@@ -1,21 +1,19 @@
 import type { API } from "@opensearch-project/opensearch";
 import { log } from "../log.ts";
 
-const OPENSEARCH_URL = Deno.env.get("OPENSEARCH_URL");
-const OPENSEARCH_USERNAME = Deno.env.get("OPENSEARCH_USERNAME");
-const OPENSEARCH_PASSWORD = Deno.env.get("OPENSEARCH_PASSWORD");
-const OPENSEARCH_INDEX = Deno.env.get("OPENSEARCH_INDEX") ?? "notes";
-
 const MAX_LIMIT = 100;
 
-const enabled = (): boolean => {
-  if (!OPENSEARCH_URL) return false;
-  return true;
-};
+const openSearchUrl = (): string | undefined => Deno.env.get("OPENSEARCH_URL");
+const openSearchIndex = (): string =>
+  Deno.env.get("OPENSEARCH_INDEX") ?? "notes";
+
+const enabled = (): boolean => Boolean(openSearchUrl());
 
 const authHeaders = (): Record<string, string> => {
-  if (OPENSEARCH_USERNAME && OPENSEARCH_PASSWORD) {
-    const creds = btoa(`${OPENSEARCH_USERNAME}:${OPENSEARCH_PASSWORD}`);
+  const username = Deno.env.get("OPENSEARCH_USERNAME");
+  const password = Deno.env.get("OPENSEARCH_PASSWORD");
+  if (username && password) {
+    const creds = btoa(`${username}:${password}`);
     return { Authorization: `Basic ${creds}` };
   }
   return {};
@@ -29,7 +27,7 @@ const request = async (
   path: string,
   body?: unknown,
 ): Promise<Response> => {
-  const url = `${OPENSEARCH_URL}${path}`;
+  const url = `${openSearchUrl()}${path}`;
   const headers: Record<string, string> = { ...authHeaders() };
   if (body !== undefined) headers["Content-Type"] = "application/json";
   return await fetch(url, {
@@ -59,11 +57,12 @@ const indexMappings = {
 
 export const ensureIndex = async (): Promise<void> => {
   if (!enabled()) return;
-  const head = await request("HEAD", `/${OPENSEARCH_INDEX}`);
+  const index = openSearchIndex();
+  const head = await request("HEAD", `/${index}`);
   if (head.status === 200) return;
-  const res = await request("PUT", `/${OPENSEARCH_INDEX}`, indexMappings);
+  const res = await request("PUT", `/${index}`, indexMappings);
   if (res.ok) {
-    log(`[opensearch] created index ${OPENSEARCH_INDEX}`);
+    log(`[opensearch] created index ${index}`);
     return;
   }
   const text = await res.text();
@@ -96,7 +95,7 @@ export const indexNote = async (note: IndexedNote): Promise<void> => {
   };
   const res = await request(
     "PUT",
-    `/${OPENSEARCH_INDEX}/_doc/${docId(note.did, note.rkey)}`,
+    `/${openSearchIndex()}/_doc/${docId(note.did, note.rkey)}`,
     doc,
   );
   if (!res.ok) {
@@ -114,7 +113,7 @@ export const removeNote = async (
   if (!enabled()) return;
   const res = await request(
     "DELETE",
-    `/${OPENSEARCH_INDEX}/_doc/${docId(did, rkey)}`,
+    `/${openSearchIndex()}/_doc/${docId(did, rkey)}`,
   );
   if (!res.ok && res.status !== 404) {
     const text = await res.text();
@@ -219,7 +218,7 @@ export const searchNotes = async (
     ...(searchAfter ? { search_after: searchAfter } : {}),
   };
 
-  const res = await request("POST", `/${OPENSEARCH_INDEX}/_search`, body);
+  const res = await request("POST", `/${openSearchIndex()}/_search`, body);
   if (!res.ok) {
     const text = await res.text();
     throw new Error(`Search failed: ${res.status} ${text}`);

tests/_helpers/app.ts

@@ -0,0 +1,49 @@
+import type { Application } from "@oak/oak";
+
+export type RequestOptions = {
+  method?: string;
+  path: string;
+  headers?: HeadersInit;
+  body?: unknown;
+};
+
+export type TestResponse = {
+  status: number;
+  headers: Headers;
+  text: string;
+  json: () => unknown;
+};
+
+export const requestApp = async (
+  app: Application,
+  opts: RequestOptions,
+): Promise<TestResponse> => {
+  const method = opts.method ?? "GET";
+  const url = `http://test.local${opts.path}`;
+  const init: RequestInit = {
+    method,
+    headers: opts.headers,
+  };
+  if (opts.body !== undefined && method !== "GET" && method !== "HEAD") {
+    init.body = typeof opts.body === "string"
+      ? opts.body
+      : JSON.stringify(opts.body);
+    const headers = new Headers(opts.headers);
+    if (!headers.has("Content-Type")) {
+      headers.set("Content-Type", "application/json");
+    }
+    init.headers = headers;
+  }
+  const req = new Request(url, init);
+  const res = await app.handle(req);
+  if (!res) {
+    throw new Error("app.handle returned undefined");
+  }
+  const text = await res.text();
+  return {
+    status: res.status,
+    headers: res.headers,
+    text,
+    json: () => JSON.parse(text),
+  };
+};

tests/_helpers/auth.ts

@@ -0,0 +1,18 @@
+import {
+  _resetAuthenticatorForTest,
+  _setAuthenticatorForTest,
+} from "../../server.ts";
+
+export type AuthStub = { restore: () => void };
+
+export const stubAuthenticate = (didOrError: string | Error): AuthStub => {
+  _setAuthenticatorForTest(() => {
+    if (didOrError instanceof Error) {
+      return Promise.reject(didOrError);
+    }
+    return Promise.resolve(didOrError);
+  });
+  return {
+    restore: () => _resetAuthenticatorForTest(),
+  };
+};

tests/_helpers/db.ts

@@ -0,0 +1,60 @@
+import { Database } from "@db/sqlite";
+import {
+  _resetDbForTest,
+  _setDbForTest,
+  addWebhookSubscription,
+  upsertNote,
+  type WebhookVerb,
+} from "../../src/data/db.ts";
+import { applyMigrations } from "../../src/migrations/apply.ts";
+import type { Note } from "../../src/data/note.ts";
+
+export const withTestDb = (
+  fn: (db: Database) => Promise<void> | void,
+): () => Promise<void> => {
+  return async () => {
+    const db = new Database(":memory:");
+    applyMigrations(db);
+    _setDbForTest(db);
+    try {
+      await fn(db);
+    } finally {
+      _resetDbForTest();
+      db.close();
+    }
+  };
+};
+
+let seedCounter = 0;
+
+export const seedNote = (overrides: Partial<Note> = {}): Note => {
+  seedCounter++;
+  const note: Note = {
+    did: overrides.did ?? "did:plc:test",
+    rkey: overrides.rkey ?? `seed${seedCounter.toString().padStart(6, "0")}`,
+    title: overrides.title ?? "Test title",
+    publishedAt: overrides.publishedAt ?? "2026-01-01T00:00:00.000Z",
+    createdAt: overrides.createdAt ?? "2026-01-01T00:00:00.000Z",
+    discoverable: overrides.discoverable,
+    language: overrides.language,
+    content: overrides.content,
+  };
+  upsertNote(note);
+  return note;
+};
+
+export const seedWebhook = (overrides: {
+  did?: string;
+  method?: string;
+  url?: string;
+  token?: string;
+  verb?: WebhookVerb;
+} = {}) => {
+  return addWebhookSubscription({
+    did: overrides.did ?? "did:plc:test",
+    method: overrides.method ?? "POST",
+    url: overrides.url ?? "https://example.com/hook",
+    token: overrides.token,
+    verb: overrides.verb ?? "create",
+  });
+};

tests/_helpers/fetch_stub.ts

@@ -0,0 +1,57 @@
+export type FetchHandler = (
+  req: Request,
+) => Response | Promise<Response>;
+
+export type CapturedRequest = {
+  method: string;
+  url: string;
+  headers: Headers;
+  body: string;
+};
+
+export type FetchStub = {
+  calls: CapturedRequest[];
+  restore: () => void;
+};
+
+export const installFetchStub = (handler: FetchHandler): FetchStub => {
+  const original = globalThis.fetch;
+  const calls: CapturedRequest[] = [];
+  let restored = false;
+
+  globalThis.fetch = async (input, init) => {
+    const req = new Request(input as RequestInfo, init);
+    const body = req.method === "GET" || req.method === "HEAD"
+      ? ""
+      : await req.clone().text();
+    calls.push({
+      method: req.method,
+      url: req.url,
+      headers: new Headers(req.headers),
+      body,
+    });
+    return await handler(req);
+  };
+
+  return {
+    calls,
+    restore: () => {
+      if (restored) throw new Error("FetchStub.restore() called twice");
+      restored = true;
+      globalThis.fetch = original;
+    },
+  };
+};
+
+export const jsonResponse = (
+  body: unknown,
+  init: ResponseInit = {},
+): Response => {
+  return new Response(JSON.stringify(body), {
+    status: init.status ?? 200,
+    headers: { "Content-Type": "application/json", ...(init.headers ?? {}) },
+  });
+};
+
+export const errorResponse = (status: number, text = "error"): Response =>
+  new Response(text, { status });

tests/auth_verify_test.ts

@@ -0,0 +1,118 @@
+import { assertEquals, assertRejects, assertThrows } from "@std/assert";
+import { authenticateRequest, decodeJwtPayload } from "../src/auth/verify.ts";
+import { installFetchStub, jsonResponse } from "./_helpers/fetch_stub.ts";
+
+const makeJwt = (payload: Record<string, unknown>): string => {
+  const header = btoa(JSON.stringify({ alg: "HS256", typ: "JWT" }));
+  const body = btoa(JSON.stringify(payload));
+  return `${header}.${body}.sig`;
+};
+
+Deno.test("decodeJwtPayload parses sub from a 3-segment JWT", () => {
+  const token = makeJwt({ sub: "did:plc:abc", iat: 1 });
+  const payload = decodeJwtPayload(token);
+  assertEquals(payload.sub, "did:plc:abc");
+});
+
+Deno.test("decodeJwtPayload throws on malformed token", () => {
+  assertThrows(() => decodeJwtPayload("not.a.valid.jwt"));
+  assertThrows(() => decodeJwtPayload("onlytwo.parts"));
+});
+
+Deno.test("authenticateRequest rejects missing or non-Bearer Authorization", async () => {
+  await assertRejects(() => authenticateRequest(null));
+  await assertRejects(() => authenticateRequest(""));
+  await assertRejects(() => authenticateRequest("Basic abc"));
+});
+
+Deno.test(
+  "authenticateRequest resolves PDS then verifies session and returns did",
+  async () => {
+    const did = "did:plc:user";
+    const stub = installFetchStub((req) => {
+      if (req.url === `https://plc.directory/${did}`) {
+        return jsonResponse({
+          service: [{
+            id: "#atproto_pds",
+            serviceEndpoint: "https://pds.example.com",
+          }],
+        });
+      }
+      if (
+        req.url ===
+          "https://pds.example.com/xrpc/com.atproto.server.getSession"
+      ) {
+        return jsonResponse({ did });
+      }
+      return jsonResponse({ error: "unexpected" }, { status: 500 });
+    });
+
+    try {
+      const result = await authenticateRequest(
+        `Bearer ${makeJwt({ sub: did })}`,
+      );
+      assertEquals(result, did);
+      const sessionCall = stub.calls.find((c) => c.url.endsWith("getSession"));
+      assertEquals(
+        sessionCall?.headers.get("Authorization")?.startsWith("Bearer "),
+        true,
+      );
+    } finally {
+      stub.restore();
+    }
+  },
+);
+
+Deno.test(
+  "authenticateRequest throws when plc.directory or getSession is non-2xx",
+  async () => {
+    const did = "did:plc:user";
+
+    const plcFailStub = installFetchStub(() =>
+      new Response("not found", { status: 404 })
+    );
+    try {
+      await assertRejects(() =>
+        authenticateRequest(`Bearer ${makeJwt({ sub: did })}`)
+      );
+    } finally {
+      plcFailStub.restore();
+    }
+
+    const sessionFailStub = installFetchStub((req) => {
+      if (req.url.startsWith("https://plc.directory/")) {
+        return jsonResponse({
+          service: [{
+            id: "#atproto_pds",
+            serviceEndpoint: "https://pds.example.com",
+          }],
+        });
+      }
+      return new Response("nope", { status: 401 });
+    });
+    try {
+      await assertRejects(() =>
+        authenticateRequest(`Bearer ${makeJwt({ sub: did })}`)
+      );
+    } finally {
+      sessionFailStub.restore();
+    }
+  },
+);
+
+Deno.test(
+  "authenticateRequest throws when DID document has no atproto_pds service",
+  async () => {
+    const did = "did:plc:user";
+    const stub = installFetchStub(() =>
+      jsonResponse({ service: [{ id: "#other", serviceEndpoint: "x" }] })
+    );
+    try {
+      await assertRejects(() =>
+        authenticateRequest(`Bearer ${makeJwt({ sub: did })}`)
+      );
+    } finally {
+      stub.restore();
+    }
+  },
+);

tests/db_test.ts

@@ -0,0 +1,141 @@
+import { assertEquals, assertFalse } from "@std/assert";
+import {
+  addWebhookSubscription,
+  deleteWebhookById,
+  getNotes,
+  getNotesByDids,
+  getWebhooksByDidAndVerb,
+  listWebhooksByDid,
+  upsertNote,
+} from "../src/data/db.ts";
+import { seedNote, seedWebhook, withTestDb } from "./_helpers/db.ts";
+
+Deno.test(
+  "upsertNote inserts then updates on (did, rkey) conflict",
+  withTestDb(() => {
+    upsertNote({
+      did: "did:plc:user",
+      rkey: "rkey1",
+      title: "First",
+      publishedAt: "2026-01-01T00:00:00.000Z",
+      createdAt: "2026-01-01T00:00:00.000Z",
+    });
+    upsertNote({
+      did: "did:plc:user",
+      rkey: "rkey1",
+      title: "Second",
+      publishedAt: "2026-02-01T00:00:00.000Z",
+      createdAt: "2026-01-01T00:00:00.000Z",
+    });
+
+    const { notes } = getNotes(undefined, 10);
+    assertEquals(notes.length, 1);
+    assertEquals(notes[0].title, "Second");
+    assertEquals(notes[0].publishedAt, "2026-02-01T00:00:00.000Z");
+  }),
+);
+
+Deno.test(
+  "upsertNote treats undefined discoverable as 1 and false as 0",
+  withTestDb(() => {
+    upsertNote({
+      did: "did:plc:user",
+      rkey: "default",
+      title: "Default",
+      publishedAt: "2026-01-01T00:00:00.000Z",
+      createdAt: "2026-01-01T00:00:00.000Z",
+    });
+    upsertNote({
+      did: "did:plc:user",
+      rkey: "hidden",
+      title: "Hidden",
+      publishedAt: "2026-01-01T00:00:00.000Z",
+      createdAt: "2026-01-01T00:00:00.000Z",
+      discoverable: false,
+    });
+
+    const { notes } = getNotes(undefined, 10);
+    const rkeys = notes.map((n) => n.rkey);
+    assertEquals(rkeys, ["default"]);
+  }),
+);
+
+Deno.test(
+  "getNotes paginates rkey desc and returns cursor only when page is full",
+  withTestDb(() => {
+    for (const rkey of ["a", "b", "c", "d", "e"]) {
+      seedNote({ rkey });
+    }
+
+    const firstPage = getNotes(undefined, 3);
+    assertEquals(firstPage.notes.map((n) => n.rkey), ["e", "d", "c"]);
+    assertEquals(firstPage.cursor, "c");
+
+    const secondPage = getNotes(firstPage.cursor, 3);
+    assertEquals(secondPage.notes.map((n) => n.rkey), ["b", "a"]);
+    assertEquals(secondPage.cursor, undefined);
+  }),
+);
+
+Deno.test(
+  "getNotesByDids returns empty without running SQL on empty did list",
+  withTestDb(() => {
+    seedNote({ did: "did:plc:alice", rkey: "a" });
+    const result = getNotesByDids([], undefined, 10);
+    assertEquals(result, { notes: [] });
+  }),
+);
+
+Deno.test(
+  "webhook CRUD: add omits token, list orders desc, delete by id reports hit",
+  withTestDb(() => {
+    const created = addWebhookSubscription({
+      did: "did:plc:user",
+      method: "POST",
+      url: "https://example.com/a",
+      token: "secret",
+      verb: "create",
+    });
+    assertEquals(created.token, undefined);
+    assertEquals(created.url, "https://example.com/a");
+
+    seedWebhook({
+      did: "did:plc:user",
+      url: "https://example.com/b",
+      verb: "create",
+    });
+    seedWebhook({
+      did: "did:plc:user",
+      url: "https://example.com/c",
+      verb: "delete",
+    });
+
+    const list = listWebhooksByDid("did:plc:user");
+    assertEquals(list.length, 3);
+    const ids = list.map((w) => w.id);
+    assertEquals(ids, [...ids].sort((a, b) => b - a));
+
+    assertFalse(deleteWebhookById({ did: "did:plc:user", id: 9999 }));
+    const deleted = deleteWebhookById({ did: "did:plc:user", id: created.id });
+    assertEquals(deleted, true);
+    assertEquals(listWebhooksByDid("did:plc:user").length, 2);
+  }),
+);
+
+Deno.test(
+  "getWebhooksByDidAndVerb filters by verb and caps at 10",
+  withTestDb(() => {
+    for (let i = 0; i < 12; i++) {
+      seedWebhook({ url: `https://example.com/c${i}`, verb: "create" });
+    }
+    seedWebhook({ url: "https://example.com/d", verb: "delete" });
+
+    const creates = getWebhooksByDidAndVerb("did:plc:test", "create");
+    assertEquals(creates.length, 10);
+    for (const row of creates) assertEquals(row.verb, "create");
+
+    const deletes = getWebhooksByDidAndVerb("did:plc:test", "delete");
+    assertEquals(deletes.length, 1);
+    assertEquals(deletes[0].verb, "delete");
+  }),
+);

tests/jetstream_bulk_test.ts

@@ -0,0 +1,147 @@
+import { assertEquals } from "@std/assert";
+import { FakeTime } from "@std/testing/time";
+import {
+  _resetBulkBuffersForTest,
+  type BulkDeps,
+  queueBulkCreate,
+} from "../src/jetstream/bulk.ts";
+import type { WebhookTarget } from "../src/jetstream/webhooks.ts";
+import type { WebhookVerb } from "../src/data/db.ts";
+
+type DispatchCall = {
+  webhooks: WebhookTarget[];
+  payload: Record<string, unknown>;
+  label: string;
+};
+
+const flushMicrotasks = async (): Promise<void> => {
+  for (let i = 0; i < 5; i++) {
+    await Promise.resolve();
+  }
+};
+
+const makeDeps = (
+  webhooks: WebhookTarget[] = [],
+): {
+  deps: BulkDeps;
+  getSubsCalls: { did: string; verb: WebhookVerb }[];
+  dispatchCalls: DispatchCall[];
+} => {
+  const getSubsCalls: { did: string; verb: WebhookVerb }[] = [];
+  const dispatchCalls: DispatchCall[] = [];
+  const deps: BulkDeps = {
+    getSubs: (did, verb) => {
+      getSubsCalls.push({ did, verb });
+      return webhooks;
+    },
+    dispatch: (w, payload, label) => {
+      dispatchCalls.push({ webhooks: w, payload, label });
+      return Promise.resolve();
+    },
+    debounceMs: 500,
+  };
+  return { deps, getSubsCalls, dispatchCalls };
+};
+
+Deno.test("queueBulkCreate accumulates records and flushes once after debounce", async () => {
+  const time = new FakeTime();
+  try {
+    _resetBulkBuffersForTest();
+    const { deps, dispatchCalls } = makeDeps();
+
+    queueBulkCreate("did:plc:a", { rkey: "r1" }, deps);
+    queueBulkCreate("did:plc:a", { rkey: "r2" }, deps);
+    queueBulkCreate("did:plc:a", { rkey: "r3" }, deps);
+
+    assertEquals(dispatchCalls.length, 0);
+
+    await time.tickAsync(500);
+    await flushMicrotasks();
+
+    assertEquals(dispatchCalls.length, 1);
+    const payload = dispatchCalls[0].payload as {
+      records: { rkey: string }[];
+    };
+    assertEquals(payload.records.map((r) => r.rkey), ["r1", "r2", "r3"]);
+  } finally {
+    _resetBulkBuffersForTest();
+    time.restore();
+  }
+});
+
+Deno.test("queueBulkCreate restarts the timer on each push (debounce)", async () => {
+  const time = new FakeTime();
+  try {
+    _resetBulkBuffersForTest();
+    const { deps, dispatchCalls } = makeDeps();
+
+    queueBulkCreate("did:plc:a", { rkey: "r1" }, deps);
+    await time.tickAsync(400);
+    queueBulkCreate("did:plc:a", { rkey: "r2" }, deps);
+    await time.tickAsync(400);
+
+    assertEquals(dispatchCalls.length, 0);
+
+    await time.tickAsync(100);
+    await flushMicrotasks();
+
+    assertEquals(dispatchCalls.length, 1);
+  } finally {
+    _resetBulkBuffersForTest();
+    time.restore();
+  }
+});
+
+Deno.test("flushBulkCreate uses bulk-create verb and the standard payload shape", async () => {
+  const time = new FakeTime();
+  try {
+    _resetBulkBuffersForTest();
+    const targets: WebhookTarget[] = [
+      { method: "POST", url: "https://hook.example/bulk" },
+    ];
+    const { deps, getSubsCalls, dispatchCalls } = makeDeps(targets);
+
+    queueBulkCreate("did:plc:a", { rkey: "r1", title: "T" }, deps);
+    await time.tickAsync(500);
+    await flushMicrotasks();
+
+    assertEquals(getSubsCalls, [{ did: "did:plc:a", verb: "bulk-create" }]);
+    assertEquals(dispatchCalls.length, 1);
+    assertEquals(dispatchCalls[0].webhooks, targets);
+    assertEquals(dispatchCalls[0].label, "bulk-create did:plc:a");
+    assertEquals(dispatchCalls[0].payload, {
+      event: "bulk-create",
+      did: "did:plc:a",
+      records: [{ rkey: "r1", title: "T" }],
+    });
+  } finally {
+    _resetBulkBuffersForTest();
+    time.restore();
+  }
+});
+
+Deno.test("bulkBuffers are cleared after flush and isolated per did", async () => {
+  const time = new FakeTime();
+  try {
+    _resetBulkBuffersForTest();
+    const { deps, dispatchCalls } = makeDeps();
+
+    queueBulkCreate("did:plc:a", { rkey: "a1" }, deps);
+    queueBulkCreate("did:plc:b", { rkey: "b1" }, deps);
+    await time.tickAsync(500);
+    await flushMicrotasks();
+
+    assertEquals(dispatchCalls.length, 2);
+    const dids = dispatchCalls.map((c) => (c.payload as { did: string }).did)
+      .sort();
+    assertEquals(dids, ["did:plc:a", "did:plc:b"]);
+
+    // Another flush window should not re-dispatch the same records.
+    await time.tickAsync(500);
+    await flushMicrotasks();
+    assertEquals(dispatchCalls.length, 2);
+  } finally {
+    _resetBulkBuffersForTest();
+    time.restore();
+  }
+});

tests/jetstream_webhooks_test.ts

@@ -0,0 +1,94 @@
+import { assertEquals } from "@std/assert";
+import { dispatchAll } from "../src/jetstream/webhooks.ts";
+import { installFetchStub, jsonResponse } from "./_helpers/fetch_stub.ts";
+
+Deno.test("dispatchAll is a noop on empty webhook list", async () => {
+  const stub = installFetchStub(() =>
+    jsonResponse({ should: "not be called" })
+  );
+  try {
+    await dispatchAll([], { event: "create" }, "label");
+    assertEquals(stub.calls.length, 0);
+  } finally {
+    stub.restore();
+  }
+});
+
+Deno.test(
+  "dispatchAll sends Authorization Bearer only when token is present",
+  async () => {
+    const stub = installFetchStub(() => new Response(null, { status: 204 }));
+    try {
+      await dispatchAll(
+        [
+          { method: "POST", url: "https://a.example/hook" },
+          {
+            method: "POST",
+            url: "https://b.example/hook",
+            token: "shh",
+          },
+        ],
+        { event: "create" },
+        "label",
+      );
+      assertEquals(stub.calls.length, 2);
+      const [first, second] = stub.calls;
+      assertEquals(first.headers.get("Authorization"), null);
+      assertEquals(second.headers.get("Authorization"), "Bearer shh");
+      assertEquals(first.headers.get("Content-Type"), "application/json");
+    } finally {
+      stub.restore();
+    }
+  },
+);
+
+Deno.test(
+  "dispatchAll omits body and Content-Type for GET and HEAD",
+  async () => {
+    const stub = installFetchStub(() => new Response(null, { status: 204 }));
+    try {
+      await dispatchAll(
+        [
+          { method: "GET", url: "https://a.example/ping" },
+          { method: "HEAD", url: "https://b.example/ping" },
+        ],
+        { event: "create", data: "ignored" },
+        "label",
+      );
+      assertEquals(stub.calls.length, 2);
+      for (const call of stub.calls) {
+        assertEquals(call.body, "");
+        assertEquals(call.headers.get("Content-Type"), null);
+      }
+    } finally {
+      stub.restore();
+    }
+  },
+);
+
+Deno.test(
+  "dispatchAll uses Promise.allSettled — one rejection does not abort others",
+  async () => {
+    const stub = installFetchStub((req) => {
+      if (req.url === "https://reject.example/hook") {
+        return Promise.reject(new Error("connection refused"));
+      }
+      return Promise.resolve(new Response(null, { status: 204 }));
+    });
+    try {
+      await dispatchAll(
+        [
+          { method: "POST", url: "https://reject.example/hook" },
+          { method: "POST", url: "https://ok.example/hook" },
+        ],
+        { event: "create" },
+        "label",
+      );
+      assertEquals(stub.calls.length, 2);
+      const urls = stub.calls.map((c) => c.url);
+      assertEquals(urls.includes("https://ok.example/hook"), true);
+    } finally {
+      stub.restore();
+    }
+  },
+);

tests/migrations_test.ts

@@ -0,0 +1,115 @@
+import { assertEquals } from "@std/assert";
+import { Database } from "@db/sqlite";
+import { applyMigrations } from "../src/migrations/apply.ts";
+
+type TableInfoRow = { name: string };
+type ColumnInfoRow = { name: string };
+
+const tableNames = (db: Database): string[] =>
+  db.prepare(
+    "SELECT name FROM sqlite_master WHERE type = 'table' ORDER BY name",
+  ).all<TableInfoRow>().map((r) => r.name);
+
+const columnNames = (db: Database, table: string): string[] =>
+  db.prepare(`PRAGMA table_info(${table})`)
+    .all<ColumnInfoRow>()
+    .map((r) => r.name)
+    .sort();
+
+const indexNames = (db: Database): string[] =>
+  db.prepare(
+    "SELECT name FROM sqlite_master WHERE type = 'index' AND name NOT LIKE 'sqlite_%' ORDER BY name",
+  ).all<TableInfoRow>().map((r) => r.name);
+
+Deno.test("applyMigrations creates expected tables, columns, and indices", () => {
+  const db = new Database(":memory:");
+  try {
+    applyMigrations(db);
+
+    const tables = tableNames(db);
+    assertEquals(
+      tables.includes("note") &&
+        tables.includes("state") &&
+        tables.includes("webhook_subscription"),
+      true,
+    );
+
+    const noteCols = columnNames(db, "note");
+    for (
+      const col of [
+        "title",
+        "publishedAt",
+        "createdAt",
+        "did",
+        "rkey",
+        "discoverable",
+        "language",
+      ]
+    ) {
+      assertEquals(noteCols.includes(col), true, `note.${col} missing`);
+    }
+
+    const webhookCols = columnNames(db, "webhook_subscription");
+    for (const col of ["id", "did", "method", "url", "token", "verb"]) {
+      assertEquals(
+        webhookCols.includes(col),
+        true,
+        `webhook_subscription.${col} missing`,
+      );
+    }
+
+    const indices = indexNames(db);
+    assertEquals(indices.includes("idx_webhook_subscription_did"), true);
+    assertEquals(indices.includes("idx_webhook_subscription_did_verb"), true);
+  } finally {
+    db.close();
+  }
+});
+
+Deno.test("applyMigrations is idempotent", () => {
+  const db = new Database(":memory:");
+  try {
+    applyMigrations(db);
+    db.exec(
+      "INSERT INTO webhook_subscription (did, method, url, verb) VALUES ('did:plc:x', 'POST', 'https://e.com', 'create')",
+    );
+    applyMigrations(db);
+    applyMigrations(db);
+
+    const [{ count }] = db.prepare(
+      "SELECT COUNT(*) AS count FROM webhook_subscription WHERE did = 'did:plc:x' AND verb = 'create'",
+    ).all<{ count: number }>();
+    assertEquals(count, 1);
+  } finally {
+    db.close();
+  }
+});
+
+Deno.test(
+  "applyMigrations upgrades a legacy schema missing language and discoverable",
+  () => {
+    const db = new Database(":memory:");
+    try {
+      db.exec(`
+        CREATE TABLE note (
+          title TEXT NOT NULL,
+          publishedAt DATETIME,
+          createdAt DATETIME NOT NULL,
+          did TEXT NOT NULL,
+          rkey TEXT NOT NULL,
+          listed INTEGER NOT NULL DEFAULT 1,
+          PRIMARY KEY (did, rkey)
+        );
+      `);
+
+      applyMigrations(db);
+
+      const cols = columnNames(db, "note");
+      assertEquals(cols.includes("discoverable"), true);
+      assertEquals(cols.includes("language"), true);
+      assertEquals(cols.includes("listed"), false);
+    } finally {
+      db.close();
+    }
+  },
+);

tests/opensearch_test.ts

@@ -0,0 +1,204 @@
+import { assertEquals, assertRejects } from "@std/assert";
+import {
+  decodeCursor,
+  encodeCursor,
+  firstSnippet,
+  searchNotes,
+} from "../src/search/opensearch.ts";
+import { installFetchStub, jsonResponse } from "./_helpers/fetch_stub.ts";
+
+const withOpenSearchEnv = (fn: () => Promise<void> | void) => {
+  return async () => {
+    const previousUrl = Deno.env.get("OPENSEARCH_URL");
+    const previousIndex = Deno.env.get("OPENSEARCH_INDEX");
+    Deno.env.set("OPENSEARCH_URL", "http://opensearch.test");
+    Deno.env.set("OPENSEARCH_INDEX", "notes");
+    try {
+      await fn();
+    } finally {
+      if (previousUrl === undefined) Deno.env.delete("OPENSEARCH_URL");
+      else Deno.env.set("OPENSEARCH_URL", previousUrl);
+      if (previousIndex === undefined) Deno.env.delete("OPENSEARCH_INDEX");
+      else Deno.env.set("OPENSEARCH_INDEX", previousIndex);
+    }
+  };
+};
+
+Deno.test("encodeCursor and decodeCursor round-trip", () => {
+  const cursor = encodeCursor(3.14, "abc123");
+  assertEquals(decodeCursor(cursor), [3.14, "abc123"]);
+});
+
+Deno.test("decodeCursor returns undefined on garbage input", () => {
+  assertEquals(decodeCursor("not-base64-at-all!!!"), undefined);
+  assertEquals(decodeCursor(btoa("not-json")), undefined);
+  assertEquals(decodeCursor(btoa(JSON.stringify([1]))), undefined);
+  assertEquals(
+    decodeCursor(btoa(JSON.stringify(["wrong", "type"]))),
+    undefined,
+  );
+});
+
+Deno.test("firstSnippet prefers highlight.content > title > source content > title fallback", () => {
+  assertEquals(
+    firstSnippet(
+      { content: ["hl-content"], title: ["hl-title"] },
+      { title: "src-title", content: "src-content" },
+    ),
+    "hl-content",
+  );
+  assertEquals(
+    firstSnippet({ title: ["hl-title"] }, {
+      title: "src-title",
+      content: "src-content",
+    }),
+    "hl-title",
+  );
+  const longContent = "a".repeat(500);
+  assertEquals(
+    firstSnippet(undefined, { content: longContent, title: "ignored" }).length,
+    200,
+  );
+  assertEquals(firstSnippet(undefined, { title: "only-title" }), "only-title");
+});
+
+Deno.test(
+  "searchNotes returns empty when OPENSEARCH_URL is unset",
+  async () => {
+    const previousUrl = Deno.env.get("OPENSEARCH_URL");
+    Deno.env.delete("OPENSEARCH_URL");
+    try {
+      const stub = installFetchStub(() =>
+        jsonResponse({ should: "not be called" })
+      );
+      try {
+        const result = await searchNotes({
+          q: "hello",
+          discoverableOnly: true,
+          limit: 10,
+        });
+        assertEquals(result, { results: [] });
+        assertEquals(stub.calls.length, 0);
+      } finally {
+        stub.restore();
+      }
+    } finally {
+      if (previousUrl !== undefined) {
+        Deno.env.set("OPENSEARCH_URL", previousUrl);
+      }
+    }
+  },
+);
+
+Deno.test(
+  "searchNotes builds multi_match body with filters and cursor",
+  withOpenSearchEnv(async () => {
+    const stub = installFetchStub(() =>
+      jsonResponse({
+        hits: {
+          hits: [
+            {
+              _source: {
+                did: "did:plc:a",
+                rkey: "rk-a",
+                title: "T",
+                content: "c",
+              },
+              _score: 1.5,
+              highlight: { content: ["snippet"] },
+            },
+            {
+              _source: {
+                did: "did:plc:b",
+                rkey: "rk-b",
+                title: "U",
+                content: "d",
+              },
+              _score: 1.0,
+            },
+          ],
+        },
+      })
+    );
+    try {
+      const result = await searchNotes({
+        q: "hello world",
+        discoverableOnly: true,
+        did: "did:plc:a",
+        limit: 2,
+        cursor: encodeCursor(2.0, "rk-prev"),
+      });
+      assertEquals(result.results.length, 2);
+      assertEquals(result.results[0].snippet, "snippet");
+      assertEquals(result.results[1].snippet, "d");
+      assertEquals(result.cursor, encodeCursor(1.0, "rk-b"));
+
+      assertEquals(stub.calls.length, 1);
+      const sent = JSON.parse(stub.calls[0].body) as Record<string, unknown>;
+      assertEquals(sent.size, 2);
+      assertEquals(sent.search_after, [2.0, "rk-prev"]);
+      const query = sent.query as {
+        bool: { must: unknown[]; filter: unknown[] };
+      };
+      const multi =
+        (query.bool.must[0] as { multi_match: Record<string, unknown> })
+          .multi_match;
+      assertEquals(multi.query, "hello world");
+      assertEquals(multi.fields, ["title^2", "content"]);
+      assertEquals(multi.fuzziness, "AUTO");
+      assertEquals(query.bool.filter, [
+        { term: { discoverable: true } },
+        { term: { did: "did:plc:a" } },
+      ]);
+    } finally {
+      stub.restore();
+    }
+  }),
+);
+
+Deno.test(
+  "searchNotes returns cursor only when the page is full",
+  withOpenSearchEnv(async () => {
+    const stub = installFetchStub(() =>
+      jsonResponse({
+        hits: {
+          hits: [
+            {
+              _source: { did: "did:plc:a", rkey: "rk", title: "T" },
+              _score: 1,
+            },
+          ],
+        },
+      })
+    );
+    try {
+      const result = await searchNotes({
+        q: "hi",
+        discoverableOnly: false,
+        limit: 5,
+      });
+      assertEquals(result.results.length, 1);
+      assertEquals(result.cursor, undefined);
+    } finally {
+      stub.restore();
+    }
+  }),
+);
+
+Deno.test(
+  "searchNotes throws on non-ok response",
+  withOpenSearchEnv(async () => {
+    const stub = installFetchStub(() => new Response("boom", { status: 500 }));
+    try {
+      await assertRejects(() =>
+        searchNotes({
+          q: "hi",
+          discoverableOnly: false,
+          limit: 5,
+        })
+      );
+    } finally {
+      stub.restore();
+    }
+  }),
+);

tests/server_test.ts

@@ -0,0 +1,287 @@
+import { assertEquals } from "@std/assert";
+import { createApp } from "../server.ts";
+import { addWebhookSubscription, listWebhooksByDid } from "../src/data/db.ts";
+import { seedNote, withTestDb } from "./_helpers/db.ts";
+import { requestApp } from "./_helpers/app.ts";
+import { stubAuthenticate } from "./_helpers/auth.ts";
+import { installFetchStub, jsonResponse } from "./_helpers/fetch_stub.ts";
+
+const withAdminEnv = (
+  dids: string,
+  fn: () => Promise<void> | void,
+): () => Promise<void> => {
+  return async () => {
+    const previous = Deno.env.get("ADMIN_DIDS");
+    Deno.env.set("ADMIN_DIDS", dids);
+    try {
+      await fn();
+    } finally {
+      if (previous === undefined) Deno.env.delete("ADMIN_DIDS");
+      else Deno.env.set("ADMIN_DIDS", previous);
+    }
+  };
+};
+
+const withOpenSearchEnv = (fn: () => Promise<void> | void) => {
+  return async () => {
+    const previous = Deno.env.get("OPENSEARCH_URL");
+    Deno.env.set("OPENSEARCH_URL", "http://opensearch.test");
+    try {
+      await fn();
+    } finally {
+      if (previous === undefined) Deno.env.delete("OPENSEARCH_URL");
+      else Deno.env.set("OPENSEARCH_URL", previous);
+    }
+  };
+};
+
+Deno.test(
+  "GET /health returns 200 with status ok",
+  withTestDb(async () => {
+    const res = await requestApp(createApp(), { path: "/health" });
+    assertEquals(res.status, 200);
+    assertEquals(res.json(), { status: "ok" });
+  }),
+);
+
+Deno.test(
+  "GET /notes paginates rkey desc and honors cursor + limit",
+  withTestDb(async () => {
+    for (const rkey of ["a", "b", "c", "d", "e"]) {
+      seedNote({ rkey });
+    }
+    const app = createApp();
+
+    const first = await requestApp(app, { path: "/notes?limit=3" });
+    assertEquals(first.status, 200);
+    const firstBody = first.json() as {
+      notes: { rkey: string }[];
+      cursor?: string;
+    };
+    assertEquals(firstBody.notes.map((n) => n.rkey), ["e", "d", "c"]);
+    assertEquals(firstBody.cursor, "c");
+
+    const second = await requestApp(app, {
+      path: `/notes?limit=3&cursor=${firstBody.cursor}`,
+    });
+    const secondBody = second.json() as { notes: { rkey: string }[] };
+    assertEquals(secondBody.notes.map((n) => n.rkey), ["b", "a"]);
+  }),
+);
+
+Deno.test(
+  "POST /notes/feed rejects empty dids and accepts a valid list",
+  withTestDb(async () => {
+    seedNote({ did: "did:plc:alice", rkey: "rk1" });
+    const app = createApp();
+
+    const empty = await requestApp(app, {
+      method: "POST",
+      path: "/notes/feed",
+      body: { dids: [] },
+    });
+    assertEquals(empty.status, 400);
+
+    const notArray = await requestApp(app, {
+      method: "POST",
+      path: "/notes/feed",
+      body: { dids: "did:plc:alice" },
+    });
+    assertEquals(notArray.status, 400);
+
+    const ok = await requestApp(app, {
+      method: "POST",
+      path: "/notes/feed",
+      body: { dids: ["did:plc:alice"] },
+    });
+    assertEquals(ok.status, 200);
+    const body = ok.json() as { notes: { rkey: string }[] };
+    assertEquals(body.notes.length, 1);
+  }),
+);
+
+Deno.test(
+  "POST /:did/webhooks: 401 without auth, 403 on DID mismatch, 201 inserts create+delete by default",
+  withTestDb(async () => {
+    const app = createApp();
+
+    const noAuth = await requestApp(app, {
+      method: "POST",
+      path: "/did:plc:alice/webhooks",
+      body: { method: "POST", url: "https://hook.example/x" },
+    });
+    assertEquals(noAuth.status, 401);
+
+    const mismatch = stubAuthenticate("did:plc:bob");
+    try {
+      const res = await requestApp(app, {
+        method: "POST",
+        path: "/did:plc:alice/webhooks",
+        headers: { Authorization: "Bearer fake" },
+        body: { method: "POST", url: "https://hook.example/x" },
+      });
+      assertEquals(res.status, 403);
+    } finally {
+      mismatch.restore();
+    }
+
+    const owned = stubAuthenticate("did:plc:alice");
+    try {
+      const res = await requestApp(app, {
+        method: "POST",
+        path: "/did:plc:alice/webhooks",
+        headers: { Authorization: "Bearer fake" },
+        body: { method: "POST", url: "https://hook.example/x" },
+      });
+      assertEquals(res.status, 201);
+      const created = res.json() as { verb: string }[];
+      const verbs = created.map((w) => w.verb).sort();
+      assertEquals(verbs, ["create", "delete"]);
+    } finally {
+      owned.restore();
+    }
+  }),
+);
+
+Deno.test(
+  "POST /:did/webhooks rejects unknown verb with 400",
+  withTestDb(async () => {
+    const auth = stubAuthenticate("did:plc:alice");
+    try {
+      const res = await requestApp(createApp(), {
+        method: "POST",
+        path: "/did:plc:alice/webhooks",
+        headers: { Authorization: "Bearer fake" },
+        body: {
+          method: "POST",
+          url: "https://hook.example/x",
+          verb: "destroy",
+        },
+      });
+      assertEquals(res.status, 400);
+    } finally {
+      auth.restore();
+    }
+  }),
+);
+
+Deno.test(
+  "DELETE /:did/webhooks/:id: 400 on non-positive, 404 on unknown, 204 on success",
+  withTestDb(async () => {
+    const created = addWebhookSubscription({
+      did: "did:plc:alice",
+      method: "POST",
+      url: "https://hook.example/x",
+      verb: "create",
+    });
+    const auth = stubAuthenticate("did:plc:alice");
+    const app = createApp();
+    try {
+      const bad = await requestApp(app, {
+        method: "DELETE",
+        path: "/did:plc:alice/webhooks/0",
+        headers: { Authorization: "Bearer fake" },
+      });
+      assertEquals(bad.status, 400);
+
+      const missing = await requestApp(app, {
+        method: "DELETE",
+        path: "/did:plc:alice/webhooks/9999",
+        headers: { Authorization: "Bearer fake" },
+      });
+      assertEquals(missing.status, 404);
+
+      const ok = await requestApp(app, {
+        method: "DELETE",
+        path: `/did:plc:alice/webhooks/${created.id}`,
+        headers: { Authorization: "Bearer fake" },
+      });
+      assertEquals(ok.status, 204);
+      assertEquals(listWebhooksByDid("did:plc:alice").length, 0);
+    } finally {
+      auth.restore();
+    }
+  }),
+);
+
+Deno.test(
+  "GET /admin/webhooks: 403 for non-admin, 200 when ADMIN_DIDS contains caller",
+  withAdminEnv(
+    "did:plc:admin",
+    withTestDb(async () => {
+      const app = createApp();
+
+      const nonAdmin = stubAuthenticate("did:plc:other");
+      try {
+        const res = await requestApp(app, {
+          path: "/admin/webhooks",
+          headers: { Authorization: "Bearer fake" },
+        });
+        assertEquals(res.status, 403);
+      } finally {
+        nonAdmin.restore();
+      }
+
+      const admin = stubAuthenticate("did:plc:admin");
+      try {
+        const res = await requestApp(app, {
+          path: "/admin/webhooks",
+          headers: { Authorization: "Bearer fake" },
+        });
+        assertEquals(res.status, 200);
+        assertEquals(Array.isArray(res.json()), true);
+      } finally {
+        admin.restore();
+      }
+    }),
+  ),
+);
+
+Deno.test(
+  "GET /search: 400 on blank q, forwards discoverableOnly:true to opensearch",
+  withOpenSearchEnv(
+    withTestDb(async () => {
+      const app = createApp();
+
+      const blank = await requestApp(app, { path: "/search?q=" });
+      assertEquals(blank.status, 400);
+
+      const stub = installFetchStub(() => jsonResponse({ hits: { hits: [] } }));
+      try {
+        const res = await requestApp(app, { path: "/search?q=hello" });
+        assertEquals(res.status, 200);
+        assertEquals(stub.calls.length, 1);
+        const sent = JSON.parse(stub.calls[0].body) as {
+          query: { bool: { filter: Record<string, unknown>[] } };
+        };
+        assertEquals(sent.query.bool.filter, [
+          { term: { discoverable: true } },
+        ]);
+      } finally {
+        stub.restore();
+      }
+    }),
+  ),
+);
+
+Deno.test(
+  "OPTIONS preflight returns 204 with CORS headers",
+  withTestDb(async () => {
+    const res = await requestApp(createApp(), {
+      method: "OPTIONS",
+      path: "/notes",
+    });
+    assertEquals(res.status, 204);
+    assertEquals(res.headers.get("Access-Control-Allow-Origin"), "*");
+    assertEquals(
+      res.headers.get("Access-Control-Allow-Methods")?.includes("POST"),
+      true,
+    );
+    assertEquals(
+      res.headers.get("Access-Control-Allow-Headers")?.includes(
+        "Authorization",
+      ),
+      true,
+    );
+  }),
+);