various bugfixes

tests/defaultSite.test.mjs

@@ -0,0 +1,12 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { defaultSite } from '../build/defaultSite.mjs'
+
+test('default site supports the demo and configurable site paths without embedding credentials', () => {
+  assert.equal(defaultSite(), 'https://ttp.joeykimsey.com')
+  assert.equal(defaultSite(' https://site.test/ttp/ '), 'https://site.test/ttp')
+  assert.equal(defaultSite('http://192.168.1.194:8024/'), 'http://192.168.1.194:8024')
+  for (const value of ['', 'not a url', 'file:///C:/test', 'https://user:secret@site.test/', 'https://site.test/?token=secret', 'https://site.test/#login']) {
+    assert.throws(() => defaultSite(value))
+  }
+})

tests/updates.test.mjs

@@ -10,6 +10,7 @@ function fixture(enabled = true) {
   const scheduled = []
   const cancelled = []
   updater.checks = 0
+  updater.downloads = 0
   updater.installs = []
   updater.checkForUpdates = async () => {
     updater.checks++
@@ -17,6 +18,10 @@ function fixture(enabled = true) {
     return {}
   }
   updater.quitAndInstall = (...args) => updater.installs.push(args)
+  updater.downloadUpdate = async () => {
+    updater.downloads++
+    updater.emit('update-downloaded', { version: '0.1.1' })
+  }
   const controller = createUpdateController({
     updater, enabled, version: '0.1.0', onState: (state) => states.push(state),
     schedule: (callback, delay) => { const task = { callback, delay }; scheduled.push(task); return task },
@@ -29,8 +34,10 @@ test('local/dev builds never check, schedule, or install', async () => {
   const { controller, updater, scheduled } = fixture(false)
   controller.start()
   await controller.check()
+  await controller.download()
   assert.equal(controller.snapshot().status, 'disabled')
   assert.equal(updater.checks, 0)
+  assert.equal(updater.downloads, 0)
   assert.equal(scheduled.length, 0)
   assert.equal(controller.install(), false)
 })
@@ -56,8 +63,13 @@ test('network and download failures are retryable without exposing raw errors',
   await controller.check()
   assert.equal(controller.snapshot().status, 'error')
   assert.doesNotMatch(JSON.stringify(controller.snapshot()), /private/)
-  updater.checkForUpdates = async () => ({ downloadPromise: Promise.reject(new Error('checksum mismatch')) })
+  updater.checkForUpdates = async () => {
+    updater.emit('update-available', { version: '0.1.1' })
+    return {}
+  }
   await controller.check()
+  updater.downloadUpdate = async () => { throw new Error('checksum mismatch') }
+  await controller.download()
   assert.equal(controller.snapshot().status, 'error')
   updater.checkForUpdates = async () => {
     updater.emit('update-not-available')
@@ -73,12 +85,25 @@ test('one in-flight download, progress, verified readiness, and explicit restart
   updater.checkForUpdates = async () => {
     updater.checks++
     updater.emit('update-available', { version: '0.1.1' })
-    return { downloadPromise: new Promise((resolve) => { finish = resolve }) }
+    return {}
+  }
+  updater.downloadUpdate = async () => {
+    updater.downloads++
+    return new Promise((resolve) => { finish = resolve })
   }
   assert.equal(controller.install(), false)
-  const pending = controller.check()
+  await controller.download()
+  assert.equal(updater.downloads, 0)
+  await controller.check()
+  assert.equal(controller.snapshot().status, 'available')
+  assert.equal(updater.autoDownload, false)
+  assert.equal(updater.downloads, 0)
+  assert.equal(controller.install(), false)
+  const pending = controller.download()
+  await controller.download()
   await controller.check()
   assert.equal(updater.checks, 1)
+  assert.equal(updater.downloads, 1)
   updater.emit('download-progress', { percent: 53.2 })
   assert.equal(controller.snapshot().percent, 53)
   assert.equal(controller.install(), false)
@@ -125,6 +150,7 @@ test('update IPC rejects sites, child frames, and unowned windows', () => {
     controller, getWindows: () => windows, rendererUrl: url
   })
   assert.throws(() => handlers.get('capsule:updates:install')(event), /denied/)
+  assert.throws(() => handlers.get('capsule:updates:download')(event), /denied/)
   frame.url = url
   assert.equal(handlers.get('capsule:updates:status')(event).currentVersion, '0.1.0')
   cleanup()