Migration/3.0 by jankapunkt · Pull Request #20 · leaonline/leaonline-content

jankapunkt · 2026-02-04T12:36:34Z

Upgrade to Meteor 3.4

update internals
update tests

…t into migration/3.0

Copilot

Pull request overview

Upgrades the app to Meteor 3.4 and updates supporting infrastructure (startup wiring, settings validation, logging/health, patches) while expanding/modernizing the test suite and test tooling.

Changes:

Bump Meteor release/packages and update schema/JWT/health integrations.
Refactor collection/files validation & logging behavior (esp. under tests).
Add new utilities/patch + expand tests and test runner scripts/CI.

Reviewed changes

Copilot reviewed 41 out of 43 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
tests/main.js	Initializes test app env and adds new util tests.
tests/helpers/mockCollection.js	Adds schema attach helper for mocked collections.
test.sh	Adds browser driver, debugger, coverage options.
settings.json	Extends hosts and patch settings.
server/main.js	Adds health startup import.
run.sh	Adds optional debugger flag.
package.json	Updates deps/devDeps for Meteor 3.4.
package-lock.json	Locks updated dependency graph.
imports/utils/toArray.js	Adds `toArray` helper utility.
imports/utils/tests/isArray.tests.js	Adds tests for `toArray` behavior.
imports/utils/noop.js	Adds `noop` helper.
imports/utils/log.js	Disables logging during tests.
imports/startup/server/webapp.js	Adjusts WebApp JSON middleware wiring.
imports/startup/server/settingsSchema.js	Passes meteor SimpleSchema into validator.
imports/startup/server/rateLimit.js	Updates rate limiter hook invocation.
imports/startup/server/patches.js	Refactors patch execution flow.
imports/startup/server/health.js	Adds health inquiry method.
imports/startup/server/accounts.js	Changes OAuth debug behavior and logs.
imports/contexts/tests/UnitSet.tests.js	Adds extensive UnitSet behavior tests.
imports/contexts/UnitSet.js	Adds doc/comment and route behavior context.
imports/contexts/MediaLib.js	Removes eslint disable comment.
imports/contexts/Assets.js	Removes eslint disable comment.
imports/api/schema/Schema.js	Switches to Meteor SimpleSchema package import.
imports/api/progress/calculateProgress.js	Makes `unitSetProgressChanged` async with fetchAsync loop.
imports/api/patches/removeImageOrigin.js	Adds new migration patch for image URL stripping.
imports/api/origins/tests/getAllowedOrigins.tests.js	Updates origin tests to validate dynamically.
imports/api/mixins/checkPermissions.js	Switches JWT validation to leaonline:jwt.
imports/api/grid/tests/checkMime.tests.js	Adds tests for mime checking behavior.
imports/api/grid/checkuser.js	Makes user check async and adds debug hooks.
imports/api/grid/checkMime.js	Refactors signature, adds safer comparisons.
imports/api/factories/createRoute.js	Renames debug middleware option.
imports/api/factories/createPublication.js	Adds health mixin to publications.
imports/api/factories/createMethods.js	Adds health mixin to methods.
imports/api/factories/createFilesCollection.js	Removes always-on debug flag.
imports/api/context/initCollection.js	Refactors debug/i18n/mime/user validation wiring.
.settingsschema.js	Refactors to injectable SimpleSchema + expands schema.
.meteor/versions	Updates Meteor package versions list.
.meteor/release	Bumps Meteor release to 3.4.
.meteor/packages	Updates Meteor package pins and adds jwt/health.
.gitignore	Ignores `.deploy*` instead of `.deploy`.
.github/workflows/test_suite.yml	Reads Meteor version dynamically; removes coverage job.
.coverage.json	Adds coverage exclusion config.
.babelrc	Adds coverage-only istanbul config and exclusions.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-12T13:52:37Z

imports/contexts/tests/UnitSet.tests.js

+    UnitSetCollection = UnitSet.collection()
+    UnitCollection = Unit.collection()
+    TestCylceCollection = TestCycle.collection()
+    console.debug(UnitSet.methods.update)


console.debug(UnitSet.methods.update) adds noisy output to the test run and can make CI logs harder to read. Please remove this debug statement (or gate it behind an explicit verbose flag).

Suggested change

console.debug(UnitSet.methods.update)

Copilot · 2026-02-12T13:52:38Z

imports/contexts/tests/UnitSet.tests.js

+  after(() => {
+    restoreCollection(UnitSet)
+  })


This suite mocks collections for Unit and TestCycle as well, but only restores UnitSet in after(). Not restoring all mocked collections can leak state into other tests. Please restore Unit and TestCycle here too (and consider fixing the TestCylceCollection typo to avoid confusion).

Copilot · 2026-02-12T13:52:38Z

imports/api/patches/removeImageOrigin.js

+const checkForImages = (name, array) => {
+  const updates = []
+  for (let i = 0; i < array.length; i++) {
+    const entry = array[i]


toArray(null) returns [null] (by design, per its docs/tests). If any of these fields can be null, entry.subtype will throw because entry is null. Add a guard like if (!entry) continue (and similarly for non-object entries) before accessing entry.subtype.

Suggested change

const entry = array[i]

const entry = array[i]

if (!entry || typeof entry !== 'object') {

continue

}

Copilot · 2026-02-12T13:52:38Z

imports/api/progress/calculateProgress.js

+export const unitSetProgressChanged = async ({ unitSetId, debug = () => {} }) => {
  debug('(unitSetProgressChanged):', unitSetId)
-  TestCycle
+  const docs = await TestCycle
    .collection()
    .find({ unitSets: unitSetId })
-    .forEach(testCycleDoc => updateTestCycleDoc({ testCycleDoc, debug }))
+    .fetchAsync()
+  for (const testCycleDoc of docs) {
+    await updateTestCycleDoc({ testCycleDoc, debug })
+  }


unitSetProgressChanged is now async, but existing call sites/tests may still call it synchronously. Without awaiting/returning the promise, callers can observe stale TestCycle progress (and tests may become flaky). Please update callers to await (or keep a synchronous API by returning TestCycle.collection().find(...).forEachAsync(...)).

Copilot · 2026-02-12T13:52:38Z

imports/api/mixins/checkPermissions.js

      const token = args[0]?.token
+      console.debug('check token for', name, 'token:', token)
      const { valid, reason } = tokenIsValid(token, name)


This logs the raw JWT (console.debug('... token:', token)), which can leak credentials into logs (especially in production / CI). Please remove token logging or gate it behind a strict dev-only flag and ensure the validator debug output cannot print sensitive token contents.

Copilot · 2026-02-12T13:52:39Z

imports/api/origins/tests/getAllowedOrigins.tests.js

+    try {
+      urlSchema.validate({ urls })
+    }
+    catch (e) {
+      console.error(e)
+    }


The schema validation here isn't actually checking anything because urlSchema.validate({ urls }) doesn't use validationContext; then you read validationContext.validationErrors() without ever calling validationContext.validate(...). Use the context to validate (or drop the context entirely and assert that urlSchema.validate does not throw).

Suggested change

try {

urlSchema.validate({ urls })

}

catch (e) {

console.error(e)

}

const isValid = validationContext.validate({ urls })

expect(isValid).to.equal(true)

Copilot · 2026-02-12T13:52:39Z

.github/workflows/test_suite.yml

+          release_number="${release_raw#METEOR@}"
+          echo "release_raw=$release_raw"
+          echo "release_number=$release_number"
+          echo "::set-output name=release_number::$release_number"


GitHub Actions ::set-output is deprecated and can break on newer runners. Write the output to $GITHUB_OUTPUT instead so ${{ steps.meteor_release.outputs.release_number }} remains available.

Suggested change

echo "::set-output name=release_number::$release_number"

echo "release_number=$release_number" >> "$GITHUB_OUTPUT"

Copilot · 2026-02-12T13:52:39Z

imports/startup/server/webapp.js

 WebApp.express.urlencoded({ extended: true })
-WebApp.express.json()
+WebApp.handlers.use(WebApp.express.json())


WebApp.express.urlencoded({ extended: true }) creates a middleware but it isn't mounted anywhere, so urlencoded request bodies won't actually be parsed. Use WebApp.handlers.use(WebApp.express.urlencoded({ extended: true })) (similar to the json middleware) or remove the line if not needed.

Copilot · 2026-02-12T13:52:40Z

imports/api/grid/checkuser.js

+    const exists = await userExists(userId)
+    debug('userExists?', { userId, exists })
+    if (!exists) {
+      debug('users', await Meteor.users.find().fetchAsync())


When a user is missing, this debug path fetches and logs all users (Meteor.users.find().fetchAsync()), which is both a potential PII leak and can be very expensive on large user collections. Consider removing this branch or limiting it to tests only (and log only minimal metadata like counts / ids).

Suggested change

debug('users', await Meteor.users.find().fetchAsync())

debug('userMissing', { userId })

Copilot · 2026-02-12T13:52:40Z

imports/startup/server/accounts.js

        accessTokenUrl: oauth.accessTokenUrl,
        identityUrl: oauth.identityUrl,
        redirectUrl: oauth.redirectUrl,
-        debug: oauth.debug
+        debug: true
      }


debug: true forces verbose OAuth logging in all environments and ignores Meteor.settings.oauth.debug. This can leak sensitive auth details; please wire this back to settings and/or gate it behind Meteor.isDevelopment.

jankapunkt added 24 commits January 13, 2025 22:22

deps: packages updated

61e92d1

deps(meteor): resolve conflicts

3bfdfbf

fix(dev): add debug to service config

5076777

git: ignore all forms of .deploy folder

8d97e89

feature: add health endpoints and extract jwt to library

1aa0e22

fix: minor null issues fixed and tests added for file access

7570a5a

fix: lint fix

aca65f0

build(core): add appstaging to schema

f06c276

core: upgrade to meteor 3.4

d1c4186

fix: tests updated

e6f181c

fix(tests): remaining tests upgraded and coverage improved

65a9201

ci: use current meteor release for setup

366ebae

feature: prepare for token based backend communication

ff2ee08

fix(deps): remove 3.4 incompatible deps

d53d1ff

deps: update to 3.4 compatible

24e6313

core: update Meteor package versions

31c7bb0

fix: update gttp-factory to 2.0.0

7659bca

tests: impoved coverage

c6516c3

build(core): update package versions

6f5f821

fix: standard js lint fix

0878d47

fix(ci): remove coverage checks in favor of local dev

4d9915c

Merge branch 'master' into migration/3.0

5ff2d6e

fix: remove unused package versions

8691693

Merge branch 'migration/3.0' of github.com:leaonline/leaonline-conten…

f5f163f

…t into migration/3.0

jankapunkt requested a review from Copilot February 12, 2026 13:44

Copilot started reviewing on behalf of jankapunkt February 12, 2026 13:44 View session

Copilot AI reviewed Feb 12, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Migration/3.0#20

Migration/3.0#20
jankapunkt wants to merge 24 commits intomasterfrom
migration/3.0

jankapunkt commented Feb 4, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 12, 2026

Uh oh!

Copilot AI Feb 12, 2026

Uh oh!

Copilot AI Feb 12, 2026

Uh oh!

Copilot AI Feb 12, 2026

Uh oh!

Copilot AI Feb 12, 2026

Uh oh!

Copilot AI Feb 12, 2026

Uh oh!

Copilot AI Feb 12, 2026

Uh oh!

Copilot AI Feb 12, 2026

Uh oh!

Copilot AI Feb 12, 2026

Uh oh!

Copilot AI Feb 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	echo "::set-output name=release_number::$release_number"
	echo "release_number=$release_number" >> "$GITHUB_OUTPUT"

	debug('users', await Meteor.users.find().fetchAsync())
	debug('userMissing', { userId })

Conversation

jankapunkt commented Feb 4, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants