Add /api/dev/session for curl-based testing#885
Draft
nicoalbanese wants to merge 9 commits into
Draft
Conversation
Mints a real Better Auth session cookie for a dedicated bot user (id `__test_bot__`) so the app can be exercised end-to-end from the command line. The endpoint cannot impersonate real users, is gated by `TEST_AUTH_SECRET` + `X-Test-Auth` header (timing-safe), and is disabled on production deployments. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The managed-template-trial gate treats any Vercel-auth user without a vercel.com email as a trial user, capped at 1 session and 5 messages. The bot needs to exercise multiple sessions and unlimited turns to be useful for testing, so we assign it `test-bot@vercel.com`. Existing bot users created before this change get their email backfilled on the next call to /api/dev/session. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Drives the full happy path from the command line: mint cookie → create session → wait for sandbox → send message → stream response. Accepts a custom prompt as the first argument and prints the sessionId/chatId so follow-up turns can target the same chat. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
When `--session SESSION_ID` is passed, the script skips session/sandbox creation, fetches the existing chat and its message history, and appends the new user turn. The trailing hint now points to a runnable command instead of a hand-rolled curl sequence. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![vercel[bot]](https://avatars.githubusercontent.com/in/8329?s=60&v=4){kind=small}
Co-authored-by: vercel[bot] <35613825+vercel[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
POST /api/dev/session, a dev-only endpoint that mints a real Better Auth session cookie for a dedicated bot user (id = __test_bot__,username = test-bot) so the app can be exercised end-to-end from the command line.scripts/test-agent.sh— a self-contained smoke test that mints the cookie, creates a chat session, waits for the Vercel sandbox, sends a message, and streams the response. Supports--session SESSION_IDfor follow-up turns to an existing chat.docs/agents/endpoints.md— the curl-based testing guide, linked fromAGENTS.md.Why
Today every feature is only really testable through the browser. That blocks coding agents (and humans on the CLI) from verifying changes without OAuth-signing-in and clicking around. With this endpoint, anything the browser can do is reachable from
curlwith a real session cookie — same code path, same auth, same workflow.Security boundary
__test_bot__. The id is a 12-char sentinel that cannot collide with Better Auth's 21-char nanoid IDs.VERCEL_ENV=production. Vercel previews stay enabled.TEST_AUTH_SECRETis unset or shorter than 64 hex chars.crypto.timingSafeEqual.The bot is given a
@vercel.comemail so it bypasses the managed-template-trial gate (which otherwise caps at 1 session and 5 messages per non-Vercel user).Verification
End-to-end verified against the live dev server:
/api/dev/session→ Better Auth's verifier accepts it (GET /api/auth/inforeturns the bot user)./api/sessions→ real Vercel sandbox provisions in ~10s.POST /api/chatstreams a real agent response.Test plan
TEST_AUTH_SECRET=$(openssl rand -hex 32)inapps/web/.env.localbash scripts/test-agent.sh— expect the agent to replyTEST_AUTH_SECRETset — expect 404🤖 Generated with Claude Code