chore: import upstream snapshot with attribution

backend/tests/unit/function-predeploy-check-real.test.ts

@@ -0,0 +1,96 @@
+import { ERROR_CODES } from '@insforge/shared-schemas';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+// End-to-end through the REAL DenoSubhostingProvider running the REAL
+// `deno check` (the provider is intentionally NOT mocked here). Proves the
+// wired createFunction path actually rejects the #1594 bug — a duplicate
+// top-level declaration — before any DB write. Only DB/secret/logger are
+// mocked, so this exercises the full service -> provider -> deno check chain.
+
+const mockClient = { query: vi.fn(), release: vi.fn() };
+const mockPool = { query: vi.fn(), connect: vi.fn().mockResolvedValue(mockClient) };
+
+vi.mock('../../src/infra/database/database.manager.js', () => ({
+  DatabaseManager: {
+    getInstance: () => ({ getPool: () => mockPool }),
+  },
+}));
+
+vi.mock('../../src/services/secrets/secret.service.js', () => ({
+  SecretService: { getInstance: () => ({}) },
+}));
+
+vi.mock('../../src/utils/logger.js', () => ({
+  default: { info: vi.fn(), error: vi.fn(), warn: vi.fn(), debug: vi.fn() },
+}));
+
+const DUPLICATE_DECL = [
+  'const KILL_SWITCH_DOC_ID = "global";',
+  'export default function (_req: Request): Response {',
+  '  return new Response(KILL_SWITCH_DOC_ID);',
+  '}',
+  'var KILL_SWITCH_DOC_ID = "global";',
+].join('\n');
+
+describe('Pre-deploy check — end to end through real deno check (#1594)', () => {
+  beforeEach(() => {
+    vi.resetModules();
+    vi.clearAllMocks();
+    process.env.DENO_DEPLOY_TOKEN = 't';
+    process.env.DENO_DEPLOY_ORG_ID = 'o';
+  });
+
+  afterEach(() => {
+    delete process.env.DENO_DEPLOY_TOKEN;
+    delete process.env.DENO_DEPLOY_ORG_ID;
+  });
+
+  it('rejects the real duplicate-declaration function with a 400 before any DB write', async () => {
+    const { FunctionService } = await import('../../src/services/functions/function.service.js');
+    const service = FunctionService.getInstance();
+
+    await expect(
+      service.createFunction({
+        slug: 'dpo_agent',
+        name: 'DPO Agent',
+        code: DUPLICATE_DECL,
+        status: 'active',
+      })
+    ).rejects.toMatchObject({ statusCode: 400, code: ERROR_CODES.INVALID_INPUT });
+
+    // The real `deno check` names the offending identifier, and the bad
+    // function must never reach the database.
+    await expect(
+      service.createFunction({
+        slug: 'dpo_agent',
+        name: 'DPO Agent',
+        code: DUPLICATE_DECL,
+        status: 'active',
+      })
+    ).rejects.toThrow(/KILL_SWITCH_DOC_ID/);
+
+    expect(mockPool.connect).not.toHaveBeenCalled();
+  }, 60_000);
+
+  it('does NOT block the same code when it is uploaded inactive (no deploy => no check)', async () => {
+    const { FunctionService } = await import('../../src/services/functions/function.service.js');
+    const service = FunctionService.getInstance();
+
+    // Inactive functions are not deployed, so the static check is skipped and
+    // the DB write proceeds (mocked). Guards the create-time gating.
+    mockClient.query
+      .mockResolvedValueOnce({})
+      .mockResolvedValueOnce({ rows: [{ id: '1', slug: 'dpo_agent' }] });
+
+    await expect(
+      service.createFunction({
+        slug: 'dpo_agent',
+        name: 'DPO Agent',
+        code: DUPLICATE_DECL,
+        status: 'inactive',
+      })
+    ).resolves.toBeDefined();
+
+    expect(mockPool.connect).toHaveBeenCalled();
+  }, 60_000);
+});