chore: import upstream snapshot with attribution

test/server/routes/blobs.test.ts

@@ -0,0 +1,723 @@
+import type { Server } from 'node:http';
+
+import request from 'supertest';
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
+import { createApp } from '../../../src/server/server';
+
+// Mock dependencies
+vi.mock('../../../src/blobs/extractor');
+vi.mock('../../../src/blobs');
+vi.mock('../../../src/database');
+
+// Import after mocking
+import { getBlobByHash, getBlobUrl } from '../../../src/blobs';
+import { isBlobStorageEnabled } from '../../../src/blobs/extractor';
+import { getDb } from '../../../src/database';
+
+const mockedIsBlobStorageEnabled = vi.mocked(isBlobStorageEnabled);
+const mockedGetBlobUrl = vi.mocked(getBlobUrl);
+const mockedGetBlobByHash = vi.mocked(getBlobByHash);
+const mockedGetDb = vi.mocked(getDb);
+
+describe('Blobs Routes', () => {
+  let api: ReturnType<typeof request.agent>;
+  let server: Server;
+
+  beforeAll(async () => {
+    await new Promise<void>((resolve, reject) => {
+      server = createApp().listen(0, '127.0.0.1', (error?: Error) =>
+        error ? reject(error) : resolve(),
+      );
+    });
+    api = request.agent(server);
+  });
+
+  afterAll(async () => {
+    if (!server.listening) {
+      return;
+    }
+    await new Promise<void>((resolve, reject) => {
+      server.close((error) => (error ? reject(error) : resolve()));
+    });
+  });
+
+  describe('GET /api/blobs/:hash', () => {
+    const validHash = 'a'.repeat(64);
+
+    // Create chainable mock DB that returns assetResult on first .get() and referenceResult on second
+    function createMockDb(assetResult?: any, referenceResult?: any) {
+      let callCount = 0;
+      return {
+        select: vi.fn().mockReturnThis(),
+        from: vi.fn().mockReturnThis(),
+        where: vi.fn().mockReturnThis(),
+        get: vi.fn().mockImplementation(() => {
+          callCount++;
+          return callCount === 1 ? assetResult : referenceResult;
+        }),
+      } as any;
+    }
+
+    function setupDbWithAssetAndReference(
+      asset: Record<string, unknown>,
+      reference: Record<string, unknown> = { evalId: 'eval-123' },
+    ) {
+      mockedIsBlobStorageEnabled.mockReturnValue(true);
+      const mockDb = createMockDb(asset, reference);
+      mockedGetDb.mockReturnValue(mockDb);
+    }
+
+    function createBlobResponse(mimeType: string, sizeBytes: number) {
+      return {
+        data: Buffer.alloc(sizeBytes),
+        metadata: {
+          mimeType,
+          sizeBytes,
+          createdAt: new Date().toISOString(),
+          provider: 'local',
+          key: validHash,
+        },
+      };
+    }
+
+    beforeEach(() => {
+      vi.resetAllMocks();
+    });
+
+    afterEach(() => {
+      vi.resetAllMocks();
+    });
+
+    it('should return 404 when blob storage is disabled', async () => {
+      mockedIsBlobStorageEnabled.mockReturnValue(false);
+
+      const response = await api.get(`/api/blobs/${validHash}`);
+
+      expect(response.status).toBe(404);
+      expect(response.body).toEqual({ error: 'Blob storage disabled' });
+    });
+
+    it.each([
+      ['too short', 'abc123'],
+      ['invalid characters', 'g'.repeat(64)],
+      ['too long', 'a'.repeat(65)],
+    ])('should return 400 for invalid hash (%s)', async (_label, hash) => {
+      mockedIsBlobStorageEnabled.mockReturnValue(true);
+
+      const response = await api.get(`/api/blobs/${hash}`);
+
+      expect(response.status).toBe(400);
+      expect(response.body).toHaveProperty('error');
+    });
+
+    it('should return 404 when blob asset not found in DB', async () => {
+      mockedIsBlobStorageEnabled.mockReturnValue(true);
+      mockedGetDb.mockReturnValue(createMockDb(undefined));
+
+      const response = await api.get(`/api/blobs/${validHash}`);
+
+      expect(response.status).toBe(404);
+      expect(response.body).toEqual({ error: 'Blob not found' });
+    });
+
+    it('should return 403 when no reference exists', async () => {
+      const mockAsset = {
+        hash: validHash,
+        mimeType: 'image/png',
+        sizeBytes: 1024,
+        provider: 'local',
+      };
+      mockedIsBlobStorageEnabled.mockReturnValue(true);
+      mockedGetDb.mockReturnValue(createMockDb(mockAsset, undefined));
+
+      const response = await api.get(`/api/blobs/${validHash}`);
+
+      expect(response.status).toBe(403);
+      expect(response.body).toEqual({ error: 'Not authorized to access this blob' });
+    });
+
+    it('should redirect 302 when presigned URL is available', async () => {
+      setupDbWithAssetAndReference({
+        hash: validHash,
+        mimeType: 'image/png',
+        sizeBytes: 1024,
+        provider: 's3',
+      });
+
+      const presignedUrl = 'https://s3.amazonaws.com/bucket/blob?signature=xyz';
+      mockedGetBlobUrl.mockResolvedValue(presignedUrl);
+
+      const response = await api.get(`/api/blobs/${validHash}`);
+
+      expect(response.status).toBe(302);
+      expect(response.header.location).toBe(presignedUrl);
+      expect(mockedGetBlobUrl).toHaveBeenCalledWith(validHash);
+      expect(mockedGetBlobByHash).not.toHaveBeenCalled();
+    });
+
+    it('should serve blob data directly when no presigned URL', async () => {
+      setupDbWithAssetAndReference({
+        hash: validHash,
+        mimeType: 'image/png',
+        sizeBytes: 1024,
+        provider: 'local',
+      });
+
+      mockedGetBlobUrl.mockResolvedValue(null);
+      mockedGetBlobByHash.mockResolvedValue(createBlobResponse('image/png', 1024));
+
+      const response = await api.get(`/api/blobs/${validHash}`);
+
+      expect(response.status).toBe(200);
+      expect(response.header['content-type']).toBe('image/png');
+      expect(response.header['cache-control']).toBe('public, max-age=31536000, immutable');
+      expect(response.header['accept-ranges']).toBe('none');
+      // Content-Length may be absent if response is gzipped (Express uses transfer-encoding: chunked)
+      expect(
+        response.header['content-length'] === '1024' ||
+          response.header['transfer-encoding'] === 'chunked',
+      ).toBe(true);
+      expect(mockedGetBlobByHash).toHaveBeenCalledWith(validHash);
+    });
+
+    it('should use fallback MIME type for invalid MIME types', async () => {
+      setupDbWithAssetAndReference(
+        { hash: validHash, mimeType: 'audio/wav.html', sizeBytes: 2048, provider: 'local' },
+        { evalId: 'eval-456' },
+      );
+
+      mockedGetBlobUrl.mockResolvedValue(null);
+      mockedGetBlobByHash.mockResolvedValue(createBlobResponse('audio/wav.html', 2048));
+
+      const response = await api.get(`/api/blobs/${validHash}`);
+
+      expect(response.status).toBe(200);
+      expect(response.header['content-type']).toBe('application/octet-stream');
+      expect(response.header['cache-control']).toBe('public, max-age=31536000, immutable');
+      expect(response.header['accept-ranges']).toBe('none');
+    });
+
+    it('should use blob metadata MIME type when available', async () => {
+      setupDbWithAssetAndReference(
+        { hash: validHash, mimeType: 'image/png', sizeBytes: 1024, provider: 'local' },
+        { evalId: 'eval-789' },
+      );
+
+      mockedGetBlobUrl.mockResolvedValue(null);
+      // Blob metadata has different MIME type and size than the asset record
+      mockedGetBlobByHash.mockResolvedValue(createBlobResponse('image/jpeg', 2048));
+
+      const response = await api.get(`/api/blobs/${validHash}`);
+
+      expect(response.status).toBe(200);
+      expect(response.header['content-type']).toBe('image/jpeg');
+      expect(response.header['cache-control']).toBe('public, max-age=31536000, immutable');
+      expect(response.header['accept-ranges']).toBe('none');
+      // Content-Length may be absent if response is gzipped
+      expect(
+        response.header['content-length'] === '2048' ||
+          response.header['transfer-encoding'] === 'chunked',
+      ).toBe(true);
+    });
+
+    it('should return 404 when getBlobByHash throws error', async () => {
+      setupDbWithAssetAndReference(
+        { hash: validHash, mimeType: 'text/plain', sizeBytes: 512, provider: 'local' },
+        { evalId: 'eval-error' },
+      );
+
+      mockedGetBlobUrl.mockResolvedValue(null);
+      mockedGetBlobByHash.mockRejectedValue(new Error('File system error'));
+
+      const response = await api.get(`/api/blobs/${validHash}`);
+
+      expect(response.status).toBe(404);
+      expect(response.body).toEqual({ error: 'Blob not found' });
+    });
+  });
+
+  describe('GET /api/blobs/library', () => {
+    /**
+     * Create a mock DB for library queries.
+     * The /library route executes 3 chained queries:
+     * 1. COUNT query via .get() → { count: number }
+     * 2. uniqueHashes query via .all() → [{ hash: string }]
+     * 3. items detail query via .all() → full item rows
+     *
+     * We track calls to .get() and .all() to return the right data.
+     */
+    function createLibraryMockDb(
+      countResult: { count: number },
+      uniqueHashes: Array<{ hash: string }>,
+      items: any[],
+    ) {
+      let getAllCallCount = 0;
+      return {
+        select: vi.fn().mockReturnThis(),
+        selectDistinct: vi.fn().mockReturnThis(),
+        from: vi.fn().mockReturnThis(),
+        innerJoin: vi.fn().mockReturnThis(),
+        leftJoin: vi.fn().mockReturnThis(),
+        where: vi.fn().mockReturnThis(),
+        orderBy: vi.fn().mockReturnThis(),
+        limit: vi.fn().mockReturnThis(),
+        offset: vi.fn().mockReturnThis(),
+        get: vi.fn().mockReturnValue(countResult),
+        all: vi.fn().mockImplementation(() => {
+          getAllCallCount++;
+          // First .all() call: uniqueHashes query
+          // Second .all() call: items detail query
+          return getAllCallCount === 1 ? uniqueHashes : items;
+        }),
+      } as any;
+    }
+
+    beforeEach(() => {
+      vi.resetAllMocks();
+    });
+
+    afterEach(() => {
+      vi.resetAllMocks();
+    });
+
+    it('should return empty list with blobStorageEnabled=false when blob storage is disabled', async () => {
+      mockedIsBlobStorageEnabled.mockReturnValue(false);
+
+      const response = await api.get('/api/blobs/library');
+
+      expect(response.status).toBe(200);
+      expect(response.body).toEqual({
+        success: true,
+        data: { items: [], total: 0, hasMore: false, blobStorageEnabled: false },
+      });
+    });
+
+    it('should return 400 for invalid query parameters', async () => {
+      mockedIsBlobStorageEnabled.mockReturnValue(true);
+
+      const response = await api.get('/api/blobs/library?limit=abc');
+
+      expect(response.status).toBe(400);
+      expect(response.body).toEqual({
+        success: false,
+        error: 'Invalid query parameters',
+      });
+    });
+
+    it('should return 400 for invalid type filter', async () => {
+      mockedIsBlobStorageEnabled.mockReturnValue(true);
+
+      const response = await api.get('/api/blobs/library?type=invalid');
+
+      expect(response.status).toBe(400);
+      expect(response.body).toEqual({
+        success: false,
+        error: 'Invalid query parameters',
+      });
+    });
+
+    it('should return empty list when no items match', async () => {
+      mockedIsBlobStorageEnabled.mockReturnValue(true);
+      const mockDb = createLibraryMockDb({ count: 0 }, [], []);
+      mockedGetDb.mockReturnValue(mockDb);
+
+      const response = await api.get('/api/blobs/library');
+
+      expect(response.status).toBe(200);
+      expect(response.body.success).toBe(true);
+      expect(response.body.data.items).toEqual([]);
+      expect(response.body.data.total).toBe(0);
+      expect(response.body.data.hasMore).toBe(false);
+    });
+
+    it('should return items with correct response shape (list mode)', async () => {
+      mockedIsBlobStorageEnabled.mockReturnValue(true);
+
+      const hash1 = 'a'.repeat(64);
+      const items = [
+        {
+          hash: hash1,
+          mimeType: 'image/png',
+          sizeBytes: 1024,
+          createdAt: '2025-01-01 00:00:00',
+          evalId: 'eval-1',
+          testIdx: 0,
+          promptIdx: 0,
+          location: 'response',
+          kind: 'image',
+          evalDescription: 'Test eval',
+          provider: { id: 'openai:gpt-4', label: 'GPT-4' },
+          success: true,
+          score: 0.9,
+        },
+      ];
+
+      const mockDb = createLibraryMockDb({ count: 1 }, [{ hash: hash1 }], items);
+      mockedGetDb.mockReturnValue(mockDb);
+
+      const response = await api.get('/api/blobs/library');
+
+      expect(response.status).toBe(200);
+      expect(response.body.success).toBe(true);
+      expect(response.body.data.total).toBe(1);
+      expect(response.body.data.hasMore).toBe(false);
+
+      const item = response.body.data.items[0];
+      expect(item.hash).toBe(hash1);
+      expect(item.mimeType).toBe('image/png');
+      expect(item.sizeBytes).toBe(1024);
+      expect(item.kind).toBe('image');
+      expect(item.url).toBe(`/api/blobs/${hash1}`);
+      expect(item.context.evalId).toBe('eval-1');
+      expect(item.context.evalDescription).toBe('Test eval');
+      expect(item.context.provider).toBe('GPT-4');
+      expect(item.context.pass).toBe(true);
+      expect(item.context.score).toBe(0.9);
+      // Detail-only fields should NOT be in list responses
+      expect(item.context.prompt).toBeUndefined();
+      expect(item.context.variables).toBeUndefined();
+      expect(item.context.graderResults).toBeUndefined();
+      expect(item.context.latencyMs).toBeUndefined();
+      expect(item.context.cost).toBeUndefined();
+    });
+
+    it('should return detail fields when hash filter is provided', async () => {
+      mockedIsBlobStorageEnabled.mockReturnValue(true);
+
+      const hash1 = 'a'.repeat(64);
+      const items = [
+        {
+          hash: hash1,
+          mimeType: 'image/png',
+          sizeBytes: 1024,
+          createdAt: '2025-01-01 00:00:00',
+          evalId: 'eval-1',
+          testIdx: 0,
+          promptIdx: 0,
+          location: 'response',
+          kind: 'image',
+          evalDescription: 'Test eval',
+          provider: { id: 'openai:gpt-4', label: 'GPT-4' },
+          prompt: { raw: 'Generate an image' },
+          success: true,
+          score: 0.9,
+          gradingResult: null,
+          testCase: { vars: { prompt: 'test' } },
+          latencyMs: 500,
+          cost: 0.01,
+        },
+      ];
+
+      const mockDb = createLibraryMockDb({ count: 1 }, [{ hash: hash1 }], items);
+      mockedGetDb.mockReturnValue(mockDb);
+
+      const response = await api.get(`/api/blobs/library?hash=${hash1}`);
+
+      expect(response.status).toBe(200);
+      const item = response.body.data.items[0];
+      expect(item.context.prompt).toBe('Generate an image');
+      expect(item.context.variables).toEqual({ prompt: 'test' });
+      expect(item.context.latencyMs).toBe(500);
+      expect(item.context.cost).toBe(0.01);
+    });
+
+    it('should handle string provider format (legacy)', async () => {
+      mockedIsBlobStorageEnabled.mockReturnValue(true);
+
+      const hash1 = 'b'.repeat(64);
+      const items = [
+        {
+          hash: hash1,
+          mimeType: 'audio/wav',
+          sizeBytes: 2048,
+          createdAt: 1700000000,
+          evalId: 'eval-2',
+          testIdx: 0,
+          promptIdx: 0,
+          location: null,
+          kind: null,
+          evalDescription: null,
+          provider: 'openai:tts-1',
+          prompt: null,
+          success: null,
+          score: null,
+          gradingResult: null,
+          testCase: null,
+          latencyMs: null,
+          cost: null,
+        },
+      ];
+
+      const mockDb = createLibraryMockDb({ count: 1 }, [{ hash: hash1 }], items);
+      mockedGetDb.mockReturnValue(mockDb);
+
+      const response = await api.get('/api/blobs/library');
+
+      expect(response.status).toBe(200);
+      const item = response.body.data.items[0];
+      expect(item.context.provider).toBe('openai:tts-1');
+      // Kind should be derived from mimeType when not set in reference
+      expect(item.kind).toBe('audio');
+    });
+
+    it('should indicate hasMore when more items exist beyond the page', async () => {
+      mockedIsBlobStorageEnabled.mockReturnValue(true);
+
+      const hash1 = 'c'.repeat(64);
+      const items = [
+        {
+          hash: hash1,
+          mimeType: 'image/jpeg',
+          sizeBytes: 512,
+          createdAt: '2025-06-01 12:00:00',
+          evalId: 'eval-3',
+          testIdx: 0,
+          promptIdx: 0,
+          location: null,
+          kind: 'image',
+          evalDescription: null,
+          provider: null,
+          prompt: null,
+          success: null,
+          score: null,
+          gradingResult: null,
+          testCase: null,
+          latencyMs: null,
+          cost: null,
+        },
+      ];
+
+      // Total is 5 but only 1 returned (limit=1, offset=0)
+      const mockDb = createLibraryMockDb({ count: 5 }, [{ hash: hash1 }], items);
+      mockedGetDb.mockReturnValue(mockDb);
+
+      const response = await api.get('/api/blobs/library?limit=1');
+
+      expect(response.status).toBe(200);
+      expect(response.body.data.total).toBe(5);
+      expect(response.body.data.hasMore).toBe(true);
+      expect(response.body.data.items).toHaveLength(1);
+    });
+
+    it('should accept valid filter parameters', async () => {
+      mockedIsBlobStorageEnabled.mockReturnValue(true);
+      const mockDb = createLibraryMockDb({ count: 0 }, [], []);
+      mockedGetDb.mockReturnValue(mockDb);
+
+      // Type filter
+      const res1 = await api.get('/api/blobs/library?type=image');
+      expect(res1.status).toBe(200);
+
+      // Sort parameters
+      const res2 = await api.get('/api/blobs/library?sortField=sizeBytes&sortOrder=asc');
+      expect(res2.status).toBe(200);
+
+      // Eval filter
+      const res3 = await api.get('/api/blobs/library?evalId=some-eval-id');
+      expect(res3.status).toBe(200);
+
+      // Hash filter (deep link)
+      const hash = 'd'.repeat(64);
+      const res4 = await api.get(`/api/blobs/library?hash=${hash}`);
+      expect(res4.status).toBe(200);
+    });
+
+    it('should handle grading results in detail response', async () => {
+      mockedIsBlobStorageEnabled.mockReturnValue(true);
+
+      const hash1 = 'e'.repeat(64);
+      const items = [
+        {
+          hash: hash1,
+          mimeType: 'image/png',
+          sizeBytes: 1024,
+          createdAt: '2025-01-01 00:00:00',
+          evalId: 'eval-grading',
+          testIdx: 0,
+          promptIdx: 0,
+          location: null,
+          kind: 'image',
+          evalDescription: null,
+          provider: null,
+          prompt: null,
+          success: true,
+          score: 0.75,
+          gradingResult: {
+            componentResults: [
+              { pass: true, score: 1.0, reason: 'Looks good', assertion: { type: 'human' } },
+              { pass: false, score: 0.5, reason: 'Low quality' },
+            ],
+          },
+          testCase: null,
+          latencyMs: null,
+          cost: null,
+        },
+      ];
+
+      const mockDb = createLibraryMockDb({ count: 1 }, [{ hash: hash1 }], items);
+      mockedGetDb.mockReturnValue(mockDb);
+
+      // Use hash filter to trigger detail mode
+      const response = await api.get(`/api/blobs/library?hash=${hash1}`);
+
+      expect(response.status).toBe(200);
+      const item = response.body.data.items[0];
+      expect(item.context.graderResults).toHaveLength(2);
+      expect(item.context.graderResults[0]).toEqual({
+        name: 'human',
+        pass: true,
+        score: 1.0,
+        reason: 'Looks good',
+      });
+      expect(item.context.graderResults[1]).toEqual({
+        name: 'Grader 2',
+        pass: false,
+        score: 0.5,
+        reason: 'Low quality',
+      });
+    });
+
+    it('should return 500 on database error', async () => {
+      mockedIsBlobStorageEnabled.mockReturnValue(true);
+      mockedGetDb.mockImplementation(() => {
+        throw new Error('Database connection failed');
+      });
+
+      const response = await api.get('/api/blobs/library');
+
+      expect(response.status).toBe(500);
+    });
+  });
+
+  describe('GET /api/blobs/library/evals', () => {
+    function createEvalsMockDb(evals: any[]) {
+      return {
+        selectDistinct: vi.fn().mockReturnThis(),
+        from: vi.fn().mockReturnThis(),
+        innerJoin: vi.fn().mockReturnThis(),
+        where: vi.fn().mockReturnThis(),
+        orderBy: vi.fn().mockReturnThis(),
+        limit: vi.fn().mockReturnThis(),
+        all: vi.fn().mockReturnValue(evals),
+      } as any;
+    }
+
+    beforeEach(() => {
+      vi.resetAllMocks();
+    });
+
+    afterEach(() => {
+      vi.resetAllMocks();
+    });
+
+    it('should return empty array when blob storage is disabled', async () => {
+      mockedIsBlobStorageEnabled.mockReturnValue(false);
+
+      const response = await api.get('/api/blobs/library/evals');
+
+      expect(response.status).toBe(200);
+      expect(response.body).toEqual({ success: true, data: [] });
+    });
+
+    it('should return 400 for invalid query parameters', async () => {
+      mockedIsBlobStorageEnabled.mockReturnValue(true);
+
+      const response = await api.get('/api/blobs/library/evals?limit=abc');
+
+      expect(response.status).toBe(400);
+      expect(response.body).toEqual({
+        success: false,
+        error: 'Invalid query parameters',
+      });
+    });
+
+    it('should return evals with correct shape', async () => {
+      mockedIsBlobStorageEnabled.mockReturnValue(true);
+
+      const mockEvals = [
+        {
+          evalId: 'eval-abc-123',
+          description: 'Image generation test',
+          createdAt: '2025-06-15 10:30:00',
+        },
+        {
+          evalId: 'eval-def-456',
+          description: null,
+          createdAt: 1700000000,
+        },
+      ];
+
+      const mockDb = createEvalsMockDb(mockEvals);
+      mockedGetDb.mockReturnValue(mockDb);
+
+      const response = await api.get('/api/blobs/library/evals');
+
+      expect(response.status).toBe(200);
+      expect(response.body.success).toBe(true);
+      expect(response.body.data).toHaveLength(2);
+
+      // First eval with description
+      expect(response.body.data[0].evalId).toBe('eval-abc-123');
+      expect(response.body.data[0].description).toBe('Image generation test');
+      expect(response.body.data[0].createdAt).toBeDefined();
+
+      // Second eval falls back to truncated ID
+      expect(response.body.data[1].evalId).toBe('eval-def-456');
+      expect(response.body.data[1].description).toBe('Eval eval-def');
+    });
+
+    it('should respect custom limit parameter', async () => {
+      mockedIsBlobStorageEnabled.mockReturnValue(true);
+      const mockDb = createEvalsMockDb([]);
+      mockedGetDb.mockReturnValue(mockDb);
+
+      const response = await api.get('/api/blobs/library/evals?limit=5');
+
+      expect(response.status).toBe(200);
+      expect(mockDb.limit).toHaveBeenCalledWith(5);
+    });
+
+    it('should return 500 on database error', async () => {
+      mockedIsBlobStorageEnabled.mockReturnValue(true);
+      mockedGetDb.mockImplementation(() => {
+        throw new Error('Database connection failed');
+      });
+
+      const response = await api.get('/api/blobs/library/evals');
+
+      expect(response.status).toBe(500);
+    });
+
+    it('should pass search query to where clause', async () => {
+      mockedIsBlobStorageEnabled.mockReturnValue(true);
+      const mockDb = createEvalsMockDb([]);
+      mockedGetDb.mockReturnValue(mockDb);
+
+      const response = await api.get('/api/blobs/library/evals?search=test');
+
+      expect(response.status).toBe(200);
+      expect(mockDb.where).toHaveBeenCalled();
+    });
+
+    it('should not add where clause when search is empty', async () => {
+      mockedIsBlobStorageEnabled.mockReturnValue(true);
+      const mockDb = createEvalsMockDb([]);
+      mockedGetDb.mockReturnValue(mockDb);
+
+      const response = await api.get('/api/blobs/library/evals');
+
+      expect(response.status).toBe(200);
+      // where is called with undefined (no conditions)
+      expect(mockDb.where).toHaveBeenCalledWith(undefined);
+    });
+
+    it('should reject search strings exceeding max length', async () => {
+      mockedIsBlobStorageEnabled.mockReturnValue(true);
+
+      const longSearch = 'a'.repeat(201);
+      const response = await api.get(`/api/blobs/library/evals?search=${longSearch}`);
+
+      expect(response.status).toBe(400);
+    });
+  });
+});