The old file asserted on string literals it defined itself (e.g.
expect(".eq('space_id', ...)").toContain('space_id')) and never invoked an
action, so it stayed green regardless of the code — false confidence on exactly
the authz/scoping it claimed to cover.
Rewrite drives the real updateMember/removeMember/logCashPayment through a
recording mock Supabase client and asserts: unauthenticated + non-privileged
callers are rejected with no write; admin/treasurer writes are pinned to the
caller's own space_id (the IDOR guard). Removing a role gate or a space_id
scope now fails a test.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Set up Vitest for unit/integration tests and Playwright for E2E tests; add configs, tests, and documentation
Co-authored-by: Moheeb Zara <1184415+virgilvox@users.noreply.github.com>
Moheeb ZaraandClaude Opus 4.8
v0andMoheeb Zara