[Wycode569]

Summary

Expands/adds unit test coverage for four under-tested modules identified in the Wave 10 batch: the safe static path resolver, the service health check utility, OpenTelemetry tracing setup, and the database pool configuration (which previously had no tests at all).

Closes #595
Closes #596
Closes #603
Closes #606

Changes

#595 - safe-static-path.ts

• Added a symlink attacks describe block to tests/unit/utils/safe-static-path.test.ts using real on-disk symlinks (via fs.mkdtempSync/fs.symlinkSync).
• Covers a filename that is itself a symlink pointing outside the upload dir, and an upload dir that is itself a symlink, confirming resolveSafeStaticPath stays confined to the configured upload dir in both cases (it only does string-path resolution, never fs.realpath, so this documents and locks in that behavior).

#596 - service-health.ts

• Added cases to tests/unit/utils/service-health.test.ts: default-timeout fallback (no explicit timeoutMs passed), latency recorded on an immediate rejection, that the observed Prometheus seconds value is consistent with the returned latencyMs, and that concurrent checks for different services are each labeled correctly.

#603 - tracing.ts

• Added assertions in tests/unit/tracing.test.ts for the OTLP exporter endpoint (default and custom), the resource's service.name attribute (default and custom), that all four instrumentations (Fastify/HTTP/Pg/IORedis) are registered, and that NodeSDK.start() is called.
• Added a new span creation and context propagation block that exercises the real @opentelemetry/api (not the mocked NodeSDK) with AsyncHooksContextManager registered, covering: span creation, a parent span propagating through context.with(), a child span sharing the parent's trace ID, and that an active span doesn't leak outside its context.with() scope.

#606 - database.ts

• New file tests/unit/config/database.test.ts (none existed before). Mocks pg and drizzle-orm/node-postgres so nothing attempts a real connection. Covers: DATABASE_URL wiring (both postgresql:// and postgres:// schemes), pool size/timeout settings (max, idleTimeoutMillis, connectionTimeoutMillis), the pool's error handler logging via logger.error instead of crashing, drizzle being wired to the pool, the exported pool reference, and closeDatabase() ending the pool.

Test plan

• npx vitest run on the four touched/added files: 38/38 passing.
• Full baseline comparison: ran npx vitest run on a clean npm ci worktree off upstream/main and on this branch, diffed the sorted FAIL file lists. Identical 71 pre-existing failures on both (all e2e/contract/integration tests requiring a live Postgres/Redis, unrelated to this change). Zero new regressions.
• npx prettier --write and npx eslint run clean on all touched files.

Caveats

• The repo-wide test suite has 71 pre-existing failing suites (mostly tests/e2e/, tests/contract/) that require live DB/Redis infra not available in this sandbox, confirmed pre-existing via the baseline diff above, not introduced by this PR.
• src/tracing.ts is excluded from the coverage config's include list already; these tests still exercise its exported behavior directly.

[drips-wave]

@Wycode569 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits