Skip to content

Major upgrade to Jest 30#19981

Closed
cd-bitwarden wants to merge 46 commits intomainfrom
Jest
Closed

Major upgrade to Jest 30#19981
cd-bitwarden wants to merge 46 commits intomainfrom
Jest

Conversation

@cd-bitwarden
Copy link
Copy Markdown
Contributor

@cd-bitwarden cd-bitwarden commented Apr 3, 2026

🎟️ Tracking

https://bitwarden.atlassian.net/jira/software/c/projects/BW/boards/99?assignee=625cb516fd06270069beaf5d&selectedIssue=SM-1762

Summarized Changes:

  1. Window.location unmockability: jsdom doesn't allow mocking window.location directly (non-configurable), so I created wrapper functions instead of trying to mock the property itself.
  2. LocationService wrapper (apps/browser/src/autofill/services/location.service.ts): Created mockable service for browser autofill with methods like getHref(), getHostname(), getProtocol().
  3. Connector location wrappers (apps/web/src/connectors/common.ts): Added mockable functions getLocationHref(), getLocationOrigin(), getLocationHostname() with security validation (protocol whitelisting, hostname format checking).
  4. Module isolation pattern (common.spec.ts, webauthn.spec.ts): Switched from module-level jest.mocked() to jest.isolateModules() blocks so internal function calls see mocked versions.
  5. XSS hardening: Added security documentation and input validation to location wrapper functions (silent failures on invalid input).
  6. Type suppression: Replaced commented-out mocks with @ts-expect-error comments for jest-mock-extended v4 generic type issues.
  7. Test skipping: Added .skip to tests that depend on problematic window property mocking (window.location, window.top, etc.).

📔 Objective

Upgrade Jest to V30, skip all tests that are not easily fixed (these will be assigned to respective teams and fixed at a later time)

The following files will be sorted and assigned to teams to be fixed and the .skips removed
@bitwarden/team-autofill-dev (Autofill team)

  • apps/browser/src/autofill/fido2/content/messaging/messenger.spec.ts
  • apps/browser/src/autofill/fido2/content/fido2-content-script.spec.ts
  • apps/browser/src/autofill/notification/bar.spec.ts
  • apps/browser/src/autofill/services/dom-element-visibility.service.spec.ts
  • apps/browser/src/autofill/services/autofill-overlay-content.service.spec.ts
  • apps/browser/src/autofill/fido2/content/fido2-page-script.webauthn-unsupported.spec.ts
  • apps/browser/src/autofill/fido2/content/fido2-page-script.webauthn-supported.spec.ts

@bitwarden/team-auth-dev (Auth team)

  • apps/web/src/app/auth/core/services/link-sso.service.spec.ts
  • apps/web/src/connectors/common.spec.ts
  • apps/web/src/connectors/duo-redirect.spec.ts
  • apps/web/src/connectors/sso.spec.ts
  • apps/web/src/connectors/webauthn.spec.ts
  • libs/angular/src/auth/guards/redirect-to-vault-if-unlocked/redirect-to-vault-if-unlocked.guard.spec.ts
  • libs/angular/src/auth/guards/auth.guard.spec.ts
  • libs/angular/src/auth/guards/lock.guard.spec.ts
  • libs/angular/src/auth/guards/tde-decryption-required.guard.spec.ts
  • libs/angular/src/auth/guards/unauth.guard.spec.ts
  • libs/auth/src/common/login-strategies/password-login.strategy.spec.ts

@bitwarden/team-platform-dev (Platform team)

  • apps/browser/src/platform/browser/browser-api.spec.ts
  • apps/web/src/app/settings/appearance.component.spec.ts
  • libs/common/src/platform/services/migration-runner.spec.ts
  • libs/common/src/services/api.service.spec.ts
  • libs/angular/src/platform/guard/feature-flag.guard.spec.ts

@bitwarden/team-tools-dev (Tools team)

  • libs/common/src/tools/rx.spec.ts
  • libs/importer/src/importers/lastpass/lastpass-csv-importer.spec.ts
  • libs/importer/src/importers/firefox-csv-importer.spec.ts
  • libs/importer/src/importers/safari-csv-importer.spec.ts
  • libs/importer/src/importers/zohovault-csv-importer.spec.ts
  • libs/tools/generator/core/src/engine/password-randomizer.spec.ts

@bitwarden/team-vault-dev (Vault team)

  • libs/common/src/vault/services/totp.service.spec.ts
  • libs/common/src/vault/services/default-cipher-archive.service.spec.ts

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Apr 3, 2026

Logo
Checkmarx One – Scan Summary & Detailsf2c52e08-3976-440c-8ad2-c54708378638


New Issues (5) Checkmarx found the following issues in this Pull Request
# Severity Issue Source File / Package Checkmarx Insight
1 HIGH Client_DOM_XSS apps/web/src/connectors/common.ts: 81
detailsThe method setLocationHref embeds untrusted data in generated output with href, at line 98 of /apps/web/src/connectors/common.ts. This untrusted ...
Attack Vector
2 MEDIUM Client_DOM_Open_Redirect apps/web/src/connectors/common.ts: 81
detailsThe potentially tainted value provided by href in /apps/web/src/connectors/common.ts at line 81 is used as a destination URL by replace in /apps/w...
Attack Vector
3 MEDIUM Client_DOM_Open_Redirect apps/web/src/connectors/common.ts: 81
detailsThe potentially tainted value provided by href in /apps/web/src/connectors/common.ts at line 81 is used as a destination URL by replace in /apps/w...
Attack Vector
4 MEDIUM Client_DOM_Open_Redirect apps/web/src/connectors/common.ts: 81
detailsThe potentially tainted value provided by href in /apps/web/src/connectors/common.ts at line 81 is used as a destination URL by href in /apps/web/...
Attack Vector
5 MEDIUM Missing_HSTS_Header apps/cli/src/auth/commands/login.command.ts: 571
detailsThe web-application does not define an HSTS header, leaving it vulnerable to attack.
Attack Vector

Fixed Issues (8) Great job! The following issues were fixed in this Pull Request
Severity Issue Source File / Package
CRITICAL CVE-2026-33937 Npm-handlebars-4.7.8
HIGH CVE-2026-33938 Npm-handlebars-4.7.8
HIGH CVE-2026-33939 Npm-handlebars-4.7.8
HIGH CVE-2026-33940 Npm-handlebars-4.7.8
HIGH CVE-2026-33941 Npm-handlebars-4.7.8
HIGH Client_DOM_XSS apps/web/src/connectors/redirect.ts: 6
MEDIUM CVE-2026-3449 Npm-@tootallnate/once-2.0.0
MEDIUM Client_DOM_Open_Redirect apps/web/src/connectors/redirect.ts: 6

cd-bitwarden and others added 13 commits April 7, 2026 11:05
…wide-scale

// test-utils/set-test-url.ts
export function setTestUrl(url: string) {
  window.history.replaceState({}, "", url);
}

then replace
globalThis.location = { href: "https://example.com/foo?bar=1" } as Location;
window.location.href = "https://example.com/foo?bar=1";

with

setTestUrl("https://example.com/foo?bar=1");
- Marked 14 tests as .skip in webauthn.spec.ts
- Tests attempt to redefine window.location which jsdom forbids
- Added clear comments explaining why each test is skipped
- Remaining 7 unit tests still pass

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
- Commented out jest.spyOn(globalThis, 'location', 'get') in beforeEach
- Commented out Object.defineProperty calls in afterEach
- Marked 10 tests as .skip that depend on these incompatible mocks
- All 54 tests now pass (44 pass, 10 skip)

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
This commit replaces direct window.location access with mockable wrapper methods
to avoid jsdom limitations where location properties are not configurable.

Changes:
- Created LocationService class in browser autofill module with mockable methods
  (getHref, getHostname, getProtocol, setHref, reload)
- Created wrapper functions in web connectors' common.ts
  (getLocationOrigin, setLocationHref, getLocationHostname)
- Updated all source files to use wrapper methods instead of direct window.location
- Injected LocationService as optional dependency into InsertAutofillContentService
- Refactored webauthn.spec.ts tests to mock wrapper functions via jest.mock
- Refactored insert-autofill-content.service.spec.ts to use mock LocationService
- Removed all Object.defineProperty window.location comments and .skip marks
- Tests can now spy on wrapper methods instead of trying to redefine location

This enables tests to control location values without triggering jsdom errors,
and maintains production behavior through real window.location access.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
Comment thread apps/web/src/connectors/common.ts Fixed
Comment thread apps/web/src/connectors/common.ts Fixed
cd-bitwarden and others added 5 commits April 7, 2026 15:49
- Added currentlyInSandboxedIframe mock to browser autofill tests
- Simplified webauthn test setup to not attempt mocking window.location.href via getQsParam
- All 54 browser autofill tests now pass
- 16 webauthn tests pass, 5 tests with deeplinkScheme parameter fail (require window.location.href mocking)

The deeplinkScheme tests fail because getQsParam reads window.location.href directly,
which cannot be mocked in jsdom without refactoring getQsParam as a wrapper method.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
11 tests skipped - these tests depend on getQsParam which reads window.location.href
directly and cannot be mocked in jsdom without refactoring getQsParam as a wrapper method.

10 tests still pass (resolveWebauthnCallbackUri unit tests and basic functionality).

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
@codecov
Copy link
Copy Markdown

codecov Bot commented Apr 7, 2026

Codecov Report

❌ Patch coverage is 37.25490% with 32 lines in your changes missing coverage. Please review.
✅ Project coverage is 45.75%. Comparing base (c8b0f25) to head (cd768cf).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Files with missing lines Patch % Lines
apps/web/src/connectors/common.ts 39.13% 13 Missing and 1 partial ⚠️
.../browser/src/autofill/services/location.service.ts 16.66% 5 Missing ⚠️
apps/web/src/connectors/redirect.ts 0.00% 4 Missing ⚠️
apps/web/src/connectors/sso.ts 25.00% 3 Missing ⚠️
...ofill/services/collect-autofill-content.service.ts 50.00% 1 Missing and 1 partial ⚠️
apps/web/src/connectors/duo-redirect.ts 33.33% 2 Missing ⚠️
...b/src/connectors/platform/proxy-cookie-redirect.ts 0.00% 2 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main   #19981      +/-   ##
==========================================
- Coverage   46.96%   45.75%   -1.21%     
==========================================
  Files        3889     3890       +1     
  Lines      117180   117217      +37     
  Branches    17920    17923       +3     
==========================================
- Hits        55033    53637    -1396     
+ Misses      59669    59537     -132     
- Partials     2478     4043    +1565     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

cd-bitwarden and others added 8 commits April 7, 2026 19:20
- Commented out unused stateVersion variable declaration and assignment
- Added eslint-disable comments for mock implementations with type errors
- Removed TypeScript type mismatches in feature flag mock implementations
- Tests now pass type checking and ESLint validation

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
- Added .skip to 7 tests that use boolean true/false values
- Boolean mock implementation is commented out due to TypeScript type error
- Kept 2 string value tests that have working mock implementations
- Reason: ❌ Commented out: TypeScript type error in mock implementation

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
- unauth.guard.spec.ts: describe.skip
- auth.guard.spec.ts: describe.skip (already was)
- lock.guard.spec.ts: describe.skip
- tde-decryption-required.guard.spec.ts: describe.skip
- redirect-to-vault-if-unlocked.guard.spec.ts: describe.skip
- feature-flag.guard.spec.ts: describe.skip + removed individual it.skip
- migration-runner.spec.ts: describe.skip (already was)

Reason: All tests have broken mock implementations due to TypeScript type errors

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
- Deleted .claude/settings.local.json
- Deleted .claude/scheduled_tasks.lock
- Deleted apps/.claude/settings.local.json
- Deleted apps/web/.claude/settings.local.json
- Deleted JEST_V30_UPGRADE_REPORT.md (temporary report file)

These are local development files that shouldn't be in the PR.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
@cd-bitwarden cd-bitwarden requested a review from a team as a code owner April 10, 2026 18:55
@cd-bitwarden cd-bitwarden changed the title testing out this claude update to jest 30 Major upgrade to Jest 30 Apr 14, 2026
Copy link
Copy Markdown
Contributor

@djsmith85 djsmith85 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@cd-bitwarden: Looking at the release blog post and the migration guide the majority of breaking changes are easily addressable. With the location one mentioned by you being the hardest to solve.

Due to the sheer size of this PR and partially skipping valid test cases without a immediate plan to enable them, may I suggest to split this up.

Starting with enabling this eslint rule on Jest 29. This has a autofix available and prevent new ones from occurring until the migration to Jest 30 is completed. This will probably be a larger PR involving multiple teams, but the review will be easy as the change were automated and follow a repeating pattern.

Once that is merged, revisit what is left on this PR. Ideally removing the need to skip any test cases.

@sonarqubecloud
Copy link
Copy Markdown

@bw-ghapp
Copy link
Copy Markdown
Contributor

bw-ghapp Bot commented Apr 17, 2026

Changes in this PR impact the Autofill experience of the browser client

BIT has tested the core experience with these changes and the feature flag configuration used by vault.bitwarden.com.

✅ Fortunately, these BIT tests have passed! 🎉

@bw-ghapp
Copy link
Copy Markdown
Contributor

bw-ghapp Bot commented Apr 17, 2026

Changes in this PR impact the Autofill experience of the browser client

BIT has tested the core experience with these changes and all feature flags disabled.

✅ Fortunately, these BIT tests have passed! 🎉

@quexten quexten requested review from quexten and removed request for a team, mzieniukbw and quexten April 17, 2026 07:19
@quexten
Copy link
Copy Markdown
Contributor

quexten commented Apr 17, 2026

@cd-bitwarden Looks like @bitwarden/team-key-management-dev was not actually required. I've removed the request for review. Please let me know if you do want a review on anything.

@cd-bitwarden cd-bitwarden marked this pull request as draft April 17, 2026 13:26
@cd-bitwarden
Copy link
Copy Markdown
Contributor Author

Closing this, in favor of a simpler upgrade that doesn't involve a direct dependency with jest-environment-jsdom that has breaking changes. New PR #20211

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants