bitvid/issues/todo-test-coverage-gaps.md

TODO: Improve Test Coverage for Untested Areas

Source: Test coverage analysis (Feb 2026)

Context: Several areas of the codebase lack unit test coverage. This document tracks the remaining gaps after the initial test coverage expansion. Items are ordered by risk/impact.

---

P0 — Financial Correctness (js/payments/)

These files handle real money (Lightning/zap payments). Bugs here directly affect user funds. No existing tests except zapSplit, zapSharedState, and nwcClient.

[x] js/payments/lnurl.js — LNURL protocol + bech32 encoding

Exports: encodeLnurlBech32, resolveLightningAddress, fetchPayServiceData, validateInvoiceAmount, requestInvoice Testing helpers via __TESTING__: bech32Encode, bech32Decode, decodeLnurlBech32, convertWords, createChecksum Dependencies: TextEncoder/TextDecoder, fetch API Test cases needed:

• bech32 encode/decode roundtrip for various URLs
• resolveLightningAddress: lnurl-encoded input, email format (user@domain), HTTPS URL, invalid/empty input, mixed-case rejection
• fetchPayServiceData: successful fetch, HTTP errors (404/500), invalid JSON, missing callback, error status in response body, invalid metadata JSON gracefully skipped
• validateInvoiceAmount: within limits, below min, above max, zero/negative, non-numeric
• requestInvoice: valid retrieval, comment truncation based on commentAllowed, both amountSats and amountMsats, missing invoice in response, error response

[x] js/payments/zapReceiptValidator.js — Validates zap receipts from relays

Exports: validateZapReceipt(context, overrides) Returns: {status: "passed"|"failed"|"skipped", reason, event, checkedRelays} Dependencies: nostr-tools (SimplePool, event validation), bech32, sha256, bytesToHex Test cases needed:

• Missing/invalid zap request JSON → status:"skipped"
• Valid zap request but no relays specified → status:"skipped"
• Invoice description hash extraction and SHA256 matching
• Amount validation (invoice amount vs expected share, with tolerance)
• Receipt found with matching pubkey and valid signature → status:"passed"
• Receipt found with wrong pubkey → status:"failed"
• No receipt found on relays → status:"failed"
• Override injection for createPool, listEvents, decodeDescriptionHash, getAmountFromBolt11
• BOLT11 parsing: valid with description hash tag "h", without it, truncated/invalid

[x] js/payments/platformFee.js — Fee percentage parsing and clamping

Exports: parsePercentValue, clampPercent, getDefaultPlatformFeePercent, resolvePlatformFeePercent Dependencies: ../config.js (PLATFORM_FEE_PERCENT) Test cases needed:

• parsePercentValue: integers, floats, bigints, string percentages ("50%"), string fractions ("10/100"), division by zero, empty strings, whitespace
• clampPercent: 0, 50, 100, >100, <0, NaN, non-numeric → 0
• getDefaultPlatformFeePercent: valid config, invalid config → 0
• resolvePlatformFeePercent: with override (uses override), without (uses default), null/undefined → default

[x] js/payments/zapRequests.js — Zap request event creation and publishing

Exports: resolveZapRecipient, buildZapRequestPayload, signZapRequest, publishZapRequest, createAndPublishZapRequest Testing helpers via __TESTING__: normalizeRelayList, resolveLnurlTag Dependencies: lnurl.js, nostrEventSchemas, nostrPublish, signRequestQueue, RELAY_URLS Test cases needed:

• buildZapRequestPayload: all params, minimal params, created_at override, additionalTags passthrough → verify kind:9734 event structure
• signZapRequest: valid signer, timeout scenario
• publishZapRequest: relay acceptance, relay rejection → throws
• createAndPublishZapRequest: full flow, recipient doesn't support Nostr zaps, invoice fetch failure (non-fatal)
• normalizeRelayList: deduplication, empty list

[ ] js/payments/zapNotifications.js — UI notifications for zap events

Exports: showLoginRequiredToZapNotification, syncNotificationPortalVisibility Dependencies: DOM APIs, applicationContext, zapMessages Test cases needed:

• With app context (showStatus available)
• Fallback to showError
• Without app context (creates DOM portal elements)
• Auto-hide timing (configurable autoHideMs)
• Portal visibility sync based on banner state
• Multiple calls don't duplicate elements
• Accessibility attributes (aria-live, aria-label)

[ ] js/payments/platformAddress.js — Platform Lightning address from admin profile

Exports: getPlatformLightningAddress, __resetPlatformAddressCache Dependencies: config (PLATFORM_LUD16_OVERRIDE, ADMIN_SUPER_NPUB), nostrClient, nostr-tools (nip19) Test cases needed:

• PLATFORM_LUD16_OVERRIDE set → returns immediately
• No override: fetches admin kind:0 profile, extracts lud16 or lud06
• Cache TTL (10 min): fresh → returns cached, expired → re-fetches
• forceRefresh bypasses cache
• Missing ADMIN_SUPER_NPUB → null
• Relay failures → null (logged)
• nostr-tools unavailable → fallback handling

---

P0 — Identity/Feed-Critical Utilities

[ ] js/utils/hex.js — Hex normalization for Nostr pubkeys

Exports: normalizeHexString, normalizeHexId, normalizeHexPubkey Dependencies: None (pure utility) Why P0: Incorrect hex normalization breaks identity lookups silently. Test cases needed:

• Valid 64-char hex → lowercase trimmed
• Mixed case → normalized
• Whitespace → trimmed
• Non-string inputs → graceful handling
• Empty string, null, undefined

[ ] js/utils/hashtagNormalization.js — Hashtag canonicalization

Exports: normalizeHashtag, formatHashtag Dependencies: None (pure utility) Why P0: Affects feed filtering and content matching across the app. Test cases needed:

• Strip # prefix, handle ## double prefix
• Trim whitespace before and after
• Lowercase conversion
• Empty-after-strip detection
• formatHashtag adds # prefix back
• Roundtrip: normalizeHashtag → formatHashtag

---

P1 — Upload Reliability (js/storage/)

[ ] js/storage/s3-multipart.js — Multipart upload chunking

Why: Multipart upload bugs are extremely hard to debug in production. Only dmDb.js is tested in this directory. Test cases needed:

• Chunk splitting at correct sizes
• Part numbering sequence
• Upload completion/abort flows
• Progress tracking
• Error recovery for individual part failures

[ ] js/storage/s3-client.js — S3-compatible client

Test cases needed:

• Request signing
• Bucket operations
• Error response parsing
• SDK loading fallback

[ ] js/storage/r2-mgmt.js — R2 bucket management

[ ] js/storage/r2-s3.js — R2/S3 integration layer

[ ] js/services/s3UploadService.js — Upload orchestration and progress tracking

---

P1 — Content Safety (js/feedEngine/)

[ ] js/feedEngine/kidsAudienceFilterStage.js — Kids mode content filtering

Exports: createKidsAudienceFilterStage() → async filter function Dependencies: nostrService, toSet utility Why P1: Safety-critical — wrong classification shows inappropriate content to children. Test cases needed:

• Removes non-kids, NSFW, blacklisted, content-warning-flagged videos
• Warning normalization: trim().toLowerCase().replace(/[\s_]+/g, "-")
• Array/string/Set warning inputs; comma/semicolon/pipe delimiters
• Context fallback: runtime → config → fallback defaults
• Empty video lists, null video objects

[ ] js/feedEngine/kidsScoring.js — Kids content scoring (0-1 clamped)

Exports: createKidsScorerStage() → async scoring function Dependencies: normalizeHashtag, toSet, isPlainObject Key factors: age-appropriateness (0.35), educational (0.25), author trust (0.15), popularity (0.1), freshness (0.1), safety multiplier (0.6 weight) Test cases needed:

• Individual factor calculations at boundaries
• Clamping edge cases (NaN, Infinity → 0 or 1)
• Exponential freshness decay with various half-lives
• Safety penalty stacking (trusted reports + muted)
• Weight override resolution order: options → runtime → config
• Metadata injection correctness (kidsScore, components)

[ ] js/feedEngine/sorters.js — Feed sorting strategies

Exports: createChronologicalSorter(), createExploreDiversitySorter(), createKidsScoreSorter() Test cases needed:

• Chronological: timestamp resolution path priority (hook → rootCreatedAt → nip71Source → created_at), trustedMuted items sunk to end
• MMR diversity: cosine similarity on zero vectors, NaN handling, lambda=0 (pure diversity) vs lambda=1 (pure relevance)
• Kids score: desc score → desc timestamp → video ID tiebreak

---

P1 — DM UI Components (js/ui/dm/)

Why: 14 files, zero tests. Growing feature area with complex state management.

[ ] js/ui/dm/MessageBubble.js — Individual message rendering

[ ] js/ui/dm/Composer.js — Message composition UI

[ ] js/ui/dm/DMPrivacySettings.js — Privacy configuration

[ ] js/ui/dm/MessageThread.js — Message thread display

[ ] js/ui/dm/NotificationCenter.js — Notification handling

[ ] js/ui/dm/ConversationList.js — Conversation list rendering

[ ] js/ui/dm/ZapInterface.js — In-chat zap sending

[ ] js/ui/dm/ZapReceiptList.js — Zap receipt display

[ ] js/ui/dm/ContactRow.js — Contact list item

[ ] js/ui/dm/Avatar.js — Profile avatar display

[ ] js/ui/dm/AppShell.js — DM app shell layout

[ ] js/ui/dm/DayDivider.js — Date separator between messages

[ ] js/ui/dm/index.js — Module entry point

---

P2 — Playback Failure Modes

[ ] js/services/playbackService.js — Additional failure/fallback path tests

Existing tests: playbackService.test.mjs (3 variants: base, forcedSource, order) What's missing: The URL→magnet fallback chain is documented as the most fragile path. Test cases to add:

• No video element → error path
• No playable source (no URL, bad magnet)
• Probe HEAD timeout → triggers torrent fallback
• Playback stall (8s default watchdog) → triggers fallback
• Unsupported BTIH magnet format
• Autoplay blocked (NotAllowedError) → wait for user play → restore watchdog
• Race conditions: request signature matching, overlapping session cleanup
• effectiveTimeout=0 when forcedSource set
• Watchdog cleanup before new session

---

P2 — View Managers

[ ] js/forYouView.js — "For You" feed with empty state lifecycle

Exports: initForYouView(), ForYouView class Test focus: MutationObserver lifecycle, empty state injection/removal, action button delegation

[ ] js/exploreView.js — Explore feed

Test focus: Same empty state management pattern as forYouView

[ ] js/searchView.js — Search results with profile/video dual search

Exports: initSearchView() + internal helpers Test focus: Token cancellation for stale searches, JSON.parse failures, filter state persistence, relay search fallback to local

[ ] js/hashView.js — Hash-based view routing

Exports: getHashViewName(), setHashView(viewName, options) Test focus: Regex extraction, URL param manipulation, modal/v param preservation

[ ] js/kidsView.js — Kids-only feed

Test focus: Same pattern as exploreView

---

P2 — UI Modal Components

[ ] js/ui/ModalManager.js — Modal lifecycle management

[ ] js/ui/components/DeleteModal.js — Delete confirmation (destructive operation)

[ ] js/ui/components/UploadModal.js — Upload flow (destructive operation)

[ ] js/ui/components/EditModal.js — Edit modal

[ ] js/ui/components/SearchFilterModal.js — Search filter UI

[ ] js/ui/components/EventDetailsModal.js — Event details display

[ ] js/ui/initEditModal.js — Edit modal initialization

[ ] js/ui/initDeleteModal.js — Delete modal initialization

---

P2 — Utilities (js/utils/)

[ ] js/utils/logger.js — Logger with dev/user channels

Exports: logger, devLogger, userLogger, isCompatibleLogger Test focus: Console fallback chain, force flag parsing, dev mode gating, noop fallback for missing console

[ ] js/utils/profileBatchFetcher.js — Batch profile fetching

Exports: batchFetchProfilesFromRelays Test focus: Pubkey validation (HEX64), cache hit bypass, newest-by-timestamp dedup, malformed JSON handling, relay timeouts

[ ] js/utils/domUtils.js — DOM helpers

[ ] js/utils/storage.js — localStorage abstraction

[ ] js/utils/storagePointer.js — Storage pointer helpers

[ ] js/utils/videoTimestamps.js — Timestamp parsing

[ ] js/utils/videoPointer.js — Video pointer utilities

[ ] js/utils/torrentHash.js — Torrent hash utilities

[ ] js/utils/linkPreviewSettings.js — Link preview config

[ ] js/utils/profileMedia.js — Profile media handling

[ ] js/utils/qrcode.js — QR code generation

---

P3 — Infrastructure Improvements

[ ] Add coverage reporting

Details: Add --experimental-test-coverage to Node.js test runner (available since Node 20) or integrate c8. This gives concrete numbers and trend tracking for CI.

[ ] Worker test harness

Details: Web Worker code (dmDecryptWorker.js, nip04Worker.js) can't be tested in JSDOM. Consider vitest with @vitest/web-worker or a lightweight worker polyfill.

[ ] Fix flaky E2E tests

Details: KNOWN_ISSUES.md documents broken E2E tests: modal timeouts, missing elements, undefined functions. Fix these to restore CI confidence.

---

P3 — Low Priority / Hard to Test

Nostr Workers (need worker harness)

• js/nostr/dmDecryptWorker.js
• js/nostr/dmDecryptWorkerClient.js
• js/nostr/nip04Worker.js
• js/nostr/nip04WorkerClient.js

Diagnostic/Debug Files

• js/nostr/countDiagnostics.js
• js/nostr/maxListenerDiagnostics.js

Remaining UI Components

• js/ui/watchHistoryController.js
• js/ui/profileIdentityController.js
• js/ui/ambientBackground.js
• js/ui/components/FeedInfoPopover.js
• js/ui/components/EmbedVideoModal.js
• js/ui/components/RevertModal.js
• js/ui/components/ShareNostrModal.js

---

E2E Test Gaps

Only 6 E2E tests exist. Consider adding:

• Full upload flow (video file → published note)
• Video playback fallback scenarios (URL → magnet)
• Authentication flows (NIP-07, NIP-46 connection)
• Relay switching behavior under failure conditions
• Watch history persistence and sync
• DM conversation flow

---

Notes

• When adding tests, follow existing patterns in tests/ directory
• Use node:test and node:assert/strict for unit tests
• Use Playwright for E2E tests
• Mock external dependencies (nostr-tools, relays) appropriately
• Run npm run test:unit to verify new tests pass
• Files exposing __TESTING__ objects provide internal helpers for white-box testing
• Payment files are pure-ish logic (no DOM) — good candidates for straightforward unit tests