Skip to main content

Run smoke tests

Automated Smoke Workflow​

GitHub Actions runs SABLE Smoke on a weekday schedule and by manual dispatch. It requires these repository secrets:

  • SUPABASE_ACCESS_TOKEN
  • SUPABASE_PROJECT_REF

The smoke workflow uses the Supabase Management API for the migration list, checks function inventory, and checks the live auth gates for asana-act, fathom-webhook, and email-webhook. It does not require a direct database connection string. Use synthetic request bodies and confirm the project ref before manually dispatching a live smoke run.

Local Helper Tests​

node --test supabase/tests/*.test.mjs web/tests/*.test.mjs

Expected: all tests pass.

Migration State​

cd supabase
supabase migration list

Expected: every local migration through the latest migrations/*.sql file is applied remotely.

Function Inventory​

supabase functions list

Expected active functions include:

  • fathom-sync
  • fathom-webhook
  • asana-sync
  • asana-act
  • calendar-act
  • toggl-sync
  • drive-sync
  • hubspot-sync
  • calendar-sync

Auth Gate Check​

Protected functions should reject anonymous requests:

curl -s -i -X POST https://fvngkfrmienkltuwtoxa.supabase.co/functions/v1/asana-act \
  -H 'content-type: application/json' \
  --data '{"approvalId":"00000000-0000-0000-0000-000000000000"}'

Expected: 401 from Supabase gateway for missing auth.

Fathom Webhook Gate Check​

An unsigned request should be rejected when FATHOM_WEBHOOK_SECRET is configured. Confirm the secret's presence through the approved operator path; this page does not establish current state.

curl -s -i -X POST https://fvngkfrmienkltuwtoxa.supabase.co/functions/v1/fathom-webhook \
  -H 'content-type: application/json' \
  --data '{"recording_id":"smoke"}'

Expected: 401 with an invalid signature message.

Docs Build​

cd docs-site
npm run build

Expected: Docusaurus build succeeds with no broken links.

Check customer portal boundaries​

Run the complete customer portal release checklist when portal schema, access, reviews, files, notifications, or workers change. At minimum, verify:

  • Anonymous portal API calls return 401
  • Client A cannot read or mutate Client B
  • A revoked member receives 403 with an existing Auth token
  • Viewer and reviewer capabilities remain distinct
  • Consultants stay within exact active or current project assignments
  • Stale writes return 409 and idempotent retries create one receipt
  • Released resources and Ask SABLE exclude internal or unpublished evidence
  • Publication inventory counts match customer-visible resources and direct updates
  • Publish, stale-revision rejection, idempotent replay, and withdrawal work for one synthetic resource
  • A real supported file completes the signed upload and download path
  • Notification health mode succeeds without dispatching email