gorkem-bwl
ed268b3099
Adds a regression suite for #3843 so the leak cannot return silently. The client had no test runner, so this introduces Vitest, which reuses the existing Vite resolution and the `@/` alias rather than needing a separate transform pipeline. jsdom is required because the logger reads window.location and navigator.userAgent. The tests drive the exported `logger` rather than the private redaction helpers, so they cover the wiring as well as the logic. That distinction matters here: the first attempt at this fix redacted the JSON branch but left the debug branch printing raw objects, a gap that testing the helper in isolation would not have caught. Each case runs at both error and debug level for the same reason. Covered: the reported login payload, credentials carried on an AxiosError (config.data and the Authorization header), non-JSON request bodies, passwords on class instances, key-matching variants, and circular payloads. One asserts non-sensitive context survives, so redaction cannot regress into blanket suppression. Verified by reverting the fix: 16 of 23 tests fail against the original behaviour, including a pre-existing crash on circular payloads.
This directory contains the client side (frontend) of Checkmate.