OUT-3671: setup vitest and add DropboxClient isolation test

[SandipBajracharya]

Summary

• Set up Vitest as the test runner: vitest, vite-tsconfig-paths, Node environment, tsconfig path-alias support, server-only stub, env placeholders for Zod-validated server modules.
• Added pnpm test (run-once) and pnpm test:watch scripts.
• First test src/lib/dropbox/__tests__/DropboxClient.isolation.test.ts — locks in the per-instance isolation invariant for DropboxClient / DropboxAuthClient / underlying SDK authInstance so a future module-level cache fails CI loudly.
• Includes prior commit on this branch: hotfix for Assembly webhook event validation (object !== 'link' check, atomic && instead of mistaken ||).

Scope note

The isolation test verifies a constructor-level structural invariant only — it is a regression tripwire, not a proof of absence of cross-tenant credential leaks. That claim still rests on the manual code audit captured in OUT-3671's description.

Test plan

• pnpm test passes locally (3/3)
• pnpm typecheck clean
• pnpm lint clean
• Sanity check: temporarily introducing a module-level cached DropboxAuthClient causes the isolation test to fail (verified during development)

Follow-ups (tracked, not in this PR)

• Wire pnpm test into .husky/pre-push
• Add CI step (GitHub Actions) running pnpm test on every PR
• Broader test coverage — webhook handlers, Trigger.dev tasks, mocked Dropbox SDK

🤖 Generated with Claude Code

[linear-code]

OUT-3671 Dropbox: Setup vitest and CI test mechanisms

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
dropbox-integration	Ready	Preview, Comment	May 4, 2026 7:01am

[greptile-apps]

Greptile Summary

This PR wires up Vitest as the test runner with proper TypeScript path-alias support and a server-only stub, then adds the first isolation test that locks in the per-constructor independence invariant of DropboxClient / DropboxAuthClient / the underlying DropboxAuth instance across both same- and different-token scenarios. The implementation is clean: env stubs use ??= so CI values are never clobbered, the server-only alias correctly resolves to an empty export, and all three layers of the client tree (dbxAuthClient, authInstance, clientInstance via getDropboxClient()) are asserted in every test case.

Confidence Score: 5/5

Safe to merge — test-infrastructure only change with no production code paths altered.

No P0 or P1 findings. All three client-tree layers are correctly asserted. Env stubs are safe. The vitest config is minimal and correct. The previous review comments about missing getDropboxClient() assertions have been fully addressed in the final test file.

No files require special attention.

Important Files Changed

Filename	Overview
src/lib/dropbox/tests/DropboxClient.isolation.test.ts	New isolation test covering per-instance uniqueness of dbxAuthClient, authInstance, and clientInstance (via getDropboxClient()) for both same- and different-token scenarios; assertions target public/readonly fields and the public accessor method.
vitest.config.ts	Clean vitest config with tsconfigPaths plugin, server-only alias stub, node environment, and correct include glob; no issues found.
vitest.setup.ts	Placeholder env-var setup using ??= so real CI values are never overwritten; covers all vars consumed by Zod-validated server modules at import time.
test/stubs/server-only.ts	Correct minimal stub (empty export) that satisfies the server-only import without triggering its throw.
package.json	Added test/test:watch scripts and vitest + vite-tsconfig-paths as devDependencies; changes are minimal and appropriate.
pnpm-lock.yaml	Lockfile updated to reflect new vitest and vite-tsconfig-paths entries; no manual edits required.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[vitest run] --> B[vitest.setup.ts\nInjects placeholder env vars via ??=]
    B --> C[DropboxClient.isolation.test.ts]

    C --> D[Test 1: different refresh tokens]
    C --> E[Test 2: same refresh token]

    D --> F[new DropboxClient\nrefreshTokenA]
    D --> G[new DropboxClient\nrefreshTokenB]
    E --> H[new DropboxClient\nrefreshTokenA]
    E --> I[new DropboxClient\nrefreshTokenA]

    F --> J{Assert isolation}
    G --> J
    H --> K{Assert isolation}
    I --> K

    J --> L[dbxAuthClient not same ref]
    J --> M[authInstance not same ref]
    J --> N[getDropboxClient not same ref]

    K --> L
    K --> M
    K --> N

    subgraph Config
        V[vitest.config.ts]
        V --> P[tsconfigPaths plugin\n@ alias resolution]
        V --> Q[server-only alias\n to test/stubs/server-only.ts]
        V --> R[environment: node]
    end

Loading

_{Reviews (2): Last reviewed commit: "test(OUT-3671): cover clientInstance and..." | Re-trigger Greptile}

[SandipBajracharya]

@greptileai

[priosshrsth]

lgtm