test(unit): add a unit-test layer (backend cargo + frontend vitest)

The suite was almost entirely e2e; pure logic had no direct coverage. Add fast, DB-free unit tests on both sides. Backend (cargo test — inline #[cfg(test)] modules): - rate_limiter: allow-up-to-max-then-block, per-key independence, sliding-window expiry, retry-after bounds, clear(), and client_ip X-Forwarded-For parsing (first entry / whitespace-trim / fallback). - sse_tickets: single-use consume (replay → None), unknown ticket, uniqueness + hex shape, prune keeps fresh tickets, and an expired ticket (injected past-TTL entry) consumes to None. - hashtag: fill the boundary gaps the 3 existing tests missed — stop-at-non-word, the 40-char cap (drops, doesn't truncate), no-dedup contract, and the German umlaut truncation limitation (pinned so a future Unicode fix is deliberate). Frontend (Vitest — new, standalone config that stubs $app/environment so server-safe module paths import cleanly under node): - avatar: avatarPalette (neutral for empty, deterministic, real palette entry) and initials (?, single word, two words, whitespace collapse). - data-mode-store: pickMediaUrl across original/saver modes and the preview→thumbnail→original fallback chain. - `npm run test:unit` script added. Backend: 20 passing. Frontend: 11 passing. svelte-check: 0 errors. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-01 19:14:33 +02:00
parent fabc6af656
commit 723a492d44
9 changed files with 606 additions and 3 deletions
--- a/backend/src/models/hashtag.rs
+++ b/backend/src/models/hashtag.rs
@@ -109,4 +109,38 @@ mod tests {
    fn empty_or_bare_hash_skipped() {
        assert_eq!(extract_hashtags("# #"), Vec::<String>::new());
    }
+
+    #[test]
+    fn tag_stops_at_first_non_word_char() {
+        // A tag runs until the first char that isn't ascii-alphanumeric or '_'.
+        assert_eq!(extract_hashtags("#foo#bar"), vec!["foo"]);
+        assert_eq!(extract_hashtags("#foo-bar"), vec!["foo"]);
+        assert_eq!(extract_hashtags("##tag"), Vec::<String>::new()); // '#' after the strip is non-word
+    }
+
+    #[test]
+    fn tag_length_is_capped_at_40_chars() {
+        let ok = "a".repeat(40);
+        assert_eq!(extract_hashtags(&format!("#{ok}")), vec![ok.clone()]);
+        // 41+ chars → dropped entirely (not truncated).
+        let too_long = "a".repeat(41);
+        assert_eq!(extract_hashtags(&format!("#{too_long}")), Vec::<String>::new());
+    }
+
+    #[test]
+    fn duplicate_tags_are_returned_verbatim_not_deduplicated() {
+        // Dedup is the DB's job (Hashtag::upsert ON CONFLICT); extraction returns each
+        // occurrence so callers can count/link them independently. Case folds to lower.
+        assert_eq!(extract_hashtags("#fun #Fun #fun!"), vec!["fun", "fun", "fun"]);
+    }
+
+    #[test]
+    fn non_ascii_word_chars_truncate_the_tag() {
+        // KNOWN LIMITATION for a German app: `is_ascii_alphanumeric` excludes umlauts
+        // and ß, so a tag truncates at the first non-ASCII letter. Pinned here so a
+        // future Unicode-aware change is a deliberate, test-visible decision.
+        assert_eq!(extract_hashtags("#Grüße"), vec!["gr"]);
+        assert_eq!(extract_hashtags("#Straße"), vec!["stra"]);
+        assert_eq!(extract_hashtags("#café"), vec!["caf"]);
+    }
 }
--- a/backend/src/services/rate_limiter.rs
+++ b/backend/src/services/rate_limiter.rs
@@ -81,3 +81,74 @@ pub fn client_ip(headers: &axum::http::HeaderMap, fallback: &str) -> String {
        .map(|s| s.trim().to_owned())
        .unwrap_or_else(|| fallback.to_owned())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use axum::http::HeaderMap;
+
+    const MIN: Duration = Duration::from_secs(60);
+
+    #[test]
+    fn allows_up_to_max_then_blocks() {
+        let rl = RateLimiter::new();
+        assert!(rl.check("k", 3, MIN));
+        assert!(rl.check("k", 3, MIN));
+        assert!(rl.check("k", 3, MIN));
+        assert!(!rl.check("k", 3, MIN), "the 4th request must be blocked");
+    }
+
+    #[test]
+    fn keys_are_independent() {
+        let rl = RateLimiter::new();
+        assert!(rl.check("a", 1, MIN));
+        assert!(!rl.check("a", 1, MIN));
+        assert!(rl.check("b", 1, MIN), "a different key has its own window");
+    }
+
+    #[test]
+    fn window_slides_and_allows_again_after_expiry() {
+        let rl = RateLimiter::new();
+        let w = Duration::from_millis(40);
+        assert!(rl.check("k", 1, w));
+        assert!(!rl.check("k", 1, w));
+        std::thread::sleep(Duration::from_millis(55));
+        assert!(rl.check("k", 1, w), "the slot should expire once the window passes");
+    }
+
+    #[test]
+    fn retry_after_is_between_one_and_window() {
+        let rl = RateLimiter::new();
+        assert!(rl.check_with_retry("k", 1, MIN).is_ok());
+        let retry = rl.check_with_retry("k", 1, MIN).unwrap_err();
+        assert!((1..=60).contains(&retry), "retry_after {retry} out of range");
+    }
+
+    #[test]
+    fn clear_resets_every_window() {
+        let rl = RateLimiter::new();
+        assert!(rl.check("k", 1, MIN));
+        assert!(!rl.check("k", 1, MIN));
+        rl.clear();
+        assert!(rl.check("k", 1, MIN), "clear() must free the window");
+    }
+
+    #[test]
+    fn client_ip_prefers_first_forwarded_for_entry() {
+        let mut h = HeaderMap::new();
+        h.insert("x-forwarded-for", "203.0.113.7, 10.0.0.1".parse().unwrap());
+        assert_eq!(client_ip(&h, "fallback"), "203.0.113.7");
+    }
+
+    #[test]
+    fn client_ip_trims_surrounding_whitespace() {
+        let mut h = HeaderMap::new();
+        h.insert("x-forwarded-for", "  198.51.100.5  ".parse().unwrap());
+        assert_eq!(client_ip(&h, "fb"), "198.51.100.5");
+    }
+
+    #[test]
+    fn client_ip_falls_back_when_header_absent() {
+        assert_eq!(client_ip(&HeaderMap::new(), "127.0.0.1"), "127.0.0.1");
+    }
+}
--- a/backend/src/services/sse_tickets.rs
+++ b/backend/src/services/sse_tickets.rs
@@ -72,3 +72,58 @@ fn random_ticket() -> String {
    rng.fill(&mut bytes);
    bytes.iter().map(|b| format!("{b:02x}")).collect()
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn issue_then_consume_returns_the_hash_exactly_once() {
+        let store = SseTicketStore::new();
+        let ticket = store.issue("hash-1".into());
+        assert_eq!(store.consume(&ticket).as_deref(), Some("hash-1"));
+        // Single-use: a replay of the same ticket is rejected.
+        assert_eq!(store.consume(&ticket), None, "a consumed ticket must not be reusable");
+    }
+
+    #[test]
+    fn unknown_ticket_consumes_to_none() {
+        let store = SseTicketStore::new();
+        assert_eq!(store.consume("never-issued"), None);
+    }
+
+    #[test]
+    fn issued_tickets_are_unique_and_hex() {
+        let store = SseTicketStore::new();
+        let a = store.issue("h".into());
+        let b = store.issue("h".into());
+        assert_ne!(a, b, "each ticket must be unique");
+        assert_eq!(a.len(), 48, "24 random bytes → 48 hex chars");
+        assert!(a.chars().all(|c| c.is_ascii_hexdigit()));
+    }
+
+    #[test]
+    fn fresh_ticket_survives_prune() {
+        let store = SseTicketStore::new();
+        let ticket = store.issue("h".into());
+        store.prune(); // not expired → kept
+        assert_eq!(store.consume(&ticket).as_deref(), Some("h"));
+    }
+
+    #[test]
+    fn expired_ticket_consumes_to_none() {
+        // Construct an entry that is already past the TTL and confirm consume() rejects it.
+        let store = SseTicketStore::new();
+        let stale = "stale-ticket".to_string();
+        store.inner.lock().unwrap().insert(
+            stale.clone(),
+            Entry {
+                token_hash: "h".into(),
+                issued_at: Instant::now()
+                    .checked_sub(TTL + Duration::from_secs(1))
+                    .expect("host uptime should exceed the ticket TTL"),
+            },
+        );
+        assert_eq!(store.consume(&stale), None, "an expired ticket must not authenticate");
+    }
+}
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -23,7 +23,8 @@
 				"svelte-check": "^4.4.2",
 				"tailwindcss": "^4.2.2",
 				"typescript": "^5.9.3",
-				"vite": "^7.3.1"
+				"vite": "^7.3.1",
+				"vitest": "^4.1.9"
 			}
 		},
 		"node_modules/@esbuild/aix-ppc64": {
@@ -1397,6 +1398,17 @@
 				"url": "https://github.com/sponsors/tannerlinsley"
 			}
 		},
+		"node_modules/@types/chai": {
+			"version": "5.2.3",
+			"resolved": "https://registry.npmjs.org/@types/chai/-/chai-5.2.3.tgz",
+			"integrity": "sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"@types/deep-eql": "*",
+				"assertion-error": "^2.0.1"
+			}
+		},
 		"node_modules/@types/cookie": {
 			"version": "0.6.0",
 			"resolved": "https://registry.npmjs.org/@types/cookie/-/cookie-0.6.0.tgz",
@@ -1404,6 +1416,13 @@
 			"dev": true,
 			"license": "MIT"
 		},
+		"node_modules/@types/deep-eql": {
+			"version": "4.0.2",
+			"resolved": "https://registry.npmjs.org/@types/deep-eql/-/deep-eql-4.0.2.tgz",
+			"integrity": "sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw==",
+			"dev": true,
+			"license": "MIT"
+		},
 		"node_modules/@types/estree": {
 			"version": "1.0.8",
 			"resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.8.tgz",
@@ -1456,6 +1475,129 @@
 				"url": "https://opencollective.com/typescript-eslint"
 			}
 		},
+		"node_modules/@vitest/expect": {
+			"version": "4.1.9",
+			"resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.9.tgz",
+			"integrity": "sha512-vl/rYsUKcBr3SnQn166+XR5ZQcgMx3DQhFWdfli/cWpLnLUmbxZvyrJZotLFUryib+LtArYMSTJ5RbQ57ZqrlA==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"@standard-schema/spec": "^1.1.0",
+				"@types/chai": "^5.2.2",
+				"@vitest/spy": "4.1.9",
+				"@vitest/utils": "4.1.9",
+				"chai": "^6.2.2",
+				"tinyrainbow": "^3.1.0"
+			},
+			"funding": {
+				"url": "https://opencollective.com/vitest"
+			}
+		},
+		"node_modules/@vitest/mocker": {
+			"version": "4.1.9",
+			"resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.1.9.tgz",
+			"integrity": "sha512-EVkXzBjrPGM+cK8/ANWgBrkUCfJfb38/EfTSO8h7pWvKkyPkpWxvR7BkD2MyItMF62C97zAEoqdpUixwR/e+Rw==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"@vitest/spy": "4.1.9",
+				"estree-walker": "^3.0.3",
+				"magic-string": "^0.30.21"
+			},
+			"funding": {
+				"url": "https://opencollective.com/vitest"
+			},
+			"peerDependencies": {
+				"msw": "^2.4.9",
+				"vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
+			},
+			"peerDependenciesMeta": {
+				"msw": {
+					"optional": true
+				},
+				"vite": {
+					"optional": true
+				}
+			}
+		},
+		"node_modules/@vitest/mocker/node_modules/estree-walker": {
+			"version": "3.0.3",
+			"resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-3.0.3.tgz",
+			"integrity": "sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"@types/estree": "^1.0.0"
+			}
+		},
+		"node_modules/@vitest/pretty-format": {
+			"version": "4.1.9",
+			"resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.9.tgz",
+			"integrity": "sha512-s0iufns3iIFitdgm+YR7g1whCAaGtXz459VS9/PqyKDEEFgYIhsHOQmXgIgDuYCt7DeQmiZT0Qe2OA2p4ZPu5A==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"tinyrainbow": "^3.1.0"
+			},
+			"funding": {
+				"url": "https://opencollective.com/vitest"
+			}
+		},
+		"node_modules/@vitest/runner": {
+			"version": "4.1.9",
+			"resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.1.9.tgz",
+			"integrity": "sha512-KXLMDtc7oe70+3mJfGrPUWPesswH+3sTxAMAMl8DG7I8IUQT4XW718dY5ID3vPUcmlu27CcKfY4P3h3I29SLJg==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"@vitest/utils": "4.1.9",
+				"pathe": "^2.0.3"
+			},
+			"funding": {
+				"url": "https://opencollective.com/vitest"
+			}
+		},
+		"node_modules/@vitest/snapshot": {
+			"version": "4.1.9",
+			"resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.1.9.tgz",
+			"integrity": "sha512-Jc7RKGNBo8Z28WYIm0Niej4xdSPByRf6mU58VpHQkd6Zh05rlnA+twjbK5HyeIGHxrzsc3mJgS43uM0CZKzaIA==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"@vitest/pretty-format": "4.1.9",
+				"@vitest/utils": "4.1.9",
+				"magic-string": "^0.30.21",
+				"pathe": "^2.0.3"
+			},
+			"funding": {
+				"url": "https://opencollective.com/vitest"
+			}
+		},
+		"node_modules/@vitest/spy": {
+			"version": "4.1.9",
+			"resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.9.tgz",
+			"integrity": "sha512-fHpsS6mIi+PiEW+vcRVOMkX1oSaPKne3VOclSFICPcGOmfKgXPU5iAah+wcNcj2xPrCCmfq99IDGf+EojhhvhA==",
+			"dev": true,
+			"license": "MIT",
+			"funding": {
+				"url": "https://opencollective.com/vitest"
+			}
+		},
+		"node_modules/@vitest/utils": {
+			"version": "4.1.9",
+			"resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.9.tgz",
+			"integrity": "sha512-A51o8ymO5PpqlWNnBP9ZHPXDIpuMtTLlGSjN7la4US+LJzoUMyhwjA5QXlm39JexgwHKW4Xjs8Z2d3dLCXOeuA==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"@vitest/pretty-format": "4.1.9",
+				"convert-source-map": "^2.0.0",
+				"tinyrainbow": "^3.1.0"
+			},
+			"funding": {
+				"url": "https://opencollective.com/vitest"
+			}
+		},
 		"node_modules/acorn": {
 			"version": "8.16.0",
 			"resolved": "https://registry.npmjs.org/acorn/-/acorn-8.16.0.tgz",
@@ -1501,6 +1643,16 @@
 				"node": ">= 0.4"
 			}
 		},
+		"node_modules/assertion-error": {
+			"version": "2.0.1",
+			"resolved": "https://registry.npmjs.org/assertion-error/-/assertion-error-2.0.1.tgz",
+			"integrity": "sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==",
+			"dev": true,
+			"license": "MIT",
+			"engines": {
+				"node": ">=12"
+			}
+		},
 		"node_modules/axobject-query": {
 			"version": "4.1.0",
 			"resolved": "https://registry.npmjs.org/axobject-query/-/axobject-query-4.1.0.tgz",
@@ -1519,6 +1671,16 @@
 				"node": ">=6"
 			}
 		},
+		"node_modules/chai": {
+			"version": "6.2.2",
+			"resolved": "https://registry.npmjs.org/chai/-/chai-6.2.2.tgz",
+			"integrity": "sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg==",
+			"dev": true,
+			"license": "MIT",
+			"engines": {
+				"node": ">=18"
+			}
+		},
 		"node_modules/chokidar": {
 			"version": "4.0.3",
 			"resolved": "https://registry.npmjs.org/chokidar/-/chokidar-4.0.3.tgz",
@@ -1580,6 +1742,13 @@
 			"dev": true,
 			"license": "MIT"
 		},
+		"node_modules/convert-source-map": {
+			"version": "2.0.0",
+			"resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz",
+			"integrity": "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==",
+			"dev": true,
+			"license": "MIT"
+		},
 		"node_modules/cookie": {
 			"version": "0.6.0",
 			"resolved": "https://registry.npmjs.org/cookie/-/cookie-0.6.0.tgz",
@@ -1651,6 +1820,13 @@
 				"node": ">=10.13.0"
 			}
 		},
+		"node_modules/es-module-lexer": {
+			"version": "2.2.0",
+			"resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.2.0.tgz",
+			"integrity": "sha512-3lGxdTXCLfe1MYfTz1y2ksAAUM4NAOP6rPEjxGJVKO7TZ5+tvHCaQWGpC4Y3IXvW3ece0Cz1cIP4FWBxOnGCTQ==",
+			"dev": true,
+			"license": "MIT"
+		},
 		"node_modules/esbuild": {
 			"version": "0.27.4",
 			"resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.27.4.tgz",
@@ -1716,6 +1892,16 @@
 			"dev": true,
 			"license": "MIT"
 		},
+		"node_modules/expect-type": {
+			"version": "1.4.0",
+			"resolved": "https://registry.npmjs.org/expect-type/-/expect-type-1.4.0.tgz",
+			"integrity": "sha512-KfYbmpRm0VbLjEvVa9yGwCi9GI34xvi7A/HXYWQO65CSD2u3MczUJSuwXKFIxlGsgBQizV9q5J9NHj4VG0n+pA==",
+			"dev": true,
+			"license": "Apache-2.0",
+			"engines": {
+				"node": ">=12.0.0"
+			}
+		},
 		"node_modules/fdir": {
 			"version": "6.5.0",
 			"resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
@@ -2258,6 +2444,13 @@
 			"dev": true,
 			"license": "MIT"
 		},
+		"node_modules/pathe": {
+			"version": "2.0.3",
+			"resolved": "https://registry.npmjs.org/pathe/-/pathe-2.0.3.tgz",
+			"integrity": "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==",
+			"dev": true,
+			"license": "MIT"
+		},
 		"node_modules/picocolors": {
 			"version": "1.1.1",
 			"resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
@@ -2454,6 +2647,13 @@
 			"dev": true,
 			"license": "MIT"
 		},
+		"node_modules/siginfo": {
+			"version": "2.0.0",
+			"resolved": "https://registry.npmjs.org/siginfo/-/siginfo-2.0.0.tgz",
+			"integrity": "sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g==",
+			"dev": true,
+			"license": "ISC"
+		},
 		"node_modules/sirv": {
 			"version": "3.0.2",
 			"resolved": "https://registry.npmjs.org/sirv/-/sirv-3.0.2.tgz",
@@ -2479,6 +2679,20 @@
 				"node": ">=0.10.0"
 			}
 		},
+		"node_modules/stackback": {
+			"version": "0.0.2",
+			"resolved": "https://registry.npmjs.org/stackback/-/stackback-0.0.2.tgz",
+			"integrity": "sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==",
+			"dev": true,
+			"license": "MIT"
+		},
+		"node_modules/std-env": {
+			"version": "4.1.0",
+			"resolved": "https://registry.npmjs.org/std-env/-/std-env-4.1.0.tgz",
+			"integrity": "sha512-Rq7ybcX2RuC55r9oaPVEW7/xu3tj8u4GeBYHBWCychFtzMIr86A7e3PPEBPT37sHStKX3+TiX/Fr/ACmJLVlLQ==",
+			"dev": true,
+			"license": "MIT"
+		},
 		"node_modules/string-width": {
 			"version": "4.2.3",
 			"resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
@@ -2590,6 +2804,23 @@
 				"url": "https://opencollective.com/webpack"
 			}
 		},
+		"node_modules/tinybench": {
+			"version": "2.9.0",
+			"resolved": "https://registry.npmjs.org/tinybench/-/tinybench-2.9.0.tgz",
+			"integrity": "sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg==",
+			"dev": true,
+			"license": "MIT"
+		},
+		"node_modules/tinyexec": {
+			"version": "1.2.4",
+			"resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.2.4.tgz",
+			"integrity": "sha512-SHf/r48b7vOrjve9PxJo3MN5v5yuyjHvdUcrQffT3WXMUfnGmHDVbC4k3sHJaJTgZCwpUplIaAo5ANtMyp3YHg==",
+			"dev": true,
+			"license": "MIT",
+			"engines": {
+				"node": ">=18"
+			}
+		},
 		"node_modules/tinyglobby": {
 			"version": "0.2.15",
 			"resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.15.tgz",
@@ -2607,6 +2838,16 @@
 				"url": "https://github.com/sponsors/SuperchupuDev"
 			}
 		},
+		"node_modules/tinyrainbow": {
+			"version": "3.1.0",
+			"resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-3.1.0.tgz",
+			"integrity": "sha512-Bf+ILmBgretUrdJxzXM0SgXLZ3XfiaUuOj/IKQHuTXip+05Xn+uyEYdVg0kYDipTBcLrCVyUzAPz7QmArb0mmw==",
+			"dev": true,
+			"license": "MIT",
+			"engines": {
+				"node": ">=14.0.0"
+			}
+		},
 		"node_modules/totalist": {
 			"version": "3.0.1",
 			"resolved": "https://registry.npmjs.org/totalist/-/totalist-3.0.1.tgz",
@@ -2733,12 +2974,119 @@
 				}
 			}
 		},
+		"node_modules/vitest": {
+			"version": "4.1.9",
+			"resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.9.tgz",
+			"integrity": "sha512-nE3/LEyc0z87uHYLZebqCUOaJr2hdtuPp7BQ4BosVFnfltxgAvMG08NyrSGlPpOUWvR27c5flSmYFTNr78L9GQ==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"@vitest/expect": "4.1.9",
+				"@vitest/mocker": "4.1.9",
+				"@vitest/pretty-format": "4.1.9",
+				"@vitest/runner": "4.1.9",
+				"@vitest/snapshot": "4.1.9",
+				"@vitest/spy": "4.1.9",
+				"@vitest/utils": "4.1.9",
+				"es-module-lexer": "^2.0.0",
+				"expect-type": "^1.3.0",
+				"magic-string": "^0.30.21",
+				"obug": "^2.1.1",
+				"pathe": "^2.0.3",
+				"picomatch": "^4.0.3",
+				"std-env": "^4.0.0-rc.1",
+				"tinybench": "^2.9.0",
+				"tinyexec": "^1.0.2",
+				"tinyglobby": "^0.2.15",
+				"tinyrainbow": "^3.1.0",
+				"vite": "^6.0.0 || ^7.0.0 || ^8.0.0",
+				"why-is-node-running": "^2.3.0"
+			},
+			"bin": {
+				"vitest": "vitest.mjs"
+			},
+			"engines": {
+				"node": "^20.0.0 || ^22.0.0 || >=24.0.0"
+			},
+			"funding": {
+				"url": "https://opencollective.com/vitest"
+			},
+			"peerDependencies": {
+				"@edge-runtime/vm": "*",
+				"@opentelemetry/api": "^1.9.0",
+				"@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0",
+				"@vitest/browser-playwright": "4.1.9",
+				"@vitest/browser-preview": "4.1.9",
+				"@vitest/browser-webdriverio": "4.1.9",
+				"@vitest/coverage-istanbul": "4.1.9",
+				"@vitest/coverage-v8": "4.1.9",
+				"@vitest/ui": "4.1.9",
+				"happy-dom": "*",
+				"jsdom": "*",
+				"vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
+			},
+			"peerDependenciesMeta": {
+				"@edge-runtime/vm": {
+					"optional": true
+				},
+				"@opentelemetry/api": {
+					"optional": true
+				},
+				"@types/node": {
+					"optional": true
+				},
+				"@vitest/browser-playwright": {
+					"optional": true
+				},
+				"@vitest/browser-preview": {
+					"optional": true
+				},
+				"@vitest/browser-webdriverio": {
+					"optional": true
+				},
+				"@vitest/coverage-istanbul": {
+					"optional": true
+				},
+				"@vitest/coverage-v8": {
+					"optional": true
+				},
+				"@vitest/ui": {
+					"optional": true
+				},
+				"happy-dom": {
+					"optional": true
+				},
+				"jsdom": {
+					"optional": true
+				},
+				"vite": {
+					"optional": false
+				}
+			}
+		},
 		"node_modules/which-module": {
 			"version": "2.0.1",
 			"resolved": "https://registry.npmjs.org/which-module/-/which-module-2.0.1.tgz",
 			"integrity": "sha512-iBdZ57RDvnOR9AGBhML2vFZf7h8vmBjhoaZqODJBFWHVtKkDmKuHai3cx5PgVMrX5YDNp27AofYbAwctSS+vhQ==",
 			"license": "ISC"
 		},
+		"node_modules/why-is-node-running": {
+			"version": "2.3.0",
+			"resolved": "https://registry.npmjs.org/why-is-node-running/-/why-is-node-running-2.3.0.tgz",
+			"integrity": "sha512-hUrmaWBdVDcxvYqnyh09zunKzROWjbZTiNy8dBEjkS7ehEDQibXJ7XvlmtbwuTclUiIyN+CyXQD4Vmko8fNm8w==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"siginfo": "^2.0.0",
+				"stackback": "0.0.2"
+			},
+			"bin": {
+				"why-is-node-running": "cli.js"
+			},
+			"engines": {
+				"node": ">=8"
+			}
+		},
 		"node_modules/wrap-ansi": {
 			"version": "6.2.0",
 			"resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-6.2.0.tgz",
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -9,7 +9,9 @@
 		"preview": "vite preview",
 		"prepare": "svelte-kit sync || echo ''",
 		"check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
-		"check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch"
+		"check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
+		"test:unit": "vitest run",
+		"test:unit:watch": "vitest"
 	},
 	"devDependencies": {
 		"@sveltejs/adapter-auto": "^7.0.0",
@@ -22,7 +24,8 @@
 		"svelte-check": "^4.4.2",
 		"tailwindcss": "^4.2.2",
 		"typescript": "^5.9.3",
-		"vite": "^7.3.1"
+		"vite": "^7.3.1",
+		"vitest": "^4.1.9"
 	},
 	"dependencies": {
 		"@tanstack/svelte-virtual": "^3.13.30",
--- a/frontend/src/lib/avatar.test.ts
+++ b/frontend/src/lib/avatar.test.ts
@@ -0,0 +1,39 @@
+import { describe, it, expect } from 'vitest';
+import { avatarPalette, initials } from './avatar';
+
+describe('avatarPalette', () => {
+  it('returns the neutral palette for empty / nullish names', () => {
+    expect(avatarPalette(null)).toContain('bg-gray-100');
+    expect(avatarPalette(undefined)).toContain('bg-gray-100');
+    expect(avatarPalette('')).toContain('bg-gray-100');
+  });
+
+  it('is deterministic for the same name', () => {
+    expect(avatarPalette('Alice')).toBe(avatarPalette('Alice'));
+  });
+
+  it('returns a real palette entry (not neutral) for a non-empty name', () => {
+    expect(avatarPalette('Bob')).toMatch(/bg-(blue|purple|green|amber|rose|teal)-100/);
+  });
+});
+
+describe('initials', () => {
+  it('returns "?" for empty / nullish / whitespace-only names', () => {
+    expect(initials(null)).toBe('?');
+    expect(initials(undefined)).toBe('?');
+    expect(initials('')).toBe('?');
+    expect(initials('   ')).toBe('?');
+  });
+
+  it('uses the first letter (uppercased) for a single word', () => {
+    expect(initials('alice')).toBe('A');
+  });
+
+  it('uses the first letters of the first two words', () => {
+    expect(initials('Alice Bob Carol')).toBe('AB');
+  });
+
+  it('collapses runs of whitespace between words', () => {
+    expect(initials('  john   doe ')).toBe('JD');
+  });
+});
--- a/frontend/src/lib/data-mode-store.test.ts
+++ b/frontend/src/lib/data-mode-store.test.ts
@@ -0,0 +1,28 @@
+import { describe, it, expect } from 'vitest';
+import { pickMediaUrl } from './data-mode-store';
+
+const upload = {
+  id: 'abc-123',
+  preview_url: '/media/previews/p.jpg',
+  thumbnail_url: '/media/thumbnails/t.jpg',
+};
+
+describe('pickMediaUrl', () => {
+  it('original mode → the original API route, ignoring preview/thumbnail', () => {
+    expect(pickMediaUrl('original', upload)).toBe('/api/v1/upload/abc-123/original');
+  });
+
+  it('saver mode → preview_url when present', () => {
+    expect(pickMediaUrl('saver', upload)).toBe('/media/previews/p.jpg');
+  });
+
+  it('saver mode → thumbnail_url when preview is null', () => {
+    expect(pickMediaUrl('saver', { ...upload, preview_url: null })).toBe('/media/thumbnails/t.jpg');
+  });
+
+  it('saver mode → original route when both preview and thumbnail are null', () => {
+    expect(pickMediaUrl('saver', { id: 'x', preview_url: null, thumbnail_url: null })).toBe(
+      '/api/v1/upload/x/original'
+    );
+  });
+});
--- a/frontend/src/test/mocks/app-environment.ts
+++ b/frontend/src/test/mocks/app-environment.ts
@@ -0,0 +1,7 @@
+// Test stub for SvelteKit's `$app/environment` virtual module (which only exists
+// during dev/build). `browser: false` makes modules like data-mode-store take their
+// server-safe path (no localStorage access) when imported under Vitest's node env.
+export const browser = false;
+export const dev = false;
+export const building = false;
+export const version = 'test';
--- a/frontend/vitest.config.ts
+++ b/frontend/vitest.config.ts
@@ -0,0 +1,18 @@
+import { defineConfig } from 'vitest/config';
+import { fileURLToPath } from 'node:url';
+
+// Standalone Vitest config (separate from vite.config.ts so it doesn't pull in the
+// full SvelteKit plugin). It only needs to resolve the two aliases our pure-logic
+// modules use: `$lib` and SvelteKit's `$app/environment` virtual module (stubbed).
+export default defineConfig({
+  resolve: {
+    alias: {
+      '$app/environment': fileURLToPath(new URL('./src/test/mocks/app-environment.ts', import.meta.url)),
+      $lib: fileURLToPath(new URL('./src/lib', import.meta.url)),
+    },
+  },
+  test: {
+    environment: 'node',
+    include: ['src/**/*.test.ts'],
+  },
+});