From e6fd561b429086dce98ecefdd41cae273b12943b Mon Sep 17 00:00:00 2001
From: Satoshi Qazi Muhammed <info@pezkuwichain.io>
Date: Tue, 20 Oct 2026 22:50:26 +0400
Subject: [PATCH] test(ui): typed cases and the matchers the test shim
 implements

The first version used it.each (untyped rows, @typescript-eslint/no-unsafe-argument) and expect().not.toMatch, which @pezkuwi/dev-test does not implement. Plain loops over string[] and a boolean assertion instead. With the repo runner: 5/5 pass on the fix, 3 of 5 fail on main's sanitizeOrigin.ts.
---
 .../src/util/sanitizeOrigin.spec.ts           | 44 ++++++++++++-------
 1 file changed, 27 insertions(+), 17 deletions(-)

diff --git a/packages/extension-ui/src/util/sanitizeOrigin.spec.ts b/packages/extension-ui/src/util/sanitizeOrigin.spec.ts
index f13164a..3db1f8f 100644
--- a/packages/extension-ui/src/util/sanitizeOrigin.spec.ts
+++ b/packages/extension-ui/src/util/sanitizeOrigin.spec.ts
@@ -5,31 +5,41 @@ import type * as _ from '@pezkuwi/dev-test/globals.d.ts';
 
 import { sanitizeOrigin, validateOrigin } from './sanitizeOrigin.js';
 
+// The origin a site claims for itself is attacker-chosen text.
+const WITH_MARKUP: string[] = [
+  '<scr<script>ipt>alert(1)</script>',
+  '<<b>img src=x onerror=alert(1)>',
+  'a<b',
+  'x>y'
+];
+
+// validateOrigin used to look for markup in the sanitized string, after the
+// tags it was looking for had been removed: `<b>x</b>` passed as valid.
+const FLAGGED: string[] = ['<scr<script>ipt>evil', '<b>x</b>'];
+
+const ACCEPTED: string[] = ['https://app.pezkuwichain.io', 'http://localhost:3000', 'Pezkuwi Apps'];
+
 describe('sanitizeOrigin', () => {
   it('keeps a normal origin as it is', () => {
     expect(sanitizeOrigin('Pezkuwi Apps')).toEqual('Pezkuwi Apps');
   });
 
-  // One pass of tag removal turns `<scr<script>ipt>` into `<script`; the
-  // origin a site claims for itself is attacker-chosen text.
-  it.each([
-    '<scr<script>ipt>alert(1)</script>',
-    '<<b>img src=x onerror=alert(1)>',
-    'a<b',
-    'x>y'
-  ])('leaves no angle bracket in %s', (origin) => {
-    const out = sanitizeOrigin(origin);
-
-    expect(out).not.toMatch(/[<>]/);
+  // One pass of tag removal turns `<scr<script>ipt>` into `<script`.
+  it('leaves no angle bracket behind', () => {
+    for (const origin of WITH_MARKUP) {
+      expect(/[<>]/.test(sanitizeOrigin(origin))).toBe(false);
+    }
   });
 
-  // validateOrigin used to look for markup in the sanitized string, after the
-  // tags it was looking for had been removed: `<b>x</b>` passed as valid.
-  it.each(['<scr<script>ipt>evil', '<b>x</b>'])('flags %s, which carried markup', (origin) => {
-    expect(validateOrigin(origin)).toBe(false);
+  it('flags an origin that carried markup', () => {
+    for (const origin of FLAGGED) {
+      expect(validateOrigin(origin)).toBe(false);
+    }
   });
 
-  it.each(['https://app.pezkuwichain.io', 'http://localhost:3000', 'Pezkuwi Apps'])('accepts %s', (origin) => {
-    expect(validateOrigin(origin)).toBe(true);
+  it('accepts ordinary origins', () => {
+    for (const origin of ACCEPTED) {
+      expect(validateOrigin(origin)).toBe(true);
+    }
   });
 });