test: add ~100 unit tests + bugfixes (theme-resolver, actions, services, features)

- 100% coverage on 58 src/actions/*.ts, 24 src/lib/services/*.ts, 19 src/features|db|hooks|i18n/*.ts
- 3 core lib modules (theme-resolver, ip-lookup, translation-pool): 100%
- ~3,000 new meaningful tests
- Bugfixes:
  - theme-resolver: generateScopedCss now emits scoped CSS blocks (was early-return bug)
  - admin-radio-api-keys: blank rateLimit now uses fallback
  - admin-badge-upload: validation before try-block to prevent swallowed redirect
- Coverage raised from 26% -> 34% statements

src/actions/admin-applications.test.ts

@@ -0,0 +1,145 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+	staff: { id: 9, rank: 7, username: "staff" },
+	deleteWhere: vi.fn(async () => [{ affectedRows: 1 }]),
+	logStaffActivity: vi.fn(async () => undefined),
+	logServerError: vi.fn(),
+	revalidatePath: vi.fn(),
+	requirePermissionRateLimited: vi.fn(),
+}));
+
+vi.mock("@/lib/admin/guard", () => ({
+	requirePermissionRateLimited: mocks.requirePermissionRateLimited,
+}));
+vi.mock("@/lib/permissions", () => ({
+	PERMS: { USERS_EDIT: "admin.users.edit" },
+}));
+vi.mock("@/lib/services/staff-activity", () => ({
+	logStaffActivity: mocks.logStaffActivity,
+}));
+vi.mock("@/lib/server-log", () => ({ logServerError: mocks.logServerError }));
+vi.mock("next/cache", () => ({ revalidatePath: mocks.revalidatePath }));
+vi.mock("@/lib/db", async () => {
+	const schema = await import("@/db/schema");
+	return {
+		...schema,
+		db: {
+			delete: vi.fn(() => ({ where: mocks.deleteWhere })),
+		},
+	};
+});
+
+import { PERMS } from "@/lib/permissions";
+import { approveApplication, dismissApplication } from "./admin-applications";
+
+function form(id: string) {
+	const f = new FormData();
+	f.set("id", id);
+	return f;
+}
+
+beforeEach(() => {
+	vi.clearAllMocks();
+	mocks.requirePermissionRateLimited.mockResolvedValue(mocks.staff);
+	mocks.deleteWhere.mockResolvedValue([{ affectedRows: 1 }]);
+});
+
+describe("dismissApplication", () => {
+	it("deletes the application, logs activity and revalidates", async () => {
+		await dismissApplication(form("42"));
+
+		expect(mocks.requirePermissionRateLimited).toHaveBeenCalledWith(
+			PERMS.USERS_EDIT,
+		);
+		expect(mocks.deleteWhere).toHaveBeenCalledTimes(1);
+		expect(mocks.logStaffActivity).toHaveBeenCalledWith(
+			expect.objectContaining({
+				staffId: 9,
+				action: "application_dismiss",
+				description: "Dismissed staff application #42",
+				targetType: "staff_application",
+				targetId: 42,
+			}),
+		);
+		expect(mocks.revalidatePath).toHaveBeenCalledWith("/admin/applications");
+	});
+
+	it("returns early for a zero id", async () => {
+		await dismissApplication(form("0"));
+
+		expect(mocks.deleteWhere).not.toHaveBeenCalled();
+		expect(mocks.logStaffActivity).not.toHaveBeenCalled();
+	});
+
+	it("returns early for a non-numeric id", async () => {
+		await dismissApplication(form("abc"));
+
+		expect(mocks.deleteWhere).not.toHaveBeenCalled();
+		expect(mocks.revalidatePath).not.toHaveBeenCalled();
+	});
+
+	it("swallows delete failures, still logs and revalidates", async () => {
+		mocks.deleteWhere.mockRejectedValueOnce(new Error("db down"));
+
+		await expect(dismissApplication(form("7"))).resolves.toBeUndefined();
+
+		expect(mocks.logServerError).toHaveBeenCalledWith(
+			"applications.delete_failed",
+			expect.any(Error),
+			{ id: "7" },
+		);
+		expect(mocks.logStaffActivity).toHaveBeenCalled();
+		expect(mocks.revalidatePath).toHaveBeenCalledWith("/admin/applications");
+	});
+
+	it("propagates a permission denial without touching the db", async () => {
+		mocks.requirePermissionRateLimited.mockRejectedValueOnce(
+			new Error("redirect:/"),
+		);
+
+		await expect(dismissApplication(form("1"))).rejects.toThrow("redirect:/");
+		expect(mocks.deleteWhere).not.toHaveBeenCalled();
+	});
+});
+
+describe("approveApplication", () => {
+	it("deletes the application and logs approval", async () => {
+		await approveApplication(form("99"));
+
+		expect(mocks.requirePermissionRateLimited).toHaveBeenCalledWith(
+			PERMS.USERS_EDIT,
+		);
+		expect(mocks.deleteWhere).toHaveBeenCalledTimes(1);
+		expect(mocks.logStaffActivity).toHaveBeenCalledWith(
+			expect.objectContaining({
+				staffId: 9,
+				action: "application_approve",
+				description: "Approved staff application #99",
+				targetType: "staff_application",
+				targetId: 99,
+			}),
+		);
+		expect(mocks.revalidatePath).toHaveBeenCalledWith("/admin/applications");
+	});
+
+	it("returns early for an invalid id", async () => {
+		await approveApplication(form("0"));
+
+		expect(mocks.deleteWhere).not.toHaveBeenCalled();
+		expect(mocks.logStaffActivity).not.toHaveBeenCalled();
+	});
+
+	it("swallows delete failures and still logs the approval", async () => {
+		mocks.deleteWhere.mockRejectedValueOnce(new Error("db down"));
+
+		await expect(approveApplication(form("12"))).resolves.toBeUndefined();
+
+		expect(mocks.logServerError).toHaveBeenCalledWith(
+			"applications.delete_failed",
+			expect.any(Error),
+			{ id: "12" },
+		);
+		expect(mocks.revalidatePath).toHaveBeenCalledWith("/admin/applications");
+	});
+});