fix(dash): resolve test regressions, await promises, and improve TypeScript strictness

web/src/server.test.ts

@@ -1,17 +1,46 @@
 import { describe, test, expect, afterAll, mock } from "bun:test";
+import type { WebServerInstance } from "./server";
+import { createWebServer } from "./server";
 
-// Mock the services directly to stay focused on server limits
-mock.module("@shared/modules/dashboard/dashboard.service", () => ({
-    dashboardService: {
-        getActiveUserCount: mock(() => Promise.resolve(5)),
-        getTotalUserCount: mock(() => Promise.resolve(10)),
-        getEconomyStats: mock(() => Promise.resolve({ totalWealth: 1000n, avgLevel: 5, topStreak: 2 })),
-        getRecentEvents: mock(() => Promise.resolve([])),
-    }
-}));
+interface MockBotStats {
+    bot: { name: string; avatarUrl: string | null };
+    guilds: number;
+    ping: number;
+    cachedUsers: number;
+    commandsRegistered: number;
+    uptime: number;
+    lastCommandTimestamp: number | null;
+}
 
+// 1. Mock DrizzleClient (dependency of dashboardService)
+mock.module("@shared/db/DrizzleClient", () => {
+    const mockBuilder = {
+        where: mock(() => Promise.resolve([{ count: "5", balance: 1000n, level: 5, dailyStreak: 2 }])),
+        then: (onfulfilled: any) => onfulfilled([{ count: "5", balance: 1000n, level: 5, dailyStreak: 2 }]),
+    };
+
+    const mockFrom = {
+        from: mock(() => mockBuilder),
+    };
+
+    return {
+        DrizzleClient: {
+            select: mock(() => mockFrom),
+            query: {
+                transactions: { findMany: mock(() => Promise.resolve([])) },
+                moderationCases: { findMany: mock(() => Promise.resolve([])) },
+                users: {
+                    findFirst: mock(() => Promise.resolve({ username: "test" })),
+                    findMany: mock(() => Promise.resolve([])),
+                },
+            }
+        },
+    };
+});
+
+// 2. Mock Bot Stats Provider
 mock.module("../../bot/lib/clientStats", () => ({
-    getClientStats: mock(() => ({
+    getClientStats: mock((): MockBotStats => ({
         bot: { name: "TestBot", avatarUrl: null },
         guilds: 5,
         ping: 42,
@@ -22,17 +51,22 @@ mock.module("../../bot/lib/clientStats", () => ({
     })),
 }));
 
-// Ensure @shared/lib/events is mocked if needed
+// 3. Mock System Events
 mock.module("@shared/lib/events", () => ({
-    systemEvents: { on: mock(() => { }) },
-    EVENTS: { DASHBOARD: { NEW_EVENT: "dashboard:new_event" } }
+    systemEvents: {
+        on: mock(() => { }),
+        emit: mock(() => { }),
+    },
+    EVENTS: {
+        DASHBOARD: {
+            NEW_EVENT: "dashboard:new_event",
+        }
+    }
 }));
 
-import { createWebServer } from "./server";
-
 describe("WebServer Security & Limits", () => {
     const port = 3001;
-    let serverInstance: any;
+    let serverInstance: WebServerInstance | null = null;
 
     afterAll(async () => {
         if (serverInstance) {
@@ -50,16 +84,20 @@ describe("WebServer Security & Limits", () => {
             for (let i = 0; i < 12; i++) {
                 const ws = new WebSocket(wsUrl);
                 sockets.push(ws);
-                await new Promise(resolve => setTimeout(resolve, 10));
+                await new Promise(resolve => setTimeout(resolve, 5));
             }
 
             // Give connections time to settle
-            await new Promise(resolve => setTimeout(resolve, 500));
+            await new Promise(resolve => setTimeout(resolve, 800));
 
-            // Should be exactly 10 or less
-            expect(serverInstance.server.pendingWebSockets).toBeLessThanOrEqual(10);
+            const pendingCount = serverInstance.server.pendingWebSockets;
+            expect(pendingCount).toBeLessThanOrEqual(10);
         } finally {
-            sockets.forEach(s => s.close());
+            sockets.forEach(s => {
+                if (s.readyState === WebSocket.OPEN || s.readyState === WebSocket.CONNECTING) {
+                    s.close();
+                }
+            });
         }
     });
 
@@ -69,7 +107,7 @@ describe("WebServer Security & Limits", () => {
         }
         const response = await fetch(`http://localhost:${port}/api/health`);
         expect(response.status).toBe(200);
-        const data = await response.json();
+        const data = (await response.json()) as { status: string };
         expect(data.status).toBe("ok");
     });
 });

web/src/server.ts

@@ -151,8 +151,17 @@ export async function createWebServer(config: WebServerConfig = {}): Promise<Web
             },
             async message(ws, message) {
                 try {
+                    const messageStr = message.toString();
+
+                    // Defense-in-depth: redundant length check before parsing
+                    if (messageStr.length > MAX_PAYLOAD_BYTES) {
+                        console.error("❌ [WS] Payload exceeded maximum limit");
+                        return;
+                    }
+
+                    const rawData = JSON.parse(messageStr);
                     const { WsMessageSchema } = await import("@shared/modules/dashboard/dashboard.types");
-                    const parsed = WsMessageSchema.safeParse(JSON.parse(message.toString()));
+                    const parsed = WsMessageSchema.safeParse(rawData);
 
                     if (!parsed.success) {
                         console.error("❌ [WS] Invalid message format:", parsed.error.issues);
@@ -163,7 +172,7 @@ export async function createWebServer(config: WebServerConfig = {}): Promise<Web
                         ws.send(JSON.stringify({ type: "PONG" }));
                     }
                 } catch (e) {
-                    console.error("❌ [WS] Failed to parse message:", e);
+                    console.error("❌ [WS] Failed to handle message:", e instanceof Error ? e.message : "Malformed JSON");
                 }
             },
             close(ws) {