ankn/Orchestrator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(andreknie.de): close data lifecycle review gaps

Browse Source
This commit is contained in:
ankn
2026-07-28 11:23:19 +02:00
parent b31da6175a
commit dfae463402
8 changed files with 127 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
privat/CV/andreknie.de/server/index.test.js
+67 -4
View File
@@ -1,16 +1,36 @@
import { beforeAll, afterAll, describe, expect, it } from 'vitest'
import { existsSync, mkdtempSync, readFileSync, rmSync } from 'fs'
import { tmpdir } from 'os'
import { join } from 'path'
let server
let baseUrl
let testDir
let tokensFile
let createToken
let reserveToken
let releaseToken
beforeAll(async () => {
testDir = mkdtempSync(join(tmpdir(), 'andreknie-server-test-'))
tokensFile = join(testDir, 'pending-tokens.json')
process.env.CONFIRMATION_TOKEN_FILE = tokensFile
const tokenService = await import('./services/confirmationToken.js')
createToken = tokenService.createToken
reserveToken = tokenService.reserveToken
releaseToken = tokenService.releaseToken
const { app } = await import('./index.js')
server = app.listen(0)
await new Promise(resolve => server.once('listening', resolve))
baseUrl = `http://127.0.0.1:${server.address().port}`
})
afterAll(() => server?.close())
afterAll(async () => {
if (server) await new Promise(resolve => server.close(resolve))
delete process.env.CONFIRMATION_TOKEN_FILE
rmSync(testDir, { recursive: true, force: true })
})
describe('backend mail safety', () => {
it('reports degraded health without SMTP configuration', async () => {
@@ -23,14 +43,57 @@ describe('backend mail safety', () => {
expect(JSON.stringify(body)).not.toContain('SMTP_PASS')
})
it('does not report success when contact mail cannot be sent', async () => {
const response = await fetch(`${baseUrl}/api/contact`, {
it.each([
['contact', { name: 'Test', email: 'test@example.invalid', message: 'Synthetic test' }],
['talk-request', {
name: 'Test',
email: 'test@example.invalid',
event_name: 'Synthetic event',
topic: 'Synthetic topic',
message: 'Synthetic test',
}],
['newsletter', { email: 'test@example.invalid' }],
])('does not retain %s data when confirmation mail cannot be sent', async (endpoint, payload) => {
const response = await fetch(`${baseUrl}/api/${endpoint}`, {
method: 'POST',
headers: { 'content-type': 'application/json' },
body: JSON.stringify({ name: 'Test', email: 'test@example.invalid', message: 'Synthetic test' }),
body: JSON.stringify(payload),
})
expect(response.status).toBe(503)
expect((await response.json()).error).toBeTruthy()
expect(existsSync(tokensFile) ? JSON.parse(readFileSync(tokensFile, 'utf8')) : []).toEqual([])
})
it('does not report success when speaker CV mail cannot be sent', async () => {
const response = await fetch(`${baseUrl}/api/speaker-cv`, {
method: 'POST',
headers: { 'content-type': 'application/json' },
body: JSON.stringify({
name: 'Test',
email: 'test@example.invalid',
message: 'Synthetic test',
}),
})
expect(response.status).toBe(503)
expect((await response.json()).error).toBeTruthy()
})
it('releases a confirmation token when stakeholder notification fails', async () => {
const token = await createToken('contact', {
name: 'Synthetic Test',
email: 'test@example.invalid',
message: 'No external mail is sent.',
})
const response = await fetch(`${baseUrl}/api/contact/confirm/${token}`, {
redirect: 'manual',
})
expect(response.status).toBe(302)
expect(response.headers.get('location')).toBe('/bestaetigung?status=error')
expect(await reserveToken(token)).toMatchObject({ status: 'processing' })
await releaseToken(token)
})
})
privat/CV/andreknie.de/server/routes/contact.js
+8 -6
View File
@@ -8,26 +8,28 @@ const router = Router()
router.post('/', contactLimiter, antiSpam, async (req, res) => {
const { name, email, message } = req.body
let token
const errors = {}
if (!name || name.trim().length === 0) errors.name = 'Name ist erforderlich.'
if (name && name.length > 100) errors.name = 'Max. 100 Zeichen.'
if (!email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) errors.email = 'Gueltige E-Mail erforderlich.'
if (!email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) errors.email = 'Gültige E-Mail erforderlich.'
if (!message || message.trim().length === 0) errors.message = 'Nachricht ist erforderlich.'
if (message && message.length > 2000) errors.message = 'Max. 2000 Zeichen.'
if (Object.keys(errors).length > 0) return res.status(400).json({ errors })
try {
const token = await createToken('contact', { name, email, message }, 24)
token = await createToken('contact', { name, email, message }, 24)
await sendConfirmationEmail(email, 'contact', token)
res.status(201).json({ ok: true, message: 'Bestaetigungs-E-Mail gesendet.' })
res.status(201).json({ ok: true, message: 'Bestätigungs-E-Mail gesendet.' })
} catch (error) {
if (token) await completeToken(token)
res.status(error instanceof MailerNotReadyError ? 503 : 502).json({ error: 'Die Anfrage konnte derzeit nicht versendet werden.' })
}
})
router.get('/confirm/:token', async (req, res) => {
const baseUrl = process.env.BASE_URL || ''
const baseUrl = (process.env.BASE_URL || '').replace(/\/+$/, '')
const entry = await reserveToken(req.params.token)
if (!entry) return res.redirect(baseUrl + '/bestaetigung?status=error')
@@ -35,9 +37,9 @@ router.get('/confirm/:token', async (req, res) => {
await sendStakeholderNotification('contact', entry.data)
await completeToken(req.params.token)
res.redirect(baseUrl + '/bestaetigung?status=success')
} catch (error) {
} catch {
await releaseToken(req.params.token)
res.status(error instanceof MailerNotReadyError ? 503 : 502).redirect(baseUrl + '/bestaetigung?status=error')
res.redirect(baseUrl + '/bestaetigung?status=error')
}
})
privat/CV/andreknie.de/server/routes/newsletter.js
+7 -5
View File
@@ -26,8 +26,9 @@ const router = Router()
router.post('/', newsletterLimiter, antiSpam, async (req, res) => {
const { email } = req.body
let token
if (!email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
return res.status(400).json({ errors: { email: 'Gueltige E-Mail erforderlich.' } })
return res.status(400).json({ errors: { email: 'Gültige E-Mail erforderlich.' } })
}
const subs = loadSubscribers()
@@ -36,16 +37,17 @@ router.post('/', newsletterLimiter, antiSpam, async (req, res) => {
}
try {
const token = await createToken('newsletter', { email }, 48)
token = await createToken('newsletter', { email }, 48)
await sendConfirmationEmail(email, 'newsletter', token)
res.status(201).json({ ok: true, message: 'Bestaetigungs-E-Mail gesendet.' })
res.status(201).json({ ok: true, message: 'Bestätigungs-E-Mail gesendet.' })
} catch (error) {
if (token) await completeToken(token)
res.status(error instanceof MailerNotReadyError ? 503 : 502).json({ error: 'Die Anfrage konnte derzeit nicht versendet werden.' })
}
})
router.get('/confirm/:token', async (req, res) => {
const baseUrl = process.env.BASE_URL || ''
const baseUrl = (process.env.BASE_URL || '').replace(/\/+$/, '')
const entry = await reserveToken(req.params.token)
if (!entry) return res.redirect(baseUrl + '/bestaetigung?status=error')
@@ -65,7 +67,7 @@ router.get('/confirm/:token', async (req, res) => {
res.redirect(baseUrl + '/bestaetigung?status=success')
} catch {
await releaseToken(req.params.token)
res.status(502).redirect(baseUrl + '/bestaetigung?status=error')
res.redirect(baseUrl + '/bestaetigung?status=error')
}
})
privat/CV/andreknie.de/server/routes/speaker-cv.js
+3 -3
View File
@@ -5,7 +5,7 @@ import { fileURLToPath } from 'url'
import { Mutex } from 'async-mutex'
import { resourceLimiter } from '../middleware/rateLimiter.js'
import { antiSpam } from '../middleware/antiSpam.js'
import { sendSpeakerCv } from '../services/mailer.js'
import { sendSpeakerCv, MailerNotReadyError } from '../services/mailer.js'
const __dirname = dirname(fileURLToPath(import.meta.url))
const LEADS_FILE = join(__dirname, '..', 'data', 'speaker-cv-leads.json')
@@ -51,8 +51,8 @@ router.post('/', resourceLimiter, antiSpam, async (req, res) => {
})
res.status(201).json({ ok: true, message: 'Danke! Der Speaker CV ist auf dem Weg in dein Postfach.' })
} catch {
res.status(503).json({ error: 'Der Versand ist derzeit nicht verfügbar.' })
} catch (error) {
res.status(error instanceof MailerNotReadyError ? 503 : 502).json({ error: 'Der Versand ist derzeit nicht verfügbar.' })
}
})
privat/CV/andreknie.de/server/routes/talk-request.js
+8 -6
View File
@@ -8,9 +8,10 @@ const router = Router()
router.post('/', talkRequestLimiter, antiSpam, async (req, res) => {
const { name, email, event_name, topic, message } = req.body
let token
const errors = {}
if (!name || name.trim().length === 0) errors.name = 'Name ist erforderlich.'
if (!email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) errors.email = 'Gueltige E-Mail erforderlich.'
if (!email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) errors.email = 'Gültige E-Mail erforderlich.'
if (!event_name || event_name.trim().length === 0) errors.event_name = 'Eventname ist erforderlich.'
if (!topic || topic.trim().length === 0) errors.topic = 'Thema ist erforderlich.'
if (!message || message.trim().length === 0) errors.message = 'Nachricht ist erforderlich.'
@@ -19,16 +20,17 @@ router.post('/', talkRequestLimiter, antiSpam, async (req, res) => {
if (Object.keys(errors).length > 0) return res.status(400).json({ errors })
try {
const token = await createToken('talk-request', { name, email, event_name, topic, message }, 48)
token = await createToken('talk-request', { name, email, event_name, topic, message }, 48)
await sendConfirmationEmail(email, 'talk-request', token)
res.status(201).json({ ok: true, message: 'Bestaetigungs-E-Mail gesendet.' })
res.status(201).json({ ok: true, message: 'Bestätigungs-E-Mail gesendet.' })
} catch (error) {
if (token) await completeToken(token)
res.status(error instanceof MailerNotReadyError ? 503 : 502).json({ error: 'Die Anfrage konnte derzeit nicht versendet werden.' })
}
})
router.get('/confirm/:token', async (req, res) => {
const baseUrl = process.env.BASE_URL || ''
const baseUrl = (process.env.BASE_URL || '').replace(/\/+$/, '')
const entry = await reserveToken(req.params.token)
if (!entry) return res.redirect(baseUrl + '/bestaetigung?status=error')
@@ -36,9 +38,9 @@ router.get('/confirm/:token', async (req, res) => {
await sendStakeholderNotification('talk-request', entry.data)
await completeToken(req.params.token)
res.redirect(baseUrl + '/bestaetigung?status=success')
} catch (error) {
} catch {
await releaseToken(req.params.token)
res.status(error instanceof MailerNotReadyError ? 503 : 502).redirect(baseUrl + '/bestaetigung?status=error')
res.redirect(baseUrl + '/bestaetigung?status=error')
}
})
privat/CV/andreknie.de/server/services/confirmationToken.js
+2 -2
View File
@@ -6,10 +6,10 @@ import { Mutex } from 'async-mutex'
const __dirname = dirname(fileURLToPath(import.meta.url))
const DATA_DIR = join(__dirname, '..', 'data')
const TOKENS_FILE = join(DATA_DIR, 'pending-tokens.json')
const TOKENS_FILE = process.env.CONFIRMATION_TOKEN_FILE || join(DATA_DIR, 'pending-tokens.json')
const tokenMutex = new Mutex()
mkdirSync(DATA_DIR, { recursive: true })
mkdirSync(dirname(TOKENS_FILE), { recursive: true })
function loadTokens() {
if (!existsSync(TOKENS_FILE)) return []
privat/CV/andreknie.de/server/services/confirmationToken.test.js
+32 -5
View File
@@ -1,16 +1,38 @@
import { afterEach, beforeEach, describe, expect, it } from 'vitest'
import { existsSync, readFileSync, unlinkSync } from 'fs'
import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it } from 'vitest'
import { existsSync, mkdtempSync, readFileSync, rmSync, unlinkSync, writeFileSync } from 'fs'
import { tmpdir } from 'os'
import { join } from 'path'
import { createToken, reserveToken, completeToken, releaseToken, cleanupExpiredTokens } from './confirmationToken.js'
const tokensFile = join(process.cwd(), 'server', 'data', 'pending-tokens.json')
let testDir
let tokensFile
let createToken
let reserveToken
let completeToken
let releaseToken
let cleanupExpiredTokens
function removeTokensFile() {
if (existsSync(tokensFile)) unlinkSync(tokensFile)
}
beforeAll(async () => {
testDir = mkdtempSync(join(tmpdir(), 'andreknie-token-test-'))
tokensFile = join(testDir, 'pending-tokens.json')
process.env.CONFIRMATION_TOKEN_FILE = tokensFile
const service = await import('./confirmationToken.js')
createToken = service.createToken
reserveToken = service.reserveToken
completeToken = service.completeToken
releaseToken = service.releaseToken
cleanupExpiredTokens = service.cleanupExpiredTokens
})
beforeEach(removeTokensFile)
afterEach(removeTokensFile)
afterAll(() => {
delete process.env.CONFIRMATION_TOKEN_FILE
rmSync(testDir, { recursive: true, force: true })
})
describe('confirmation token lifecycle', () => {
it('creates a pending token and reserves it once', async () => {
@@ -55,8 +77,13 @@ describe('confirmation token lifecycle', () => {
it('cleans expired pending and processing entries', async () => {
const pending = await createToken('contact', { email: 'pending@example.invalid' }, -1)
const processing = await createToken('contact', { email: 'processing@example.invalid' }, -1)
const processing = await createToken('contact', { email: 'processing@example.invalid' }, 1)
await reserveToken(processing)
const stored = JSON.parse(readFileSync(tokensFile, 'utf8'))
stored.find(entry => entry.token === processing).expiresAt = new Date(Date.now() - 1000).toISOString()
writeFileSync(tokensFile, JSON.stringify(stored), 'utf8')
await cleanupExpiredTokens()
expect(pending).toBeTruthy()