fix(andreknie.de): close data lifecycle review gaps

privat/CV/andreknie.de/server/index.test.js

@@ -1,16 +1,36 @@
 import { beforeAll, afterAll, describe, expect, it } from 'vitest'
+import { existsSync, mkdtempSync, readFileSync, rmSync } from 'fs'
+import { tmpdir } from 'os'
+import { join } from 'path'
 
 let server
 let baseUrl
+let testDir
+let tokensFile
+let createToken
+let reserveToken
+let releaseToken
 
 beforeAll(async () => {
+  testDir = mkdtempSync(join(tmpdir(), 'andreknie-server-test-'))
+  tokensFile = join(testDir, 'pending-tokens.json')
+  process.env.CONFIRMATION_TOKEN_FILE = tokensFile
+
+  const tokenService = await import('./services/confirmationToken.js')
+  createToken = tokenService.createToken
+  reserveToken = tokenService.reserveToken
+  releaseToken = tokenService.releaseToken
   const { app } = await import('./index.js')
   server = app.listen(0)
   await new Promise(resolve => server.once('listening', resolve))
   baseUrl = `http://127.0.0.1:${server.address().port}`
 })
 
-afterAll(() => server?.close())
+afterAll(async () => {
+  if (server) await new Promise(resolve => server.close(resolve))
+  delete process.env.CONFIRMATION_TOKEN_FILE
+  rmSync(testDir, { recursive: true, force: true })
+})
 
 describe('backend mail safety', () => {
   it('reports degraded health without SMTP configuration', async () => {
@@ -23,14 +43,57 @@ describe('backend mail safety', () => {
     expect(JSON.stringify(body)).not.toContain('SMTP_PASS')
   })
 
-  it('does not report success when contact mail cannot be sent', async () => {
-    const response = await fetch(`${baseUrl}/api/contact`, {
+  it.each([
+    ['contact', { name: 'Test', email: 'test@example.invalid', message: 'Synthetic test' }],
+    ['talk-request', {
+      name: 'Test',
+      email: 'test@example.invalid',
+      event_name: 'Synthetic event',
+      topic: 'Synthetic topic',
+      message: 'Synthetic test',
+    }],
+    ['newsletter', { email: 'test@example.invalid' }],
+  ])('does not retain %s data when confirmation mail cannot be sent', async (endpoint, payload) => {
+    const response = await fetch(`${baseUrl}/api/${endpoint}`, {
       method: 'POST',
       headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ name: 'Test', email: 'test@example.invalid', message: 'Synthetic test' }),
+      body: JSON.stringify(payload),
+    })
+
+    expect(response.status).toBe(503)
+    expect((await response.json()).error).toBeTruthy()
+    expect(existsSync(tokensFile) ? JSON.parse(readFileSync(tokensFile, 'utf8')) : []).toEqual([])
+  })
+
+  it('does not report success when speaker CV mail cannot be sent', async () => {
+    const response = await fetch(`${baseUrl}/api/speaker-cv`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({
+        name: 'Test',
+        email: 'test@example.invalid',
+        message: 'Synthetic test',
+      }),
     })
 
     expect(response.status).toBe(503)
     expect((await response.json()).error).toBeTruthy()
   })
+
+  it('releases a confirmation token when stakeholder notification fails', async () => {
+    const token = await createToken('contact', {
+      name: 'Synthetic Test',
+      email: 'test@example.invalid',
+      message: 'No external mail is sent.',
+    })
+
+    const response = await fetch(`${baseUrl}/api/contact/confirm/${token}`, {
+      redirect: 'manual',
+    })
+
+    expect(response.status).toBe(302)
+    expect(response.headers.get('location')).toBe('/bestaetigung?status=error')
+    expect(await reserveToken(token)).toMatchObject({ status: 'processing' })
+    await releaseToken(token)
+  })
 })