133 lines
4.3 KiB
JavaScript
133 lines
4.3 KiB
JavaScript
import { beforeAll, afterAll, describe, expect, it } from 'vitest'
|
|
import { existsSync, mkdtempSync, readFileSync, rmSync } from 'fs'
|
|
import { tmpdir } from 'os'
|
|
import { join } from 'path'
|
|
|
|
let server
|
|
let baseUrl
|
|
let testDir
|
|
let tokensFile
|
|
let createToken
|
|
let reserveToken
|
|
let releaseToken
|
|
|
|
beforeAll(async () => {
|
|
testDir = mkdtempSync(join(tmpdir(), 'andreknie-server-test-'))
|
|
tokensFile = join(testDir, 'pending-tokens.json')
|
|
process.env.CONFIRMATION_TOKEN_FILE = tokensFile
|
|
|
|
const tokenService = await import('./services/confirmationToken.js')
|
|
createToken = tokenService.createToken
|
|
reserveToken = tokenService.reserveToken
|
|
releaseToken = tokenService.releaseToken
|
|
const { app } = await import('./index.js')
|
|
server = app.listen(0)
|
|
await new Promise(resolve => server.once('listening', resolve))
|
|
baseUrl = `http://127.0.0.1:${server.address().port}`
|
|
})
|
|
|
|
afterAll(async () => {
|
|
if (server) await new Promise(resolve => server.close(resolve))
|
|
delete process.env.CONFIRMATION_TOKEN_FILE
|
|
rmSync(testDir, { recursive: true, force: true })
|
|
})
|
|
|
|
describe('backend mail safety', () => {
|
|
it('reports degraded health without SMTP configuration', async () => {
|
|
const response = await fetch(`${baseUrl}/api/health`)
|
|
const body = await response.json()
|
|
|
|
expect(response.status).toBe(200)
|
|
expect(body.status).toBe('degraded')
|
|
expect(body.mailer).toEqual({ ready: false })
|
|
expect(JSON.stringify(body)).not.toContain('SMTP_PASS')
|
|
})
|
|
|
|
it.each([
|
|
['contact', { name: 'Test', email: 'test@example.invalid', message: 'Synthetic test' }],
|
|
['talk-request', {
|
|
name: 'Test',
|
|
email: 'test@example.invalid',
|
|
event_name: 'Synthetic event',
|
|
topic: 'Synthetic topic',
|
|
message: 'Synthetic test',
|
|
}],
|
|
['newsletter', { email: 'test@example.invalid' }],
|
|
])('does not retain %s data when confirmation mail cannot be sent', async (endpoint, payload) => {
|
|
const response = await fetch(`${baseUrl}/api/${endpoint}`, {
|
|
method: 'POST',
|
|
headers: { 'content-type': 'application/json' },
|
|
body: JSON.stringify(payload),
|
|
})
|
|
|
|
expect(response.status).toBe(503)
|
|
expect((await response.json()).error).toBeTruthy()
|
|
expect(existsSync(tokensFile) ? JSON.parse(readFileSync(tokensFile, 'utf8')) : []).toEqual([])
|
|
})
|
|
|
|
it('does not report success when speaker CV mail cannot be sent', async () => {
|
|
const response = await fetch(`${baseUrl}/api/speaker-cv`, {
|
|
method: 'POST',
|
|
headers: { 'content-type': 'application/json' },
|
|
body: JSON.stringify({
|
|
name: 'Test',
|
|
email: 'test@example.invalid',
|
|
message: 'Synthetic test',
|
|
}),
|
|
})
|
|
|
|
expect(response.status).toBe(503)
|
|
expect((await response.json()).error).toBeTruthy()
|
|
})
|
|
|
|
it('releases a confirmation token when stakeholder notification fails', async () => {
|
|
const token = await createToken('contact', {
|
|
name: 'Synthetic Test',
|
|
email: 'test@example.invalid',
|
|
message: 'No external mail is sent.',
|
|
})
|
|
|
|
const response = await fetch(`${baseUrl}/api/contact/confirm/${token}`, {
|
|
redirect: 'manual',
|
|
})
|
|
|
|
expect(response.status).toBe(302)
|
|
expect(response.headers.get('location')).toBe('/bestaetigung?status=error')
|
|
expect(await reserveToken(token)).toMatchObject({ status: 'processing' })
|
|
await releaseToken(token)
|
|
})
|
|
|
|
it('rejects unknown resources before any notification is sent', async () => {
|
|
const response = await fetch(`${baseUrl}/api/resource-download`, {
|
|
method: 'POST',
|
|
headers: { 'content-type': 'application/json' },
|
|
body: JSON.stringify({
|
|
name: 'Test',
|
|
email: 'test@example.invalid',
|
|
company: 'Synthetic Test',
|
|
resource_id: 'does-not-exist',
|
|
}),
|
|
})
|
|
|
|
expect(response.status).toBe(400)
|
|
expect((await response.json()).errors.resource_id).toBeTruthy()
|
|
})
|
|
|
|
it('silently accepts resource honeypot submissions', async () => {
|
|
const response = await fetch(`${baseUrl}/api/resource-download`, {
|
|
method: 'POST',
|
|
headers: { 'content-type': 'application/json' },
|
|
body: JSON.stringify({
|
|
name: 'Test',
|
|
email: 'test@example.invalid',
|
|
company: 'Synthetic Test',
|
|
resource_id: 'does-not-exist',
|
|
company_website: 'https://bot.example.invalid',
|
|
}),
|
|
})
|
|
|
|
expect(response.status).toBe(201)
|
|
expect((await response.json()).ok).toBe(true)
|
|
})
|
|
})
|