@7365admin1/core 3.42.0 → 3.42.1

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7365admin1/core",
   "license": "MIT",
-  "version": "3.42.0",
+  "version": "3.42.1",
   "author": "7365admin1",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -12,7 +12,8 @@
   "scripts": {
     "build": "tsup src/index.ts --format cjs,esm --dts && shx cp -r src/public dist && shx cp -r src/utils/handlebars dist",
     "release": "yarn run build && changeset publish",
-    "lint": "tsc"
+    "lint": "tsc",
+    "test:e2e": "yarn build && node --test --test-concurrency=1 --test-timeout=600000 \"test/e2e/*.test.mjs\""
   },
   "devDependencies": {
     "@changesets/cli": "^2.26.0",
@@ -24,6 +25,7 @@
     "@types/node-cron": "^3.0.11",
     "@types/nodemailer": "^8.0.0",
     "@types/xml2js": "^0.4.14",
+    "mongodb-memory-server": "^10.1.4",
     "shx": "^0.4.0",
     "tsup": "^6.5.0",
     "typescript": "^4.9.4"

package/test/e2e/harness.mjs

@@ -0,0 +1,426 @@
+// Throwaway end-to-end harness for the service-provider invite flow.
+//
+// Everything it talks to is created here and thrown away at the end of the run:
+// an in-process MongoDB replica set (mongodb-memory-server, replica set because
+// the services use transactions), a minimal Redis server on a loopback port, and
+// a minimal SMTP server on a loopback port that swallows every message and hands
+// it back for assertions.
+//
+// Nothing here reaches a shared database, a shared Redis, or a real mail server.
+// The mailer is pointed at 127.0.0.1, so a real email cannot be sent even by
+// mistake.
+//
+// The Express wiring below is a verbatim mirror of the route files in
+// iservice365-API-core (named above each block). The middleware (`requireAuth`),
+// the error handler, the controllers and the services are the real published
+// ones — only the `app.use(...)` mounting is restated here, because the route
+// files live in the API repository and cannot be imported from this package.
+
+import net from "node:net";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import crypto from "node:crypto";
+import { once } from "node:events";
+import { createRequire } from "node:module";
+
+import express from "express";
+import { MongoMemoryReplSet } from "mongodb-memory-server";
+import { ObjectId } from "mongodb";
+
+const require = createRequire(import.meta.url);
+
+/* -------------------------------------------------------------- fake Redis */
+
+// ponytail: only the commands this flow actually uses, and TTLs are ignored —
+// a run lasts seconds. If a test ever needs expiry, store an expiry timestamp
+// alongside the value and check it in GET.
+function startRedis() {
+  const strings = new Map();
+  const sets = new Map();
+
+  const enc = (v) => {
+    if (v === null || v === undefined) return "$-1\r\n";
+    if (typeof v === "number") return `:${v}\r\n`;
+    if (Array.isArray(v)) return `*${v.length}\r\n` + v.map(enc).join("");
+    if (typeof v === "object" && v.simple) return `+${v.simple}\r\n`;
+    const b = Buffer.from(String(v));
+    return `$${b.length}\r\n${b.toString()}\r\n`;
+  };
+
+  const run = (args) => {
+    const cmd = String(args[0] ?? "").toUpperCase();
+    const key = args[1];
+
+    switch (cmd) {
+      case "PING":
+        return { simple: "PONG" };
+      case "INFO":
+        return "# Server\r\nredis_version:7.2.0\r\n# Persistence\r\nloading:0\r\n";
+      case "GET":
+        return strings.has(key) ? strings.get(key) : null;
+      case "SET":
+      case "SETEX":
+        strings.set(key, cmd === "SET" ? args[2] : args[3]);
+        return { simple: "OK" };
+      case "DEL":
+      case "UNLINK": {
+        let n = 0;
+        for (const k of args.slice(1)) {
+          if (strings.delete(k)) n++;
+          if (sets.delete(k)) n++;
+        }
+        return n;
+      }
+      case "EXISTS":
+        return args.slice(1).filter((k) => strings.has(k) || sets.has(k)).length;
+      case "SADD": {
+        const s = sets.get(key) ?? new Set();
+        const before = s.size;
+        for (const m of args.slice(2)) s.add(m);
+        sets.set(key, s);
+        return s.size - before;
+      }
+      case "SMEMBERS":
+        return [...(sets.get(key) ?? [])];
+      case "KEYS":
+        return [...strings.keys()];
+      case "EXPIRE":
+      case "TTL":
+        return 1;
+      default:
+        // AUTH, SELECT, CLIENT, COMMAND, QUIT, ...
+        return { simple: "OK" };
+    }
+  };
+
+  const server = net.createServer((sock) => {
+    let buf = Buffer.alloc(0);
+
+    sock.on("data", (chunk) => {
+      buf = Buffer.concat([buf, chunk]);
+
+      for (;;) {
+        const parsed = parseCommand(buf);
+        if (!parsed) return;
+        buf = parsed.rest;
+        sock.write(enc(run(parsed.args)));
+      }
+    });
+    sock.on("error", () => {});
+  });
+
+  // RESP: *<n>\r\n then n bulk strings ($<len>\r\n<bytes>\r\n)
+  function parseCommand(b) {
+    const text = b.toString("utf8");
+    if (!text.startsWith("*")) return null;
+
+    let i = text.indexOf("\r\n");
+    if (i < 0) return null;
+
+    const count = Number(text.slice(1, i));
+    let pos = i + 2;
+    const args = [];
+
+    for (let n = 0; n < count; n++) {
+      if (text[pos] !== "$") return null;
+      const j = text.indexOf("\r\n", pos);
+      if (j < 0) return null;
+      const len = Number(text.slice(pos + 1, j));
+      const start = j + 2;
+      if (text.length < start + len + 2) return null;
+      args.push(text.slice(start, start + len));
+      pos = start + len + 2;
+    }
+
+    return { args, rest: Buffer.from(text.slice(pos), "utf8") };
+  }
+
+  return new Promise((resolve) => {
+    server.listen(0, "127.0.0.1", () =>
+      resolve({ port: server.address().port, stop: () => server.close() }),
+    );
+  });
+}
+
+/* --------------------------------------------------------------- mail sink */
+
+const decodeQuotedPrintable = (s) =>
+  s
+    .replace(/=\r?\n/g, "")
+    .replace(/=([0-9A-Fa-f]{2})/g, (_, h) => String.fromCharCode(parseInt(h, 16)));
+
+function parseMessage(raw) {
+  const split = raw.indexOf("\r\n\r\n");
+  const head = raw.slice(0, split).replace(/\r\n[ \t]+/g, " ");
+  let body = raw.slice(split + 4);
+
+  const header = (name) =>
+    head.match(new RegExp(`^${name}:\\s*(.*)$`, "im"))?.[1]?.trim() ?? "";
+
+  if (/quoted-printable/i.test(header("Content-Transfer-Encoding"))) {
+    body = decodeQuotedPrintable(body);
+  } else if (/base64/i.test(header("Content-Transfer-Encoding"))) {
+    body = Buffer.from(body.replace(/\r\n/g, ""), "base64").toString("utf8");
+  }
+
+  return { to: header("To"), from: header("From"), subject: header("Subject"), body };
+}
+
+function startMailSink() {
+  const messages = [];
+
+  const server = net.createServer((sock) => {
+    let buf = "";
+    let inData = false;
+
+    sock.write("220 e2e.invalid ESMTP\r\n");
+
+    sock.on("data", (chunk) => {
+      buf += chunk.toString("utf8");
+
+      for (;;) {
+        if (inData) {
+          const end = buf.indexOf("\r\n.\r\n");
+          if (end < 0) return;
+          messages.push(parseMessage(buf.slice(0, end)));
+          buf = buf.slice(end + 5);
+          inData = false;
+          sock.write("250 2.0.0 Ok\r\n");
+          continue;
+        }
+
+        const nl = buf.indexOf("\r\n");
+        if (nl < 0) return;
+        const line = buf.slice(0, nl);
+        buf = buf.slice(nl + 2);
+
+        const cmd = line.split(" ")[0].toUpperCase();
+        if (cmd === "EHLO" || cmd === "HELO") {
+          sock.write("250-e2e.invalid\r\n250-AUTH PLAIN\r\n250 8BITMIME\r\n");
+        } else if (cmd === "DATA") {
+          inData = true;
+          sock.write("354 End data with <CR><LF>.<CR><LF>\r\n");
+        } else if (cmd === "QUIT") {
+          sock.write("221 Bye\r\n");
+          sock.end();
+          return;
+        } else {
+          sock.write("250 2.0.0 Ok\r\n"); // AUTH, MAIL FROM, RCPT TO, RSET, NOOP
+        }
+      }
+    });
+    sock.on("error", () => {});
+  });
+
+  return new Promise((resolve) => {
+    server.listen(0, "127.0.0.1", () =>
+      resolve({ port: server.address().port, messages, stop: () => server.close() }),
+    );
+  });
+}
+
+/* ------------------------------------------------------------------- app */
+
+function buildApp(nsu, core) {
+  const { requireAuth, errorHandler } = nsu;
+  const app = express();
+  app.use(express.json());
+
+  // mirrors iservice365-API-core/src/routes/auth.route.ts
+  const auth = express.Router();
+  {
+    const { login } = core.useAuthController();
+    auth.post("/", login);
+  }
+
+  // mirrors iservice365-API-core/src/routes/auth-v2.route.ts
+  const authV2 = express.Router();
+  {
+    const { signUp } = core.useAuthControllerV2();
+    const { verify } = core.useVerificationControllerV2();
+    authV2.post("/sign-up", signUp);
+    authV2.get("/verify/:verificationCode", verify);
+  }
+
+  // mirrors iservice365-API-core/src/routes/user-v2.route.ts
+  const usersV2 = express.Router();
+  {
+    const { createUserByVerification } = core.useUserControllerV2();
+    usersV2.post("/invite/:id", createUserByVerification);
+  }
+
+  // mirrors iservice365-API-core/src/routes/service-provider.route.ts
+  const serviceProviders = express.Router();
+  {
+    const { createServiceProviderInvite } = core.useVerificationController();
+    serviceProviders.post("/invite", requireAuth, createServiceProviderInvite);
+  }
+
+  // mirrors iservice365-API-core/src/routes/customer-site.route.ts
+  const customerSites = express.Router();
+  {
+    const { getAll, addViaInvite } = core.useCustomerSiteController();
+    customerSites.get("/", requireAuth, getAll);
+    customerSites.post("/invite/:id", addViaInvite); // no requireAuth — as shipped
+  }
+
+  // mirrors iservice365-API-core/src/routes/index.ts mount points
+  app.use("/api/auth", auth);
+  app.use("/api/auth/v2", authV2);
+  app.use("/api/users/v2", usersV2);
+  app.use("/api/service-providers", serviceProviders);
+  app.use("/api/customer-sites", customerSites);
+
+  app.use(errorHandler);
+  return app;
+}
+
+/* ------------------------------------------------------------ working dir */
+
+// src/utils/rsa-encryption.ts reads the Entrypass key pair from
+// `<cwd>/src/public/rsa-keys/` at module load, and those keys are secrets that
+// are not in the repository — so simply requiring the package fails anywhere
+// they are absent. The invite flow never touches Entrypass, so the harness runs
+// from a temporary directory holding a freshly generated throwaway pair. It
+// also keeps the run away from any local .env.
+function makeWorkDir() {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "iservice365-e2e-"));
+  const keys = path.join(dir, "src", "public", "rsa-keys");
+  fs.mkdirSync(keys, { recursive: true });
+
+  const { publicKey, privateKey } = crypto.generateKeyPairSync("rsa", {
+    modulusLength: 512,
+    publicKeyEncoding: { type: "spki", format: "pem" },
+    privateKeyEncoding: { type: "pkcs8", format: "pem" },
+  });
+
+  fs.writeFileSync(path.join(keys, "new_rsa_512_pub.pem"), publicKey);
+  fs.writeFileSync(path.join(keys, "new_rsa_512_priv.pem"), privateKey);
+
+  const previous = process.cwd();
+  process.chdir(dir);
+
+  return () => {
+    process.chdir(previous);
+    fs.rmSync(dir, { recursive: true, force: true });
+  };
+}
+
+/* --------------------------------------------------------------- harness */
+
+export async function startHarness() {
+  const redis = await startRedis();
+  const mail = await startMailSink();
+  const mongo = await MongoMemoryReplSet.create({
+    replSet: { count: 1, storageEngine: "wiredTiger" },
+  });
+  const restoreCwd = makeWorkDir();
+
+  // config.ts reads these once, at import time — they must be set before the
+  // package is required.
+  Object.assign(process.env, {
+    NODE_ENV: "development",
+    MONGO_URI: mongo.getUri(),
+    MONGO_DB: "e2e",
+    REDIS_HOST: "127.0.0.1",
+    REDIS_PORT: String(redis.port),
+    REDIS_PASSWORD: "",
+    MAILER_TRANSPORT_HOST: "127.0.0.1",
+    MAILER_TRANSPORT_PORT: String(mail.port),
+    MAILER_TRANSPORT_SECURE: "false",
+    MAILER_EMAIL: "no-reply@e2e.example.com",
+    MAILER_PASSWORD: "e2e",
+    APP_MAIN: "http://app.e2e.example.com",
+    DOMAIN: "localhost",
+    // the S3 client is constructed eagerly by the user service; this flow never
+    // uploads anything, and the endpoint is deliberately unroutable.
+    SPACES_ACCESS_KEY: "e2e",
+    SPACES_SECRET_KEY: "e2e",
+    SPACES_ENDPOINT: "http://127.0.0.1:1",
+    SPACES_REGION: "us-east-1",
+    SPACES_BUCKET: "e2e",
+  });
+
+  const nsu = require("@7365admin1/node-server-utils");
+  await nsu.useAtlas.initialize({ uri: mongo.getUri(), db: "e2e" });
+  nsu.useRedis().init({ host: "127.0.0.1", port: redis.port });
+
+  const core = require("../../dist/index.js");
+  const db = nsu.useAtlas.getDb();
+
+  const server = buildApp(nsu, core).listen(0, "127.0.0.1");
+  await once(server, "listening");
+  const base = `http://127.0.0.1:${server.address().port}/api`;
+
+  async function api(path, { method = "GET", body, sid } = {}) {
+    const res = await fetch(`${base}${path}`, {
+      method,
+      headers: {
+        ...(body ? { "content-type": "application/json" } : {}),
+        ...(sid ? { authorization: `Bearer ${sid}` } : {}),
+      },
+      ...(body ? { body: JSON.stringify(body) } : {}),
+    });
+
+    const text = await res.text();
+    let json;
+    try {
+      json = JSON.parse(text);
+    } catch {
+      json = text;
+    }
+    return { status: res.status, body: json };
+  }
+
+  // issueSession caches the session without awaiting it, so a login can return
+  // a moment before requireAuth can see it. Log in through the real endpoint,
+  // then wait for the session to land.
+  async function login(email, password) {
+    const res = await api("/auth", { method: "POST", body: { email, password } });
+    if (res.status !== 200) {
+      throw new Error(`login failed for ${email}: ${res.status} ${JSON.stringify(res.body)}`);
+    }
+
+    const sid = res.body.sid;
+    for (let i = 0; i < 100; i++) {
+      const probe = await api("/customer-sites?org=" + new ObjectId().toString() + "&status=active", { sid });
+      if (probe.status !== 401) return sid;
+      await new Promise((r) => setTimeout(r, 20));
+    }
+    throw new Error(`session for ${email} never became usable`);
+  }
+
+  // some senders fire the mail off without awaiting it, so a test that looks
+  // straight after the response can be ahead of the sink.
+  async function mailAt(index, timeoutMs = 5000) {
+    const until = Date.now() + timeoutMs;
+    while (mail.messages.length <= index) {
+      if (Date.now() > until) throw new Error(`no email arrived at index ${index}`);
+      await new Promise((r) => setTimeout(r, 20));
+    }
+    return mail.messages[index];
+  }
+
+  async function stop() {
+    server.close();
+    await nsu.useAtlas.close();
+    try {
+      nsu.useRedis().getClient().disconnect();
+    } catch {}
+    redis.stop();
+    mail.stop();
+    await mongo.stop();
+    restoreCwd();
+  }
+
+  return {
+    api,
+    login,
+    mailAt,
+    db,
+    mails: mail.messages,
+    hashPassword: nsu.hashPassword,
+    stop,
+  };
+}