@antelopejs/dms-mailing 0.2.3 → 0.3.1

package/src/services/settings.ts

@@ -44,15 +44,43 @@ function toRow(values: MailingSettingsValues): Partial<MailingSettings> {
   return { ...rest, json_categories: JSON.stringify(categories) };
 }
 
+/** The tenant's stored settings, without creating them when there are none. */
+export async function findSettings(
+  tenantId: string,
+): Promise<MailingSettingsValues | undefined> {
+  const existing = await GetModel(SettingsModel, tenantId).getSingleton(
+    tenantId,
+  );
+  return existing ? toValues(existing) : undefined;
+}
+
+/**
+ * Creates the tenant's row under its tenant id, so two concurrent first
+ * readers cannot both insert one: the loser's insert is refused on the key.
+ * Resolves false when another writer created the row first.
+ */
+async function insertKeyedSettings(
+  tenantId: string,
+  values: MailingSettingsValues,
+): Promise<boolean> {
+  const model = GetModel(SettingsModel, tenantId);
+  try {
+    await model.insert({ ...toRow(values), _id: tenantId });
+    return true;
+  } catch (error) {
+    if (await model.get(tenantId)) return false;
+    throw error;
+  }
+}
+
 export async function getSettings(
   tenantId: string,
 ): Promise<MailingSettingsValues> {
-  const model = GetModel(SettingsModel, tenantId);
-  const existing = await model.getSingleton();
-  if (existing) return toValues(existing);
+  const existing = await findSettings(tenantId);
+  if (existing) return existing;
   const created = defaults();
-  await model.insert(toRow(created));
-  return created;
+  if (await insertKeyedSettings(tenantId, created)) return created;
+  return (await findSettings(tenantId)) as MailingSettingsValues;
 }
 
 export async function saveSettings(
@@ -60,9 +88,10 @@ export async function saveSettings(
   values: MailingSettingsValues,
 ): Promise<MailingSettingsValues> {
   const model = GetModel(SettingsModel, tenantId);
-  const existing = await model.getSingleton();
+  const existing = await model.getSingleton(tenantId);
   if (existing) await model.update(existing._id, toRow(values));
-  else await model.insert(toRow(values));
+  else if (!(await insertKeyedSettings(tenantId, values)))
+    await model.update(tenantId, toRow(values));
   return values;
 }
 

package/src/test/antelope.test.ts

@@ -126,6 +126,8 @@ export default defineConfig({
       source: SHARED_MODULE_SOURCES.api,
       config: {
         servers: [{ protocol: "http", host: "127.0.0.1", port: API_PORT }],
+        // Required outside development, which the test run is not.
+        publicBaseUrl: `http://127.0.0.1:${API_PORT}`,
       },
     },
     "file-storage-local": {

package/src/test/integration/events.test.ts

@@ -3,11 +3,12 @@ import {
   clearEmailEventSubscriptions,
   emailEventTrigger,
 } from "../../automation/email-event-trigger";
-import { authorizedClient } from "../helpers/http";
+import { authorizedClient, createClient } from "../helpers/http";
 import { ensureOwnerSession } from "../helpers/owner";
 
 const HTTP_OK = 200;
 const HTTP_FORBIDDEN = 403;
+const SECRET_LENGTH = 48;
 const TABLE = "/api/mailing/tables/templates";
 
 interface EventRow {
@@ -100,6 +101,28 @@ describe("[integration] events", () => {
   });
 });
 
+describe("[integration] webhook for a tenant without settings", () => {
+  // The endpoint is unauthenticated and takes the tenant from the body: reading
+  // the secret must not create a settings row for whatever tenant id it names.
+  it("refuses the event and stores nothing", async () => {
+    const { GetModel } =
+      await import("@antelopejs/interface-database-decorators");
+    const { SettingsModel } = await import("../../db");
+    const tenantId = `unknown-tenant-${Date.now()}`;
+
+    const hook = await createClient().post(
+      "/api/mailing/events/manual",
+      { messageId: "unknown-message", type: "opened", tenantId },
+      { headers: { "x-mailing-webhook-secret": "a".repeat(SECRET_LENGTH) } },
+    );
+
+    expect(hook.status).to.equal(HTTP_FORBIDDEN);
+    expect(await GetModel(SettingsModel, tenantId).getAll()).to.have.lengthOf(
+      0,
+    );
+  });
+});
+
 describe("[integration] send event purge", () => {
   // The retention cron deletes a send's events in one filtered statement. A
   // wrong predicate there would take another send's history with it, so pin

package/src/test/integration/sends.test.ts

@@ -45,6 +45,39 @@ describe("[integration] sends", () => {
     expect(detail.data.events[0].type).to.equal(detail.data.send.status);
   });
 
+  // Metrics load every send of their window; the rendered variables are the
+  // one unbounded field and none of them reads it.
+  it("reads a metrics window without the rendered variables", async () => {
+    const session = await ensureOwnerSession();
+    const client = authorizedClient(session.accessToken);
+    const created = await client.post(`${TABLE}/new`, {
+      slug: "metrics-window",
+      name: "Metrics window",
+      category: "orders",
+    });
+    const sent = await client.post(
+      `/api/mailing/templates/${created.data[0]}/test-send`,
+      { to: ["metrics@example.test"], locale: "en", data: { any: "value" } },
+    );
+    expect(sent.status, JSON.stringify(sent.data)).to.equal(HTTP_OK);
+    const sendId = sent.data.results[0].sendId as string;
+
+    const { GetModel } =
+      await import("@antelopejs/interface-database-decorators");
+    const { DEFAULT_TENANT_ID } =
+      await import("@antelopejs/interface-dms/constants");
+    const { SendModel } = await import("../../db");
+    const now = Date.now();
+    const rows = await GetModel(SendModel, DEFAULT_TENANT_ID).listBetween(
+      new Date(now - DAY_MS),
+      new Date(now + DAY_MS),
+    );
+
+    const row = rows.find((candidate) => candidate._id === sendId);
+    expect(row?.templateSlug).to.equal("metrics-window");
+    expect(row).to.not.have.property("json_variables");
+  });
+
   it("refuses a real send on a draft template", async () => {
     const session = await ensureOwnerSession();
     const client = authorizedClient(session.accessToken);

package/src/test/integration/settings.test.ts

@@ -48,3 +48,81 @@ describe("[integration] settings", () => {
     expect(restored.status).to.equal(HTTP_OK);
   });
 });
+
+const CONCURRENT_READERS = 5;
+const LEGACY_RETENTION_DAYS = 45;
+const LEGACY_SECRET = "l".repeat(48);
+
+async function loadSettingsModules() {
+  const { GetModel } =
+    await import("@antelopejs/interface-database-decorators");
+  const { SettingsModel } = await import("../../db");
+  const settings = await import("../../services/settings");
+  return {
+    ...settings,
+    rowsOf: (tenantId: string) => GetModel(SettingsModel, tenantId).getAll(),
+    insertLegacyRow: (tenantId: string) =>
+      GetModel(SettingsModel, tenantId).insert({
+        fallbackLocale: "en",
+        logRetentionDays: LEGACY_RETENTION_DAYS,
+        blockOnMissingVariables: false,
+        senderName: "",
+        senderEmail: "",
+        replyTo: "",
+        json_categories: "[]",
+        webhookSecret: LEGACY_SECRET,
+      }),
+  };
+}
+
+describe("[integration] settings row per tenant", () => {
+  // Every request path reads the settings, so a tenant's first reads arrive
+  // together. Each used to insert its own default row with its own webhook
+  // secret; the row is now keyed by the tenant id so only one can land.
+  it("creates a single row when first readers race", async () => {
+    const { getSettings, rowsOf } = await loadSettingsModules();
+    const tenantId = `settings-race-${Date.now()}`;
+
+    const reads = await Promise.all(
+      Array.from({ length: CONCURRENT_READERS }, () => getSettings(tenantId)),
+    );
+
+    const rows = await rowsOf(tenantId);
+    expect(rows).to.have.lengthOf(1);
+    expect(rows[0]?._id).to.equal(tenantId);
+    for (const read of reads) {
+      expect(read.webhookSecret).to.equal(rows[0]?.webhookSecret);
+    }
+  });
+
+  it("keeps reading and updating a row written before the key existed", async () => {
+    const { getSettings, saveSettings, rowsOf, insertLegacyRow } =
+      await loadSettingsModules();
+    const tenantId = `settings-legacy-${Date.now()}`;
+    await insertLegacyRow(tenantId);
+
+    const read = await getSettings(tenantId);
+    expect(read.webhookSecret).to.equal(LEGACY_SECRET);
+    await saveSettings(tenantId, {
+      ...read,
+      logRetentionDays: UPDATED_RETENTION_DAYS,
+    });
+
+    const rows = await rowsOf(tenantId);
+    expect(rows).to.have.lengthOf(1);
+    expect(rows[0]?.logRetentionDays).to.equal(UPDATED_RETENTION_DAYS);
+  });
+
+  it("saves a tenant's first settings under the tenant id", async () => {
+    const { getSettings, saveSettings, rowsOf } = await loadSettingsModules();
+    const tenantId = `settings-first-save-${Date.now()}`;
+    const values = await getSettings(`settings-template-${Date.now()}`);
+
+    await saveSettings(tenantId, { ...values, webhookSecret: LEGACY_SECRET });
+
+    const rows = await rowsOf(tenantId);
+    expect(rows).to.have.lengthOf(1);
+    expect(rows[0]?._id).to.equal(tenantId);
+    expect(rows[0]?.webhookSecret).to.equal(LEGACY_SECRET);
+  });
+});

package/src/test/integration/templates.test.ts

@@ -5,6 +5,7 @@ import { ensureOwnerSession } from "../helpers/owner";
 const HTTP_OK = 200;
 const HTTP_BAD_REQUEST = 400;
 const HTTP_NOT_FOUND = 404;
+const HTTP_CONFLICT = 409;
 const TABLE = "/api/mailing/tables/templates";
 
 interface TemplateRow {
@@ -116,6 +117,43 @@ describe("[integration] templates table", () => {
     expect(row.data.category).to.equal("billing");
   });
 
+  // Sends resolve a template by slug and only the create paths check it is
+  // free, so an edit must neither move it nor, by omitting it, clear it.
+  it("refuses a slug change on edit and keeps the slug when it is omitted", async () => {
+    const session = await ensureOwnerSession();
+    const client = authorizedClient(session.accessToken);
+    const created = await client.post(`${TABLE}/new`, {
+      slug: "fixed-slug",
+      name: "Fixed slug",
+      category: "orders",
+    });
+    const id = created.data[0] as string;
+
+    const moved = await client.put(`${TABLE}/edit?id=${id}`, {
+      slug: "order-confirmed",
+      name: "Fixed slug",
+      category: "orders",
+    });
+    expect(moved.status).to.equal(HTTP_CONFLICT);
+    expect(JSON.stringify(moved.data)).to.contain("slug_immutable");
+
+    const omitted = await client.put(`${TABLE}/edit?id=${id}`, {
+      name: "Renamed without slug",
+      category: "orders",
+    });
+    expect(omitted.status, JSON.stringify(omitted.data)).to.equal(HTTP_OK);
+    const row = await client.get(`${TABLE}/get?id=${id}`);
+    expect(row.data.slug).to.equal("fixed-slug");
+    expect(row.data.name).to.equal("Renamed without slug");
+
+    const { GetModel } =
+      await import("@antelopejs/interface-database-decorators");
+    const { DEFAULT_TENANT_ID } =
+      await import("@antelopejs/interface-dms/constants");
+    const { TemplateModel } = await import("../../db");
+    await GetModel(TemplateModel, DEFAULT_TENANT_ID).delete(id);
+  });
+
   it("refuses an unknown source template", async () => {
     const session = await ensureOwnerSession();
     const client = authorizedClient(session.accessToken);
@@ -211,12 +249,17 @@ describe("[integration] template content and status", () => {
   it("previews the current content with test data and reports missing variables", async () => {
     const session = await ensureOwnerSession();
     const client = authorizedClient(session.accessToken);
-    const list = await client.get(`${TABLE}/list`);
-    const id = (
-      list.data.results.find(
-        (item: TemplateRow) => item.slug === "welcome",
-      ) as TemplateRow
-    )._id;
+    // Looked up by slug rather than on the table's first page, which other
+    // tests fill with their own templates.
+    const { GetModel } =
+      await import("@antelopejs/interface-database-decorators");
+    const { DEFAULT_TENANT_ID } =
+      await import("@antelopejs/interface-dms/constants");
+    const { TemplateModel } = await import("../../db");
+    const welcome = await GetModel(TemplateModel, DEFAULT_TENANT_ID).getBySlug(
+      "welcome",
+    );
+    const id = welcome?._id as string;
     const preview = await client.post(`/api/mailing/templates/${id}/preview`, {
       locale: "en",
       data: {},

package/src/test/unit/period.test.ts

@@ -61,4 +61,31 @@ describe("[unit] period range", () => {
     expect(spanDays(previous)).to.equal(MAX_WINDOW_DAYS);
     expect(previous.to.getTime()).to.equal(current.from.getTime());
   });
+
+  // `compareFrom`/`compareTo` are plain query parameters too, and every metric
+  // reads its comparison window from the send log in full.
+  it("clamps an explicit comparison window like the current one", () => {
+    const current = currentRange(ctxWith({}));
+    const previous = comparisonRange(
+      ctxWith({
+        compareFrom: "1970-01-01T00:00:00.000Z",
+        compareTo: "2026-09-01T00:00:00.000Z",
+      }),
+      current,
+    );
+    expect(spanDays(previous)).to.equal(MAX_WINDOW_DAYS);
+    expect(previous.to.toISOString()).to.equal("2026-09-01T00:00:00.000Z");
+  });
+
+  it("keeps an explicit comparison window within the cap", () => {
+    const current = currentRange(ctxWith({}));
+    const previous = comparisonRange(
+      ctxWith({
+        compareFrom: "2026-08-01T00:00:00.000Z",
+        compareTo: "2026-09-01T00:00:00.000Z",
+      }),
+      current,
+    );
+    expect(previous.from.toISOString()).to.equal("2026-08-01T00:00:00.000Z");
+  });
 });

package/src/test/unit/permissions.test.ts

@@ -0,0 +1,30 @@
+import { expect } from "chai";
+import { GetPermission } from "@antelopejs/interface-dms/permissions";
+import { MAILING_SEND_PERMISSION } from "../../constants";
+
+const SENDS_PAGE_PERMISSION = "modules.mailing.sends";
+const SETTINGS_PAGE_PERMISSION = "settings.mailing.settings";
+const REMOVED_PERMISSIONS = [
+  "mailing.access",
+  "mailing.templates.manage",
+  "mailing.settings.manage",
+];
+
+describe("[unit] permissions", () => {
+  it("makes the send permission depend on the sends page permission", async () => {
+    const permission = await GetPermission(MAILING_SEND_PERMISSION);
+    expect(permission?.dependencies).to.deep.equal([SENDS_PAGE_PERMISSION]);
+  });
+
+  it("registers the settings page default permission", async () => {
+    expect(await GetPermission(SETTINGS_PAGE_PERMISSION)).to.not.equal(
+      undefined,
+    );
+  });
+
+  it("no longer registers the page-access permissions", async () => {
+    for (const id of REMOVED_PERMISSIONS) {
+      expect(await GetPermission(id), id).to.equal(undefined);
+    }
+  });
+});

package/src/test/unit/webhook-secret.test.ts

@@ -22,6 +22,7 @@ describe("[unit] webhook secret", () => {
     expect(webhookSecretMatches("", "")).to.equal(false);
     expect(webhookSecretMatches(undefined, "")).to.equal(false);
     expect(webhookSecretMatches(VALID_SECRET, "")).to.equal(false);
+    expect(webhookSecretMatches(VALID_SECRET, undefined)).to.equal(false);
   });
 
   it("refuses a missing or wrong header against a real secret", () => {

package/frontend-vue/tests/email-render-cases.json

@@ -1,77 +0,0 @@
-[
-	{
-		"locale": "en",
-		"email": {
-			"subject": "Your receipt",
-			"preheader": "Thanks for your order",
-			"missing": [],
-			"hiddenBlockIds": [],
-			"blocks": [
-				{
-					"id": "intro",
-					"type": "paragraph",
-					"text": "Hello Alice & Bob",
-					"align": "left"
-				},
-				{
-					"id": "items",
-					"type": "list",
-					"rows": [
-						{ "label": "Plan", "value": "Pro" },
-						{ "label": "Seats", "value": "3" }
-					]
-				},
-				{ "id": "total", "type": "total", "label": "Total", "value": "€29.00" },
-				{
-					"id": "footer",
-					"type": "footer",
-					"text": "Sent by Antelope",
-					"unsubscribeLabel": "Unsubscribe",
-					"preferencesLabel": "Preferences",
-					"unsubscribeUrl": "https://example.test/unsubscribe/en",
-					"preferencesUrl": "https://example.test/preferences/en"
-				}
-			]
-		}
-	},
-	{
-		"locale": "fr",
-		"email": {
-			"subject": "Votre reçu",
-			"preheader": "Merci pour votre commande",
-			"missing": [],
-			"hiddenBlockIds": [],
-			"blocks": [
-				{
-					"id": "intro",
-					"type": "paragraph",
-					"text": "Bonjour Alice & Bob",
-					"align": "left"
-				},
-				{
-					"id": "items",
-					"type": "list",
-					"rows": [
-						{ "label": "Offre", "value": "Pro" },
-						{ "label": "Places", "value": "3" }
-					]
-				},
-				{
-					"id": "total",
-					"type": "total",
-					"label": "Total",
-					"value": "29,00 €"
-				},
-				{
-					"id": "footer",
-					"type": "footer",
-					"text": "Envoyé par Antelope",
-					"unsubscribeLabel": "Se désabonner",
-					"preferencesLabel": "Préférences",
-					"unsubscribeUrl": "https://example.test/unsubscribe/fr",
-					"preferencesUrl": "https://example.test/preferences/fr"
-				}
-			]
-		}
-	}
-]