@beechcms/api 0.5.0 → 0.6.0-preview.2

package/src/features/automations/__tests__/automations.schema.test.ts

@@ -1,134 +1,224 @@
-import { describe, it, expect } from 'vitest'
-import {
-  createAutomationSchema,
-  updateAutomationSchema,
-  toggleAutomationSchema,
-} from '../automations.schema'
-
-const validWebhookAction = { type: 'webhook' as const, url: 'https://example.com/hook' }
-
-const minimalValid = {
-  seed_slug: 'posts',
-  name: 'notify-on-create',
-  triggers: [{ event: 'create' as const }],
-  actions: [validWebhookAction],
-}
-
-describe('createAutomationSchema', () => {
-  it('accepts minimal valid create payload', () => {
-    expect(createAutomationSchema.safeParse(minimalValid).success).toBe(true)
-  })
-
-  it('rejects cron trigger without cron expression', () => {
-    const result = createAutomationSchema.safeParse({
-      ...minimalValid,
-      triggers: [{ event: 'cron' }],
-    })
-    expect(result.success).toBe(false)
-  })
-
-  it('accepts cron trigger with cron expression', () => {
-    const result = createAutomationSchema.safeParse({
-      ...minimalValid,
-      triggers: [{ event: 'cron', cron: '0 * * * *' }],
-    })
-    expect(result.success).toBe(true)
-  })
-
-  it('rejects duplicate trigger events', () => {
-    const result = createAutomationSchema.safeParse({
-      ...minimalValid,
-      triggers: [{ event: 'create' }, { event: 'create' }],
-    })
-    expect(result.success).toBe(false)
-  })
-
-  it('accepts multiple distinct triggers', () => {
-    const result = createAutomationSchema.safeParse({
-      ...minimalValid,
-      triggers: [{ event: 'create' }, { event: 'update' }],
-    })
-    expect(result.success).toBe(true)
-  })
-
-  it('rejects empty actions array', () => {
-    const result = createAutomationSchema.safeParse({ ...minimalValid, actions: [] })
-    expect(result.success).toBe(false)
-  })
-
-  it('rejects unknown action type', () => {
-    const result = createAutomationSchema.safeParse({
-      ...minimalValid,
-      actions: [{ type: 'unknown_type', url: 'https://example.com' }],
-    })
-    expect(result.success).toBe(false)
-  })
-
-  it('rejects webhook with non-url', () => {
-    const result = createAutomationSchema.safeParse({
-      ...minimalValid,
-      actions: [{ type: 'webhook', url: 'not-a-url' }],
-    })
-    expect(result.success).toBe(false)
-  })
-
-  it('rejects send_mail with invalid email', () => {
-    const result = createAutomationSchema.safeParse({
-      ...minimalValid,
-      actions: [{ type: 'send_mail', to: 'not-an-email', subject_template: 'hi', body_template: 'body' }],
-    })
-    expect(result.success).toBe(false)
-  })
-
-  it('accepts trigger_conditions as null', () => {
-    const result = createAutomationSchema.safeParse({
-      ...minimalValid,
-      trigger_conditions: null,
-    })
-
-    expect(result.success).toBe(true)
-  })
-
-  it('accepts trigger_conditions as WhenNode', () => {
-    const result = createAutomationSchema.safeParse({
-      ...minimalValid,
-      trigger_conditions: {
-        kind: 'group',
-        op: 'AND',
-        children: [
-          { kind: 'predicate', left: { kind: 'ref', key: 'this.status' }, op: 'eq', right: { kind: 'literal', value: 'published' } },
-        ],
-      },
-    })
-    expect(result.success).toBe(true)
-  })
-})
-
-describe('updateAutomationSchema', () => {
-  it('accepts empty object', () => {
-    expect(updateAutomationSchema.safeParse({}).success).toBe(true)
-  })
-
-  it('accepts name-only without requiring triggers', () => {
-    const result = updateAutomationSchema.safeParse({ name: 'renamed' })
-    expect(result.success).toBe(true)
-  })
-})
-
-describe('toggleAutomationSchema', () => {
-  it('accepts { enabled: true }', () => {
-    expect(toggleAutomationSchema.safeParse({ enabled: true }).success).toBe(true)
-  })
-
-  it('accepts { enabled: false }', () => {
-    expect(toggleAutomationSchema.safeParse({ enabled: false }).success).toBe(true)
-  })
-
-  it('rejects missing enabled', () => {
-    expect(toggleAutomationSchema.safeParse({}).success).toBe(false)
-  })
-
-  it('rejects non-boolean enabled', () => {
-    expect(toggleAutomationSchema.safeParse({ enabled: 'true' }).success).toBe(false)
-  })
-})
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+import { describe, it, expect } from 'vitest'
+import {
+  createAutomationSchema,
+  updateAutomationSchema,
+  toggleAutomationSchema,
+} from '../automations.schema'
+
+const validWebhookAction = { type: 'webhook' as const, url: 'https://example.com/hook', body_template: '{}' }
+
+const minimalValid = {
+  seed_slug: 'posts',
+  name: 'notify-on-create',
+  triggers: [{ event: 'create' as const }],
+  actions: [validWebhookAction],
+}
+
+describe('createAutomationSchema', () => {
+  it('accepts minimal valid create payload', () => {
+    expect(createAutomationSchema.safeParse(minimalValid).success).toBe(true)
+  })
+
+  it('rejects cron trigger without cron expression', () => {
+    const result = createAutomationSchema.safeParse({
+      ...minimalValid,
+      triggers: [{ event: 'cron' }],
+    })
+    expect(result.success).toBe(false)
+  })
+
+  it('accepts cron trigger with cron expression', () => {
+    const result = createAutomationSchema.safeParse({
+      ...minimalValid,
+      triggers: [{ event: 'cron', cron: '0 * * * *' }],
+    })
+    expect(result.success).toBe(true)
+  })
+
+  it('rejects duplicate trigger events', () => {
+    const result = createAutomationSchema.safeParse({
+      ...minimalValid,
+      triggers: [{ event: 'create' }, { event: 'create' }],
+    })
+    expect(result.success).toBe(false)
+  })
+
+  it('accepts multiple distinct triggers', () => {
+    const result = createAutomationSchema.safeParse({
+      ...minimalValid,
+      triggers: [{ event: 'create' }, { event: 'update' }],
+    })
+    expect(result.success).toBe(true)
+  })
+
+  it('rejects empty actions array', () => {
+    const result = createAutomationSchema.safeParse({ ...minimalValid, actions: [] })
+    expect(result.success).toBe(false)
+  })
+
+  it('rejects unknown action type', () => {
+    const result = createAutomationSchema.safeParse({
+      ...minimalValid,
+      actions: [{ type: 'unknown_type', url: 'https://example.com' }],
+    })
+    expect(result.success).toBe(false)
+  })
+
+  it('rejects webhook with non-url', () => {
+    const result = createAutomationSchema.safeParse({
+      ...minimalValid,
+      actions: [{ type: 'webhook', url: 'not-a-url', body_template: '{}' }],
+    })
+    expect(result.success).toBe(false)
+  })
+
+  it('rejects webhook with HTTP url (not HTTPS)', () => {
+    const result = createAutomationSchema.safeParse({
+      ...minimalValid,
+      actions: [{ type: 'webhook', url: 'http://example.com', body_template: '{}' }],
+    })
+    expect(result.success).toBe(false)
+    const issues = result.error?.issues ?? []
+    expect(issues.some((i) => i.message === 'automations.editor.errors.webhookHttpsRequired')).toBe(true)
+  })
+
+  it('rejects webhook with localhost url', () => {
+    const result = createAutomationSchema.safeParse({
+      ...minimalValid,
+      actions: [{ type: 'webhook', url: 'https://localhost/x', body_template: '{}' }],
+    })
+    expect(result.success).toBe(false)
+    const issues = result.error?.issues ?? []
+    expect(issues.some((i) => i.message === 'automations.editor.errors.webhookPrivateHostBlocked')).toBe(true)
+  })
+
+  it('rejects webhook with 127.0.0.1', () => {
+    const result = createAutomationSchema.safeParse({
+      ...minimalValid,
+      actions: [{ type: 'webhook', url: 'https://127.0.0.1/x', body_template: '{}' }],
+    })
+    expect(result.success).toBe(false)
+  })
+
+  it('rejects webhook with AWS metadata IP (169.254.169.254)', () => {
+    const result = createAutomationSchema.safeParse({
+      ...minimalValid,
+      actions: [{ type: 'webhook', url: 'https://169.254.169.254/x', body_template: '{}' }],
+    })
+    expect(result.success).toBe(false)
+  })
+
+  it('rejects webhook with 10.x.x.x private IP', () => {
+    const result = createAutomationSchema.safeParse({
+      ...minimalValid,
+      actions: [{ type: 'webhook', url: 'https://10.0.0.5/x', body_template: '{}' }],
+    })
+    expect(result.success).toBe(false)
+  })
+
+  it('rejects webhook with 192.168.x.x private IP', () => {
+    const result = createAutomationSchema.safeParse({
+      ...minimalValid,
+      actions: [{ type: 'webhook', url: 'https://192.168.1.1/x', body_template: '{}' }],
+    })
+    expect(result.success).toBe(false)
+  })
+
+  it('rejects webhook with 172.16.x.x private IP', () => {
+    const result = createAutomationSchema.safeParse({
+      ...minimalValid,
+      actions: [{ type: 'webhook', url: 'https://172.16.0.1/x', body_template: '{}' }],
+    })
+    expect(result.success).toBe(false)
+  })
+
+  it('accepts webhook with 172.32.x.x (outside private range)', () => {
+    const result = createAutomationSchema.safeParse({
+      ...minimalValid,
+      actions: [{ type: 'webhook', url: 'https://172.32.0.1/x', body_template: '{}' }],
+    })
+    expect(result.success).toBe(true)
+  })
+
+  it('rejects webhook without body_template', () => {
+    const result = createAutomationSchema.safeParse({
+      ...minimalValid,
+      actions: [{ type: 'webhook', url: 'https://example.com/x' }],
+    })
+    expect(result.success).toBe(false)
+    const issues = result.error?.issues ?? []
+    expect(issues.some((i) => i.message === 'automations.editor.errors.bodyRequired')).toBe(true)
+  })
+
+  it('accepts webhook with valid HTTPS public url and body_template', () => {
+    const result = createAutomationSchema.safeParse({
+      ...minimalValid,
+      actions: [{ type: 'webhook', url: 'https://example.com/x', body_template: '{}' }],
+    })
+    expect(result.success).toBe(true)
+  })
+
+  it('rejects send_mail with invalid email', () => {
+    const result = createAutomationSchema.safeParse({
+      ...minimalValid,
+      actions: [{ type: 'send_mail', to: 'not-an-email', subject_template: 'hi', body_template: 'body' }],
+    })
+    expect(result.success).toBe(false)
+  })
+
+  it('accepts trigger_conditions as null', () => {
+    const result = createAutomationSchema.safeParse({
+      ...minimalValid,
+      trigger_conditions: null,
+    })
+
+    expect(result.success).toBe(true)
+  })
+
+  it('accepts trigger_conditions as WhenNode', () => {
+    const result = createAutomationSchema.safeParse({
+      ...minimalValid,
+      trigger_conditions: {
+        kind: 'group',
+        op: 'AND',
+        children: [
+          { kind: 'predicate', left: { kind: 'ref', key: 'this.status' }, op: 'eq', right: { kind: 'literal', value: 'published' } },
+        ],
+      },
+    })
+    expect(result.success).toBe(true)
+  })
+})
+
+describe('updateAutomationSchema', () => {
+  it('accepts empty object', () => {
+    expect(updateAutomationSchema.safeParse({}).success).toBe(true)
+  })
+
+  it('accepts name-only without requiring triggers', () => {
+    const result = updateAutomationSchema.safeParse({ name: 'renamed' })
+    expect(result.success).toBe(true)
+  })
+})
+
+describe('toggleAutomationSchema', () => {
+  it('accepts { enabled: true }', () => {
+    expect(toggleAutomationSchema.safeParse({ enabled: true }).success).toBe(true)
+  })
+
+  it('accepts { enabled: false }', () => {
+    expect(toggleAutomationSchema.safeParse({ enabled: false }).success).toBe(true)
+  })
+
+  it('rejects missing enabled', () => {
+    expect(toggleAutomationSchema.safeParse({}).success).toBe(false)
+  })
+
+  it('rejects non-boolean enabled', () => {
+    expect(toggleAutomationSchema.safeParse({ enabled: 'true' }).success).toBe(false)
+  })
+})

package/src/features/automations/__tests__/context-resolver.test.ts

@@ -1,122 +1,126 @@
-import { describe, it, expect } from 'vitest'
-import type { Automation } from '@beechcms/core'
-import { resolveAutomationContext, deriveEntryContext } from '../context-resolver'
-import { parseTemplateKey } from '../template-grammar'
-
-function makeAutomation(overrides: Partial<Automation> = {}): Automation {
-  return {
-    id: 'auto-1',
-    seed_slug: 'orders',
-    name: 'test',
-    enabled: true,
-    triggers: [{ event: 'cron' as const, cron: '* * * * *' }],
-    trigger_conditions: null,
-    actions: [],
-    created_at: 0,
-    updated_at: 0,
-    ...overrides,
-  }
-}
-
-describe('resolveAutomationContext', () => {
-  const triggerEntry = { id: 'e1', email: 'alice@example.com', product_id: 'p1' }
-  const batchEntries = [
-    { id: 'e1', total: 10, email: 'alice@example.com' },
-    { id: 'e2', total: 20, email: 'bob@example.com' },
-    { id: 'e3', total: 30, email: 'carol@example.com' },
-  ]
-
-  it('this scope resolves to triggering entry field', async () => {
-    const ctx = await resolveAutomationContext(makeAutomation(), triggerEntry, [triggerEntry])
-    expect(ctx.lookup(parseTemplateKey('this:email')!)).toBe('alice@example.com')
-  })
-
-  it('this. dot notation resolves to triggering entry field', async () => {
-    const ctx = await resolveAutomationContext(makeAutomation(), triggerEntry, [triggerEntry])
-    expect(ctx.lookup(parseTemplateKey('email')!)).toBe('alice@example.com')
-    expect(ctx.lookup(parseTemplateKey('this:product_id')!)).toBe('p1')
-  })
-
-  it('batch:all:count matches batchEntries length', async () => {
-    const ctx = await resolveAutomationContext(makeAutomation(), triggerEntry, batchEntries)
-    expect(ctx.lookup(parseTemplateKey('batch:all:count')!)).toBe(3)
-  })
-
-  it('unknown scope → undefined + onMissing fires', async () => {
-    const ctx = await resolveAutomationContext(makeAutomation(), triggerEntry, [triggerEntry])
-    const missing: string[] = []
-    const val = ctx.lookup(parseTemplateKey('unknownseed:lastone:email')!, (f) => missing.push(f))
-    expect(val).toBeUndefined()
-    expect(missing).toHaveLength(1)
-    expect(missing[0]).toBe('unknownseed')
-  })
-
-  it('pluck truncates to 100 entries and appends truncation marker', async () => {
-    const rows = Array.from({ length: 150 }, (_, i) => ({ email: `u${i}@example.com` }))
-    const ctx = await resolveAutomationContext(makeAutomation(), triggerEntry, rows)
-    const key = parseTemplateKey('batch:all:pluck:email')!
-    const result = ctx.lookup(key) as string
-    const values = result.split(', ')
-    expect(result.endsWith(' …')).toBe(true)
-    expect(values.length).toBe(100)
-  })
-
-  it('sum on non-numeric field values returns 0 and fires onMissing for NaN', async () => {
-    const ctx = await resolveAutomationContext(
-      makeAutomation(),
-      triggerEntry,
-      [{ id: 'e1', amount: 'not-a-number' }, { id: 'e2', amount: 'also-not' }],
-    )
-    const missing: string[] = []
-    const result = ctx.lookup(parseTemplateKey('batch:all:sum:amount')!, (f) => missing.push(f))
-    expect(result).toBe(0)
-    expect(missing.length).toBeGreaterThan(0)
-  })
-
-  describe('aggregates on batch', () => {
-    const rows = [
-      { id: 'e1', total: 10 },
-      { id: 'e2', total: 20 },
-      { id: 'e3', total: 30 },
-    ]
-
-    async function makeCtx(batchRows: Record<string, unknown>[]) {
-      return resolveAutomationContext(makeAutomation(), batchRows[0] ?? null, batchRows)
-    }
-
-    it('count', async () => {
-      const ctx = await makeCtx(rows)
-      expect(ctx.lookup(parseTemplateKey('batch:all:count')!)).toBe(3)
-    })
-
-    it('sum', async () => {
-      const ctx = await makeCtx(rows)
-      expect(ctx.lookup(parseTemplateKey('batch:all:sum:total')!)).toBe(60)
-    })
-
-    it('avg', async () => {
-      const ctx = await makeCtx(rows)
-      expect(ctx.lookup(parseTemplateKey('batch:all:avg:total')!)).toBe(20)
-    })
-
-    it('min', async () => {
-      const ctx = await makeCtx(rows)
-      expect(ctx.lookup(parseTemplateKey('batch:all:min:total')!)).toBe(10)
-    })
-
-    it('max', async () => {
-      const ctx = await makeCtx(rows)
-      expect(ctx.lookup(parseTemplateKey('batch:all:max:total')!)).toBe(30)
-    })
-  })
-})
-
-describe('deriveEntryContext', () => {
-  it('this scope returns new entry, batch scope delegates to base', async () => {
-    const batchRows = [{ id: 'e1', val: 1 }, { id: 'e2', val: 2 }]
-    const base = await resolveAutomationContext(makeAutomation(), batchRows[0] ?? null, batchRows)
-    const derived = deriveEntryContext(base, { id: 'e2', val: 2, email: 'derived@example.com' })
-    expect(derived.lookup(parseTemplateKey('this:email')!)).toBe('derived@example.com')
-    expect(derived.lookup(parseTemplateKey('batch:all:count')!)).toBe(2)
-  })
-})
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+import { describe, it, expect } from 'vitest'
+import type { Automation } from '@beechcms/core'
+import { resolveAutomationContext, deriveEntryContext } from '../context-resolver'
+import { parseTemplateKey } from '../template-grammar'
+
+function makeAutomation(overrides: Partial<Automation> = {}): Automation {
+  return {
+    id: 'auto-1',
+    seed_slug: 'orders',
+    name: 'test',
+    enabled: true,
+    triggers: [{ event: 'cron' as const, cron: '* * * * *' }],
+    trigger_conditions: null,
+    actions: [],
+    created_at: 0,
+    updated_at: 0,
+    ...overrides,
+  }
+}
+
+describe('resolveAutomationContext', () => {
+  const triggerEntry = { id: 'e1', email: 'alice@example.com', product_id: 'p1' }
+  const batchEntries = [
+    { id: 'e1', total: 10, email: 'alice@example.com' },
+    { id: 'e2', total: 20, email: 'bob@example.com' },
+    { id: 'e3', total: 30, email: 'carol@example.com' },
+  ]
+
+  it('this scope resolves to triggering entry field', async () => {
+    const ctx = await resolveAutomationContext(makeAutomation(), triggerEntry, [triggerEntry])
+    expect(ctx.lookup(parseTemplateKey('this:email')!)).toBe('alice@example.com')
+  })
+
+  it('this. dot notation resolves to triggering entry field', async () => {
+    const ctx = await resolveAutomationContext(makeAutomation(), triggerEntry, [triggerEntry])
+    expect(ctx.lookup(parseTemplateKey('email')!)).toBe('alice@example.com')
+    expect(ctx.lookup(parseTemplateKey('this:product_id')!)).toBe('p1')
+  })
+
+  it('batch:all:count matches batchEntries length', async () => {
+    const ctx = await resolveAutomationContext(makeAutomation(), triggerEntry, batchEntries)
+    expect(ctx.lookup(parseTemplateKey('batch:all:count')!)).toBe(3)
+  })
+
+  it('unknown scope → undefined + onMissing fires', async () => {
+    const ctx = await resolveAutomationContext(makeAutomation(), triggerEntry, [triggerEntry])
+    const missing: string[] = []
+    const val = ctx.lookup(parseTemplateKey('unknownseed:lastone:email')!, (f) => missing.push(f))
+    expect(val).toBeUndefined()
+    expect(missing).toHaveLength(1)
+    expect(missing[0]).toBe('unknownseed')
+  })
+
+  it('pluck truncates to 100 entries and appends truncation marker', async () => {
+    const rows = Array.from({ length: 150 }, (_, i) => ({ email: `u${i}@example.com` }))
+    const ctx = await resolveAutomationContext(makeAutomation(), triggerEntry, rows)
+    const key = parseTemplateKey('batch:all:pluck:email')!
+    const result = ctx.lookup(key) as string
+    const values = result.split(', ')
+    expect(result.endsWith(' …')).toBe(true)
+    expect(values.length).toBe(100)
+  })
+
+  it('sum on non-numeric field values returns 0 and fires onMissing for NaN', async () => {
+    const ctx = await resolveAutomationContext(
+      makeAutomation(),
+      triggerEntry,
+      [{ id: 'e1', amount: 'not-a-number' }, { id: 'e2', amount: 'also-not' }],
+    )
+    const missing: string[] = []
+    const result = ctx.lookup(parseTemplateKey('batch:all:sum:amount')!, (f) => missing.push(f))
+    expect(result).toBe(0)
+    expect(missing.length).toBeGreaterThan(0)
+  })
+
+  describe('aggregates on batch', () => {
+    const rows = [
+      { id: 'e1', total: 10 },
+      { id: 'e2', total: 20 },
+      { id: 'e3', total: 30 },
+    ]
+
+    async function makeCtx(batchRows: Record<string, unknown>[]) {
+      return resolveAutomationContext(makeAutomation(), batchRows[0] ?? null, batchRows)
+    }
+
+    it('count', async () => {
+      const ctx = await makeCtx(rows)
+      expect(ctx.lookup(parseTemplateKey('batch:all:count')!)).toBe(3)
+    })
+
+    it('sum', async () => {
+      const ctx = await makeCtx(rows)
+      expect(ctx.lookup(parseTemplateKey('batch:all:sum:total')!)).toBe(60)
+    })
+
+    it('avg', async () => {
+      const ctx = await makeCtx(rows)
+      expect(ctx.lookup(parseTemplateKey('batch:all:avg:total')!)).toBe(20)
+    })
+
+    it('min', async () => {
+      const ctx = await makeCtx(rows)
+      expect(ctx.lookup(parseTemplateKey('batch:all:min:total')!)).toBe(10)
+    })
+
+    it('max', async () => {
+      const ctx = await makeCtx(rows)
+      expect(ctx.lookup(parseTemplateKey('batch:all:max:total')!)).toBe(30)
+    })
+  })
+})
+
+describe('deriveEntryContext', () => {
+  it('this scope returns new entry, batch scope delegates to base', async () => {
+    const batchRows = [{ id: 'e1', val: 1 }, { id: 'e2', val: 2 }]
+    const base = await resolveAutomationContext(makeAutomation(), batchRows[0] ?? null, batchRows)
+    const derived = deriveEntryContext(base, { id: 'e2', val: 2, email: 'derived@example.com' })
+    expect(derived.lookup(parseTemplateKey('this:email')!)).toBe('derived@example.com')
+    expect(derived.lookup(parseTemplateKey('batch:all:count')!)).toBe(2)
+  })
+})