@beechcms/api 0.6.0-preview.2 → 0.6.0-preview.3

package/src/features/settings/__tests__/settings.handler.test.ts

@@ -1,555 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-import { describe, it, expect, vi } from 'vitest'
-import { Hono } from 'hono'
-import { settingsApp } from '../settings.handler'
-
-// ---------------------------------------------------------------------------
-// Helpers and Mocks
-// ---------------------------------------------------------------------------
-
-function buildApp(mocks: any = {}) {
-  const app = new Hono()
-  app.use('*', async (c, next) => {
-    c.set('siteSettingsRepository', mocks.siteSettingsRepository ?? {
-      getAll: vi.fn().mockResolvedValue({
-        siteTitle: 'Beech CMS',
-        defaultLanguage: 'en',
-        timezone: 'Europe/Rome',
-        currency: 'EUR',
-        companyName: 'Flavio Corp',
-        companyWebsite: 'https://flavio.corp',
-        companyAbbreviation: 'FC',
-      }),
-      setMany: vi.fn().mockResolvedValue(undefined),
-    })
-
-    c.set('userRepository', mocks.userRepository ?? {
-      findById: vi.fn().mockResolvedValue({
-        id: 'u1',
-        email: 'test@beechcms.com',
-        name: 'Test',
-        surname: 'User',
-        passwordHash: 'hashed-pwd',
-        avatarUrl: null,
-        notificationPreferences: JSON.stringify({
-          contentCreate: true,
-          contentUpdate: false,
-          contentDelete: true,
-          mediaUpload: true,
-        }),
-      }),
-      emailBelongsToAnotherUser: vi.fn().mockResolvedValue(false),
-      updateProfile: vi.fn().mockResolvedValue(undefined),
-      updatePasswordHash: vi.fn().mockResolvedValue(undefined),
-      updateAvatarUrl: vi.fn().mockResolvedValue(undefined),
-      updateNotificationPreferences: vi.fn().mockResolvedValue(undefined),
-    })
-
-    c.set('sessionRepository', mocks.sessionRepository ?? {
-      listActiveForUser: vi.fn().mockResolvedValue([
-        { id: 'sess-1', userAgent: 'Mozilla/5.0', expiresAt: 2000000000 },
-      ]),
-      revokeById: vi.fn().mockResolvedValue(true),
-    })
-
-    c.set('activityLogRepository', mocks.activityLogRepository ?? {
-      list: vi.fn().mockResolvedValue([
-        {
-          id: 'log-1',
-          action: 'create',
-          entityType: 'post',
-          entitySlug: 'first-post',
-          details: { ip: '127.0.0.1' },
-          createdAt: 1700000000,
-        },
-      ]),
-    })
-
-    c.set('mediaRepository', mocks.mediaRepository ?? {
-      count: vi.fn().mockResolvedValue(5),
-      list: vi.fn().mockResolvedValue({
-        items: [
-          { key: 'media/img1.png', size: 1024 },
-          { key: 'media/img2.png', size: 2048 },
-        ],
-      }),
-    })
-
-    c.set('systemStatsRepository', mocks.systemStatsRepository ?? {
-      getStorageUsage: vi.fn().mockResolvedValue(3072),
-    })
-
-    c.set('seedRegistry', mocks.seedRegistry ?? {
-      all: vi.fn().mockReturnValue([{ slug: 'posts' }]),
-    })
-
-    c.set('contentScanRepository', mocks.contentScanRepository ?? {
-      getReferencedMediaKeys: vi.fn().mockResolvedValue(new Set(['media/img1.png'])),
-    })
-
-    c.set('hashProvider', mocks.hashProvider ?? {
-      verify: vi.fn().mockResolvedValue(true),
-      hash: vi.fn().mockResolvedValue('new-hashed-pwd'),
-    })
-
-    c.set('jwtPayload', mocks.jwtPayload ?? { sub: 'u1' })
-
-    c.env = mocks.env ?? {
-      DATE_FORMAT: 'YYYY-MM-DD',
-      EMAIL_PROVIDER: 'smtp',
-    }
-
-    await next()
-  })
-
-  app.route('/', settingsApp)
-  return app
-}
-
-// ---------------------------------------------------------------------------
-// Tests
-// ---------------------------------------------------------------------------
-
-describe('Settings Handler', () => {
-  describe('GET /', () => {
-    it('returns site settings configuration', async () => {
-      const app = buildApp()
-      const res = await app.request('/')
-      expect(res.status).toBe(200)
-      const body = await res.json() as any
-      expect(body.siteTitle).toBe('Beech CMS')
-      expect(body.company.name).toBe('Flavio Corp')
-      expect(body.dateFormat).toBe('YYYY-MM-DD')
-      expect(body.features.email).toBe(true)
-    })
-  })
-
-  describe('PUT /', () => {
-    it('returns 400 for invalid JSON', async () => {
-      const app = buildApp()
-      const res = await app.request('/', {
-        method: 'PUT',
-        headers: { 'Content-Type': 'application/json' },
-        body: 'not-json',
-      })
-      expect(res.status).toBe(400)
-      const body = await res.json() as any
-      expect(body.error).toBe('Invalid JSON body')
-    })
-
-    it('returns 400 for invalid default language', async () => {
-      const app = buildApp()
-      const res = await app.request('/', {
-        method: 'PUT',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ defaultLanguage: 'fr' }),
-      })
-      expect(res.status).toBe(400)
-      const body = await res.json() as any
-      expect(body.detail).toContain('Invalid default language')
-    })
-
-    it('returns 400 for invalid company website URL', async () => {
-      const app = buildApp()
-      const res = await app.request('/', {
-        method: 'PUT',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ company: { website: 'not-a-valid-url' } }),
-      })
-      expect(res.status).toBe(400)
-      const body = await res.json() as any
-      expect(body.detail).toContain('Invalid company website URL')
-    })
-
-    it('updates site settings and syncs company name to siteTitle if siteTitle is omitted', async () => {
-      const setManySpy = vi.fn().mockResolvedValue(undefined)
-      const app = buildApp({
-        siteSettingsRepository: {
-          getAll: vi.fn(),
-          setMany: setManySpy,
-        },
-      })
-
-      const res = await app.request('/', {
-        method: 'PUT',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-          defaultLanguage: 'it',
-          company: {
-            name: 'New Corp',
-            website: 'https://newcorp.com',
-            abbreviation: 'NC',
-          },
-        }),
-      })
-
-      expect(res.status).toBe(200)
-      expect(setManySpy).toHaveBeenCalledWith({
-        defaultLanguage: 'it',
-        companyName: 'New Corp',
-        companyWebsite: 'https://newcorp.com',
-        companyAbbreviation: 'NC',
-        siteTitle: 'New Corp',
-      })
-    })
-
-    it('allows resetting company fields by passing null', async () => {
-      const setManySpy = vi.fn().mockResolvedValue(undefined)
-      const app = buildApp({
-        siteSettingsRepository: {
-          getAll: vi.fn(),
-          setMany: setManySpy,
-        },
-      })
-
-      const res = await app.request('/', {
-        method: 'PUT',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-          company: null,
-        }),
-      })
-
-      expect(res.status).toBe(200)
-      expect(setManySpy).toHaveBeenCalledWith({
-        companyName: null,
-        companyWebsite: null,
-        companyAbbreviation: null,
-      })
-    })
-  })
-
-  describe('GET /me', () => {
-    it('returns 404 if current user is not found', async () => {
-      const app = buildApp({
-        userRepository: {
-          findById: vi.fn().mockResolvedValue(null),
-        },
-      })
-      const res = await app.request('/me')
-      expect(res.status).toBe(404)
-      const body = await res.json() as any
-      expect(body.error).toBe('User not found')
-    })
-
-    it('returns current user profile and notification preferences', async () => {
-      const app = buildApp()
-      const res = await app.request('/me')
-      expect(res.status).toBe(200)
-      const body = await res.json() as any
-      expect(body.email).toBe('test@beechcms.com')
-      expect(body.surname).toBe('User')
-      expect(body.avatarUrl).toContain('gravatar.com')
-      expect(body.notificationPrefs.contentUpdate).toBe(false)
-    })
-  })
-
-  describe('PUT /profile', () => {
-    it('returns 400 for invalid JSON', async () => {
-      const app = buildApp()
-      const res = await app.request('/profile', {
-        method: 'PUT',
-        headers: { 'Content-Type': 'application/json' },
-        body: 'invalid',
-      })
-      expect(res.status).toBe(400)
-    })
-
-    it('returns 400 for invalid email format', async () => {
-      const app = buildApp()
-      const res = await app.request('/profile', {
-        method: 'PUT',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ email: 'invalid-email' }),
-      })
-      expect(res.status).toBe(400)
-      const body = await res.json() as any
-      expect(body.detail).toBe('Invalid email format')
-    })
-
-    it('returns 400 if name is too long', async () => {
-      const app = buildApp()
-      const res = await app.request('/profile', {
-        method: 'PUT',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ name: 'A'.repeat(101) }),
-      })
-      expect(res.status).toBe(400)
-      const body = await res.json() as any
-      expect(body.detail).toContain('Name is too long')
-    })
-
-    it('returns 400 if surname is too long', async () => {
-      const app = buildApp()
-      const res = await app.request('/profile', {
-        method: 'PUT',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ surname: 'A'.repeat(101) }),
-      })
-      expect(res.status).toBe(400)
-      const body = await res.json() as any
-      expect(body.detail).toContain('Surname is too long')
-    })
-
-    it('returns 400 if no fields to update are provided', async () => {
-      const app = buildApp()
-      const res = await app.request('/profile', {
-        method: 'PUT',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({}),
-      })
-      expect(res.status).toBe(400)
-      const body = await res.json() as any
-      expect(body.error).toBe('No fields to update')
-    })
-
-    it('returns 409 if email is already in use by another user', async () => {
-      const app = buildApp({
-        userRepository: {
-          emailBelongsToAnotherUser: vi.fn().mockResolvedValue(true),
-        },
-      })
-      const res = await app.request('/profile', {
-        method: 'PUT',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ email: 'taken@beechcms.com' }),
-      })
-      expect(res.status).toBe(409)
-      const body = await res.json() as any
-      expect(body.detail).toBe('Email address is already in use')
-    })
-
-    it('updates user profile successfully', async () => {
-      const updateProfileSpy = vi.fn().mockResolvedValue(undefined)
-      const app = buildApp({
-        userRepository: {
-          emailBelongsToAnotherUser: vi.fn().mockResolvedValue(false),
-          updateProfile: updateProfileSpy,
-        },
-      })
-      const res = await app.request('/profile', {
-        method: 'PUT',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ name: 'NewName', surname: 'NewSurname', email: 'new@beechcms.com' }),
-      })
-      expect(res.status).toBe(200)
-      expect(updateProfileSpy).toHaveBeenCalledWith('u1', {
-        name: 'NewName',
-        surname: 'NewSurname',
-        email: 'new@beechcms.com',
-      })
-    })
-  })
-
-  describe('PUT /password', () => {
-    it('returns 400 if currentPassword or newPassword is missing', async () => {
-      const app = buildApp()
-      const res = await app.request('/password', {
-        method: 'PUT',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ currentPassword: 'pwd' }),
-      })
-      expect(res.status).toBe(400)
-    })
-
-    it('returns 400 if newPassword is too short', async () => {
-      const app = buildApp()
-      const res = await app.request('/password', {
-        method: 'PUT',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ currentPassword: 'pwd', newPassword: 'short' }),
-      })
-      expect(res.status).toBe(400)
-    })
-
-    it('returns 400 if newPassword is too long', async () => {
-      const app = buildApp()
-      const res = await app.request('/password', {
-        method: 'PUT',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ currentPassword: 'pwd', newPassword: 'A'.repeat(129) }),
-      })
-      expect(res.status).toBe(400)
-    })
-
-    it('returns 404 if user is not found', async () => {
-      const app = buildApp({
-        userRepository: {
-          findById: vi.fn().mockResolvedValue(null),
-        },
-      })
-      const res = await app.request('/password', {
-        method: 'PUT',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ currentPassword: 'pwd', newPassword: 'new-valid-pwd' }),
-      })
-      expect(res.status).toBe(404)
-    })
-
-    it('returns 401 if current password verification fails', async () => {
-      const app = buildApp({
-        hashProvider: {
-          verify: vi.fn().mockResolvedValue(false),
-        },
-      })
-      const res = await app.request('/password', {
-        method: 'PUT',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ currentPassword: 'pwd', newPassword: 'new-valid-pwd' }),
-      })
-      expect(res.status).toBe(401)
-    })
-
-    it('updates password successfully if current password is correct', async () => {
-      const updatePasswordHashSpy = vi.fn().mockResolvedValue(undefined)
-      const app = buildApp({
-        userRepository: {
-          findById: vi.fn().mockResolvedValue({ passwordHash: 'old-hash' }),
-          updatePasswordHash: updatePasswordHashSpy,
-        },
-        hashProvider: {
-          verify: vi.fn().mockResolvedValue(true),
-          hash: vi.fn().mockResolvedValue('new-hashed-pwd'),
-        },
-      })
-      const res = await app.request('/password', {
-        method: 'PUT',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ currentPassword: 'pwd', newPassword: 'new-valid-pwd' }),
-      })
-      expect(res.status).toBe(200)
-      expect(updatePasswordHashSpy).toHaveBeenCalledWith('u1', 'new-hashed-pwd')
-    })
-  })
-
-  describe('PUT /avatar', () => {
-    it('updates avatar URL', async () => {
-      const updateAvatarSpy = vi.fn().mockResolvedValue(undefined)
-      const app = buildApp({
-        userRepository: {
-          updateAvatarUrl: updateAvatarSpy,
-        },
-      })
-      const res = await app.request('/avatar', {
-        method: 'PUT',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ avatarUrl: 'https://beechcms.com/avatar.png' }),
-      })
-      expect(res.status).toBe(200)
-      expect(updateAvatarSpy).toHaveBeenCalledWith('u1', 'https://beechcms.com/avatar.png')
-    })
-  })
-
-  describe('GET /sessions', () => {
-    it('returns a list of user active sessions', async () => {
-      const app = buildApp()
-      const res = await app.request('/sessions')
-      expect(res.status).toBe(200)
-      const body = await res.json() as any[]
-      expect(body).toHaveLength(1)
-      expect(body[0].id).toBe('sess-1')
-    })
-  })
-
-  describe('DELETE /sessions/:id', () => {
-    it('returns 404 if session to revoke is not found', async () => {
-      const app = buildApp({
-        sessionRepository: {
-          revokeById: vi.fn().mockResolvedValue(false),
-        },
-      })
-      const res = await app.request('/sessions/unknown', {
-        method: 'DELETE',
-      })
-      expect(res.status).toBe(404)
-    })
-
-    it('revokes session successfully', async () => {
-      const revokeSpy = vi.fn().mockResolvedValue(true)
-      const app = buildApp({
-        sessionRepository: {
-          revokeById: revokeSpy,
-        },
-      })
-      const res = await app.request('/sessions/sess-1', {
-        method: 'DELETE',
-      })
-      expect(res.status).toBe(200)
-      expect(revokeSpy).toHaveBeenCalledWith('sess-1', 'u1', expect.any(Number))
-    })
-  })
-
-  describe('GET /activity', () => {
-    it('returns user activity logs in legacy format', async () => {
-      const app = buildApp()
-      const res = await app.request('/activity')
-      expect(res.status).toBe(200)
-      const body = await res.json() as any[]
-      expect(body).toHaveLength(1)
-      expect(body[0].id).toBe('log-1')
-      expect(body[0].entity_type).toBe('post')
-      expect(body[0].entity_slug).toBe('first-post')
-      expect(body[0].details).toBe('{"ip":"127.0.0.1"}')
-    })
-  })
-
-  describe('GET /storage', () => {
-    it('returns storage metrics and orphaned media files', async () => {
-      const app = buildApp()
-      const res = await app.request('/storage')
-      expect(res.status).toBe(200)
-      const body = await res.json() as any
-      expect(body.totalBytes).toBe(3072)
-      expect(body.fileCount).toBe(5)
-      expect(body.orphans).toHaveLength(1)
-      expect(body.orphans[0].key).toBe('media/img2.png')
-    })
-  })
-
-  describe('GET /notifications', () => {
-    it('returns user notification preferences', async () => {
-      const app = buildApp()
-      const res = await app.request('/notifications')
-      expect(res.status).toBe(200)
-      const body = await res.json() as any
-      expect(body.contentCreate).toBe(true)
-      expect(body.contentUpdate).toBe(false)
-      expect(body.contentDelete).toBe(true)
-      expect(body.mediaUpload).toBe(true)
-    })
-  })
-
-  describe('PUT /notifications', () => {
-    it('updates user notification preferences', async () => {
-      const updateNotificationSpy = vi.fn().mockResolvedValue(undefined)
-      const app = buildApp({
-        userRepository: {
-          updateNotificationPreferences: updateNotificationSpy,
-        },
-      })
-      const res = await app.request('/notifications', {
-        method: 'PUT',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-          contentCreate: true,
-          contentUpdate: true,
-          contentDelete: false,
-          mediaUpload: false,
-        }),
-      })
-      expect(res.status).toBe(200)
-      expect(updateNotificationSpy).toHaveBeenCalledWith(
-        'u1',
-        JSON.stringify({
-          contentCreate: true,
-          contentUpdate: true,
-          contentDelete: false,
-          mediaUpload: false,
-        })
-      )
-    })
-  })
-})