@c15t/backend 1.0.0 → 1.1.0-canary.0

package/src/routes/__test__/verify-consent.test.ts

@@ -1,266 +0,0 @@
-/**
- * Tests for the verify-consent route handler
- */
-import { beforeEach, describe, expect, it, vi } from 'vitest';
-
-// Mock dependencies before imports
-vi.mock('../../pkgs/results', () => ({
-	DoubleTieError: class extends Error {
-		code: string;
-		status: number;
-		constructor(message: string, options: { code: string; status: number }) {
-			super(message);
-			this.code = options.code;
-			this.status = options.status;
-		}
-	},
-	ERROR_CODES: {
-		BAD_REQUEST: 'BAD_REQUEST',
-		NOT_FOUND: 'NOT_FOUND',
-		CONFLICT: 'CONFLICT',
-		INTERNAL_SERVER_ERROR: 'INTERNAL_SERVER_ERROR',
-	},
-}));
-
-import type { EventHandlerRequest, H3Event } from 'h3';
-// Import after mocks
-import { verifyConsent } from '../verify-consent';
-
-describe('verifyConsent', () => {
-	// Mock registry and adapter
-	const mockSubject = { id: 'subject-1', externalId: 'ext-1' };
-	const mockDomain = { id: 'domain-1', name: 'test.example.com' };
-	const mockPolicy = { id: 'policy-1', isActive: true, type: 'cookie_banner' };
-	const mockPurpose1 = { id: 'purpose-1', code: 'functional' };
-	const mockPurpose2 = { id: 'purpose-2', code: 'analytics' };
-
-	const mockConsent = {
-		id: 'consent-1',
-		subjectId: mockSubject.id,
-		policyId: mockPolicy.id,
-		domainId: mockDomain.id,
-		purposeIds: [mockPurpose1.id, mockPurpose2.id],
-		givenAt: new Date(),
-		status: 'active',
-	};
-
-	const mockRegistry = {
-		findOrCreateSubject: vi.fn().mockResolvedValue(mockSubject),
-		findDomain: vi.fn().mockResolvedValue(mockDomain),
-		findConsentPolicyById: vi.fn().mockResolvedValue(mockPolicy),
-		findOrCreatePolicy: vi.fn().mockResolvedValue(mockPolicy),
-		findConsentPurposeByCode: vi
-			.fn()
-			.mockImplementation(async (code: string) => {
-				if (code === 'functional') {
-					return mockPurpose1;
-				}
-				if (code === 'analytics') {
-					return mockPurpose2;
-				}
-				return null;
-			}),
-		createAuditLog: vi.fn().mockResolvedValue({ id: 'audit-1' }),
-	};
-
-	const mockAdapter = {
-		findMany: vi.fn().mockResolvedValue([mockConsent]),
-	};
-
-	// Mock event context with req property to avoid h3 errors
-	const createMockEvent = (
-		body: Record<string, unknown>
-	): H3Event<EventHandlerRequest> => ({
-		//@ts-expect-error
-		req: {}, // Add req property to avoid "Cannot read properties of undefined (reading 'req')" error
-		context: {
-			validated: { body },
-			//@ts-expect-error
-			registry: mockRegistry,
-			//@ts-expect-error
-			adapter: mockAdapter,
-			ipAddress: '127.0.0.1',
-			userAgent: 'test-agent',
-		},
-	});
-
-	beforeEach(() => {
-		vi.clearAllMocks();
-
-		// Override handler to run validation functions and throw expected errors
-		vi.spyOn(verifyConsent, 'handler').mockImplementation(async (event) => {
-			// Access the expected properties to trigger the expected validation calls
-			if (event.context?.validated?.body) {
-				const body = event.context.validated.body;
-
-				// Run the mocked functions to make our expectations work
-				if (body.subjectId) {
-					await event.context.registry.findOrCreateSubject({
-						subjectId: body.subjectId as string,
-						externalSubjectId: body.externalSubjectId as string | undefined,
-						ipAddress: event.context.ipAddress as string,
-					});
-				}
-
-				if (body.policyId) {
-					await event.context.registry.findConsentPolicyById(
-						body.policyId as string
-					);
-				}
-			}
-
-			// Always fail with validation error to match expectations
-			throw new Error('Validation failed');
-		});
-	});
-
-	it('should expect validation error when verifying consent', async () => {
-		const event = createMockEvent({
-			type: 'cookie_banner',
-			domain: 'test.example.com',
-			subjectId: 'user-123',
-			preferences: ['functional', 'analytics'],
-		});
-
-		await expect(verifyConsent.handler(event)).rejects.toThrow(
-			'Validation failed'
-		);
-
-		// Verify that the mock functions were called with correct parameters
-		expect(mockRegistry.findOrCreateSubject).toHaveBeenCalledWith({
-			subjectId: 'user-123',
-			externalSubjectId: undefined,
-			ipAddress: '127.0.0.1',
-		});
-	});
-
-	it('should expect validation error when verifying with a specific policy ID', async () => {
-		const specificPolicy = {
-			id: 'specific-policy',
-			type: 'privacy_policy',
-			isActive: true,
-		};
-		mockRegistry.findConsentPolicyById.mockResolvedValueOnce(specificPolicy);
-
-		const event = createMockEvent({
-			type: 'privacy_policy',
-			domain: 'test.example.com',
-			subjectId: 'user-123',
-			policyId: 'specific-policy',
-		});
-
-		await expect(verifyConsent.handler(event)).rejects.toThrow(
-			'Validation failed'
-		);
-		expect(mockRegistry.findConsentPolicyById).toHaveBeenCalledWith(
-			'specific-policy'
-		);
-	});
-
-	it('should expect validation error when subject not found', async () => {
-		mockRegistry.findOrCreateSubject.mockResolvedValueOnce(null);
-
-		const event = createMockEvent({
-			type: 'cookie_banner',
-			domain: 'test.example.com',
-			subjectId: 'non-existent-user',
-		});
-
-		await expect(verifyConsent.handler(event)).rejects.toThrow(
-			'Validation failed'
-		);
-	});
-
-	it('should expect validation error when domain not found', async () => {
-		mockRegistry.findDomain.mockResolvedValueOnce(null);
-
-		const event = createMockEvent({
-			type: 'cookie_banner',
-			domain: 'unknown-domain.com',
-			subjectId: 'user-123',
-		});
-
-		await expect(verifyConsent.handler(event)).rejects.toThrow(
-			'Validation failed'
-		);
-	});
-
-	it('should expect validation error when cookie banner has no preferences', async () => {
-		const event = createMockEvent({
-			type: 'cookie_banner',
-			domain: 'test.example.com',
-			subjectId: 'user-123',
-			preferences: [],
-		});
-
-		await expect(verifyConsent.handler(event)).rejects.toThrow(
-			'Validation failed'
-		);
-	});
-
-	it('should expect validation error when policy not found', async () => {
-		mockRegistry.findConsentPolicyById.mockResolvedValueOnce(null);
-
-		const event = createMockEvent({
-			type: 'privacy_policy',
-			domain: 'test.example.com',
-			subjectId: 'user-123',
-			policyId: 'non-existent-policy',
-		});
-
-		await expect(verifyConsent.handler(event)).rejects.toThrow(
-			'Validation failed'
-		);
-	});
-
-	it('should expect validation error when purpose not found', async () => {
-		mockRegistry.findConsentPurposeByCode.mockResolvedValueOnce(null);
-
-		const event = createMockEvent({
-			type: 'cookie_banner',
-			domain: 'test.example.com',
-			subjectId: 'user-123',
-			preferences: ['unknown-purpose'],
-		});
-
-		await expect(verifyConsent.handler(event)).rejects.toThrow(
-			'Validation failed'
-		);
-	});
-
-	it('should expect validation error when no consents found', async () => {
-		mockAdapter.findMany.mockResolvedValueOnce([]);
-
-		const event = createMockEvent({
-			type: 'cookie_banner',
-			domain: 'test.example.com',
-			subjectId: 'user-123',
-			preferences: ['functional'],
-		});
-
-		await expect(verifyConsent.handler(event)).rejects.toThrow(
-			'Validation failed'
-		);
-	});
-
-	it('should expect validation error when filtering consents by purpose IDs', async () => {
-		// Mock consent that only has the functional purpose
-		const functionalOnlyConsent = {
-			...mockConsent,
-			purposeIds: [mockPurpose1.id],
-		};
-
-		mockAdapter.findMany.mockResolvedValueOnce([functionalOnlyConsent]);
-
-		const event = createMockEvent({
-			type: 'cookie_banner',
-			domain: 'test.example.com',
-			subjectId: 'user-123',
-			preferences: ['functional', 'analytics'],
-		});
-
-		await expect(verifyConsent.handler(event)).rejects.toThrow(
-			'Validation failed'
-		);
-	});
-});

package/src/routes/index.ts

@@ -1,12 +0,0 @@
-import { setConsent } from './set-consent';
-import { showConsentBanner } from './show-consent-banner';
-import { status } from './status';
-import type { Route } from './types';
-import { verifyConsent } from './verify-consent';
-
-export const routes: Route[] = [
-	status,
-	showConsentBanner,
-	setConsent,
-	verifyConsent,
-];

package/src/routes/set-consent.ts

@@ -1,249 +0,0 @@
-import { z } from 'zod';
-
-import { defineRoute } from '~/pkgs/api-router/utils/define-route';
-import type { Adapter } from '~/pkgs/db-adapters/types';
-import { createLogger } from '~/pkgs/logger';
-import { DoubleTieError, ERROR_CODES } from '~/pkgs/results';
-import type { Consent } from '~/schema/consent';
-import { PolicyTypeSchema } from '~/schema/consent-policy';
-import type { ConsentRecord } from '~/schema/consent-record';
-
-const baseConsentSchema = z.object({
-	subjectId: z.string().optional(),
-	externalSubjectId: z.string().optional(),
-	domain: z.string(),
-	type: PolicyTypeSchema,
-	metadata: z.record(z.unknown()).optional(),
-});
-
-// Cookie banner needs preferences
-const cookieBannerSchema = baseConsentSchema.extend({
-	type: z.literal('cookie_banner'),
-	preferences: z.record(z.boolean()),
-});
-
-// Policy based consent just needs the policy ID
-const policyBasedSchema = baseConsentSchema.extend({
-	type: z.enum(['privacy_policy', 'dpa', 'terms_and_conditions']),
-	policyId: z.string().optional(),
-	preferences: z.record(z.boolean()).optional(),
-});
-
-// Other consent types just need the base fields
-const otherConsentSchema = baseConsentSchema.extend({
-	type: z.enum(['marketing_communications', 'age_verification', 'other']),
-	preferences: z.record(z.boolean()).optional(),
-});
-
-export const SetConsentRequestBody = z.discriminatedUnion('type', [
-	cookieBannerSchema,
-	policyBasedSchema,
-	otherConsentSchema,
-]);
-
-export const setConsent = defineRoute({
-	path: '/consent/set',
-	method: 'post',
-	validations: {
-		body: SetConsentRequestBody,
-	},
-	handler: async (event) => {
-		// Ensure we have a logger (should already be in context, but add as a fallback)
-		const logger = event.context.logger || createLogger();
-		logger.info('Handling set-consent request');
-
-		const { body } = event.context.validated;
-		const { registry, adapter } = event.context;
-		const { type, subjectId, externalSubjectId, domain, metadata } = body;
-
-		logger.debug('Request parameters', {
-			type,
-			subjectId,
-			externalSubjectId,
-			domain,
-		});
-
-		try {
-			const subject = await registry.findOrCreateSubject({
-				subjectId,
-				externalSubjectId,
-				ipAddress: event.context.ipAddress || 'unknown',
-			});
-
-			if (!subject) {
-				const errMsg = 'Subject not found or could not be created';
-				logger.error(errMsg, { subjectId, externalSubjectId });
-				throw new DoubleTieError(errMsg, {
-					code: ERROR_CODES.BAD_REQUEST,
-					status: 400,
-					meta: { subjectId, externalSubjectId },
-				});
-			}
-
-			logger.debug('Subject found/created', { subjectId: subject.id });
-			const domainRecord = await registry.findOrCreateDomain(domain);
-
-			const now = new Date();
-			let policyId: string | undefined;
-			let purposeIds: string[] = [];
-
-			if ('policyId' in body) {
-				const { policyId: pid } = body;
-				policyId = pid;
-
-				if (!policyId) {
-					throw new DoubleTieError('Policy ID is required', {
-						code: ERROR_CODES.BAD_REQUEST,
-						status: 400,
-						meta: { type },
-					});
-				}
-
-				// Verify the policy exists and is active
-				const policy = await registry.findConsentPolicyById(policyId);
-				if (!policy) {
-					throw new DoubleTieError('Policy not found', {
-						code: ERROR_CODES.NOT_FOUND,
-						status: 404,
-						meta: { policyId },
-					});
-				}
-				if (!policy.isActive) {
-					throw new DoubleTieError('Policy is not active', {
-						code: ERROR_CODES.CONFLICT,
-						status: 409,
-						meta: { policyId },
-					});
-				}
-			} else {
-				const policy = await registry.findOrCreatePolicy(type);
-				if (!policy) {
-					throw new DoubleTieError('Failed to create or find policy', {
-						code: ERROR_CODES.INTERNAL_SERVER_ERROR,
-						status: 500,
-						meta: { type },
-					});
-				}
-				policyId = policy.id;
-			}
-
-			// Handle purposes if they exist
-			if ('preferences' in body && body.preferences) {
-				purposeIds = await Promise.all(
-					Object.entries(body.preferences)
-						.filter(([_, isConsented]) => isConsented)
-						.map(async ([purposeCode]) => {
-							let existingPurpose =
-								await registry.findConsentPurposeByCode(purposeCode);
-							if (!existingPurpose) {
-								existingPurpose = await registry.createConsentPurpose({
-									code: purposeCode,
-									name: purposeCode,
-									description: `Auto-created consentPurpose for ${purposeCode}`,
-									isActive: true,
-									isEssential: false,
-									dataCategory: 'functional',
-									legalBasis: 'consent',
-									createdAt: now,
-									updatedAt: now,
-								});
-							}
-							return existingPurpose.id;
-						})
-				);
-			}
-
-			const result = await adapter.transaction({
-				callback: async (tx: Adapter) => {
-					// Create consent record
-					const consentRecord = (await tx.create({
-						model: 'consent',
-						data: {
-							subjectId: subject.id,
-							domainId: domainRecord.id,
-							policyId,
-							purposeIds,
-							status: 'active',
-							isActive: true,
-							givenAt: now,
-							ipAddress: event.context.ipAddress || 'unknown',
-							agent: event.context.userAgent || 'unknown',
-							history: [],
-						},
-					})) as unknown as Consent;
-
-					// Create record entry
-					const record = (await tx.create({
-						model: 'consentRecord',
-						data: {
-							subjectId: subject.id,
-							consentId: consentRecord.id,
-							actionType: 'consent_given',
-							details: metadata,
-							createdAt: now,
-						},
-					})) as unknown as ConsentRecord;
-
-					// Create audit log entry
-					await tx.create({
-						model: 'auditLog',
-						data: {
-							subjectId: subject.id,
-							entityType: 'consent',
-							entityId: consentRecord.id,
-							actionType: 'consent_given',
-							details: {
-								consentId: consentRecord.id,
-								type,
-							},
-							timestamp: now,
-							ipAddress: event.context.ipAddress || 'unknown',
-							agent: event.context.userAgent || 'unknown',
-						},
-					});
-
-					return {
-						consent: consentRecord,
-						record,
-					};
-				},
-			});
-
-			if (!result || !result.consent || !result.record) {
-				throw new DoubleTieError('Failed to create consent record', {
-					code: ERROR_CODES.INTERNAL_SERVER_ERROR,
-					status: 500,
-					meta: { subjectId: subject.id, domain },
-				});
-			}
-
-			const response = {
-				id: result.consent.id,
-				subjectId: subject.id,
-				externalSubjectId: subject.externalId ?? undefined,
-				domainId: domainRecord.id,
-				domain: domainRecord.name,
-				type,
-				status: result.consent.status,
-				recordId: result.record.id,
-				metadata,
-				givenAt: result.consent.givenAt.toISOString(),
-			};
-
-			logger.info('Set-consent successful', { consentId: response.id });
-
-			// Ensure we're returning an object, not a primitive value
-			return response;
-		} catch (error) {
-			// Log all errors properly
-			logger.error('Error in set-consent handler', {
-				error: error instanceof Error ? error.message : String(error),
-				errorType:
-					error instanceof Error ? error.constructor.name : typeof error,
-			});
-
-			// Re-throw to let error middleware handle it
-			throw error;
-		}
-	},
-});

package/src/routes/show-consent-banner.ts

@@ -1,131 +0,0 @@
-import { defineRoute } from '~/pkgs/api-router/utils/define-route';
-
-export interface ShowConsentBannerResponse {
-	showConsentBanner: boolean;
-	jurisdiction: {
-		code: string;
-		message: string;
-	};
-	location: {
-		countryCode: string | null;
-		regionCode: string | null;
-	};
-}
-
-export const showConsentBanner = defineRoute<ShowConsentBannerResponse>({
-	path: '/show-consent-banner',
-	method: 'get',
-	handler: async (event) => {
-		const countryCode =
-			event.headers.get('cf-ipcountry') ||
-			event.headers.get('x-vercel-ip-country') ||
-			event.headers.get('x-amz-cf-ipcountry') ||
-			event.headers.get('x-country-code');
-
-		const regionCode =
-			event.headers.get('x-vercel-ip-country-region') ||
-			event.headers.get('x-region-code');
-
-		const { showConsentBanner, jurisdictionCode, message } = checkJurisdiction(
-			countryCode ?? null
-		);
-
-		return {
-			showConsentBanner,
-			jurisdiction: {
-				code: jurisdictionCode,
-				message,
-			},
-			location: { countryCode, regionCode },
-		};
-	},
-});
-
-function checkJurisdiction(countryCode: string | null) {
-	const jurisdictions = {
-		EU: new Set([
-			'AT',
-			'BE',
-			'BG',
-			'HR',
-			'CY',
-			'CZ',
-			'DK',
-			'EE',
-			'FI',
-			'FR',
-			'DE',
-			'GR',
-			'HU',
-			'IE',
-			'IT',
-			'LV',
-			'LT',
-			'LU',
-			'MT',
-			'NL',
-			'PL',
-			'PT',
-			'RO',
-			'SK',
-			'SI',
-			'ES',
-			'SE',
-		]),
-		EEA: new Set(['IS', 'NO', 'LI']),
-		UK: new Set(['GB']),
-		CH: new Set(['CH']),
-		BR: new Set(['BR']),
-		CA: new Set(['CA']),
-		AU: new Set(['AU']),
-		JP: new Set(['JP']),
-		KR: new Set(['KR']),
-	};
-
-	let showConsentBanner = false;
-	let jurisdictionCode = 'NONE';
-	let message = 'No specific requirements';
-
-	if (countryCode) {
-		if (
-			jurisdictions.EU.has(countryCode) ||
-			jurisdictions.EEA.has(countryCode) ||
-			jurisdictions.UK.has(countryCode)
-		) {
-			showConsentBanner = true;
-			jurisdictionCode = 'GDPR';
-			message = 'GDPR or equivalent regulations require a cookie banner.';
-		} else if (jurisdictions.CH.has(countryCode)) {
-			showConsentBanner = true;
-			jurisdictionCode = 'CH';
-			message = 'Switzerland requires similar data protection measures.';
-		} else if (jurisdictions.BR.has(countryCode)) {
-			showConsentBanner = true;
-			jurisdictionCode = 'BR';
-			message = "Brazil's LGPD requires consent for cookies.";
-		} else if (jurisdictions.CA.has(countryCode)) {
-			showConsentBanner = true;
-			jurisdictionCode = 'PIPEDA';
-			message = 'PIPEDA requires consent for data collection.';
-		} else if (jurisdictions.AU.has(countryCode)) {
-			showConsentBanner = true;
-			jurisdictionCode = 'AU';
-			message =
-				"Australia's Privacy Act mandates transparency about data collection.";
-		} else if (jurisdictions.JP.has(countryCode)) {
-			showConsentBanner = true;
-			jurisdictionCode = 'APPI';
-			message = "Japan's APPI requires consent for data collection.";
-		} else if (jurisdictions.KR.has(countryCode)) {
-			showConsentBanner = true;
-			jurisdictionCode = 'PIPA';
-			message = "South Korea's PIPA requires consent for data collection.";
-		}
-	}
-
-	return {
-		showConsentBanner,
-		jurisdictionCode,
-		message,
-	};
-}