@consilioweb/payload-support 2.0.0 → 3.0.0

package/src/__tests__/integration/snooze.test.ts

@@ -1,68 +0,0 @@
-import { describe, it, expect } from 'vitest'
-import { buildTestPayload } from './buildTestPayload'
-import { createProcessSnoozeEndpoint } from '../../endpoints/process-snooze'
-import { resolveSlugs } from '../../utils/slugs'
-
-const PW = 'test-pw-12345'
-const slugs = resolveSlugs({ users: 'users' })
-
-async function makeClient(payload: Awaited<ReturnType<typeof buildTestPayload>>, email: string) {
-  return payload.create({ collection: 'support-clients', data: { email, password: PW, firstName: 'S', lastName: 'N', company: 'C' }, overrideAccess: true })
-}
-
-/**
- * Snooze wake-up cron (P2): a snoozed ticket must be hidden from the inbox while
- * `snoozeUntil` is in the future, resurface once it passes, and the cron must
- * clear expired snoozes (audit trail) while leaving future ones untouched.
- */
-describe('snooze wake-up cron + inbox hide (P2)', () => {
-  it('cron clears expired snoozeUntil and leaves future ones', async () => {
-    const payload = await buildTestPayload()
-    process.env.CRON_SECRET = 'test-cron-secret'
-    const c = await makeClient(payload, 'snz@example.com')
-    const past = new Date(Date.now() - 3_600_000).toISOString()
-    const future = new Date(Date.now() + 3_600_000).toISOString()
-    const tPast = await payload.create({ collection: 'tickets', data: { subject: 'past', client: c.id, status: 'open', priority: 'normal', snoozeUntil: past }, overrideAccess: true })
-    const tFuture = await payload.create({ collection: 'tickets', data: { subject: 'future', client: c.id, status: 'open', priority: 'normal', snoozeUntil: future }, overrideAccess: true })
-
-    const ep = createProcessSnoozeEndpoint(slugs)
-    const req = { payload, headers: new Headers({ 'x-cron-secret': 'test-cron-secret' }) }
-    const res = await (ep.handler as (r: unknown) => Promise<Response>)(req)
-    const json = await res.json()
-    expect(json.ok).toBe(true)
-    expect(json.processed).toBeGreaterThanOrEqual(1)
-
-    const rePast = await payload.findByID({ collection: 'tickets', id: tPast.id, overrideAccess: true })
-    const reFuture = await payload.findByID({ collection: 'tickets', id: tFuture.id, overrideAccess: true })
-    expect(rePast.snoozeUntil).toBeFalsy() // woken up
-    expect(reFuture.snoozeUntil).toBeTruthy() // still snoozed
-  }, 60_000)
-
-  it('rejects the cron without the secret', async () => {
-    const payload = await buildTestPayload()
-    process.env.CRON_SECRET = 'test-cron-secret'
-    const ep = createProcessSnoozeEndpoint(slugs)
-    const req = { payload, headers: new Headers({}) }
-    const res = await (ep.handler as (r: unknown) => Promise<Response>)(req)
-    expect(res.status).toBe(401)
-  }, 60_000)
-
-  it('the inbox snooze-hide query excludes future-snoozed tickets', async () => {
-    const payload = await buildTestPayload()
-    const c = await makeClient(payload, 'snz2@example.com')
-    const visible = await payload.create({ collection: 'tickets', data: { subject: 'visible', client: c.id, status: 'open', priority: 'normal' }, overrideAccess: true })
-    const hidden = await payload.create({ collection: 'tickets', data: { subject: 'hidden', client: c.id, status: 'open', priority: 'normal', snoozeUntil: new Date(Date.now() + 3_600_000).toISOString() }, overrideAccess: true })
-
-    const nowIso = new Date().toISOString()
-    // Same where the inbox builds via query params.
-    const found = await payload.find({
-      collection: 'tickets',
-      where: { and: [{ or: [{ snoozeUntil: { exists: false } }, { snoozeUntil: { less_than_equal: nowIso } }] }] },
-      limit: 200,
-      overrideAccess: true,
-    })
-    const ids = found.docs.map((t) => t.id)
-    expect(ids).toContain(visible.id)
-    expect(ids).not.toContain(hidden.id)
-  }, 60_000)
-})

package/src/__tests__/integration/teams.test.ts

@@ -1,38 +0,0 @@
-import { describe, it, expect } from 'vitest'
-import { buildTestPayload } from './buildTestPayload'
-
-const PW = 'test-pw-12345'
-
-/**
- * Multi-team / workspaces (roadmap): with `SUPPORT_TEAM_SCOPING` enabled, an agent
- * only sees tickets of the teams they belong to (plus team-less tickets).
- */
-describe('multi-team scoping (roadmap)', () => {
-  it('scopes ticket visibility to the agent\'s teams when enabled', async () => {
-    process.env.SUPPORT_TEAM_SCOPING = '1'
-    const payload = await buildTestPayload()
-
-    const agentA = await payload.create({ collection: 'users', data: { email: 'team-a@example.com', password: PW } as never, overrideAccess: true })
-    const agentB = await payload.create({ collection: 'users', data: { email: 'team-b@example.com', password: PW } as never, overrideAccess: true })
-    const teamA = await payload.create({ collection: 'support-teams', data: { name: 'Team A', members: [agentA.id] }, overrideAccess: true })
-    const teamB = await payload.create({ collection: 'support-teams', data: { name: 'Team B', members: [agentB.id] }, overrideAccess: true })
-
-    const c = await payload.create({ collection: 'support-clients', data: { email: 'team-c@example.com', password: PW, firstName: 'T', lastName: 'C', company: 'C' }, overrideAccess: true })
-    const tA = await payload.create({ collection: 'tickets', data: { subject: 'A', client: c.id, status: 'open', priority: 'normal', team: teamA.id }, overrideAccess: true })
-    const tB = await payload.create({ collection: 'tickets', data: { subject: 'B', client: c.id, status: 'open', priority: 'normal', team: teamB.id }, overrideAccess: true })
-    const tNone = await payload.create({ collection: 'tickets', data: { subject: 'none', client: c.id, status: 'open', priority: 'normal' }, overrideAccess: true })
-
-    const asA = await payload.find({
-      collection: 'tickets',
-      overrideAccess: false,
-      user: { ...agentA, collection: 'users' } as never,
-      limit: 200,
-    })
-    const ids = asA.docs.map((t) => String(t.id))
-    expect(ids).toContain(String(tA.id))
-    expect(ids).toContain(String(tNone.id)) // team-less tickets stay visible
-    expect(ids).not.toContain(String(tB.id)) // other team's ticket hidden
-
-    delete process.env.SUPPORT_TEAM_SCOPING
-  }, 60_000)
-})

package/src/__tests__/rateLimiter.test.ts

@@ -1,83 +0,0 @@
-import { afterEach, describe, expect, it, vi } from 'vitest'
-import { MemoryRateLimitStore, PayloadRateLimitStore, RateLimiter, type RateLimitStore } from '../utils/rateLimiter'
-
-afterEach(() => {
-  vi.useRealTimers()
-})
-
-describe('RateLimiter', () => {
-  it('allows requests up to the maximum and then blocks', async () => {
-    const limiter = new RateLimiter(60_000, 2)
-    await expect(limiter.check('key')).resolves.toBe(false)
-    await expect(limiter.check('key')).resolves.toBe(false)
-    await expect(limiter.check('key')).resolves.toBe(true)
-    await expect(limiter.check('key')).resolves.toBe(true)
-  })
-
-  it('resets only the targeted key', async () => {
-    const limiter = new RateLimiter(60_000, 1)
-    await limiter.check('key-a')
-    await limiter.check('key-b')
-    await expect(limiter.check('key-a')).resolves.toBe(true)
-    await expect(limiter.check('key-b')).resolves.toBe(true)
-
-    await limiter.reset('key-a')
-
-    await expect(limiter.check('key-a')).resolves.toBe(false)
-    await expect(limiter.check('key-b')).resolves.toBe(true)
-  })
-
-  it('opens a new window after expiry', async () => {
-    vi.useFakeTimers()
-    const limiter = new RateLimiter(1_000, 1)
-    await limiter.check('key')
-    await expect(limiter.check('key')).resolves.toBe(true)
-
-    vi.advanceTimersByTime(1_001)
-
-    await expect(limiter.check('key')).resolves.toBe(false)
-  })
-
-  it('shares counters between limiter instances using the same store', async () => {
-    const store = new MemoryRateLimitStore()
-    const firstProcess = new RateLimiter(60_000, 1, store)
-    const secondProcess = new RateLimiter(60_000, 1, store)
-
-    await expect(firstProcess.check('shared')).resolves.toBe(false)
-    await expect(secondProcess.check('shared')).resolves.toBe(true)
-  })
-
-  it('supports an asynchronous persistent store adapter', async () => {
-    const increment = vi.fn(async () => ({ count: 2, resetAt: Date.now() + 1_000 }))
-    const store: RateLimitStore = {
-      increment,
-      reset: vi.fn(async () => undefined),
-    }
-    const limiter = new RateLimiter(1_000, 1, store)
-
-    await expect(limiter.check('client:42')).resolves.toBe(true)
-    expect(increment).toHaveBeenCalledWith('client:42', 1_000)
-  })
-
-  it('persists counters through the Payload adapter', async () => {
-    let record: { id: number; key: string; count: number; resetAt: string } | undefined
-    const payload = {
-      find: vi.fn(async () => ({ docs: record ? [record] : [] })),
-      create: vi.fn(async ({ data }: { data: typeof record }) => {
-        record = { ...data!, id: 1 }
-        return record
-      }),
-      update: vi.fn(async ({ data }: { data: Partial<typeof record> }) => {
-        record = { ...record!, ...data }
-        return record
-      }),
-      delete: vi.fn(async () => undefined),
-    }
-    const store = new PayloadRateLimitStore()
-    const firstProcess = new RateLimiter(60_000, 1, store)
-    const secondProcess = new RateLimiter(60_000, 1, store)
-
-    await expect(firstProcess.check('shared', payload)).resolves.toBe(false)
-    await expect(secondProcess.check('shared', payload)).resolves.toBe(true)
-  })
-})

package/src/__tests__/sanitizeHtml.test.ts

@@ -1,165 +0,0 @@
-import { describe, it, expect } from 'vitest'
-import { sanitizeMessageHtml } from '../utils/sanitizeHtml'
-
-describe('sanitizeMessageHtml — XSS vectors stripped', () => {
-  it('strips <script> tags entirely', () => {
-    const result = sanitizeMessageHtml('<script>alert(1)</script>hi')
-    expect(result).not.toContain('<script')
-    expect(result).not.toContain('alert')
-    expect(result).toContain('hi')
-  })
-
-  it('strips <script> with attributes', () => {
-    const result = sanitizeMessageHtml('<script src="evil.js" type="text/javascript"></script>safe')
-    expect(result).not.toContain('<script')
-    expect(result).toContain('safe')
-  })
-
-  it('strips onerror inline event handlers on <img>', () => {
-    const result = sanitizeMessageHtml('<img src="x" onerror="alert(1)">')
-    expect(result).not.toContain('onerror')
-  })
-
-  it('strips onclick inline event handlers', () => {
-    const result = sanitizeMessageHtml('<span onclick="stealCookies()">click me</span>')
-    expect(result).not.toContain('onclick')
-    expect(result).toContain('click me')
-  })
-
-  it('strips onmouseover event handler', () => {
-    const result = sanitizeMessageHtml('<div onmouseover="evil()">hover</div>')
-    expect(result).not.toContain('onmouseover')
-  })
-
-  it('strips javascript: URI in anchor href', () => {
-    const result = sanitizeMessageHtml('<a href="javascript:alert(1)">x</a>')
-    expect(result).not.toContain('javascript:')
-  })
-
-  it('strips javascript: URI with mixed case', () => {
-    const result = sanitizeMessageHtml('<a href="JaVaScRiPt:alert(1)">x</a>')
-    expect(result).not.toContain('avascript:')
-    expect(result).not.toContain('href="JaVaScRiPt')
-  })
-
-  it('strips <iframe>', () => {
-    const result = sanitizeMessageHtml('<iframe src="https://evil.com"></iframe>text')
-    expect(result).not.toContain('<iframe')
-    expect(result).toContain('text')
-  })
-
-  it('strips <embed>', () => {
-    const result = sanitizeMessageHtml('<embed src="payload.swf">text')
-    expect(result).not.toContain('<embed')
-    expect(result).toContain('text')
-  })
-
-  it('strips <object>', () => {
-    const result = sanitizeMessageHtml('<object data="evil.swf"></object>after')
-    expect(result).not.toContain('<object')
-    expect(result).toContain('after')
-  })
-})
-
-describe('sanitizeMessageHtml — legitimate formatting preserved', () => {
-  it('preserves <b> tag', () => {
-    const result = sanitizeMessageHtml('<b>bold text</b>')
-    expect(result).toContain('<b>bold text</b>')
-  })
-
-  it('preserves <strong> tag', () => {
-    const result = sanitizeMessageHtml('<strong>important</strong>')
-    expect(result).toContain('<strong>important</strong>')
-  })
-
-  it('preserves <a href="https://..."> anchor', () => {
-    const result = sanitizeMessageHtml('<a href="https://example.com">link</a>')
-    expect(result).toContain('href="https://example.com"')
-    expect(result).toContain('link')
-  })
-
-  it('adds rel="noopener noreferrer nofollow" to links (tabnabbing defense)', () => {
-    const result = sanitizeMessageHtml('<a href="https://example.com">link</a>')
-    expect(result).toContain('rel="noopener noreferrer nofollow"')
-  })
-
-  it('preserves <ul><li> list structure', () => {
-    const result = sanitizeMessageHtml('<ul><li>item 1</li><li>item 2</li></ul>')
-    expect(result).toContain('<ul>')
-    expect(result).toContain('<li>item 1</li>')
-    expect(result).toContain('<li>item 2</li>')
-  })
-
-  it('preserves <ol> numbered list', () => {
-    const result = sanitizeMessageHtml('<ol><li>first</li></ol>')
-    expect(result).toContain('<ol>')
-    expect(result).toContain('<li>first</li>')
-  })
-
-  it('preserves safe inline style: color', () => {
-    const result = sanitizeMessageHtml('<span style="color: red">colored</span>')
-    // sanitize-html normalises CSS by stripping the space after ':'
-    expect(result).toContain('color:red')
-    expect(result).toContain('colored')
-  })
-
-  it('preserves safe inline style: color hex', () => {
-    const result = sanitizeMessageHtml('<span style="color: #ff0000">red</span>')
-    expect(result).toContain('color:#ff0000')
-  })
-
-  it('preserves text-align style', () => {
-    const result = sanitizeMessageHtml('<p style="text-align: center">centered</p>')
-    // sanitize-html normalises CSS by stripping the space after ':'
-    expect(result).toContain('text-align:center')
-  })
-
-  it('preserves <blockquote>', () => {
-    const result = sanitizeMessageHtml('<blockquote>quoted text</blockquote>')
-    expect(result).toContain('<blockquote>')
-    expect(result).toContain('quoted text')
-  })
-
-  it('preserves <code> and <pre>', () => {
-    const result = sanitizeMessageHtml('<pre><code>const x = 1;</code></pre>')
-    expect(result).toContain('<pre>')
-    expect(result).toContain('<code>')
-    expect(result).toContain('const x = 1;')
-  })
-
-  it('preserves heading tags h1-h3', () => {
-    const result = sanitizeMessageHtml('<h1>Title</h1><h2>Sub</h2><h3>Sub2</h3>')
-    expect(result).toContain('<h1>Title</h1>')
-    expect(result).toContain('<h2>Sub</h2>')
-    expect(result).toContain('<h3>Sub2</h3>')
-  })
-})
-
-describe('sanitizeMessageHtml — dangerous style values stripped', () => {
-  it('strips expression() from style (IE CSS injection)', () => {
-    const result = sanitizeMessageHtml('<span style="width: expression(alert(1))">x</span>')
-    expect(result).not.toContain('expression')
-  })
-
-  it('strips url() from style', () => {
-    const result = sanitizeMessageHtml('<span style="background: url(javascript:alert(1))">x</span>')
-    expect(result).not.toContain('url(')
-  })
-})
-
-describe('sanitizeMessageHtml — edge cases', () => {
-  it('returns empty string unchanged when falsy', () => {
-    expect(sanitizeMessageHtml('')).toBe('')
-  })
-
-  it('handles plain text without HTML', () => {
-    const result = sanitizeMessageHtml('Hello world')
-    expect(result).toBe('Hello world')
-  })
-
-  it('does not escape regular ampersands in text', () => {
-    const result = sanitizeMessageHtml('Tom &amp; Jerry')
-    expect(result).toContain('Tom')
-    expect(result).toContain('Jerry')
-  })
-})

package/src/__tests__/sla.test.ts

@@ -1,258 +0,0 @@
-import { describe, it, expect } from 'vitest'
-import { computeSlaState, formatSlaRemaining } from '../views/shared/sla'
-
-// ---------------------------------------------------------------------------
-// computeSlaState
-// ---------------------------------------------------------------------------
-
-describe('computeSlaState — no SLA data', () => {
-  it('returns state "none" when no due date is set', () => {
-    const result = computeSlaState({})
-    expect(result.state).toBe('none')
-    expect(result.remainingMs).toBeNull()
-    expect(result.due).toBeNull()
-  })
-
-  it('returns state "none" when dueRaw is null', () => {
-    const result = computeSlaState({ slaFirstResponseDue: null })
-    expect(result.state).toBe('none')
-  })
-
-  it('returns state "none" when dueRaw is an invalid date string', () => {
-    const result = computeSlaState({ slaFirstResponseDue: 'not-a-date' })
-    expect(result.state).toBe('none')
-  })
-})
-
-describe('computeSlaState — first response SLA (no firstResponseAt)', () => {
-  const future2h = new Date(Date.now() + 2 * 3_600_000).toISOString()
-  const future30m = new Date(Date.now() + 30 * 60_000).toISOString()
-  const past = new Date(Date.now() - 60_000).toISOString()
-
-  it('returns "ok" when deadline is more than 1 hour away', () => {
-    const result = computeSlaState({ slaFirstResponseDue: future2h })
-    expect(result.state).toBe('ok')
-    expect(result.remainingMs).toBeGreaterThan(3_600_000)
-  })
-
-  it('returns "warn" when deadline is less than 1 hour away', () => {
-    const result = computeSlaState({ slaFirstResponseDue: future30m })
-    expect(result.state).toBe('warn')
-    expect(result.remainingMs).toBeGreaterThan(0)
-    expect(result.remainingMs).toBeLessThan(3_600_000)
-  })
-
-  it('returns "breach" when deadline is in the past', () => {
-    const result = computeSlaState({ slaFirstResponseDue: past })
-    expect(result.state).toBe('breach')
-    expect(result.remainingMs).toBeLessThan(0)
-  })
-
-  it('returns "breach" when slaFirstResponseBreached flag is set (even with future due)', () => {
-    const result = computeSlaState({
-      slaFirstResponseDue: future2h,
-      slaFirstResponseBreached: true,
-    })
-    expect(result.state).toBe('breach')
-  })
-
-  it('exposes the due ISO string in result', () => {
-    const result = computeSlaState({ slaFirstResponseDue: future2h })
-    expect(result.due).toBe(future2h)
-  })
-})
-
-describe('computeSlaState — resolution SLA (firstResponseAt present)', () => {
-  const firstResponseAt = new Date(Date.now() - 60_000).toISOString()
-  const future2h = new Date(Date.now() + 2 * 3_600_000).toISOString()
-  const past = new Date(Date.now() - 60_000).toISOString()
-
-  it('uses resolution SLA when firstResponseAt is set', () => {
-    const result = computeSlaState({
-      firstResponseAt,
-      slaFirstResponseDue: past, // would be breach if used
-      slaResolutionDue: future2h, // ok
-    })
-    // Should use resolution SLA → ok
-    expect(result.state).toBe('ok')
-    expect(result.due).toBe(future2h)
-  })
-
-  it('returns "breach" when resolution deadline is passed', () => {
-    const result = computeSlaState({
-      firstResponseAt,
-      slaResolutionDue: past,
-    })
-    expect(result.state).toBe('breach')
-  })
-
-  it('returns "breach" when slaResolutionBreached flag is set', () => {
-    const result = computeSlaState({
-      firstResponseAt,
-      slaResolutionDue: future2h,
-      slaResolutionBreached: true,
-    })
-    expect(result.state).toBe('breach')
-  })
-})
-
-describe('computeSlaState — pinned "now" parameter', () => {
-  it('uses the provided "now" date for comparison', () => {
-    const due = '2024-01-15T10:00:00.000Z'
-    // now before due → ok
-    const before = new Date('2024-01-15T08:00:00.000Z')
-    expect(computeSlaState({ slaFirstResponseDue: due }, before).state).toBe('ok')
-    // now after due → breach
-    const after = new Date('2024-01-15T12:00:00.000Z')
-    expect(computeSlaState({ slaFirstResponseDue: due }, after).state).toBe('breach')
-    // now 30 min before due → warn
-    const soon = new Date('2024-01-15T09:35:00.000Z')
-    expect(computeSlaState({ slaFirstResponseDue: due }, soon).state).toBe('warn')
-  })
-})
-
-// ---------------------------------------------------------------------------
-// formatSlaRemaining
-// ---------------------------------------------------------------------------
-
-describe('formatSlaRemaining', () => {
-  it('returns "—" for null', () => {
-    expect(formatSlaRemaining(null)).toBe('—')
-  })
-
-  it('formats less-than-1-hour remaining as minutes (positive)', () => {
-    const thirtyMin = 30 * 60_000
-    expect(formatSlaRemaining(thirtyMin)).toBe('30m')
-  })
-
-  it('formats 0 remaining as "0m"', () => {
-    expect(formatSlaRemaining(0)).toBe('0m')
-  })
-
-  it('formats negative < 1 hour as −Xm', () => {
-    const minus15min = -(15 * 60_000)
-    expect(formatSlaRemaining(minus15min)).toBe('−15m')
-  })
-
-  it('formats exactly 1 hour as "1h"', () => {
-    const oneHour = 3_600_000
-    expect(formatSlaRemaining(oneHour)).toBe('1h')
-  })
-
-  it('formats 90 minutes as "1h 30"', () => {
-    const ninetyMin = 90 * 60_000
-    expect(formatSlaRemaining(ninetyMin)).toBe('1h 30')
-  })
-
-  it('formats negative hours as −Xh', () => {
-    const minus2h = -(2 * 3_600_000)
-    expect(formatSlaRemaining(minus2h)).toBe('−2h')
-  })
-
-  it('formats 24h+ as days (Xj)', () => {
-    const twoDays = 48 * 3_600_000
-    expect(formatSlaRemaining(twoDays)).toBe('2j')
-  })
-
-  it('formats negative 24h+ as −Xj', () => {
-    const minusThreeDays = -(3 * 24 * 3_600_000)
-    expect(formatSlaRemaining(minusThreeDays)).toBe('−3j')
-  })
-
-  it('formats whole hours without trailing "00" minutes', () => {
-    const twoHoursExact = 2 * 3_600_000
-    const result = formatSlaRemaining(twoHoursExact)
-    expect(result).toBe('2h')
-  })
-})
-
-// ---------------------------------------------------------------------------
-// calculateBusinessHoursDeadline (imported from hooks/checkSLA)
-// ---------------------------------------------------------------------------
-
-import { calculateBusinessHoursDeadline } from '../hooks/checkSLA'
-
-describe('calculateBusinessHoursDeadline', () => {
-  // Use UTC dates — the function uses local Date methods without TZ conversion.
-  // We pin times to Tuesday 2024-01-09 so all boundary math is predictable.
-
-  it('adds 60 minutes within the same business day', () => {
-    // Tuesday 2024-01-09 at 10:00 local
-    const start = new Date(2024, 0, 9, 10, 0, 0) // month is 0-indexed
-    const result = calculateBusinessHoursDeadline(start, 60)
-    expect(result.getHours()).toBe(11)
-    expect(result.getMinutes()).toBe(0)
-    expect(result.getDate()).toBe(9)
-  })
-
-  it('carries over minutes past end-of-day to the next business day', () => {
-    // Tuesday at 17:00, add 120 minutes (only 60 remain today: 17:00→18:00)
-    // Remaining 60 minutes spills into Wednesday morning: 9:00→10:00
-    const start = new Date(2024, 0, 9, 17, 0, 0)
-    const result = calculateBusinessHoursDeadline(start, 120)
-    expect(result.getDate()).toBe(10) // Wednesday
-    expect(result.getHours()).toBe(10)
-    expect(result.getMinutes()).toBe(0)
-  })
-
-  it('skips Saturday and Sunday', () => {
-    // Friday 2024-01-12 at 17:00, add 120 minutes → skips Sat/Sun → Monday 10:00
-    const start = new Date(2024, 0, 12, 17, 0, 0) // Friday
-    const result = calculateBusinessHoursDeadline(start, 120)
-    // 60 min remaining Friday (17→18), then 60 min on Monday (9→10)
-    expect(result.getDay()).toBe(1) // Monday
-    expect(result.getHours()).toBe(10)
-  })
-
-  it('moves a Saturday start to Monday 9:00 before counting', () => {
-    // Saturday at 10:00, add 60 minutes → Monday 10:00
-    const start = new Date(2024, 0, 13, 10, 0, 0) // Saturday
-    const result = calculateBusinessHoursDeadline(start, 60)
-    expect(result.getDay()).toBe(1) // Monday
-    expect(result.getHours()).toBe(10)
-  })
-
-  it('moves a Sunday start to Monday 9:00 before counting', () => {
-    // Sunday at 15:00, add 30 minutes → Monday 9:30
-    const start = new Date(2024, 0, 14, 15, 0, 0) // Sunday
-    const result = calculateBusinessHoursDeadline(start, 30)
-    expect(result.getDay()).toBe(1) // Monday
-    expect(result.getHours()).toBe(9)
-    expect(result.getMinutes()).toBe(30)
-  })
-
-  it('moves a before-hours start to 9:00 before counting', () => {
-    // Tuesday at 7:00 (before 9:00), add 30 minutes → 9:30 same day
-    const start = new Date(2024, 0, 9, 7, 0, 0)
-    const result = calculateBusinessHoursDeadline(start, 30)
-    expect(result.getDate()).toBe(9)
-    expect(result.getHours()).toBe(9)
-    expect(result.getMinutes()).toBe(30)
-  })
-
-  it('moves an after-hours start to next business day 9:00', () => {
-    // Tuesday at 19:00 (after 18:00), add 60 minutes → Wednesday 10:00
-    const start = new Date(2024, 0, 9, 19, 0, 0)
-    const result = calculateBusinessHoursDeadline(start, 60)
-    expect(result.getDate()).toBe(10) // Wednesday
-    expect(result.getHours()).toBe(10)
-  })
-
-  it('handles 0 minutes (deadline = start clamped to business hours)', () => {
-    const start = new Date(2024, 0, 9, 10, 30, 0) // Tuesday at 10:30
-    const result = calculateBusinessHoursDeadline(start, 0)
-    // Start is within business hours → no movement
-    expect(result.getDate()).toBe(9)
-    expect(result.getHours()).toBe(10)
-    expect(result.getMinutes()).toBe(30)
-  })
-
-  it('handles a full business day (540 min = 9 hours) spanning exactly one day', () => {
-    // Tuesday at 9:00, add 540 min (exactly one business day) → Tuesday 18:00
-    const start = new Date(2024, 0, 9, 9, 0, 0)
-    const result = calculateBusinessHoursDeadline(start, 540)
-    expect(result.getDate()).toBe(9)
-    expect(result.getHours()).toBe(18)
-    expect(result.getMinutes()).toBe(0)
-  })
-})

package/src/__tests__/trackOpenEndpoint.test.ts

@@ -1,54 +0,0 @@
-import { describe, expect, it, vi } from 'vitest'
-import { createTrackOpenEndpoint, generateTrackingToken } from '../endpoints/track-open'
-import { resolveSlugs } from '../utils/slugs'
-
-const secret = 'test-payload-secret'
-
-function createRequest(ticketId: string, messageId: string, signature: string) {
-  const findByID = vi.fn(async ({ collection }: { collection: string }) => {
-    if (collection === 'ticket-messages') {
-      return { id: Number(messageId), ticket: Number(ticketId) + 1, emailOpenedAt: null }
-    }
-    return { id: Number(ticketId), lastClientReadAt: null }
-  })
-  const update = vi.fn()
-  return {
-    req: {
-      url: `https://example.test/api/support/track-open?t=${ticketId}&m=${messageId}&sig=${signature}`,
-      payload: { findByID, update },
-    },
-    findByID,
-    update,
-  }
-}
-
-describe('track-open endpoint', () => {
-  it('does not query the database for signed non-numeric identifiers', async () => {
-    process.env.PAYLOAD_SECRET = secret
-    const ticketId = 'not-a-ticket'
-    const messageId = 'not-a-message'
-    const signature = generateTrackingToken(ticketId, messageId, secret)
-    const { req, findByID, update } = createRequest(ticketId, messageId, signature)
-    const endpoint = createTrackOpenEndpoint(resolveSlugs())
-
-    const response = await endpoint.handler(req as never)
-
-    expect(response.status).toBe(200)
-    expect(findByID).not.toHaveBeenCalled()
-    expect(update).not.toHaveBeenCalled()
-  })
-
-  it('does not mutate when the signed message belongs to another ticket', async () => {
-    process.env.PAYLOAD_SECRET = secret
-    const ticketId = '10'
-    const messageId = '20'
-    const signature = generateTrackingToken(ticketId, messageId, secret)
-    const { req, update } = createRequest(ticketId, messageId, signature)
-    const endpoint = createTrackOpenEndpoint(resolveSlugs())
-
-    const response = await endpoint.handler(req as never)
-
-    expect(response.status).toBe(200)
-    expect(update).not.toHaveBeenCalled()
-  })
-})