@defra/forms-engine-plugin 0.0.1

package/test/form/cookies.test.js

@@ -0,0 +1,338 @@
+import { join } from 'node:path'
+
+import { within } from '@testing-library/dom'
+import { StatusCodes } from 'http-status-codes'
+
+import { createServer } from '~/src/server/index.js'
+import { getFormMetadata } from '~/src/server/plugins/engine/services/formsService.js'
+import * as fixtures from '~/test/fixtures/index.js'
+import { renderResponse } from '~/test/helpers/component-helpers.js'
+import { getCookieHeader } from '~/test/utils/get-cookie.js'
+
+jest.mock('~/src/server/plugins/engine/services/formsService.js')
+
+describe(`Cookie banner and analytics`, () => {
+  /** @type {Server} */
+  let server
+
+  beforeEach(() => {
+    jest.mocked(getFormMetadata).mockResolvedValue(fixtures.form.metadata)
+  })
+
+  afterEach(async () => {
+    await server.stop()
+  })
+
+  test.each([
+    '/basic/licence', // form pages
+    '/help/accessibility-statement/basic' // non-form pages
+  ])('shows the cookie banner by default', async (path) => {
+    server = await createServer({
+      formFileName: 'basic.js',
+      formFilePath: join(import.meta.dirname, 'definitions')
+    })
+    await server.initialize()
+
+    const options = {
+      method: 'GET',
+      url: path
+    }
+
+    const { container, document } = await renderResponse(server, options)
+
+    const $cookieBanner = container.queryByRole('region', {
+      name: 'Cookies on Submit a form to Defra'
+    })
+
+    const $gaScriptMain = document.getElementById('ga-tag-js-main')
+    const $gaScriptInit = document.getElementById('ga-tag-js-init')
+
+    expect($cookieBanner).toBeInTheDocument()
+    expect($gaScriptMain).not.toBeInTheDocument()
+    expect($gaScriptInit).not.toBeInTheDocument()
+  })
+
+  test.each([
+    // form pages
+    '/basic/licence',
+    // non-form pages
+    '/help/accessibility-statement/basic'
+  ])('confirms when the user has accepted analytics cookies', async (path) => {
+    server = await createServer({
+      formFileName: 'basic.js',
+      formFilePath: join(import.meta.dirname, 'definitions')
+    })
+
+    await server.initialize()
+
+    // set the cookie preferences
+    const sessionInitialisationResponse = await server.inject({
+      method: 'POST',
+      url: `/help/cookie-preferences/basic?returnUrl=${encodeURIComponent('/mypage')}`,
+      payload: {
+        'cookies[analytics]': 'yes'
+      }
+    })
+
+    const headers = getCookieHeader(sessionInitialisationResponse, [
+      'crumb',
+      'session',
+      'cookieConsent'
+    ])
+
+    const { container, document } = await renderResponse(server, {
+      method: 'GET',
+      url: path,
+      headers
+    })
+
+    const $cookieBanner = container.getByRole('region', {
+      name: 'Cookies on Submit a form to Defra'
+    })
+
+    const $confirmationText = within($cookieBanner).getByText(
+      'You’ve accepted analytics cookies.',
+      { exact: false }
+    )
+
+    const $gaScriptMain = document.getElementById('ga-tag-js-main')
+    const $gaScriptInit = document.getElementById('ga-tag-js-init')
+
+    expect($cookieBanner).toBeInTheDocument()
+    expect($confirmationText).toBeInTheDocument()
+    expect($gaScriptMain).toBeInTheDocument()
+    expect($gaScriptInit).toBeInTheDocument()
+  })
+
+  test.each([
+    // form pages
+    '/basic/licence',
+    // non-form pages
+    '/help/accessibility-statement/basic'
+  ])('confirms when the user has rejected analytics cookies', async (path) => {
+    server = await createServer({
+      formFileName: 'basic.js',
+      formFilePath: join(import.meta.dirname, 'definitions')
+    })
+
+    await server.initialize()
+
+    // set the cookie preferences
+    const sessionInitialisationResponse = await server.inject({
+      method: 'POST',
+      url: `/help/cookie-preferences/basic?returnUrl=${encodeURIComponent('/mypage')}`,
+      payload: {
+        'cookies[analytics]': 'no'
+      }
+    })
+
+    const headers = getCookieHeader(sessionInitialisationResponse, [
+      'crumb',
+      'session',
+      'cookieConsent'
+    ])
+
+    const { container, document } = await renderResponse(server, {
+      method: 'GET',
+      url: path,
+      headers
+    })
+
+    const $cookieBanner = container.getByRole('region', {
+      name: 'Cookies on Submit a form to Defra'
+    })
+
+    const $confirmationText = within($cookieBanner).getByText(
+      'You’ve rejected analytics cookies.',
+      { exact: false }
+    )
+
+    const $gaScriptMain = document.getElementById('ga-tag-js-main')
+    const $gaScriptInit = document.getElementById('ga-tag-js-init')
+
+    expect($cookieBanner).toBeInTheDocument()
+    expect($confirmationText).toBeInTheDocument()
+
+    expect($gaScriptMain).not.toBeInTheDocument()
+    expect($gaScriptInit).not.toBeInTheDocument()
+  })
+
+  test.each([
+    // form pages
+    '/basic/start',
+    // non-form pages
+    '/'
+  ])('hides the cookie banner once dismissed', async (path) => {
+    server = await createServer({
+      formFileName: 'basic.js',
+      formFilePath: join(import.meta.dirname, 'definitions')
+    })
+
+    await server.initialize()
+
+    // set the cookie preferences
+    const sessionInitialisationResponse = await server.inject({
+      method: 'POST',
+      url: `/help/cookie-preferences/basic?returnUrl=${encodeURIComponent('/mypage')}`,
+      payload: {
+        'cookies[analytics]': 'yes',
+        'cookies[dismissed]': 'yes'
+      }
+    })
+
+    const headers = getCookieHeader(sessionInitialisationResponse, [
+      'crumb',
+      'session',
+      'cookieConsent'
+    ])
+
+    const { container } = await renderResponse(server, {
+      method: 'GET',
+      url: path,
+      headers
+    })
+
+    const $cookieBanner = container.queryByRole('region', {
+      name: 'Cookies on Submit a form to Defra'
+    })
+
+    expect($cookieBanner).not.toBeInTheDocument()
+  })
+})
+
+describe(`Cookie preferences`, () => {
+  /** @type {Server} */
+  let server
+
+  afterEach(async () => {
+    await server.stop()
+  })
+
+  test.each([
+    {
+      value: 'yes',
+      text: 'Yes'
+    },
+    {
+      value: 'no',
+      text: 'No'
+    }
+  ])(
+    'selects the cookie preference automatically based on the user selection',
+    async ({ text, value }) => {
+      server = await createServer()
+      await server.initialize()
+
+      // set the cookie preferences
+      const sessionInitialisationResponse = await server.inject({
+        method: 'POST',
+        url: `/help/cookie-preferences/basic`,
+        payload: {
+          'cookies[analytics]': value
+        }
+      })
+
+      const headers = {
+        Referer: '/help/cookie-preferences/basic',
+        ...getCookieHeader(sessionInitialisationResponse, [
+          'crumb',
+          'session',
+          'cookieConsent'
+        ])
+      }
+
+      const { container } = await renderResponse(server, {
+        method: 'GET',
+        url: '/help/cookie-preferences/basic',
+        headers
+      })
+
+      const $input = container.getByRole('radio', {
+        name: text
+      })
+
+      const $successNotification = container.getByRole('alert', {
+        name: 'Success'
+      })
+
+      expect($input).toBeChecked()
+      expect($successNotification).toHaveTextContent(
+        'You’ve set your cookie preferences.'
+      )
+    }
+  )
+
+  test("doesn't show the success banner if the user hasn't been posted from the cookie preferences page", async () => {
+    server = await createServer()
+    await server.initialize()
+
+    // set the cookie preferences
+    const sessionInitialisationResponse = await server.inject({
+      method: 'POST',
+      url: `/help/cookie-preferences/basic?returnUrl=${encodeURIComponent('/another-page')}`,
+      payload: {
+        'cookies[analytics]': 'yes'
+      }
+    })
+
+    const headers = {
+      ...getCookieHeader(sessionInitialisationResponse, [
+        'crumb',
+        'session',
+        'cookieConsent'
+      ])
+    }
+
+    const { container } = await renderResponse(server, {
+      method: 'GET',
+      url: '/help/cookie-preferences/basic',
+      headers
+    })
+
+    const $input = container.getByRole('radio', {
+      name: 'Yes'
+    })
+
+    const $successNotification = container.queryByRole('alert', {
+      name: 'Success'
+    })
+
+    expect($input).toBeChecked()
+    expect($successNotification).not.toBeInTheDocument()
+  })
+
+  test('defaults to no if one is not provided', async () => {
+    server = await createServer()
+    await server.initialize()
+
+    const { container } = await renderResponse(server, {
+      method: 'GET',
+      url: '/help/cookie-preferences/basic'
+    })
+
+    const $input = container.getByRole('radio', {
+      name: 'No'
+    })
+
+    expect($input).toBeChecked()
+  })
+
+  test('returns bad request for invalid redirect urls', async () => {
+    server = await createServer()
+    await server.initialize()
+
+    const { response } = await renderResponse(server, {
+      method: 'POST',
+      url: `/help/cookie-preferences/basic?returnUrl=${encodeURIComponent('https://my-malicious-url.com')}`,
+      payload: {
+        'cookies[analytics]': 'yes'
+      }
+    })
+
+    expect(response.statusCode).toBe(StatusCodes.BAD_REQUEST)
+  })
+})
+
+/**
+ * @import { Server } from '@hapi/hapi'
+ */

package/test/form/csrf.test.js

@@ -0,0 +1,87 @@
+import { join } from 'node:path'
+
+import { StatusCodes } from 'http-status-codes'
+
+import { createServer } from '~/src/server/index.js'
+import { getFormMetadata } from '~/src/server/plugins/engine/services/formsService.js'
+import * as fixtures from '~/test/fixtures/index.js'
+import { renderResponse } from '~/test/helpers/component-helpers.js'
+import { getCookie } from '~/test/utils/get-cookie.js'
+
+const basePath = '/basic'
+
+jest.mock('~/src/server/plugins/engine/services/formsService.js')
+
+describe('CSRF', () => {
+  /** @type {Server} */
+  let server
+
+  // Create server before each test
+  beforeAll(async () => {
+    server = await createServer({
+      formFileName: 'basic.js',
+      formFilePath: join(import.meta.dirname, 'definitions'),
+      enforceCsrf: true
+    })
+
+    await server.initialize()
+  })
+
+  beforeEach(() => {
+    jest.mocked(getFormMetadata).mockResolvedValue(fixtures.form.metadata)
+  })
+
+  afterAll(async () => {
+    await server.stop()
+  })
+
+  test('get request returns CSRF header', async () => {
+    const { response } = await renderResponse(server, {
+      url: `${basePath}/licence`
+    })
+
+    expect(response.statusCode).toBe(StatusCodes.OK)
+
+    const csrfToken = getCookie(response, 'crumb')
+    expect(csrfToken).toBeTruthy()
+
+    const $input = document.querySelector('[name=crumb]')
+    expect($input).toBeInTheDocument()
+    expect($input).toHaveAttribute('type', 'hidden')
+    expect($input).toHaveValue(csrfToken)
+  })
+
+  test('post request without CSRF token returns 403 forbidden', async () => {
+    const response = await server.inject({
+      url: `${basePath}/licence`,
+      method: 'POST',
+      payload: {
+        licenceLength: '1'
+      }
+    })
+
+    expect(response.statusCode).toBe(StatusCodes.FORBIDDEN)
+  })
+
+  test('post request with CSRF token returns 303 redirect', async () => {
+    const csrfToken = 'dummy-token'
+
+    const response = await server.inject({
+      url: `${basePath}/licence`,
+      method: 'POST',
+      headers: {
+        cookie: `crumb=${csrfToken}`
+      },
+      payload: {
+        crumb: csrfToken,
+        licenceLength: '1'
+      }
+    })
+
+    expect(response.statusCode).toBe(StatusCodes.SEE_OTHER)
+  })
+})
+
+/**
+ * @import { Server, ServerInjectOptions } from '@hapi/hapi'
+ */

package/test/form/definitions/basic.js

@@ -0,0 +1,101 @@
+import {
+  ComponentType,
+  ControllerPath,
+  ControllerType
+} from '@defra/forms-model'
+
+export default /** @satisfies {FormDefinition} */ ({
+  name: 'Basic',
+  startPage: '/licence',
+  pages: /** @type {const} */ ([
+    {
+      title: 'Buy a rod fishing licence',
+      path: '/licence',
+      components: [
+        {
+          options: {
+            bold: true
+          },
+          type: ComponentType.RadiosField,
+          name: 'licenceLength',
+          title: 'Which fishing licence do you want to get?',
+          list: 'licenceLengthDays'
+        }
+      ],
+      section: 'licenceDetails',
+      next: [
+        {
+          path: '/full-name'
+        }
+      ]
+    },
+    {
+      title: "What's your name?",
+      path: '/full-name',
+      components: [
+        {
+          schema: {
+            max: 70
+          },
+          options: {},
+          type: ComponentType.TextField,
+          name: 'fullName',
+          title: "What's your name?"
+        }
+      ],
+      section: 'personalDetails',
+      next: [
+        {
+          path: '/summary'
+        }
+      ]
+    },
+    {
+      path: ControllerPath.Summary,
+      controller: ControllerType.Summary,
+      title: 'Summary'
+    }
+  ]),
+  sections: [
+    {
+      name: 'licenceDetails',
+      title: 'Licence details'
+    },
+    {
+      name: 'personalDetails',
+      title: 'Personal details'
+    }
+  ],
+  conditions: [],
+  lists: [
+    {
+      name: 'licenceLengthDays',
+      title: 'Licence length (days)',
+      type: 'number',
+      items: [
+        {
+          text: '1 day',
+          value: 1,
+          description: 'Valid for 24 hours from the start time that you select'
+        },
+        {
+          text: '8 day',
+          value: 8,
+          description:
+            'Valid for 8 consecutive days from the start time that you select'
+        },
+        {
+          text: '12 months',
+          value: 365,
+          description:
+            '12-month licences are now valid for 365 days from their start date and can be purchased at any time during the year'
+        }
+      ]
+    }
+  ],
+  outputEmail: 'enrique.chase@defra.gov.uk'
+})
+
+/**
+ * @import { FormDefinition } from '@defra/forms-model'
+ */

package/test/form/definitions/blank.js

@@ -0,0 +1,10 @@
+export default /** @type {FormDefinition} */ ({
+  pages: [],
+  lists: [],
+  sections: [],
+  conditions: []
+})
+
+/**
+ * @import { FormDefinition } from '@defra/forms-model'
+ */

package/test/form/definitions/checkboxes.json

@@ -0,0 +1,88 @@
+{
+  "metadata": {},
+  "startPage": "/first-page",
+  "pages": [
+    {
+      "title": "First page",
+      "path": "/first-page",
+      "components": [
+        {
+          "name": "wqJmSf",
+          "options": { "required": false },
+          "type": "CheckboxesField",
+          "title": "chooseHorseType",
+          "list": "PeVjPw",
+          "schema": {}
+        }
+      ],
+      "next": [
+        { "path": "/second-page", "condition": "ihuObd" },
+        { "path": "/third-page", "condition": "EcLLXH" }
+      ]
+    },
+    {
+      "path": "/second-page",
+      "title": "Second page",
+      "components": [],
+      "next": []
+    },
+    {
+      "path": "/third-page",
+      "title": "Third page",
+      "components": [],
+      "next": []
+    }
+  ],
+  "lists": [
+    {
+      "title": "horseType",
+      "name": "PeVjPw",
+      "type": "string",
+      "items": [
+        { "text": "Shire", "value": "shire" },
+        { "text": "Race", "value": "race" },
+        { "text": "Pantomime", "value": "pantomime" },
+        { "text": "Other", "value": "other" }
+      ]
+    }
+  ],
+  "sections": [],
+  "conditions": [
+    {
+      "displayName": "Not other",
+      "name": "ihuObd",
+      "value": {
+        "name": "Not other",
+        "conditions": [
+          {
+            "field": {
+              "name": "wqJmSf",
+              "type": "CheckboxesField",
+              "display": "chooseHorseType"
+            },
+            "operator": "does not contain",
+            "value": { "type": "Value", "value": "other", "display": "other" }
+          }
+        ]
+      }
+    },
+    {
+      "displayName": "Other",
+      "name": "EcLLXH",
+      "value": {
+        "name": "Other",
+        "conditions": [
+          {
+            "field": {
+              "name": "wqJmSf",
+              "type": "CheckboxesField",
+              "display": "chooseHorseType"
+            },
+            "operator": "contains",
+            "value": { "type": "Value", "value": "other", "display": "other" }
+          }
+        ]
+      }
+    }
+  ]
+}