@flusys/nestjs-email 6.0.2 → 6.1.1

package/fesm/services/email-template.service.spec.js

@@ -0,0 +1,253 @@
+import { Test } from '@nestjs/testing';
+import { UtilsService } from '@flusys/nestjs-shared/modules';
+import { createMockDataSourceProvider, createMockRepository } from '@test-utils/mocks/repository.mock';
+import { buildMockUser } from '@test-utils/mocks/logged-user.mock';
+import { EmailTemplate, EmailTemplateWithCompany } from '../entities';
+import { EmailConfigService } from './email-config.service';
+import { EmailDataSourceProvider } from './email-datasource.provider';
+import { EmailTemplateService } from './email-template.service';
+function buildTemplate(overrides = {}) {
+    return {
+        id: 'template-uuid-1',
+        name: 'Welcome Email',
+        slug: 'welcome-email',
+        description: null,
+        subject: 'Welcome {{firstName}}!',
+        schema: {
+            fields: []
+        },
+        htmlContent: '<h1>Welcome {{firstName}}!</h1>',
+        textContent: 'Welcome {{firstName}}!',
+        schemaVersion: 1,
+        isActive: true,
+        isHtml: true,
+        createdAt: new Date(),
+        updatedAt: new Date(),
+        deletedAt: null,
+        createdById: null,
+        updatedById: null,
+        deletedById: null,
+        ...overrides
+    };
+}
+function buildQuery() {
+    return {
+        select: jest.fn().mockReturnThis(),
+        andWhere: jest.fn().mockReturnThis(),
+        orderBy: jest.fn().mockReturnThis()
+    };
+}
+describe('EmailTemplateService', ()=>{
+    let service;
+    let mockRepo;
+    let mockEmailConfig;
+    beforeEach(async ()=>{
+        mockRepo = createMockRepository();
+        const mockDataSourceProvider = createMockDataSourceProvider(mockRepo);
+        mockEmailConfig = {
+            isCompanyFeatureEnabled: jest.fn().mockReturnValue(false)
+        };
+        const module = await Test.createTestingModule({
+            providers: [
+                EmailTemplateService,
+                {
+                    provide: 'CACHE_INSTANCE',
+                    useValue: {}
+                },
+                {
+                    provide: UtilsService,
+                    useValue: {}
+                },
+                {
+                    provide: EmailConfigService,
+                    useValue: mockEmailConfig
+                },
+                {
+                    provide: EmailDataSourceProvider,
+                    useValue: mockDataSourceProvider
+                }
+            ]
+        }).compile();
+        service = await module.resolve(EmailTemplateService);
+        // convertSingleDtoToEntity accesses `this.repository` directly; normally it is
+        // lazily initialized by insert()/update() via ensureDataSourceRepository() first.
+        await service.ensureDataSourceRepository();
+    });
+    describe('resolveEntity', ()=>{
+        it('resolves the plain EmailTemplate entity when the company feature is disabled', ()=>{
+            expect(service.resolveEntity()).toBe(EmailTemplate);
+        });
+        it('resolves EmailTemplateWithCompany when the company feature is enabled', ()=>{
+            mockEmailConfig.isCompanyFeatureEnabled.mockReturnValue(true);
+            expect(service.resolveEntity()).toBe(EmailTemplateWithCompany);
+        });
+    });
+    describe('convertSingleDtoToEntity', ()=>{
+        it('creates a new entity (no schema-version bump) for an insert without id', async ()=>{
+            mockRepo.create.mockReturnValue({});
+            const entity = await service.convertSingleDtoToEntity({
+                name: 'Welcome',
+                slug: 'welcome',
+                subject: 'Hi {{name}}',
+                schema: {
+                    fields: []
+                },
+                htmlContent: '<p>Hi {{name}}</p>'
+            }, buildMockUser());
+            expect(entity.schemaVersion).toBeUndefined();
+            expect(mockRepo.findOne).not.toHaveBeenCalled();
+        });
+        it('increments schemaVersion on update when the schema payload changed', async ()=>{
+            // convertSingleDtoToEntity (ApiService base) mutates the fetched row in place via
+            // Object.assign, and incrementSchemaVersionIfChanged re-fetches by id afterwards —
+            // so the mock must return a fresh clone per call, like a real repository would.
+            mockRepo.findOne.mockImplementation(async ()=>buildTemplate({
+                    schema: {
+                        fields: []
+                    },
+                    schemaVersion: 3
+                }));
+            const entity = await service.convertSingleDtoToEntity({
+                id: 'template-uuid-1',
+                schema: {
+                    fields: [
+                        {
+                            name: 'x'
+                        }
+                    ]
+                }
+            }, buildMockUser());
+            expect(entity.schemaVersion).toBe(4);
+        });
+        it('does not increment schemaVersion on update when the schema payload is unchanged', async ()=>{
+            mockRepo.findOne.mockImplementation(async ()=>buildTemplate({
+                    schema: {
+                        fields: []
+                    },
+                    schemaVersion: 3
+                }));
+            const entity = await service.convertSingleDtoToEntity({
+                id: 'template-uuid-1',
+                schema: {
+                    fields: []
+                }
+            }, buildMockUser());
+            expect(entity.schemaVersion).toBe(3);
+        });
+        it('does not touch schemaVersion when the update payload has no schema field', async ()=>{
+            const existing = buildTemplate({
+                schema: {
+                    fields: []
+                },
+                schemaVersion: 3
+            });
+            mockRepo.findOne.mockResolvedValue(existing);
+            const entity = await service.convertSingleDtoToEntity({
+                id: 'template-uuid-1',
+                name: 'Renamed'
+            }, buildMockUser());
+            expect(entity.schemaVersion).toBe(3);
+            // ensureDataSourceRepository/findOne should only be hit once — by the base
+            // convertSingleDtoToEntity — not a second time by incrementSchemaVersionIfChanged.
+            expect(mockRepo.findOne).toHaveBeenCalledTimes(1);
+        });
+        it('attaches the current user companyId when the company feature is enabled', async ()=>{
+            mockEmailConfig.isCompanyFeatureEnabled.mockReturnValue(true);
+            mockRepo.create.mockReturnValue({});
+            const entity = await service.convertSingleDtoToEntity({
+                name: 'Welcome',
+                slug: 'welcome',
+                subject: 'Hi',
+                schema: {},
+                htmlContent: '<p/>'
+            }, buildMockUser({
+                companyId: 'company-uuid-7'
+            }));
+            expect(entity.companyId).toBe('company-uuid-7');
+        });
+    });
+    describe('getSelectQuery', ()=>{
+        it('selects the default whitelisted fields (without companyId) when company feature is disabled', async ()=>{
+            const query = buildQuery();
+            await service.getSelectQuery(query, buildMockUser());
+            const [selected] = query.select.mock.calls[0];
+            expect(selected).toEqual(expect.arrayContaining([
+                'emailTemplate.id',
+                'emailTemplate.name',
+                'emailTemplate.slug',
+                'emailTemplate.subject',
+                'emailTemplate.htmlContent',
+                'emailTemplate.textContent',
+                'emailTemplate.schemaVersion',
+                'emailTemplate.isActive',
+                'emailTemplate.isHtml'
+            ]));
+            expect(selected).not.toContain('emailTemplate.companyId');
+        });
+        it('appends companyId to the default field list when company feature is enabled', async ()=>{
+            mockEmailConfig.isCompanyFeatureEnabled.mockReturnValue(true);
+            const query = buildQuery();
+            await service.getSelectQuery(query, buildMockUser());
+            const [selected] = query.select.mock.calls[0];
+            expect(selected).toContain('emailTemplate.companyId');
+        });
+    });
+    describe('getExtraManipulateQuery', ()=>{
+        it('applies the company filter and orders by createdAt DESC when company feature is enabled', async ()=>{
+            mockEmailConfig.isCompanyFeatureEnabled.mockReturnValue(true);
+            const query = buildQuery();
+            await service.getExtraManipulateQuery(query, {}, buildMockUser({
+                companyId: 'c-1'
+            }));
+            expect(query.andWhere).toHaveBeenCalledWith('emailTemplate.companyId = :companyId', {
+                companyId: 'c-1'
+            });
+            expect(query.orderBy).toHaveBeenCalledWith('emailTemplate.createdAt', 'DESC');
+        });
+    });
+    describe('findByIdDirect', ()=>{
+        it('returns the matching template', async ()=>{
+            const template = buildTemplate();
+            mockRepo.findOne.mockResolvedValue(template);
+            const result = await service.findByIdDirect('template-uuid-1');
+            expect(result).toBe(template);
+            expect(mockRepo.findOne).toHaveBeenCalledWith({
+                where: {
+                    id: 'template-uuid-1'
+                }
+            });
+        });
+    });
+    describe('findBySlug', ()=>{
+        it('finds an active template by slug', async ()=>{
+            const template = buildTemplate();
+            mockRepo.findOne.mockResolvedValue(template);
+            const result = await service.findBySlug('welcome-email', buildMockUser());
+            expect(result).toBe(template);
+            expect(mockRepo.findOne).toHaveBeenCalledWith({
+                where: {
+                    slug: 'welcome-email',
+                    isActive: true
+                }
+            });
+        });
+        it('scopes the slug lookup to the current company when the company feature is enabled', async ()=>{
+            mockEmailConfig.isCompanyFeatureEnabled.mockReturnValue(true);
+            mockRepo.findOne.mockResolvedValue(null);
+            await service.findBySlug('welcome-email', buildMockUser({
+                companyId: 'company-uuid-3'
+            }));
+            expect(mockRepo.findOne).toHaveBeenCalledWith({
+                where: {
+                    slug: 'welcome-email',
+                    isActive: true,
+                    companyId: 'company-uuid-3'
+                }
+            });
+        });
+        it('returns null when no template matches the slug', async ()=>{
+            mockRepo.findOne.mockResolvedValue(null);
+            await expect(service.findBySlug('missing-slug', buildMockUser())).resolves.toBeNull();
+        });
+    });
+});

package/fesm/utils/email-templates.util.spec.js

@@ -0,0 +1,57 @@
+import { getOtpEmailFormat, getResetPasswordEmailFormat } from './email-templates.util';
+describe('email-templates.util', ()=>{
+    describe('getOtpEmailFormat', ()=>{
+        it('renders the OTP inside the generated HTML document', ()=>{
+            const html = getOtpEmailFormat(123456, 'Jane');
+            expect(html).toContain('<!DOCTYPE html>');
+            expect(html).toContain('123456');
+            expect(html).toContain('Hi Jane,');
+            expect(html).toContain('Your OTP Code');
+        });
+        it('falls back to a generic greeting when userName is not provided', ()=>{
+            const html = getOtpEmailFormat(654321);
+            expect(html).toContain('Hi Sir/Madam,');
+        });
+        it('falls back to a generic greeting when userName is null', ()=>{
+            const html = getOtpEmailFormat(111111, null);
+            expect(html).toContain('Hi Sir/Madam,');
+        });
+        it('does not escape HTML special characters in userName (XSS caveat)', ()=>{
+            const html = getOtpEmailFormat(999999, '<script>alert(1)</script>');
+            // Documents CURRENT behavior: userName is interpolated verbatim, unescaped.
+            expect(html).toContain('<script>alert(1)</script>');
+            expect(html).not.toContain('&lt;script&gt;');
+        });
+        it('includes styling for the OTP action box', ()=>{
+            const html = getOtpEmailFormat(1, 'A');
+            expect(html).toContain('letter-spacing: 6px');
+        });
+    });
+    describe('getResetPasswordEmailFormat', ()=>{
+        it('renders the reset link as the href of the action button', ()=>{
+            const html = getResetPasswordEmailFormat('https://app.example.com/reset?token=abc', 'Bob');
+            expect(html).toContain('href="https://app.example.com/reset?token=abc"');
+            expect(html).toContain('Hi Bob,');
+            expect(html).toContain('Reset Your Password');
+        });
+        it('falls back to a generic greeting when userName is omitted', ()=>{
+            const html = getResetPasswordEmailFormat('https://app.example.com/reset?token=abc');
+            expect(html).toContain('Hi Sir/Madam,');
+        });
+        it('does not escape or validate the reset link (XSS/HTML-injection caveat)', ()=>{
+            const maliciousLink = '"><script>alert(1)</script>';
+            const html = getResetPasswordEmailFormat(maliciousLink, 'Bob');
+            // Documents CURRENT behavior: resetLink is interpolated verbatim, unescaped,
+            // allowing HTML attribute breakout if the value is attacker-influenced.
+            expect(html).toContain(`href="${maliciousLink}"`);
+        });
+        it('does not escape HTML special characters in userName', ()=>{
+            const html = getResetPasswordEmailFormat('https://x.test/reset', '<img src=x onerror=alert(1)>');
+            expect(html).toContain('<img src=x onerror=alert(1)>');
+        });
+        it('produces a single-line action-box style for the reset button', ()=>{
+            const html = getResetPasswordEmailFormat('https://x.test/reset', 'A');
+            expect(html).toContain('font-size: 16px');
+        });
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flusys/nestjs-email",
-  "version": "6.0.2",
+  "version": "6.1.1",
   "description": "Modular email package with SMTP, SendGrid, and Mailgun providers",
   "main": "cjs/index.js",
   "module": "fesm/index.js",
@@ -105,7 +105,7 @@
     }
   },
   "dependencies": {
-    "@flusys/nestjs-core": "6.0.2",
-    "@flusys/nestjs-shared": "6.0.2"
+    "@flusys/nestjs-core": "6.1.1",
+    "@flusys/nestjs-shared": "6.1.1"
   }
 }