@jgardner04/ghost-mcp-server 1.13.0 → 1.13.2

package/src/services/__tests__/ghostServiceImproved.posts.test.js

@@ -0,0 +1,233 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { createMockContextLogger } from '../../__tests__/helpers/mockLogger.js';
+import { mockDotenv } from '../../__tests__/helpers/testUtils.js';
+
+// Mock the Ghost Admin API with posts support
+vi.mock('@tryghost/admin-api', () => ({
+  default: vi.fn(function () {
+    return {
+      posts: {
+        add: vi.fn(),
+        browse: vi.fn(),
+        read: vi.fn(),
+        edit: vi.fn(),
+        delete: vi.fn(),
+      },
+      pages: {
+        add: vi.fn(),
+        browse: vi.fn(),
+        read: vi.fn(),
+        edit: vi.fn(),
+        delete: vi.fn(),
+      },
+      tags: {
+        add: vi.fn(),
+        browse: vi.fn(),
+        read: vi.fn(),
+        edit: vi.fn(),
+        delete: vi.fn(),
+      },
+      members: {
+        add: vi.fn(),
+        browse: vi.fn(),
+        read: vi.fn(),
+        edit: vi.fn(),
+        delete: vi.fn(),
+      },
+      site: {
+        read: vi.fn(),
+      },
+      images: {
+        upload: vi.fn(),
+      },
+    };
+  }),
+}));
+
+// Mock dotenv
+vi.mock('dotenv', () => mockDotenv());
+
+// Mock logger
+vi.mock('../../utils/logger.js', () => ({
+  createContextLogger: createMockContextLogger(),
+}));
+
+// Mock fs for validateImagePath
+vi.mock('fs/promises', () => ({
+  default: {
+    access: vi.fn(),
+  },
+}));
+
+// Import after setting up mocks
+import { updatePost, api, validators } from '../ghostServiceImproved.js';
+import { updatePostSchema } from '../../schemas/postSchemas.js';
+
+describe('ghostServiceImproved - Posts (updatePost)', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  describe('updatePost', () => {
+    it('should send only update fields and updated_at, not the full existing post', async () => {
+      const postId = 'post-123';
+      const existingPost = {
+        id: postId,
+        uuid: 'abc-def-123',
+        title: 'Original Title',
+        slug: 'original-title',
+        html: '<p>Original content</p>',
+        status: 'published',
+        url: 'https://example.com/original-title',
+        comment_id: 'comment-123',
+        reading_time: 3,
+        updated_at: '2024-01-01T00:00:00.000Z',
+        created_at: '2023-12-01T00:00:00.000Z',
+      };
+      const updateData = { title: 'Updated Title' };
+      const expectedResult = { ...existingPost, title: 'Updated Title' };
+
+      api.posts.read.mockResolvedValue(existingPost);
+      api.posts.edit.mockResolvedValue(expectedResult);
+
+      const result = await updatePost(postId, updateData);
+
+      expect(result).toEqual(expectedResult);
+      // Should send ONLY updateData + updated_at, NOT the full existing post
+      expect(api.posts.edit).toHaveBeenCalledWith(
+        { title: 'Updated Title', updated_at: '2024-01-01T00:00:00.000Z' },
+        { id: postId }
+      );
+      // Verify read-only fields are NOT sent
+      const editCallData = api.posts.edit.mock.calls[0][0];
+      expect(editCallData).not.toHaveProperty('uuid');
+      expect(editCallData).not.toHaveProperty('url');
+      expect(editCallData).not.toHaveProperty('comment_id');
+      expect(editCallData).not.toHaveProperty('reading_time');
+      expect(editCallData).not.toHaveProperty('created_at');
+    });
+
+    it('should preserve updated_at from existing post for OCC', async () => {
+      const postId = 'post-123';
+      const existingPost = {
+        id: postId,
+        title: 'Original',
+        updated_at: '2024-06-15T12:30:00.000Z',
+      };
+      api.posts.read.mockResolvedValue(existingPost);
+      api.posts.edit.mockResolvedValue({ ...existingPost, title: 'Updated' });
+
+      await updatePost(postId, { title: 'Updated' });
+
+      const editCall = api.posts.edit.mock.calls[0][0];
+      expect(editCall.updated_at).toBe('2024-06-15T12:30:00.000Z');
+    });
+
+    it('should throw error when post ID is missing', async () => {
+      await expect(updatePost(null, { title: 'Updated' })).rejects.toThrow(
+        'Post ID is required for update'
+      );
+      await expect(updatePost('', { title: 'Updated' })).rejects.toThrow(
+        'Post ID is required for update'
+      );
+    });
+
+    it('should handle post not found (404)', async () => {
+      const error404 = new Error('Post not found');
+      error404.response = { status: 404 };
+      api.posts.read.mockRejectedValue(error404);
+
+      await expect(updatePost('nonexistent-id', { title: 'Updated' })).rejects.toThrow(
+        'Post not found'
+      );
+    });
+
+    it('should throw ValidationError when updating to scheduled without published_at', async () => {
+      const postId = 'post-123';
+      const existingPost = {
+        id: postId,
+        title: 'Test Post',
+        updated_at: '2024-01-01T00:00:00.000Z',
+      };
+      api.posts.read.mockResolvedValue(existingPost);
+
+      await expect(updatePost(postId, { status: 'scheduled' })).rejects.toThrow(
+        'Post validation failed'
+      );
+    });
+
+    it('should allow updating to scheduled with valid future published_at', async () => {
+      const postId = 'post-123';
+      const existingPost = {
+        id: postId,
+        title: 'Test Post',
+        updated_at: '2024-01-01T00:00:00.000Z',
+      };
+      const futureDate = new Date(Date.now() + 86400000).toISOString();
+      const updateData = { status: 'scheduled', published_at: futureDate };
+
+      api.posts.read.mockResolvedValue(existingPost);
+      api.posts.edit.mockResolvedValue({ ...existingPost, ...updateData });
+
+      const result = await updatePost(postId, updateData);
+
+      expect(result).toBeDefined();
+      expect(api.posts.edit).toHaveBeenCalledWith(
+        { ...updateData, updated_at: existingPost.updated_at },
+        { id: postId }
+      );
+    });
+  });
+
+  describe('validators.validateScheduledStatus', () => {
+    it('should throw when status is scheduled without published_at', () => {
+      expect(() => validators.validateScheduledStatus({ status: 'scheduled' })).toThrow(
+        'validation failed'
+      );
+    });
+
+    it('should throw when published_at has invalid date format', () => {
+      expect(() => validators.validateScheduledStatus({ published_at: 'not-a-date' })).toThrow(
+        'validation failed'
+      );
+    });
+
+    it('should throw when scheduled date is in the past', () => {
+      const pastDate = new Date(Date.now() - 86400000).toISOString();
+      expect(() =>
+        validators.validateScheduledStatus({ status: 'scheduled', published_at: pastDate })
+      ).toThrow('validation failed');
+    });
+
+    it('should not throw for valid scheduled status with future date', () => {
+      const futureDate = new Date(Date.now() + 86400000).toISOString();
+      expect(() =>
+        validators.validateScheduledStatus({ status: 'scheduled', published_at: futureDate })
+      ).not.toThrow();
+    });
+
+    it('should not throw when status is not scheduled', () => {
+      expect(() => validators.validateScheduledStatus({ status: 'draft' })).not.toThrow();
+      expect(() => validators.validateScheduledStatus({ status: 'published' })).not.toThrow();
+      expect(() => validators.validateScheduledStatus({})).not.toThrow();
+    });
+  });
+
+  describe('HTML sanitization (schema + service integration)', () => {
+    it('should strip XSS from post HTML on update when input flows through schema validation (production path)', async () => {
+      const rawUpdate = { html: '<p>Safe</p><script>alert("xss")</script>' };
+      const validated = updatePostSchema.parse(rawUpdate);
+
+      const existingPost = { id: 'post-1', updated_at: '2024-01-01T00:00:00.000Z' };
+      api.posts.read.mockResolvedValue(existingPost);
+      api.posts.edit.mockResolvedValue({ ...existingPost, ...validated });
+
+      await updatePost('post-1', validated);
+
+      const sentToApi = api.posts.edit.mock.calls[0][0];
+      expect(sentToApi.html).not.toContain('<script>');
+      expect(sentToApi.html).not.toContain('alert');
+      expect(sentToApi.html).toContain('<p>Safe</p>');
+    });
+  });
+});