@jmruthers/pace-core 0.5.4 → 0.5.6

package/src/utils/__tests__/validationUtils.unit.test.ts

@@ -0,0 +1,571 @@
+import { describe, it, expect, vi } from 'vitest';
+import { z } from 'zod';
+import {
+  validateUserInput,
+  sanitizeUserInput_deprecated,
+  emailSchema,
+  passwordSchema,
+  usernameSchema,
+  nameSchema,
+  phoneSchema,
+  urlSchema
+} from '../validationUtils';
+
+// Mock sanitization functions
+vi.mock('../sanitization', () => ({
+  sanitizeUserInput: vi.fn((input: string) => `sanitized_${input}`),
+  sanitizeFormData: vi.fn((data: unknown, schema: z.ZodSchema, rules?: Record<string, any>) => {
+    // Try to parse with the schema to determine success
+    try {
+      const result = schema.parse(data);
+      return {
+        success: true,
+        data: result
+      };
+    } catch (error) {
+      return {
+        success: false,
+        error: error instanceof Error ? error.message : 'Validation failed'
+      };
+    }
+  })
+}));
+
+describe('validationUtils', () => {
+  describe('validateUserInput', () => {
+    it('should validate user input with sanitization', () => {
+      const schema = z.object({
+        name: z.string(),
+        email: z.string().email()
+      });
+
+      const data = { name: 'John', email: 'john@example.com' };
+      const result = validateUserInput(schema, data);
+
+      expect(result.success).toBe(true);
+      expect(result.data).toEqual(data);
+    });
+
+    it('should handle validation errors', () => {
+      const schema = z.object({
+        name: z.string().min(2),
+        email: z.string().email()
+      });
+
+      const data = { name: 'J', email: 'invalid-email' };
+      const result = validateUserInput(schema, data);
+
+      expect(result.success).toBe(false);
+      expect(result.error).toBeDefined();
+    });
+
+    it('should handle sanitization rules', () => {
+      const schema = z.object({
+        name: z.string(),
+        bio: z.string()
+      });
+
+      const data = { name: 'John', bio: 'Some bio' };
+      const sanitizationRules = {
+        name: { allowHtml: false, maxLength: 50 },
+        bio: { allowHtml: true, maxLength: 200 }
+      };
+
+      const result = validateUserInput(schema, data, sanitizationRules);
+
+      expect(result.success).toBe(true);
+      expect(result.data).toEqual(data);
+    });
+  });
+
+  describe('sanitizeUserInput_deprecated', () => {
+    it('should call sanitizeUserInput and log deprecation warning', () => {
+      const consoleSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+      
+      const result = sanitizeUserInput_deprecated('test input');
+
+      expect(result).toBe('sanitized_test input');
+      expect(consoleSpy).toHaveBeenCalledWith(
+        'sanitizeUserInput is deprecated. Use sanitizeUserInput from lib/sanitization instead.'
+      );
+
+      consoleSpy.mockRestore();
+    });
+  });
+
+  describe('emailSchema', () => {
+    it('should validate valid email addresses', () => {
+      const validEmails = [
+        'test@example.com',
+        'user.name@domain.co.uk',
+        'user+tag@example.org',
+        '123@example.com',
+        'test@subdomain.example.com'
+      ];
+
+      validEmails.forEach(email => {
+        const result = emailSchema.safeParse(email);
+        expect(result.success).toBe(true);
+        if (result.success) {
+          expect(result.data).toBe(email.toLowerCase().trim());
+        }
+      });
+    });
+
+    it('should reject invalid email addresses', () => {
+      const invalidEmails = [
+        '',
+        'invalid-email',
+        '@example.com',
+        'test@',
+        'test@.com',
+        'test..test@example.com',
+        'test@example..com',
+        'test@example.com.',
+        'test@example.com'.repeat(100) // Too long
+      ];
+
+      invalidEmails.forEach(email => {
+        const result = emailSchema.safeParse(email);
+        expect(result.success).toBe(false);
+      });
+    });
+
+    it('should transform email to lowercase and trim', () => {
+      const result = emailSchema.safeParse('  TEST@EXAMPLE.COM  ');
+      expect(result.success).toBe(true);
+      if (result.success) {
+        expect(result.data).toBe('test@example.com');
+      }
+    });
+
+    it('should enforce minimum length', () => {
+      const result = emailSchema.safeParse('');
+      expect(result.success).toBe(false);
+      if (!result.success) {
+        expect(result.error.issues[0].message).toBe('Email is required');
+      }
+    });
+
+    it('should enforce maximum length', () => {
+      const longEmail = 'a'.repeat(250) + '@example.com';
+      const result = emailSchema.safeParse(longEmail);
+      expect(result.success).toBe(false);
+      if (!result.success) {
+        expect(result.error.issues[0].message).toBe('Email too long');
+      }
+    });
+  });
+
+  describe('passwordSchema', () => {
+    it('should validate strong passwords', () => {
+      const validPasswords = [
+        'Password123!',
+        'MySecurePass1@',
+        'ComplexP@ssw0rd',
+        'Str0ng#Pass',
+        'ValidP@ss1'
+      ];
+
+      validPasswords.forEach(password => {
+        const result = passwordSchema.safeParse(password);
+        expect(result.success).toBe(true);
+      });
+    });
+
+    it('should reject weak passwords', () => {
+      const invalidPasswords = [
+        '', // Empty
+        'short', // Too short
+        'password', // No uppercase, number, or special char
+        'PASSWORD', // No lowercase, number, or special char
+        'Password', // No number or special char
+        'password123', // No uppercase or special char
+        'PASSWORD123', // No lowercase or special char
+        'Password123', // No special char
+        'a'.repeat(129) // Too long
+      ];
+
+      invalidPasswords.forEach(password => {
+        const result = passwordSchema.safeParse(password);
+        expect(result.success).toBe(false);
+      });
+    });
+
+    it('should enforce minimum length', () => {
+      const result = passwordSchema.safeParse('Pass1!');
+      expect(result.success).toBe(false);
+      if (!result.success) {
+        expect(result.error.issues[0].message).toBe('Password must be at least 8 characters');
+      }
+    });
+
+    it('should enforce maximum length', () => {
+      const longPassword = 'A'.repeat(129);
+      const result = passwordSchema.safeParse(longPassword);
+      expect(result.success).toBe(false);
+      if (!result.success) {
+        expect(result.error.issues[0].message).toBe('Password too long');
+      }
+    });
+
+    it('should require uppercase letter', () => {
+      const result = passwordSchema.safeParse('password123!');
+      expect(result.success).toBe(false);
+      if (!result.success) {
+        expect(result.error.issues.some(issue => issue.message === 'Password must contain at least one uppercase letter')).toBe(true);
+      }
+    });
+
+    it('should require lowercase letter', () => {
+      const result = passwordSchema.safeParse('PASSWORD123!');
+      expect(result.success).toBe(false);
+      if (!result.success) {
+        expect(result.error.issues.some(issue => issue.message === 'Password must contain at least one lowercase letter')).toBe(true);
+      }
+    });
+
+    it('should require number', () => {
+      const result = passwordSchema.safeParse('Password!');
+      expect(result.success).toBe(false);
+      if (!result.success) {
+        expect(result.error.issues.some(issue => issue.message === 'Password must contain at least one number')).toBe(true);
+      }
+    });
+
+    it('should require special character', () => {
+      const result = passwordSchema.safeParse('Password123');
+      expect(result.success).toBe(false);
+      if (!result.success) {
+        expect(result.error.issues.some(issue => issue.message === 'Password must contain at least one special character')).toBe(true);
+      }
+    });
+  });
+
+  describe('usernameSchema', () => {
+    it('should validate valid usernames', () => {
+      const validUsernames = [
+        'john_doe',
+        'user123',
+        'test-user',
+        'admin',
+        'user_name_123'
+      ];
+
+      validUsernames.forEach(username => {
+        const result = usernameSchema.safeParse(username);
+        expect(result.success).toBe(true);
+        if (result.success) {
+          expect(result.data).toBe(username.toLowerCase().trim());
+        }
+      });
+    });
+
+    it('should reject invalid usernames', () => {
+      const invalidUsernames = [
+        '', // Empty
+        'ab', // Too short
+        'a'.repeat(31), // Too long
+        'user@name', // Invalid character
+        'user name', // Space
+        'user.name', // Dot
+        'user/name', // Slash
+        'user\\name', // Backslash
+        'user:name', // Colon
+        'user;name', // Semicolon
+        'user,name', // Comma
+        'user<name', // Less than
+        'user>name', // Greater than
+        'user[name', // Bracket
+        'user]name', // Bracket
+        'user{name', // Brace
+        'user}name', // Brace
+        'user|name', // Pipe
+        'user`name', // Backtick
+        'user~name' // Tilde
+      ];
+
+      invalidUsernames.forEach(username => {
+        const result = usernameSchema.safeParse(username);
+        expect(result.success).toBe(false);
+      });
+    });
+
+    it('should transform username to lowercase and trim', () => {
+      const result = usernameSchema.safeParse('  USER_NAME  ');
+      expect(result.success).toBe(true);
+      if (result.success) {
+        expect(result.data).toBe('user_name');
+      }
+    });
+
+    it('should enforce minimum length', () => {
+      const result = usernameSchema.safeParse('ab');
+      expect(result.success).toBe(false);
+      if (!result.success) {
+        expect(result.error.issues[0].message).toBe('Username must be at least 3 characters');
+      }
+    });
+
+    it('should enforce maximum length', () => {
+      const longUsername = 'a'.repeat(31);
+      const result = usernameSchema.safeParse(longUsername);
+      expect(result.success).toBe(false);
+      if (!result.success) {
+        expect(result.error.issues[0].message).toBe('Username too long');
+      }
+    });
+  });
+
+  describe('nameSchema', () => {
+    it('should validate valid names', () => {
+      const validNames = [
+        'John',
+        'Mary Jane',
+        'O\'Connor',
+        'Jean-Pierre',
+        'José',
+        'Müller'
+      ];
+
+      validNames.forEach(name => {
+        const result = nameSchema.safeParse(name);
+        expect(result.success).toBe(true);
+        if (result.success) {
+          expect(result.data).toBe('sanitized_' + name);
+        }
+      });
+    });
+
+    it('should reject invalid names', () => {
+      const invalidNames = [
+        '', // Empty
+        'a'.repeat(101), // Too long
+        'John<script>alert("xss")</script>', // HTML injection
+        'John<img src="x" onerror="alert(1)">', // XSS attempt
+      ];
+
+      invalidNames.forEach(name => {
+        const result = nameSchema.safeParse(name);
+        expect(result.success).toBe(false);
+      });
+    });
+
+    it('should enforce minimum length', () => {
+      const result = nameSchema.safeParse('');
+      expect(result.success).toBe(false);
+      if (!result.success) {
+        expect(result.error.issues[0].message).toBe('Name is required');
+      }
+    });
+
+    it('should enforce maximum length', () => {
+      const longName = 'a'.repeat(101);
+      const result = nameSchema.safeParse(longName);
+      expect(result.success).toBe(false);
+      if (!result.success) {
+        expect(result.error.issues[0].message).toBe('Name too long');
+      }
+    });
+  });
+
+  describe('phoneSchema', () => {
+    it('should validate valid phone numbers', () => {
+      const validPhones = [
+        '1234567890',
+        '+1234567890',
+        '+1-234-567-8900',
+        '+44 20 7946 0958',
+        '123-456-7890',
+        '123.456.7890',
+        '(123) 456-7890'
+      ];
+
+      validPhones.forEach(phone => {
+        const result = phoneSchema.safeParse(phone);
+        expect(result.success).toBe(true);
+      });
+    });
+
+    it('should reject invalid phone numbers', () => {
+      const invalidPhones = [
+        '', // Empty
+        '123', // Too short
+        'a'.repeat(21), // Too long
+        '123-456-789', // Too short
+        'abc-def-ghij', // Non-numeric
+        '123-456-789a', // Contains letter
+        '123-456-789!', // Contains special char
+        '123-456-789 ', // Trailing space
+        ' 123-456-789', // Leading space
+      ];
+
+      invalidPhones.forEach(phone => {
+        const result = phoneSchema.safeParse(phone);
+        expect(result.success).toBe(false);
+      });
+    });
+
+    it('should enforce minimum length', () => {
+      const result = phoneSchema.safeParse('123456789');
+      expect(result.success).toBe(false);
+      if (!result.success) {
+        expect(result.error.issues[0].message).toBe('Phone number must be at least 10 digits');
+      }
+    });
+
+    it('should enforce maximum length', () => {
+      const longPhone = '1'.repeat(21);
+      const result = phoneSchema.safeParse(longPhone);
+      expect(result.success).toBe(false);
+      if (!result.success) {
+        expect(result.error.issues[0].message).toBe('Phone number too long');
+      }
+    });
+  });
+
+  describe('urlSchema', () => {
+    it('should validate valid URLs', () => {
+      const validUrls = [
+        'https://example.com',
+        'http://example.com',
+        'https://www.example.com',
+        'https://example.com/path',
+        'https://example.com/path?param=value',
+        'https://example.com/path#fragment',
+        'https://subdomain.example.com',
+        'https://example.co.uk',
+        'https://example.com:8080',
+        'https://user:pass@example.com'
+      ];
+
+      validUrls.forEach(url => {
+        const result = urlSchema.safeParse(url);
+        expect(result.success).toBe(true);
+      });
+    });
+
+    it('should reject invalid URLs', () => {
+      const invalidUrls = [
+        '', // Empty
+        'not-a-url', // Invalid format
+        'ftp://example.com', // Wrong protocol
+        'file://example.com', // Wrong protocol
+        'mailto:user@example.com', // Wrong protocol
+        'javascript:alert(1)', // Dangerous protocol
+        'data:text/html,<script>alert(1)</script>', // Data URL
+        'https://', // Incomplete
+        'http://', // Incomplete
+        'a'.repeat(2049), // Too long
+      ];
+
+      invalidUrls.forEach(url => {
+        const result = urlSchema.safeParse(url);
+        expect(result.success).toBe(false);
+      });
+    });
+
+    it('should enforce maximum length', () => {
+      const longUrl = 'https://example.com/' + 'a'.repeat(2048);
+      const result = urlSchema.safeParse(longUrl);
+      expect(result.success).toBe(false);
+      if (!result.success) {
+        expect(result.error.issues[0].message).toBe('URL too long');
+      }
+    });
+
+    it('should only allow HTTP and HTTPS protocols', () => {
+      const protocols = [
+        'http://example.com',
+        'https://example.com',
+        'ftp://example.com',
+        'file://example.com',
+        'mailto:user@example.com',
+        'javascript:alert(1)',
+        'data:text/html,<script>alert(1)</script>'
+      ];
+
+      protocols.forEach(url => {
+        const result = urlSchema.safeParse(url);
+        if (url.startsWith('http://') || url.startsWith('https://')) {
+          expect(result.success).toBe(true);
+        } else {
+          expect(result.success).toBe(false);
+        }
+      });
+    });
+  });
+
+  describe('Integration tests', () => {
+    it('should work together in a user registration scenario', () => {
+      const userData = {
+        email: 'john.doe@example.com',
+        password: 'SecurePass123!',
+        username: 'john_doe',
+        name: 'John Doe',
+        phone: '+1-234-567-8900',
+        website: 'https://johndoe.com'
+      };
+
+      // Validate each field
+      const emailResult = emailSchema.safeParse(userData.email);
+      const passwordResult = passwordSchema.safeParse(userData.password);
+      const usernameResult = usernameSchema.safeParse(userData.username);
+      const nameResult = nameSchema.safeParse(userData.name);
+      const phoneResult = phoneSchema.safeParse(userData.phone);
+      const urlResult = urlSchema.safeParse(userData.website);
+
+      expect(emailResult.success).toBe(true);
+      expect(passwordResult.success).toBe(true);
+      expect(usernameResult.success).toBe(true);
+      expect(nameResult.success).toBe(true);
+      expect(phoneResult.success).toBe(true);
+      expect(urlResult.success).toBe(true);
+    });
+
+    it('should handle form validation with multiple schemas', () => {
+      const formSchema = z.object({
+        email: emailSchema,
+        password: passwordSchema,
+        username: usernameSchema,
+        name: nameSchema,
+        phone: phoneSchema.optional(),
+        website: urlSchema.optional()
+      });
+
+      const validFormData = {
+        email: 'user@example.com',
+        password: 'SecurePass123!',
+        username: 'user123',
+        name: 'John Doe',
+        phone: '+1-234-567-8900',
+        website: 'https://example.com'
+      };
+
+      const result = formSchema.safeParse(validFormData);
+      expect(result.success).toBe(true);
+    });
+
+    it('should handle validation errors in form data', () => {
+      const formSchema = z.object({
+        email: emailSchema,
+        password: passwordSchema,
+        username: usernameSchema,
+        name: nameSchema
+      });
+
+      const invalidFormData = {
+        email: 'invalid-email',
+        password: 'weak',
+        username: 'ab',
+        name: ''
+      };
+
+      const result = formSchema.safeParse(invalidFormData);
+      expect(result.success).toBe(false);
+      if (!result.success) {
+        expect(result.error.issues.length).toBeGreaterThan(0);
+      }
+    });
+  });
+}); 

package/src/validation/__tests__/common.unit.test.ts

@@ -0,0 +1,101 @@
+import { describe, it, expect } from 'vitest';
+import { 
+  emailSchema, 
+  nameSchema, 
+  phoneSchema, 
+  urlSchema, 
+  dateSchema 
+} from '../common';
+
+describe('Common Validation Schemas', () => {
+  describe('emailSchema', () => {
+    it('should validate correct email addresses', () => {
+      expect(emailSchema.safeParse('test@example.com').success).toBe(true);
+      expect(emailSchema.safeParse('user.name+tag@domain.co.uk').success).toBe(true);
+      expect(emailSchema.safeParse('123@domain.org').success).toBe(true);
+    });
+
+    it('should reject invalid email addresses', () => {
+      expect(emailSchema.safeParse('invalid-email').success).toBe(false);
+      expect(emailSchema.safeParse('@domain.com').success).toBe(false);
+      expect(emailSchema.safeParse('user@').success).toBe(false);
+      expect(emailSchema.safeParse('').success).toBe(false);
+    });
+
+    it('should reject emails that are too long', () => {
+      const longEmail = 'a'.repeat(255) + '@example.com';
+      expect(emailSchema.safeParse(longEmail).success).toBe(false);
+    });
+  });
+
+  describe('nameSchema', () => {
+    it('should validate correct names', () => {
+      expect(nameSchema.safeParse('John Doe').success).toBe(true);
+      expect(nameSchema.safeParse('Mary-Jane').success).toBe(true);
+      expect(nameSchema.safeParse("O'Connor").success).toBe(true);
+    });
+
+    it('should reject invalid names', () => {
+      expect(nameSchema.safeParse('').success).toBe(false);
+      expect(nameSchema.safeParse('John123').success).toBe(false);
+      expect(nameSchema.safeParse('John@Doe').success).toBe(false);
+    });
+
+    it('should reject names that are too long', () => {
+      const longName = 'A'.repeat(101);
+      expect(nameSchema.safeParse(longName).success).toBe(false);
+    });
+  });
+
+  describe('phoneSchema', () => {
+    it('should validate correct phone numbers', () => {
+      expect(phoneSchema.safeParse('+1-555-123-4567').success).toBe(true);
+      expect(phoneSchema.safeParse('555-123-4567').success).toBe(true);
+      expect(phoneSchema.safeParse('(555) 123-4567').success).toBe(true);
+    });
+
+    it('should reject invalid phone numbers', () => {
+      expect(phoneSchema.safeParse('123').success).toBe(false);
+      expect(phoneSchema.safeParse('not-a-number').success).toBe(false);
+      expect(phoneSchema.safeParse('').success).toBe(false);
+    });
+
+    it('should reject phone numbers that are too short or long', () => {
+      expect(phoneSchema.safeParse('123').success).toBe(false);
+      expect(phoneSchema.safeParse('1'.repeat(21)).success).toBe(false);
+    });
+  });
+
+  describe('urlSchema', () => {
+    it('should validate correct URLs', () => {
+      expect(urlSchema.safeParse('https://example.com').success).toBe(true);
+      expect(urlSchema.safeParse('http://sub.domain.co.uk/path').success).toBe(true);
+      expect(urlSchema.safeParse('https://example.com?param=value').success).toBe(true);
+    });
+
+    it('should reject invalid URLs', () => {
+      expect(urlSchema.safeParse('not-a-url').success).toBe(false);
+      expect(urlSchema.safeParse('').success).toBe(false);
+    });
+
+    it('should reject URLs that are too long', () => {
+      const longUrl = 'https://example.com/' + 'a'.repeat(2048);
+      expect(urlSchema.safeParse(longUrl).success).toBe(false);
+    });
+  });
+
+  describe('dateSchema', () => {
+    it('should validate correct dates', () => {
+      expect(dateSchema.safeParse('2023-12-25').success).toBe(true);
+      expect(dateSchema.safeParse('2023-01-01').success).toBe(true);
+    });
+
+    it('should reject invalid dates', () => {
+      expect(dateSchema.safeParse('invalid-date').success).toBe(false);
+      expect(dateSchema.safeParse('2023/12/25').success).toBe(false);
+      expect(dateSchema.safeParse('12/25/2023').success).toBe(false);
+      expect(dateSchema.safeParse('2023-13-45').success).toBe(false);
+      expect(dateSchema.safeParse('').success).toBe(false);
+    });
+  });
+});