@jskit-ai/connectors-catalog 0.1.1

package/test/prestashop.test.js

@@ -0,0 +1,207 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { mkdtemp, readdir, readFile, rm } from "node:fs/promises";
+import path from "node:path";
+import { tmpdir } from "node:os";
+import { createConnectionService } from "../../connectors-core/src/server/index.js";
+import { createFileConnectionStore, createCredentialProtection } from "../../connectors-core/src/server/fileStorage.js";
+import { parseIntegrationConfiguration } from "../../connectors-core/src/shared/configuration.js";
+import { prestashopProvider } from "../src/server/prestashop.js";
+
+const context = { applicationId: "store-app", subjectId: "merchant" };
+const input = { context, integrationId: "store" };
+const products = { products: [{ id: "42", reference: "SHIRT", price: "20.000000", active: "1",
+  name: [{ id: 1, value: "Shirt" }, { id: 2, value: "Chemise" }],
+  associations: { images: [{ id: "7" }] } }] };
+
+async function fixture(t) {
+  const directory = await mkdtemp(path.join(tmpdir(), "prestashop-connector-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const protection = createCredentialProtection({ keys: { current: new Uint8Array(32).fill(5) }, activeKeyId: "current" });
+  const requests = [];
+  const state = { secret: "fixture-prestashop-webservice-key", response: products, status: 200, fail: false };
+  const options = {
+    configuration: { schemaVersion: 1, registrations: {}, integrations: { store: {
+      provider: "prestashop", displayName: "My store", accountMode: "shared", scopes: [],
+      authentication: { method: "api-key", secretRef: "env:PRESTASHOP_WEBSERVICE_KEY" },
+      settings: { siteUrl: "https://merchant.example:8443/store/" }
+    } }, extensions: { fromCli: true } },
+    providers: [prestashopProvider], authorize: async (owner) => owner,
+    resolveReference: async (reference) => { assert.equal(reference, "env:PRESTASHOP_WEBSERVICE_KEY"); return state.secret; },
+    store: createFileConnectionStore({ directory, protection }),
+    fetchImpl: async (address, init) => {
+      requests.push({ url: new URL(String(address)), init, headers: new Headers(init.headers) });
+      if (state.fail) throw new Error(state.secret);
+      return Response.json(state.response, { status: state.status, headers: { Link: '<https://unrelated.example/next>; rel="next"' } });
+    }
+  };
+  return { service: createConnectionService(options), options, directory, protection, requests, state };
+}
+
+test("PrestaShop verifies product reads with header-only Basic authentication, then survives file restart and key rotation", async (t) => {
+  const { service, options, directory, protection, requests, state } = await fixture(t);
+  const connected = await service.connectApiKey(input);
+  assert.equal(connected.status, "connected");
+  assert.equal(requests[0].url.origin, "https://merchant.example:8443");
+  assert.equal(requests[0].url.pathname, "/store/api/products");
+  assert.deepEqual(Object.fromEntries(requests[0].url.searchParams), {
+    output_format: "JSON", display: "full", sort: "[id_ASC]", limit: "0,20"
+  });
+  assert.equal(requests[0].headers.get("authorization"), `Basic ${Buffer.from(`${state.secret}:`).toString("base64")}`);
+  assert.equal(requests[0].init.redirect, "error");
+  assert.equal(requests[0].init.credentials, "omit");
+  assert.equal(requests[0].headers.has("cookie"), false);
+  assert.equal(requests[0].url.href.includes(state.secret), false);
+  assert.equal(JSON.stringify(connected).includes(state.secret), false);
+  for (const name of await readdir(directory)) {
+    const text = await readFile(path.join(directory, name), "utf8");
+    assert.equal(text.includes(state.secret), false);
+    assert.equal(text.includes(requests[0].headers.get("authorization")), false);
+  }
+  const restarted = createConnectionService({ ...options, store: createFileConnectionStore({ directory, protection }) });
+  assert.deepEqual(await restarted.status(input), connected);
+  state.secret = "rotated-prestashop-webservice-key";
+  assert.deepEqual(await restarted.invoke({ ...input, operation: "products.list" }), products);
+  assert.equal(requests.at(-1).headers.get("authorization"), `Basic ${Buffer.from(`${state.secret}:`).toString("base64")}`);
+  assert.equal(requests.length, 2, "Response links and associated resources are data, not follow-up requests.");
+  await restarted.disconnect(input);
+  assert.equal((await service.status(input)).status, "disconnected");
+});
+
+test("PrestaShop preserves multilingual product and decimal order values with bounded explicit pagination", async (t) => {
+  const { service, requests, state } = await fixture(t);
+  await service.connectApiKey(input);
+  assert.deepEqual(await service.invoke({ ...input, operation: "products.list", input: { offset: 100, limit: 100, language: 2 } }), products);
+  assert.deepEqual(Object.fromEntries(requests.at(-1).url.searchParams), {
+    output_format: "JSON", display: "full", sort: "[id_ASC]", limit: "100,100", language: "2"
+  });
+  state.response = { orders: [{ id: 12, reference: "EXAMPLE", current_state: "2", total_paid: "20.000000", id_currency: "1" }] };
+  assert.deepEqual(await service.invoke({ ...input, operation: "orders.list", input: { offset: 20, limit: 10 } }), state.response);
+  assert.equal(requests.at(-1).url.pathname, "/store/api/orders");
+  assert.equal(requests.at(-1).url.searchParams.get("limit"), "20,10");
+  assert.equal(requests.at(-1).url.searchParams.has("language"), false);
+  assert.equal(requests.length, 3);
+  assert.ok(requests.every(({ init }) => init.method === "GET" && init.body === undefined));
+});
+
+test("PrestaShop accepts the provider's empty JSON lists and rejects error or malformed envelopes", async (t) => {
+  const { service, state } = await fixture(t);
+  state.response = [];
+  await service.connectApiKey(input);
+  for (const resource of ["products", "orders"]) {
+    for (const response of [[], { [resource]: [] }]) {
+      state.response = response;
+      assert.deepEqual(await service.invoke({ ...input, operation: `${resource}.list` }), response);
+    }
+    for (const response of [{}, [{}], { [resource]: [{}] }, { [resource]: [{ id: 0 }] }, { [resource]: [{ id: "1/evil" }] },
+      { [resource]: [], errors: [{ message: state.secret }] }, { errors: [{ code: 20, message: state.secret }] }]) {
+      state.response = response;
+      await assert.rejects(service.invoke({ ...input, operation: `${resource}.list` }), (error) => {
+        assert.equal(error.code, "connector_response_invalid");
+        assert.equal(error.stack.includes(state.secret), false);
+        return true;
+      });
+    }
+  }
+});
+
+test("PrestaShop rejects invalid settings, raw keys and pagination or destination overrides before HTTP", async (t) => {
+  const { service, options, requests } = await fixture(t);
+  const parse = (configuration) => parseIntegrationConfiguration(JSON.stringify(configuration), { providers: [prestashopProvider] });
+  assert.deepEqual(parse(options.configuration), options.configuration);
+  for (const siteUrl of [undefined, "", "http://merchant.example", "https:merchant.example", "https://key@merchant.example",
+    "https://merchant.example?key=secret", "https://merchant.example#fragment", "https://merchant.example/store/../", "https://merchant.example/%2e%2e/",
+    "https://merchant.example\\@evil.example", "https://merchant.example/with space", "https://merchant.example:99999"]) {
+    const configuration = structuredClone(options.configuration);
+    configuration.integrations.store.settings.siteUrl = siteUrl;
+    assert.throws(() => parse(configuration), (error) => Boolean(error.fieldErrors["integrations.store.settings.siteUrl"]));
+  }
+  for (const siteUrl of ["https://merchant.example", "https://merchant.example/store/blog/", "https://[::1]:8443/store"]) {
+    const configuration = structuredClone(options.configuration);
+    configuration.integrations.store.settings.siteUrl = siteUrl;
+    assert.equal(parse(configuration).integrations.store.settings.siteUrl, siteUrl);
+    assert.ok(prestashopProvider.operations["products.list"].request({}, { siteUrl }).url.startsWith(`${siteUrl.replace(/\/+$/u, "")}/api/products?`));
+  }
+  const configuration = structuredClone(options.configuration);
+  configuration.integrations.store.authentication.secretRef = "raw-secret";
+  assert.throws(() => parse(configuration), (error) => Boolean(error.fieldErrors["integrations.store.authentication.secretRef"]));
+  assert.equal(requests.length, 0);
+  await service.connectApiKey(input);
+  for (const operation of ["products.list", "orders.list"]) {
+    for (const value of [{ offset: -1 }, { offset: 1.5 }, { offset: 1000001 }, { limit: 0 }, { limit: 101 }, { limit: 1.5 },
+      { language: 0 }, { language: 1.5 }, { url: "https://evil.example" }, { siteUrl: "https://evil.example" },
+      { ws_key: "override" }, { output_format: "XML" }, { display: "full" }, { resource: "customers" }]) {
+      await assert.rejects(service.invoke({ ...input, operation, input: value }), { code: "connector_input_invalid" });
+    }
+  }
+  assert.equal(requests.length, 1);
+});
+
+test("PrestaShop isolates owners, rejects changed store bindings and enforces the configured origin", async (t) => {
+  const { service, options, requests } = await fixture(t);
+  await service.connectApiKey(input);
+  for (const owner of [{ ...context, applicationId: "other-app" }, { ...context, subjectId: "other-owner" }]) {
+    await assert.rejects(service.invoke({ ...input, context: owner, operation: "products.list" }), { code: "connector_reconnect_required" });
+  }
+  for (const settings of [{ siteUrl: "https://other.example" }, { siteUrl: "https://merchant.example:8443/other-store" }]) {
+    const configuration = structuredClone(options.configuration);
+    configuration.integrations.store.settings = settings;
+    const changed = createConnectionService({ ...options, configuration });
+    assert.equal((await changed.status(input)).status, "reconnect-required");
+    await assert.rejects(changed.invoke({ ...input, operation: "products.list" }), { code: "connector_reconnect_required" });
+  }
+  const wrongHost = createConnectionService({ ...options, providers: [{ ...prestashopProvider, operations: {
+    "products.list": { scopes: [], request: () => ({ method: "GET", url: "https://other.example/api/products" }) }
+  } }] });
+  await assert.rejects(wrongHost.invoke({ ...input, operation: "products.list" }), { code: "connector_destination_invalid" });
+  const denied = createConnectionService({ ...options, authorize: async () => { throw new Error("Access denied"); } });
+  await assert.rejects(denied.invoke({ ...input, operation: "orders.list" }), /Access denied/u);
+  assert.equal(requests.length, 1);
+});
+
+test("PrestaShop exposes permission and rate-limit failures without claiming order permission or retrying requests", async (t) => {
+  const { service, requests, state } = await fixture(t);
+  for (const [status, code] of [[401, "connector_reconnect_required"], [403, "connector_permission_denied"], [429, "connector_rate_limited"], [500, "connector_provider_failed"]]) {
+    state.status = status;
+    state.response = { errors: [{ message: state.secret }] };
+    const count = requests.length;
+    await assert.rejects(service.connectApiKey(input), (error) => {
+      assert.equal(error.code, code);
+      assert.equal(error.stack.includes(state.secret), false);
+      assert.equal(error.cause, undefined);
+      return true;
+    });
+    assert.equal((await service.status(input)).status, "disconnected");
+    assert.equal(requests.length, count + 1);
+  }
+  state.status = 200;
+  state.response = products;
+  await service.connectApiKey(input);
+  state.status = 403;
+  await assert.rejects(service.invoke({ ...input, operation: "orders.list" }), { code: "connector_permission_denied" });
+  assert.equal((await service.status(input)).status, "connected");
+  state.status = 401;
+  await assert.rejects(service.invoke({ ...input, operation: "products.list" }), { code: "connector_reconnect_required" });
+  assert.equal((await service.status(input)).status, "reconnect-required");
+});
+
+test("PrestaShop keeps transport failures and cancellation observable without a second request", async (t) => {
+  const { service, options, requests, state } = await fixture(t);
+  await service.connectApiKey(input);
+  state.fail = true;
+  await assert.rejects(service.invoke({ ...input, operation: "products.list" }), (error) => {
+    assert.equal(error.code, "connector_provider_failed");
+    assert.equal(error.stack.includes(state.secret), false);
+    return true;
+  });
+  assert.equal(requests.length, 2);
+  const controller = new AbortController();
+  let calls = 0;
+  const interrupted = createConnectionService({ ...options, fetchImpl: async () => {
+    calls++;
+    controller.abort();
+    throw new DOMException("Interrupted", "AbortError");
+  } });
+  await assert.rejects(interrupted.invoke({ ...input, operation: "products.list", signal: controller.signal }), { code: "connector_cancelled" });
+  assert.equal(calls, 1);
+});

package/test/resend.test.js

@@ -0,0 +1,163 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { createHash } from "node:crypto";
+import { createLocalAuthService, createLocalFileBackend } from "../../auth-provider-local-core/src/server/lib/index.js";
+import { mkdtemp, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { createConnectionService } from "../../connectors-core/src/server/index.js";
+import { createFileConnectionStore, createCredentialProtection } from "../../connectors-core/src/server/fileStorage.js";
+import { resendProvider } from "../src/server/resend.js";
+
+const context = { applicationId: "mail-app", subjectId: "business-mail" };
+const input = { from: "Support <support@example.com>", to: ["person@example.com"],
+  subject: "Reset your password", text: "Your application-owned recovery message.\n",
+  idempotencyKey: "recovery/fixture-event" };
+
+async function fixture(t) {
+  const directory = await mkdtemp(path.join(tmpdir(), "resend-send-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const requests = [];
+  const state = { fail: false };
+  const service = createConnectionService({
+    configuration: { schemaVersion: 1, registrations: {}, integrations: { mail: {
+      provider: "resend", accountMode: "shared", scopes: [],
+      authentication: { method: "api-key", secretRef: "env:RESEND_KEY" }
+    } } },
+    providers: [resendProvider], authorize: async (owner, request) => state.denied === request.operation ? null : owner,
+    resolveReference: async () => "private-fixture-key",
+    store: createFileConnectionStore({ directory, protection: createCredentialProtection({
+      keys: { current: new Uint8Array(32).fill(8) }, activeKeyId: "current"
+    }) }),
+    fetchImpl: async (url, init) => {
+      requests.push({ url: String(url), init });
+      if (new URL(url).pathname === "/domains") return Response.json({ object: "list", data: [], has_more: false });
+      if (state.fail) throw new Error("unknown delivery outcome");
+      return Response.json(state.response || { id: "fixture-message-id" }, { status: state.status || 200 });
+    }
+  });
+  await service.connectApiKey({ context, integrationId: "mail" });
+  return { service, requests, state, directory };
+}
+
+test("Resend connection checks do not send; explicit delivery keeps the application's idempotency key", async (t) => {
+  const { service, requests } = await fixture(t);
+  assert.equal(requests.length, 1);
+  assert.equal(new URL(requests[0].url).pathname, "/domains");
+  assert.equal(requests[0].init.method, "GET");
+  const result = await service.invoke({ context, integrationId: "mail", operation: "emails.send", input });
+  assert.deepEqual(result, { id: "fixture-message-id" });
+  const sent = requests[1];
+  assert.equal(sent.url, "https://api.resend.com/emails");
+  assert.equal(sent.init.method, "POST");
+  assert.equal(new Headers(sent.init.headers).get("idempotency-key"), input.idempotencyKey);
+  assert.equal(new Headers(sent.init.headers).get("authorization"), "Bearer private-fixture-key");
+  const { idempotencyKey, ...body } = input;
+  assert.deepEqual(JSON.parse(sent.init.body), body);
+  await assert.rejects(service.invoke({ context: { ...context, applicationId: "other-app" },
+    integrationId: "mail", operation: "emails.send", input }));
+  assert.equal(requests.length, 2);
+});
+
+test("Resend rejects incomplete sending inputs and does not retry an uncertain delivery", async (t) => {
+  const { service, requests, state } = await fixture(t);
+  for (const invalid of [{ ...input, idempotencyKey: "" }, { ...input, to: [] },
+    { ...input, to: Array(51).fill("person@example.com") }, { ...input, to: ["not-an-email"] },
+    { ...input, subject: "subject\r\ninjected" }, { ...input, text: "" }]) {
+    await assert.rejects(service.invoke({ context, integrationId: "mail", operation: "emails.send", input: invalid }));
+  }
+  assert.equal(requests.length, 1);
+  state.fail = true;
+  await assert.rejects(service.invoke({ context, integrationId: "mail", operation: "emails.send", input }));
+  assert.equal(requests.length, 2);
+});
+
+
+test("documented application wiring sends auth recovery through the Resend adapter", async (t) => {
+  const { service, requests, directory } = await fixture(t);
+  const guide = await readFile(new URL("../docs/resend.md", import.meta.url), "utf8");
+  const example = guide.match(/```js\n([\s\S]*?)\n```/u)?.[1];
+  assert.ok(example);
+  // Evaluate only the trusted repository example to keep application wiring verified.
+  const createRecoverySender = new Function("createHash", `${example.replace('import { createHash } from "node:crypto";', "")}\nreturn createRecoverySender;`)(createHash);
+  const sender = createRecoverySender({ connections: service, context, integrationId: "mail", from: input.from });
+  const auth = createLocalAuthService({
+    backend: createLocalFileBackend({ storeDir: path.join(directory, "auth") }),
+    config: { nodeEnv: "test", sessionSecret: "fixture-session-secret",
+      appPublicUrl: "https://app.example.com", recoveryDevOutput: "response" },
+    recoverySender: sender
+  });
+  await auth.register({ email: "person@example.com", password: "correct horse battery staple" });
+  const result = await auth.requestPasswordReset({ email: "person@example.com" });
+  assert.equal(result.recoveryUrl, undefined);
+  assert.equal(requests.length, 2);
+  const body = JSON.parse(requests[1].init.body);
+  assert.deepEqual(body.to, ["person@example.com"]);
+  const recoveryUrl = body.text.trim().split("\n").at(-1);
+  const token = new URL(recoveryUrl).searchParams.get("token");
+  const recovered = await auth.completePasswordRecovery({ code: token, type: "recovery" });
+  assert.equal(recovered.actor.email, "person@example.com");
+  await sender({ email: "person@example.com", recoveryUrl });
+  assert.equal(new Headers(requests[2].init.headers).get("idempotency-key"),
+    new Headers(requests[1].init.headers).get("idempotency-key"));
+  assert.equal(requests[2].init.body, requests[1].init.body);
+});
+
+
+test("Resend marketing journey preserves subscription, drafts and explicitly authorized sending", async t => {
+  const { service, requests, state } = await fixture(t);
+  const invoke = (operation, values = {}) => service.invoke({ context, integrationId: "mail", operation, input: values });
+  state.response = { id: "sender1", status: "verified", records: [{ type: "TXT", value: "fixture-dns" }] };
+  assert.deepEqual(await invoke("domains.get", { id: "sender1" }), state.response);
+  for (const resource of ["segments", "contacts", "broadcasts"]) {
+    state.response = { object: "list", data: [{ id: "item1" }], has_more: true };
+    assert.deepEqual(await invoke(`${resource}.list`, { limit: 2, after: "last+&2", ...(resource === "contacts" ? { segment_id: "segment1" } : {}) }), state.response);
+    const url = new URL(requests.at(-1).url); assert.equal(url.searchParams.get("after"), "last+&2");
+    if (resource === "contacts") assert.equal(url.searchParams.get("segment_id"), "segment1");
+  }
+  state.response = { object: "segment", id: "segment1", name: "Opted-in test recipients" };
+  await invoke("segments.create", { name: state.response.name });
+  assert.deepEqual(JSON.parse(requests.at(-1).init.body), { name: state.response.name });
+  state.response = { object: "contact", id: "contact1" };
+  const contact = { email: "person@example.com", first_name: "Pat", unsubscribed: false, segments: [{ id: "segment1" }] };
+  await invoke("contacts.create", contact);
+  assert.deepEqual(JSON.parse(requests.at(-1).init.body), contact);
+  state.response = { id: "contact1", ...contact };
+  assert.deepEqual(await invoke("contacts.get", { id: "contact1" }), state.response);
+  await invoke("contacts.update", { id: "contact1", unsubscribed: true });
+  assert.equal(requests.at(-1).init.method, "PATCH");
+  assert.deepEqual(JSON.parse(requests.at(-1).init.body), { unsubscribed: true });
+  for (const operation of ["contacts.addSegment", "contacts.removeSegment"]) {
+    state.response = { object: "contact_segment", contact_id: "contact1", segment_id: "segment1", ...(operation.endsWith("removeSegment") ? { deleted: true } : {}) };
+    assert.deepEqual(await invoke(operation, { id: "contact1", segmentId: "segment1" }), state.response);
+    assert.equal(new URL(requests.at(-1).url).pathname, "/contacts/contact1/segments/segment1");
+  }
+  const draft = { segment_id: "segment1", from: input.from, subject: "Newsletter",
+    html: '<p>Hello {{{contact.first_name|there}}}</p><a href="{{{RESEND_UNSUBSCRIBE_URL}}}">Unsubscribe</a>' };
+  state.response = { id: "broadcast1" };
+  await invoke("broadcasts.create", draft);
+  assert.deepEqual(JSON.parse(requests.at(-1).init.body), { ...draft, send: false });
+  assert.ok(!requests.some(request => new URL(request.url).pathname.endsWith("/send")));
+  state.response = { id: "broadcast1", ...draft, status: "draft" };
+  assert.deepEqual(await invoke("broadcasts.get", { id: "broadcast1" }), state.response);
+  await invoke("broadcasts.update", { id: "broadcast1", ...draft, subject: "Reviewed newsletter" });
+  assert.equal(requests.at(-1).init.method, "PATCH");
+  state.denied = "broadcasts.send"; const before = requests.length;
+  await assert.rejects(invoke("broadcasts.send", { id: "broadcast1" }), { code: "connector_access_denied" });
+  assert.equal(requests.length, before);
+  state.denied = null; state.response = { id: "broadcast1" };
+  await invoke("broadcasts.send", { id: "broadcast1" });
+  assert.equal(new URL(requests.at(-1).url).pathname, "/broadcasts/broadcast1/send");
+  assert.equal(requests.at(-1).init.method, "POST");
+  const count = requests.length;
+  for (const [operation, values] of [["contacts.create", { email: "person@example.com" }], ["contacts.get", { id: "../other" }], ["contacts.create", { ...contact, segments: Array(101).fill({ id: "segment1" }) }], ["broadcasts.create", { ...draft, send: true }], ["broadcasts.create", { ...draft, html: "No unsubscribe" }], ["broadcasts.create", { ...draft, subject: "Injected\r\nheader" }]])
+    await assert.rejects(invoke(operation, values), { code: "connector_input_invalid" });
+  assert.equal(requests.length, count);
+  for (const status of [403, 429, 500]) {
+    state.status = status; const before = requests.length;
+    await assert.rejects(invoke("broadcasts.send", { id: "broadcast1" }));
+    assert.equal(requests.length, before + 1);
+  }
+  state.status = 200; state.response = {};
+  await assert.rejects(invoke("broadcasts.get", { id: "broadcast1" }));
+});