@lenne.tech/nest-server 11.32.3 → 11.33.0

package/src/core/common/helpers/process-diagnostics.helper.spec.ts

@@ -1,310 +0,0 @@
-import { EventEmitter } from 'node:events';
-import { afterEach, describe, expect, it, vi } from 'vitest';
-
-import { handleFatalBootstrapError, installProcessDiagnostics } from './process-diagnostics.helper';
-
-// `vi.spyOn(fs, 'writeSync')` cannot work here — an ESM module namespace is not configurable, so
-// the property cannot be redefined. Mocking the module is the only way to observe the default
-// sink, and the helper imports nothing else from `node:fs`.
-const { writeSyncMock } = vi.hoisted(() => ({ writeSyncMock: vi.fn<(fd: number, data: string) => number>() }));
-vi.mock('node:fs', () => ({ writeSync: writeSyncMock }));
-
-/**
- * Regression guard for the "silent exit" class of failures: a Node API under a ts-node dev
- * runner can die printing nothing but `app crashed` — no stacktrace, which reads like a
- * product bug and costs long, misdirected debugging sessions. The diagnostics helper makes
- * the exit reason visible — a rejected fire-and-forget promise no longer takes the server
- * down, an uncaught exception is logged with a clear marker before it exits, and an EXTERNAL
- * termination signal (another tool's pkill, `lt dev down`, an OS OOM SIGTERM, Ctrl-C) is
- * logged as such instead of masquerading as an in-process crash.
- *
- * The installer is tested against an injected EventEmitter so the real process (and the
- * Vitest runner it lives in) is never signalled or exited.
- *
- * Repo-wiring assertions (src/main.ts, src/index.ts, nodemon.json) deliberately live in
- * `tests/unit/process-diagnostics-wiring.spec.ts`, NOT here: this file ships inside `src/core/`
- * and is copied verbatim into vendor-mode consumer projects, where those repo-root paths do not
- * exist. Keeping this spec free of `process.cwd()` is what makes it portable.
- */
-function setup(
-  preRegister?: Partial<Record<string, () => void>>,
-  options?: Parameters<typeof installProcessDiagnostics>[0],
-) {
-  const target = new EventEmitter();
-  target.setMaxListeners(50);
-  const errors: string[] = [];
-  const warnings: string[] = [];
-  const logger = {
-    error: (message: string) => errors.push(message),
-    warn: (message: string) => warnings.push(message),
-  };
-  const exit = vi.fn();
-  const reraise = vi.fn();
-  if (preRegister) {
-    for (const [event, fn] of Object.entries(preRegister)) {
-      target.on(event, fn);
-    }
-  }
-  installProcessDiagnostics({ exit, logger, reraise, target, ...options });
-  return { errors, exit, reraise, target, warnings };
-}
-
-afterEach(() => {
-  vi.restoreAllMocks();
-  vi.useRealTimers();
-});
-
-describe('installProcessDiagnostics', () => {
-  it('logs an unhandled rejection but keeps the process alive', () => {
-    const { exit, target, warnings } = setup();
-    target.emit('unhandledRejection', new Error('SMTP down'));
-    expect(warnings.some((line) => line.includes('[unhandledRejection]') && line.includes('SMTP down'))).toBe(true);
-    expect(exit).not.toHaveBeenCalled();
-  });
-
-  it('routes an unhandled rejection to the NON-blocking sink', () => {
-    // An unhandled rejection can fire once per request while the server keeps serving. A
-    // synchronous write would block the whole event loop until stderr drains, so this path must
-    // use `warn` (async) and never `error` (sync). Nothing is terminating, so there is no
-    // last-gasp guarantee worth blocking for.
-    const { errors, target, warnings } = setup();
-    target.emit('unhandledRejection', new Error('per-request failure'));
-    expect(warnings).toHaveLength(1);
-    expect(errors).toHaveLength(0);
-  });
-
-  it('formats a non-Error rejection reason via String()', () => {
-    const { target, warnings } = setup();
-    target.emit('unhandledRejection', 'plain string reason');
-    expect(warnings.some((line) => line.includes('[unhandledRejection]') && line.includes('plain string reason'))).toBe(
-      true,
-    );
-  });
-
-  it('exits on an unhandled rejection when onUnhandledRejection is "exit"', () => {
-    // Restores Node >= 15's own `--unhandled-rejections=throw` default for deployments that
-    // prefer a clean restart over serving from an unknown state.
-    const { errors, exit, target } = setup(undefined, { onUnhandledRejection: 'exit' });
-    target.emit('unhandledRejection', new Error('inconsistent state'));
-    expect(errors.some((line) => line.includes('[unhandledRejection]'))).toBe(true);
-    expect(exit).toHaveBeenCalledWith(1);
-  });
-
-  it('logs an uncaught exception with a marker and exits with code 1', () => {
-    const { errors, exit, target } = setup();
-    target.emit('uncaughtException', new Error('boom'));
-    expect(errors.some((line) => line.includes('[uncaughtException]') && line.includes('boom'))).toBe(true);
-    expect(exit).toHaveBeenCalledWith(1);
-  });
-
-  it('does NOT print the error message twice', () => {
-    // `error.stack` already begins with `${name}: ${message}`. Prefixing the message again put the
-    // same line in the output twice, which reads like two distinct failures.
-    const { errors, target } = setup();
-    const error = new Error('duplicated');
-    target.emit('uncaughtException', error);
-    const occurrences = errors[0].split('duplicated').length - 1;
-    expect(occurrences).toBe(1);
-  });
-
-  it('falls back to name + message when an Error carries no stack', () => {
-    const { errors, target } = setup();
-    const error = new Error('no stack here');
-    error.stack = undefined;
-    target.emit('uncaughtException', error);
-    expect(errors[0]).toContain('Error: no stack here');
-  });
-
-  it('does NOT register a process warning handler', () => {
-    // Node prints process warnings to stderr itself and adding a listener does not replace that —
-    // it appends a second, strictly worse copy (Node's own line carries the warning `name` and the
-    // `--trace-warnings` hint). Duplicating it doubles the volume on a path that fires during
-    // normal operation.
-    const { target } = setup();
-    expect(target.listenerCount('warning')).toBe(0);
-  });
-
-  it('logs a non-zero exit code', () => {
-    const { errors, target } = setup();
-    target.emit('exit', 143);
-    expect(errors.some((line) => line.includes('[exit]') && line.includes('143'))).toBe(true);
-  });
-
-  it('stays silent on a clean exit', () => {
-    // A clean exit is not a diagnostic. Logging it under every CLI script and every graceful
-    // shutdown trains readers to ignore the marker.
-    const { errors, target } = setup();
-    target.emit('exit', 0);
-    expect(errors).toHaveLength(0);
-  });
-
-  it('logs SIGTERM as external termination and re-raises it when it is the only listener', () => {
-    const { errors, exit, reraise, target } = setup();
-    target.emit('SIGTERM', 'SIGTERM');
-    expect(errors.some((line) => line.includes('[signal]') && line.includes('SIGTERM'))).toBe(true);
-    expect(reraise).toHaveBeenCalledWith('SIGTERM');
-    expect(exit).not.toHaveBeenCalled();
-    // The handler MUST remove itself before re-raising — otherwise the re-raised signal
-    // re-enters the same handler forever (infinite log-and-re-raise loop, never terminates).
-    expect(target.listenerCount('SIGTERM')).toBe(0);
-  });
-
-  it('logs SIGINT and re-raises it when it is the only listener', () => {
-    const { errors, reraise, target } = setup();
-    target.emit('SIGINT', 'SIGINT');
-    expect(errors.some((line) => line.includes('[signal]') && line.includes('SIGINT'))).toBe(true);
-    expect(reraise).toHaveBeenCalledWith('SIGINT');
-    expect(target.listenerCount('SIGINT')).toBe(0);
-  });
-
-  it.each(['SIGHUP', 'SIGQUIT'] as const)('labels %s as an external termination too', (signal) => {
-    // A closed terminal (SIGHUP) or a SIGQUIT from an orchestrator used to terminate unannotated,
-    // producing exactly the stackless death this helper exists to explain.
-    const { errors, reraise, target } = setup();
-    target.emit(signal, signal);
-    expect(errors.some((line) => line.includes('[signal]') && line.includes(signal))).toBe(true);
-    expect(reraise).toHaveBeenCalledWith(signal);
-  });
-
-  it('does NOT touch SIGUSR2', () => {
-    // nodemon restarts the app with SIGUSR2. Attaching a listener overrides its disposition, and
-    // labelling a restart is not worth changing how restarts behave.
-    const { target } = setup();
-    expect(target.listenerCount('SIGUSR2')).toBe(0);
-  });
-
-  it('does NOT re-raise a signal when a graceful-shutdown handler is also registered', () => {
-    // `app.enableShutdownHooks()` registers its own SIGTERM/SIGINT listener. Re-raising on top of
-    // it would kill the process mid-shutdown and defeat the graceful teardown.
-    const other = vi.fn();
-    const { errors, reraise, target } = setup({ SIGTERM: other }, { shutdownTimeoutMs: 0 });
-    target.emit('SIGTERM', 'SIGTERM');
-    expect(errors.some((line) => line.includes('[signal]'))).toBe(true);
-    expect(errors.some((line) => line.includes('another handler owns the shutdown'))).toBe(true);
-    expect(reraise).not.toHaveBeenCalled();
-  });
-
-  it('forces an exit when the co-listener never finishes the shutdown', () => {
-    // Abdicating unconditionally means a co-listener that never terminates makes SIGTERM a
-    // permanent no-op while the log line claims the process is going down — only SIGKILL would
-    // still work. The watchdog bounds that.
-    vi.useFakeTimers();
-    const { errors, exit, target } = setup({ SIGTERM: vi.fn() }, { shutdownTimeoutMs: 30_000 });
-    target.emit('SIGTERM', 'SIGTERM');
-    expect(exit).not.toHaveBeenCalled();
-    vi.advanceTimersByTime(30_000);
-    expect(errors.some((line) => line.includes('shutdown watchdog expired'))).toBe(true);
-    expect(exit).toHaveBeenCalledWith(1);
-  });
-
-  it('does not arm the watchdog when shutdownTimeoutMs is 0', () => {
-    vi.useFakeTimers();
-    const { exit, target } = setup({ SIGTERM: vi.fn() }, { shutdownTimeoutMs: 0 });
-    target.emit('SIGTERM', 'SIGTERM');
-    vi.advanceTimersByTime(120_000);
-    expect(exit).not.toHaveBeenCalled();
-  });
-
-  it('is idempotent — installing twice does not stack duplicate handlers', () => {
-    const target = new EventEmitter();
-    const logger = { error: () => undefined };
-    const exit = vi.fn();
-    const reraise = vi.fn();
-    installProcessDiagnostics({ exit, logger, reraise, target });
-    installProcessDiagnostics({ exit, logger, reraise, target });
-    expect(target.listenerCount('uncaughtException')).toBe(1);
-    expect(target.listenerCount('unhandledRejection')).toBe(1);
-    expect(target.listenerCount('SIGTERM')).toBe(1);
-    expect(target.listenerCount('SIGINT')).toBe(1);
-  });
-
-  it('falls back to the error sink when a custom logger provides no warn', () => {
-    const target = new EventEmitter();
-    const errors: string[] = [];
-    installProcessDiagnostics({
-      exit: vi.fn(),
-      logger: { error: (message: string) => errors.push(message) },
-      reraise: vi.fn(),
-      target,
-    });
-    target.emit('unhandledRejection', new Error('no warn sink'));
-    expect(errors.some((line) => line.includes('[unhandledRejection]'))).toBe(true);
-  });
-});
-
-describe('redaction and truncation', () => {
-  it('masks a JWT and truncates an oversized line', () => {
-    const target = new EventEmitter();
-    const warnings: string[] = [];
-    installProcessDiagnostics({
-      exit: vi.fn(),
-      logger: { error: () => undefined, warn: (message: string) => warnings.push(message) },
-      reraise: vi.fn(),
-      target,
-    });
-    const jwt = `eyJhbGciOiJIUzI1NiJ9.${'a'.repeat(40)}.${'b'.repeat(20)}`;
-    const error = new Error(`token=${jwt} ${'x'.repeat(30_000)}`);
-    error.stack = `Error: token=${jwt} ${'x'.repeat(30_000)}`;
-    target.emit('unhandledRejection', error);
-
-    expect(warnings).toHaveLength(1);
-    expect(warnings[0]).not.toContain(jwt);
-    expect(warnings[0]).toContain('[truncated]');
-    expect(warnings[0].length).toBeLessThan(20_000);
-  });
-});
-
-describe('defaultDiagnosticsLogger', () => {
-  it('writes synchronously to fd 2 so a last-gasp line cannot be truncated', () => {
-    // console.error is asynchronous on a pipe, so a line written immediately before process.exit()
-    // can be dropped — silently losing the very line this helper exists to emit.
-    writeSyncMock.mockReset();
-    writeSyncMock.mockReturnValue(0);
-    const target = new EventEmitter();
-    installProcessDiagnostics({ exit: vi.fn(), reraise: vi.fn(), target });
-    target.emit('uncaughtException', new Error('sync sink'));
-
-    expect(writeSyncMock).toHaveBeenCalled();
-    const [fd, payload] = writeSyncMock.mock.calls[0];
-    expect(fd).toBe(2);
-    expect(String(payload)).toContain('[uncaughtException]');
-  });
-
-  it('survives a broken stderr instead of escalating', () => {
-    // EBADF (fd 2 closed), EPIPE (reader exited) and EAGAIN (non-blocking pipe) all make writeSync
-    // throw. A throw raised INSIDE the uncaughtException handler makes Node exit 7 and print its
-    // own "throw inside handler" message — losing the original error entirely.
-    writeSyncMock.mockReset();
-    writeSyncMock.mockImplementation(() => {
-      throw Object.assign(new Error('EBADF: bad file descriptor'), { code: 'EBADF' });
-    });
-    const exit = vi.fn();
-    const target = new EventEmitter();
-    installProcessDiagnostics({ exit, reraise: vi.fn(), target });
-
-    expect(() => target.emit('uncaughtException', new Error('original failure'))).not.toThrow();
-    expect(exit).toHaveBeenCalledWith(1);
-  });
-});
-
-describe('handleFatalBootstrapError', () => {
-  it('logs a failed bootstrap with a marker and exits with code 1', () => {
-    const errors: string[] = [];
-    const logger = { error: (message: string) => errors.push(message) };
-    const exit = vi.fn();
-    handleFatalBootstrapError(new Error('listen EADDRINUSE: address already in use'), { exit, logger });
-    expect(errors.some((line) => line.includes('[bootstrap]') && line.includes('EADDRINUSE'))).toBe(true);
-    expect(exit).toHaveBeenCalledWith(1);
-  });
-
-  it('redacts secrets out of a startup error before logging it', () => {
-    // The documented motivating failures ("DB unreachable") carry connection strings.
-    const errors: string[] = [];
-    const exit = vi.fn();
-    handleFatalBootstrapError(new Error('connect failed: password=hunter2'), {
-      exit,
-      logger: { error: (message: string) => errors.push(message) },
-    });
-    expect(errors[0]).not.toContain('hunter2');
-  });
-});

package/src/core/common/services/brevo.service.spec.ts

@@ -1,266 +0,0 @@
-import { Logger } from '@nestjs/common';
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-
-import type { Brevo, BrevoClient as RealBrevoClient } from '@getbrevo/brevo';
-
-import { BrevoService } from './brevo.service';
-import type { ConfigService } from './config.service';
-
-/**
- * Type-level contract against the REAL SDK.
- *
- * Everything below runs against a hand-written mock, so the mock alone could keep passing after a
- * breaking SDK upgrade. `sendMail()` is declared `Promise<unknown>`, which gives tsc nothing to
- * check either. These assertions close that gap: they compile against the installed
- * `@getbrevo/brevo`, and `pnpm run typecheck:tests` covers `src/**\/*.spec.ts`, so a v7 that
- * re-introduces a `.body` envelope or renames the request type fails the build here rather than
- * silently at runtime.
- */
-type SendFn = RealBrevoClient['transactionalEmails']['sendTransacEmail'];
-/** Awaiting the call must yield the payload itself — v3's `{ response, body }` envelope is gone. */
-type AssertNoEnvelope = Awaited<ReturnType<SendFn>> extends { body: unknown } ? never : true;
-/** The request type the service builds must still be assignable to the SDK's parameter. */
-type AssertRequestType = Brevo.SendTransacEmailRequest extends NonNullable<Parameters<SendFn>[0]> ? true : never;
-// Consumed by an assertion below so the contract cannot be dead-code-eliminated or linted away.
-const sdkContract: [AssertNoEnvelope, AssertRequestType] = [true, true];
-
-/**
- * Shared handles into the mocked SDK. `vi.hoisted` runs before the `vi.mock` factory below, so the
- * spies exist by the time the module graph is wired up.
- */
-const brevoMock = vi.hoisted(() => ({
-  /** Every options object the client was constructed with, in call order. */
-  clientOptions: [] as unknown[],
-  sendTransacEmail: vi.fn(),
-}));
-
-vi.mock('@getbrevo/brevo', () => ({
-  BrevoClient: class {
-    transactionalEmails = { sendTransacEmail: brevoMock.sendTransacEmail };
-
-    constructor(options: unknown) {
-      brevoMock.clientOptions.push(options);
-    }
-  },
-}));
-
-const API_KEY = 'test-api-key';
-const SENDER = { email: 'noreply@test.com', name: 'Test Sender' };
-
-/** Matches the per-send `Idempotency-Key` header without pinning the random UUID. */
-const anyIdempotencyHeaders = { 'Idempotency-Key': expect.any(String) as unknown as string };
-
-/**
- * Minimal ConfigService double.
- *
- * `exclude` can be set independently on the mutable (`config`) and the frozen
- * (`configFastButReadOnly`) side so the tests can prove which one the service reads.
- */
-function makeConfigService(
-  options: {
-    exclude?: RegExp;
-    frozenExclude?: RegExp;
-    maxRetries?: number;
-    throwOnError?: boolean;
-    timeoutInSeconds?: number;
-    withBrevo?: boolean;
-  } = {},
-): ConfigService {
-  const { exclude, frozenExclude = exclude, maxRetries, throwOnError, timeoutInSeconds, withBrevo = true } = options;
-  const base = { apiKey: API_KEY, maxRetries, sender: SENDER, throwOnError, timeoutInSeconds };
-  return {
-    config: withBrevo ? { brevo: { ...base, exclude } } : {},
-    configFastButReadOnly: withBrevo ? { brevo: { ...base, exclude: frozenExclude } } : {},
-  } as unknown as ConfigService;
-}
-
-describe('@getbrevo/brevo SDK contract', () => {
-  it('still resolves the payload directly and accepts the request type we build', () => {
-    // The assertion is the COMPILATION of `sdkContract` above, which `pnpm run typecheck:tests`
-    // performs against the really installed SDK. This test body exists so the contract is also
-    // referenced at runtime — otherwise it reads as dead code and invites deletion.
-    expect(sdkContract).toEqual([true, true]);
-  });
-});
-
-describe('BrevoService', () => {
-  let loggerError: ReturnType<typeof vi.spyOn>;
-
-  beforeEach(() => {
-    brevoMock.sendTransacEmail.mockReset();
-    brevoMock.clientOptions.length = 0;
-    loggerError = vi.spyOn(Logger.prototype, 'error').mockImplementation(() => undefined);
-  });
-
-  afterEach(() => {
-    // The spies above are never restored otherwise. File-level isolation contains it today, but a
-    // leaked Logger spy is the kind of thing that only surfaces as an unrelated flake later.
-    vi.restoreAllMocks();
-  });
-
-  describe('constructor', () => {
-    it('throws when the Brevo configuration is missing', () => {
-      expect(() => new BrevoService(makeConfigService({ withBrevo: false }))).toThrow('Brevo configuration not set!');
-    });
-
-    it('does NOT construct the SDK client eagerly', async () => {
-      // The SDK is ~580 CommonJS modules and BrevoService is re-exported from the package barrel,
-      // so a static import would put that cost on every consumer's cold start — including the
-      // majority that never configure Brevo.
-      const service = new BrevoService(makeConfigService());
-      expect(brevoMock.clientOptions).toEqual([]);
-
-      brevoMock.sendTransacEmail.mockResolvedValue({ messageId: '<x@brevo>' });
-      await service.sendMail('user@example.com', 42);
-      expect(brevoMock.clientOptions).toHaveLength(1);
-    });
-
-    it('creates the client with the configured API key and safe request limits', async () => {
-      brevoMock.sendTransacEmail.mockResolvedValue({ messageId: '<x@brevo>' });
-      const service = new BrevoService(makeConfigService());
-      await service.sendMail('user@example.com', 42);
-
-      // The SDK defaults to 2 retries honouring `Retry-After` with a 60 s cap PER attempt and to
-      // no timeout at all. Both send methods are awaited inside request handlers, so those
-      // defaults would let a rate-limited Brevo park a user-facing request for ~2 minutes.
-      expect(brevoMock.clientOptions).toEqual([{ apiKey: API_KEY, maxRetries: 0, timeoutInSeconds: 10 }]);
-    });
-
-    it('honours configured retry and timeout overrides', async () => {
-      brevoMock.sendTransacEmail.mockResolvedValue({ messageId: '<x@brevo>' });
-      const service = new BrevoService(makeConfigService({ maxRetries: 3, timeoutInSeconds: 30 }));
-      await service.sendMail('user@example.com', 42);
-      expect(brevoMock.clientOptions).toEqual([{ apiKey: API_KEY, maxRetries: 3, timeoutInSeconds: 30 }]);
-    });
-
-    it('reuses the client across sends', async () => {
-      brevoMock.sendTransacEmail.mockResolvedValue({ messageId: '<x@brevo>' });
-      const service = new BrevoService(makeConfigService());
-      await service.sendMail('user@example.com', 42);
-      await service.sendMail('other@example.com', 42);
-      expect(brevoMock.clientOptions).toHaveLength(1);
-    });
-  });
-
-  describe('sendMail', () => {
-    it('rejects incomplete input without calling the API', async () => {
-      const service = new BrevoService(makeConfigService());
-      await expect(service.sendMail('', 42)).resolves.toBe(false);
-      await expect(service.sendMail('user@example.com', 0)).resolves.toBe(false);
-      expect(brevoMock.sendTransacEmail).not.toHaveBeenCalled();
-    });
-
-    it('sends template, recipient and params, and returns the response unwrapped', async () => {
-      const response = { messageId: '<mail-1@brevo>' };
-      brevoMock.sendTransacEmail.mockResolvedValue(response);
-      const service = new BrevoService(makeConfigService());
-
-      // Identity check: v6 resolves the payload directly, there is no `.body` envelope any more
-      await expect(service.sendMail('user@example.com', 42, { name: 'Test' })).resolves.toBe(response);
-      expect(brevoMock.sendTransacEmail).toHaveBeenCalledWith({
-        headers: anyIdempotencyHeaders,
-        params: { name: 'Test' },
-        templateId: 42,
-        to: [{ email: 'user@example.com' }],
-      });
-    });
-
-    it('sends a unique Idempotency-Key per call', async () => {
-      // The SDK retries POSTs on 408/429/5xx. Without a key, a retry issued after a delivered
-      // response whose reply was lost sends the mail twice.
-      brevoMock.sendTransacEmail.mockResolvedValue({ messageId: '<x@brevo>' });
-      const service = new BrevoService(makeConfigService());
-      await service.sendMail('user@example.com', 42);
-      await service.sendMail('user@example.com', 42);
-
-      const keys = brevoMock.sendTransacEmail.mock.calls.map(
-        ([request]) => (request as Brevo.SendTransacEmailRequest).headers?.['Idempotency-Key'],
-      );
-      expect(keys[0]).toBeTypeOf('string');
-      expect(keys[0]).not.toBe(keys[1]);
-    });
-
-    it('skips excluded (test) recipients', async () => {
-      const service = new BrevoService(makeConfigService({ exclude: /@test\.com$/i }));
-      await expect(service.sendMail('user@test.com', 42)).resolves.toBe('TEST_USER!');
-      expect(brevoMock.sendTransacEmail).not.toHaveBeenCalled();
-    });
-
-    it('reads the exclude pattern from the mutable config, not the frozen one', async () => {
-      // A frozen RegExp carrying the `g` flag throws on `.test()` (it assigns `lastIndex`).
-      // Reading `exclude` off `configFastButReadOnly` would therefore fail instead of excluding.
-      const service = new BrevoService(
-        makeConfigService({ exclude: /@test\.com$/i, frozenExclude: Object.freeze(/@test\.com$/gi) }),
-      );
-      await expect(service.sendMail('user@test.com', 42)).resolves.toBe('TEST_USER!');
-    });
-
-    it('returns null when the API call fails', async () => {
-      brevoMock.sendTransacEmail.mockRejectedValue(new Error('Brevo down'));
-      const service = new BrevoService(makeConfigService());
-      await expect(service.sendMail('user@example.com', 42)).resolves.toBeNull();
-    });
-
-    it('logs the failure through the Nest logger', async () => {
-      // The whole point of the sibling diagnostics work is that silent failures cost debugging
-      // sessions. Asserting only the `null` return would let the observability half regress.
-      brevoMock.sendTransacEmail.mockRejectedValue(new Error('Brevo down'));
-      const service = new BrevoService(makeConfigService());
-      await service.sendMail('user@example.com', 42);
-      expect(loggerError).toHaveBeenCalledWith(expect.stringContaining('Brevo down'));
-    });
-
-    it('rethrows when throwOnError is enabled', async () => {
-      const service = new BrevoService(makeConfigService({ throwOnError: true }));
-      brevoMock.sendTransacEmail.mockRejectedValue(new Error('Brevo down'));
-      await expect(service.sendMail('user@example.com', 42)).rejects.toThrow('Brevo down');
-    });
-  });
-
-  describe('sendHtmlMail', () => {
-    it('rejects incomplete input without calling the API', async () => {
-      const service = new BrevoService(makeConfigService());
-      await expect(service.sendHtmlMail('', 'Subject', '<p>Hi</p>')).resolves.toBe(false);
-      await expect(service.sendHtmlMail('user@example.com', '', '<p>Hi</p>')).resolves.toBe(false);
-      await expect(service.sendHtmlMail('user@example.com', 'Subject', '')).resolves.toBe(false);
-      expect(brevoMock.sendTransacEmail).not.toHaveBeenCalled();
-    });
-
-    it('sends html, subject and the configured sender, and returns the response unwrapped', async () => {
-      const response = { messageId: '<mail-2@brevo>' };
-      brevoMock.sendTransacEmail.mockResolvedValue(response);
-      const service = new BrevoService(makeConfigService());
-
-      await expect(
-        service.sendHtmlMail('user@example.com', 'Subject', '<p>Hi</p>', { params: { code: '123' } }),
-      ).resolves.toBe(response);
-      expect(brevoMock.sendTransacEmail).toHaveBeenCalledWith({
-        headers: anyIdempotencyHeaders,
-        htmlContent: '<p>Hi</p>',
-        params: { code: '123' },
-        sender: SENDER,
-        subject: 'Subject',
-        to: [{ email: 'user@example.com' }],
-      });
-    });
-
-    it('skips excluded (test) recipients', async () => {
-      const service = new BrevoService(makeConfigService({ exclude: /@test\.com$/i }));
-      await expect(service.sendHtmlMail('user@test.com', 'Subject', '<p>Hi</p>')).resolves.toBe('TEST_USER!');
-      expect(brevoMock.sendTransacEmail).not.toHaveBeenCalled();
-    });
-
-    it('returns null when the API call fails', async () => {
-      brevoMock.sendTransacEmail.mockRejectedValue(new Error('Brevo down'));
-      const service = new BrevoService(makeConfigService());
-      await expect(service.sendHtmlMail('user@example.com', 'Subject', '<p>Hi</p>')).resolves.toBeNull();
-    });
-
-    it('logs the failure through the Nest logger', async () => {
-      brevoMock.sendTransacEmail.mockRejectedValue(new Error('Brevo down'));
-      const service = new BrevoService(makeConfigService());
-      await service.sendHtmlMail('user@example.com', 'Subject', '<p>Hi</p>');
-      expect(loggerError).toHaveBeenCalledWith(expect.stringContaining('Brevo down'));
-    });
-  });
-});