@omega.js/backend 0.1.0

package/test/email/render-content.test.js

@@ -0,0 +1,248 @@
+/**
+ * renderContent trust-split test — outbound email HTML must never carry live markup
+ * that came from someone else.
+ *
+ * The email body has two render lanes (prepare.js):
+ *   - UNTRUSTED (default): AI-authored campaign bodies, user-submitted fields, anything
+ *     off a route. markdown-it runs with html:false, so smuggled tags render as text.
+ *   - TRUSTED (`trusted: true`): first-party callers that hand-build markup (the internal
+ *     dispute + newsletter-report alerts). They must escapeHtml() every third-party value.
+ *
+ * Plain-node unit test (no emulator, no network).
+ */
+const assert = require('node:assert');
+const { renderContent } = require('../../dist/manager/libraries/email/prepare.js');
+const { escapeHtml } = require('../../dist/manager/libraries/email/constants.js');
+const defineCases = require('../../dist/vendor/devkit/test/define-cases.js');
+
+// The integration checks below prove the trust decision actually reaches the rendered
+// SendGrid payload — a unit test on renderContent alone would still pass if build()
+// stopped threading the flag. Each build runs once and is shared by its assertions.
+function transactionalBuild(settings) {
+  process.env.UNSUBSCRIBE_HMAC_KEY = process.env.UNSUBSCRIBE_HMAC_KEY || 'test-key';
+
+  const Transactional = require('../../dist/manager/libraries/email/transactional/index.js');
+  const Manager = {
+    config: {
+      brand: { id: 'testbrand', name: 'Test Brand', url: 'https://test.dev', contact: { email: 'hello@test.dev' }, images: {} },
+      // The account's unsubscribe group ids (#649) — every send resolves one from config
+      marketing: { campaigns: { providers: { sendgrid: { groups: { orders: 900001, hello: 900002, account: 900003, marketing: 900004, security: 900005, newsletter: 900006, internal: 900007 } } } } },
+    },
+    project: { websiteUrl: 'https://test.dev' },
+    libraries: { admin: {} },
+    User: () => ({ properties: {} }),
+  };
+  const ctx = { Manager, log: () => {}, error: () => {} };
+
+  return new Transactional(ctx).build({
+    to: 'user@test.dev',
+    template: 'card',
+    ...settings,
+  }).then((email) => email.content[0].value);
+}
+
+let untrustedBuild;
+const buildUntrusted = () => (untrustedBuild = untrustedBuild || transactionalBuild({
+  subject: 'Untrusted',
+  data: { content: { title: 'Hi', message: 'Hello <script>alert(1)</script> world' } },
+}));
+
+let trustedBuild;
+const buildTrusted = () => (trustedBuild = trustedBuild || transactionalBuild({
+  subject: 'Trusted',
+  trustedContent: true,
+  data: { content: { title: 'Alert', message: '<strong>Details:</strong>\n<ul>\n<li>Amount: $5</li>\n</ul>' } },
+}));
+
+module.exports = defineCases({
+  description: 'Email renderContent trust split (untrusted escapes, trusted renders)',
+  type: 'group',
+  tests: [
+    // ---------- Untrusted lane: payloads come out inert ----------
+
+    {
+      name: 'untrusted <script> payload renders as inert text',
+
+      run() {
+        const out = renderContent({ content: 'Hello <script>alert("xss")</script> there' });
+
+        assert.ok(!/<script/i.test(out), `live <script> survived: ${out}`);
+        assert.ok(out.includes('&lt;script&gt;'), `payload was not escaped: ${out}`);
+      },
+    },
+
+    {
+      name: 'untrusted <img onerror> payload renders as inert text',
+
+      run() {
+        const out = renderContent({ content: '<img src=x onerror="alert(1)">' });
+
+        assert.ok(!/<img/i.test(out), `live <img> survived: ${out}`);
+        assert.ok(out.includes('&lt;img'), `payload was not escaped: ${out}`);
+      },
+    },
+
+    {
+      name: 'untrusted is the DEFAULT — no flag means escaped',
+
+      run() {
+        // The security property is the default, not an opt-in.
+        const out = renderContent({ content: '<iframe src="evil"></iframe>' });
+
+        assert.ok(!/<iframe/i.test(out), `live <iframe> survived: ${out}`);
+      },
+    },
+
+    {
+      name: 'untrusted anchor payload cannot inject an onclick handler',
+
+      run() {
+        const out = renderContent({ content: '<a href="#" onclick="steal()">click</a>' });
+
+        assert.ok(!/onclick/i.test(out) || out.includes('&lt;a'), `live handler survived: ${out}`);
+        assert.ok(out.includes('&lt;a'), `anchor was not escaped: ${out}`);
+      },
+    },
+
+    {
+      name: 'untrusted content still renders real markdown',
+
+      run() {
+        // Escaping raw HTML must not cost us markdown — bold/links/lists still work.
+        const out = renderContent({ content: '**bold** and [link](https://example.com)' });
+
+        assert.ok(out.includes('<strong>bold</strong>'), `markdown bold lost: ${out}`);
+        assert.ok(out.includes('<a href="https://example.com">link</a>'), `markdown link lost: ${out}`);
+      },
+    },
+
+    // ---------- Trusted lane: first-party markup still renders ----------
+
+    {
+      name: 'first-party template markup renders live with trusted: true',
+
+      run() {
+        const markup = '<strong>Alert Details:</strong>\n<ul>\n<li>Amount: $5</li>\n</ul>';
+        const out = renderContent({ content: markup, trusted: true });
+
+        assert.ok(out.includes('<strong>Alert Details:</strong>'), `markup was escaped: ${out}`);
+        assert.ok(out.includes('<ul>') && out.includes('<li>'), `list markup lost: ${out}`);
+      },
+    },
+
+    {
+      name: 'trusted markup with escaped third-party values stays inert (the alert-email model)',
+
+      run() {
+        // Exactly what the dispute alert does: first-party <li> markup, escaped webhook value.
+        const hostile = '<script>alert(1)</script>';
+        const out = renderContent({
+          content: `<ul>\n<li><strong>Customer Email:</strong> ${escapeHtml(hostile)}</li>\n</ul>`,
+          trusted: true,
+        });
+
+        assert.ok(out.includes('<li>'), `first-party markup lost: ${out}`);
+        assert.ok(!/<script/i.test(out), `escaped value still injected: ${out}`);
+        assert.ok(out.includes('&lt;script&gt;'), `value was not escaped: ${out}`);
+      },
+    },
+
+    // ---------- The pre-rendered html lane ----------
+
+    {
+      name: 'pre-rendered html passes through untouched and skips markdown',
+
+      run() {
+        const out = renderContent({ content: '**ignored**', html: '<p>first-party <b>html</b></p>' });
+
+        assert.equal(out, '<p>first-party <b>html</b></p>');
+      },
+    },
+
+    // ---------- UTM tagging survives the split ----------
+
+    {
+      name: 'UTM tagging still applies on the untrusted lane',
+
+      run() {
+        const out = renderContent(
+          { content: '[link](https://example.com/page)' },
+          { brandUrl: 'https://example.com', brandId: 'testbrand', campaign: 'welcome', type: 'transactional' },
+        );
+
+        assert.ok(out.includes('utm_source=testbrand'), `UTM not applied: ${out}`);
+        assert.ok(out.includes('utm_campaign=welcome'), `UTM campaign missing: ${out}`);
+      },
+    },
+
+    {
+      name: 'UTM tagging still applies on the trusted lane',
+
+      run() {
+        const out = renderContent(
+          { content: '<a href="https://example.com/page">link</a>', trusted: true },
+          { brandUrl: 'https://example.com', brandId: 'testbrand', campaign: 'alert', type: 'transactional' },
+        );
+
+        assert.ok(out.includes('utm_source=testbrand'), `UTM not applied: ${out}`);
+      },
+    },
+
+    // ---------- Empty / passthrough behavior unchanged ----------
+
+    {
+      name: 'empty content returns empty string',
+
+      run() {
+        assert.equal(renderContent({}), '');
+        assert.equal(renderContent({ content: '' }), '');
+      },
+    },
+
+    // ---------- escapeHtml itself ----------
+
+    {
+      name: 'escapeHtml neutralizes the injection characters',
+
+      run() {
+        assert.equal(escapeHtml('<b>&"'), '&lt;b&gt;&amp;&quot;');
+      },
+    },
+
+    {
+      name: 'escapeHtml renders 0 and false rather than dropping them',
+
+      run() {
+        // Amounts and flags land in alert emails — a falsy value must still print.
+        assert.equal(escapeHtml(0), '0');
+        assert.equal(escapeHtml(false), 'false');
+        assert.equal(escapeHtml(null), '');
+        assert.equal(escapeHtml(undefined), '');
+      },
+    },
+
+    // ---------- Integration: the flag survives the whole transactional build ----------
+
+    {
+      name: 'built email: untrusted payload is inert in the final HTML',
+
+      async run() {
+        const untrusted = await buildUntrusted();
+
+        assert.ok(!/<script/i.test(untrusted), 'live <script> reached the SendGrid payload');
+        assert.ok(untrusted.includes('&lt;script&gt;'), 'payload was not escaped in the final HTML');
+      },
+    },
+
+    {
+      name: 'built email: first-party alert markup still renders in the final HTML',
+
+      async run() {
+        const trusted = await buildTrusted();
+
+        assert.ok(trusted.includes('<strong>Details:</strong>'), 'first-party markup was escaped');
+        assert.ok(/<ul>/i.test(trusted), 'first-party list markup was lost');
+      },
+    },
+  ],
+});

package/test/email/sanitize-images.test.js

@@ -0,0 +1,66 @@
+/**
+ * sanitizeImagesForEmail test — brand.images stores SITE-RELATIVE paths (the
+ * website absolutizes per environment); email clients can only fetch public
+ * URLs, so the sanitizer must join relatives against brand.url AND keep the
+ * svg→png email-client conversion.
+ *
+ * Plain-node unit test (no emulator, no network).
+ */
+const assert = require('node:assert');
+const { sanitizeImagesForEmail } = require('../../dist/manager/libraries/email/constants.js');
+const defineCases = require('../../dist/vendor/devkit/test/define-cases.js');
+
+module.exports = defineCases({
+  description: 'Email image sanitization (brand.images → email-safe URLs)',
+  type: 'group',
+  tests: [
+    {
+      name: 'relative path joins brand.url (trailing slash collapsed)',
+
+      run() {
+        const out = sanitizeImagesForEmail(
+          { brandmark: '/assets/images/brand/brandmark.png' },
+          'https://playground.omegajs.dev/'
+        );
+        assert.equal(out.brandmark, 'https://playground.omegajs.dev/assets/images/brand/brandmark.png');
+      },
+    },
+
+    {
+      name: 'full URL passes through untouched',
+
+      run() {
+        const out = sanitizeImagesForEmail({ social: 'https://cdn.example.com/social.png' }, 'https://x.dev');
+        assert.equal(out.social, 'https://cdn.example.com/social.png');
+      },
+    },
+
+    {
+      name: 'svg → png conversion still applies, then absolutizes',
+
+      run() {
+        const out = sanitizeImagesForEmail({ brandmark: '/assets/brand/logo-x.svg' }, 'https://x.dev');
+        assert.equal(out.brandmark, 'https://x.dev/assets/brand/logo-1024.png');
+      },
+    },
+
+    {
+      name: 'relative path without brand.url stays relative (nothing to join)',
+
+      run() {
+        const out = sanitizeImagesForEmail({ brandmark: '/mark.png' }, undefined);
+        assert.equal(out.brandmark, '/mark.png');
+      },
+    },
+
+    {
+      name: 'non-string values survive untouched',
+
+      run() {
+        const out = sanitizeImagesForEmail({ brandmark: null, social: 42 }, 'https://x.dev');
+        assert.equal(out.brandmark, null);
+        assert.equal(out.social, 42);
+      },
+    },
+  ],
+});

package/test/email/send-log-privacy.test.js

@@ -0,0 +1,107 @@
+/**
+ * Email.send() log-privacy test — a log line names its recipient, never the document.
+ *
+ * A caller may hand `to` a whole user document (the order and welcome senders do),
+ * and that document carries api.privateKey, consent, IP and attribution. The
+ * `Email.send():` line used to JSON.stringify whatever it was handed straight into
+ * Cloud Logging, where it stays for the retention window
+ * ([#632](https://github.com/Omega-JS-Stack/omega/issues/632)).
+ *
+ * Plain-node unit test (no emulator, no network): the line is written before send()
+ * reaches SendGrid, so the send is allowed to reject at that seam and the assertions
+ * read the captured ctx output.
+ */
+const assert = require('node:assert');
+
+const Transactional = require('../../dist/manager/libraries/email/transactional/index.js');
+const defineCases = require('../../dist/vendor/devkit/test/define-cases.js');
+
+// The leak fixture: a user document shaped the way a sender hands it to Email.send().
+const LEAKED_KEY = 'sk_test_fake_leak';
+const USER_DOC = {
+  auth: { uid: 'user-632', email: 'recipient@test.dev' },
+  personal: { name: { first: 'Rec' } },
+  api: { clientId: 'client-632', privateKey: LEAKED_KEY },
+  consent: { marketing: { status: 'granted', ip: '203.0.113.7' } },
+  attribution: { source: 'newsletter' },
+};
+
+async function captureSend(to) {
+  process.env.UNSUBSCRIBE_HMAC_KEY = process.env.UNSUBSCRIBE_HMAC_KEY || 'test-key';
+
+  const Manager = {
+    config: {
+      brand: { id: 'testbrand', name: 'Test Brand', url: 'https://test.dev', contact: { email: 'hello@test.dev' }, images: {} },
+    },
+    project: { websiteUrl: 'https://test.dev' },
+    libraries: { admin: {} },
+    User: () => ({ properties: {} }),
+  };
+
+  const captured = [];
+  const record = (...args) => captured.push(args.map((a) => (typeof a === 'string' ? a : JSON.stringify(a))).join(' '));
+  const ctx = { Manager, log: record, warn: record, error: record };
+
+  // There is no SendGrid in a unit test — the send rejects at that seam, long after
+  // the line under test was written. The assertions are on the log, not the result.
+  await new Transactional(ctx).send({ to, subject: 'Your order', template: 'order' }).catch(() => {});
+
+  return captured;
+}
+
+let userDocSend;
+const sendWithUserDoc = () => (userDocSend = userDocSend || captureSend(USER_DOC));
+
+module.exports = defineCases({
+  description: 'Email.send() log privacy (recipient named by address/uid, never serialized)',
+  type: 'group',
+  tests: [
+    {
+      name: 'send() line names the recipient by address',
+
+      async run() {
+        const captured = await sendWithUserDoc();
+        const line = captured.find((l) => l.includes('Email.send():'));
+
+        assert.ok(line, `no Email.send() line was logged: ${JSON.stringify(captured)}`);
+        assert.ok(line.includes('recipient@test.dev'), `line does not name the recipient: ${line}`);
+        assert.ok(line.includes('subject=Your order'), `line lost the subject: ${line}`);
+        assert.ok(line.includes('template=order'), `line lost the template: ${line}`);
+      },
+    },
+
+    {
+      name: 'send() line never serializes the user document it was handed',
+
+      async run() {
+        const captured = await sendWithUserDoc();
+        const line = captured.find((l) => l.includes('Email.send():'));
+
+        assert.ok(!line.includes('privateKey'), `user document serialized into the log line: ${line}`);
+        assert.ok(!line.includes(LEAKED_KEY), `private key written to the log line: ${line}`);
+      },
+    },
+
+    {
+      name: 'no line of the whole send carries the private key',
+
+      async run() {
+        const captured = await sendWithUserDoc();
+        const leaking = captured.filter((l) => l.includes(LEAKED_KEY) || l.includes('privateKey'));
+
+        assert.deepEqual(leaking, [], `private key reached the log: ${JSON.stringify(leaking)}`);
+      },
+    },
+
+    {
+      name: 'a uid-only recipient is named by uid',
+
+      async run() {
+        const captured = await captureSend('user-632');
+        const line = captured.find((l) => l.includes('Email.send():'));
+
+        assert.ok(line.includes('uid:user-632'), `line does not name the uid: ${line}`);
+      },
+    },
+  ],
+});