@omega.js/backend 0.1.0

package/test/routes/admin/create-post.test.js

@@ -0,0 +1,362 @@
+/**
+ * Test: POST /admin/post
+ * Tests the admin create post endpoint
+ * Creates blog posts via GitHub with image extraction and @post/ body rewriting
+ * Requires admin/blogger role, GitHub API key, and a resolvable github repo (targets.backend.github.repo slug or repo.providers.github.org + brand.id)
+ */
+const { Octokit } = require('@octokit/rest');
+const sharp = require('sharp');
+
+const { IMAGE_MAX_DIMENSION } = require('../../../dist/manager/routes/admin/post/post');
+const defineCases = require('../../../dist/vendor/devkit/test/define-cases.js');
+
+module.exports = defineCases({
+  description: 'Admin create post on GitHub',
+  type: 'suite',
+  timeout: 300000, // 5 minutes total for the suite
+
+  tests: [
+    // --- Validation tests (no GitHub needed) ---
+
+    {
+      name: 'missing-title-rejected',
+      auth: 'admin',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.post('backend-manager/admin/post', {
+          url: 'test-post',
+          description: 'Test description',
+          headerImageURL: 'https://example.com/image.jpg',
+          body: 'Test content',
+        });
+
+        assert.isError(response, 400, 'Missing title should return 400');
+      },
+    },
+
+    {
+      name: 'missing-url-rejected',
+      auth: 'admin',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.post('backend-manager/admin/post', {
+          title: 'Test Post',
+          description: 'Test description',
+          headerImageURL: 'https://example.com/image.jpg',
+          body: 'Test content',
+        });
+
+        assert.isError(response, 400, 'Missing URL should return 400');
+      },
+    },
+
+    {
+      name: 'missing-description-rejected',
+      auth: 'admin',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.post('backend-manager/admin/post', {
+          title: 'Test Post',
+          url: 'test-post',
+          headerImageURL: 'https://example.com/image.jpg',
+          body: 'Test content',
+        });
+
+        assert.isError(response, 400, 'Missing description should return 400');
+      },
+    },
+
+    {
+      name: 'missing-header-image-rejected',
+      auth: 'admin',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.post('backend-manager/admin/post', {
+          title: 'Test Post',
+          url: 'test-post',
+          description: 'Test description',
+          body: 'Test content',
+        });
+
+        assert.isError(response, 400, 'Missing headerImageURL should return 400');
+      },
+    },
+
+    {
+      name: 'missing-body-rejected',
+      auth: 'admin',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.post('backend-manager/admin/post', {
+          title: 'Test Post',
+          url: 'test-post',
+          description: 'Test description',
+          headerImageURL: 'https://example.com/image.jpg',
+        });
+
+        assert.isError(response, 400, 'Missing body should return 400');
+      },
+    },
+
+    // --- Integration: create post with inline image, verify @post/ rewriting ---
+
+    {
+      name: 'create-post-rewrites-body-images',
+      auth: 'admin',
+      timeout: 120000,
+      skip: !process.env.TEST_EXTENDED_MODE ? 'TEST_EXTENDED_MODE env var not set' : false,
+
+      async run({ http, assert, state, config }) {
+        if (!process.env.GH_TOKEN) {
+          assert.fail('GH_TOKEN env var not set');
+          return;
+        }
+
+        const { brandRepoOwner, brandRepoName } = require('../../helpers/_shared-config.js');
+        if (!brandRepoOwner(config) || !brandRepoName(config)) {
+          assert.fail('github repo not resolvable (targets.backend.github.repo slug or repo.providers.github.org + brand.id)');
+          return;
+        }
+
+        // Parse owner/repo for cleanup later
+        const repoMatch = [null, brandRepoOwner(config), brandRepoName(config)];
+
+        state.owner = repoMatch[1];
+        state.repo = repoMatch[2];
+
+        // Use a real public .jpg for the inline image
+        const inlineImageURL = 'https://picsum.photos/id/10/200/200.jpg';
+        // Oversized header image (long edge 5000px > IMAGE_MAX_DIMENSION 4096px) to
+        // verify the resize step runs end-to-end and the committed file is clamped.
+        const headerImageURL = 'https://picsum.photos/id/1/5000/3000.jpg';
+
+        const response = await http.post('backend-manager/admin/post', {
+          title: '@omega.js/backend Test Create Post',
+          url: 'backend-test-create-post',
+          description: 'Test post created by @omega.js/backend test suite to verify @post/ body rewriting.',
+          headerImageURL: headerImageURL,
+          body: `# @omega.js/backend Test Create Post\n\nSome intro text.\n\n![Test inline image](${inlineImageURL})\n\nMore text after the image.`,
+          postPath: 'guest',
+        });
+
+        assert.isSuccess(response, 'Create post should succeed');
+        assert.hasProperty(response, 'data.id', 'Response should have post id');
+        assert.hasProperty(response, 'data.path', 'Response should have post file path');
+
+        // Store for cleanup
+        state.postId = response.data.id;
+        state.postPath = response.data.path;
+      },
+    },
+
+    {
+      name: 'verify-body-has-at-post-prefix',
+      auth: 'admin',
+      timeout: 30000,
+      skip: !process.env.TEST_EXTENDED_MODE ? 'TEST_EXTENDED_MODE env var not set' : false,
+
+      async run({ assert, state }) {
+        if (!state.postPath) {
+          return; // Previous test didn't run
+        }
+
+        const octokit = new Octokit({ auth: process.env.GH_TOKEN });
+
+        // Fetch the committed post from GitHub
+        const { data: fileData } = await octokit.rest.repos.getContent({
+          owner: state.owner,
+          repo: state.repo,
+          path: state.postPath,
+        });
+
+        const content = Buffer.from(fileData.content, 'base64').toString();
+        state.currentSha = fileData.sha;
+
+        // The body should contain @post/ prefix instead of the original external URL
+        assert.ok(
+          content.includes('@post/'),
+          'Post body should contain @post/ prefix for downloaded images',
+        );
+
+        assert.ok(
+          !content.includes('picsum.photos/id/10'),
+          'Post body should NOT contain the original external inline image URL',
+        );
+      },
+    },
+
+    {
+      name: 'verify-oversized-header-image-was-resized',
+      auth: 'admin',
+      timeout: 30000,
+      skip: !process.env.TEST_EXTENDED_MODE ? 'TEST_EXTENDED_MODE env var not set' : false,
+
+      async run({ assert, state }) {
+        if (!state.postId) {
+          return; // Previous test didn't run
+        }
+
+        const octokit = new Octokit({ auth: process.env.GH_TOKEN });
+        const imageDir = `src/assets/images/blog/post-${state.postId}/`;
+
+        // List committed images and pick the header (matches the slugified URL "backend-test-create-post")
+        const { data: dirData } = await octokit.rest.repos.getContent({
+          owner: state.owner,
+          repo: state.repo,
+          path: imageDir,
+        });
+
+        const headerFile = dirData.find((f) => f.name === 'backend-test-create-post.jpg');
+        assert.ok(headerFile, 'Header image should be committed at expected slug');
+
+        // Fetch the raw bytes and read dimensions
+        const { data: blob } = await octokit.rest.git.getBlob({
+          owner: state.owner,
+          repo: state.repo,
+          file_sha: headerFile.sha,
+        });
+
+        const buffer = Buffer.from(blob.content, 'base64');
+        const meta = await sharp(buffer).metadata();
+
+        // The source we requested was 5000x3000 (over the 4096 limit).
+        // After resize, the long edge should be clamped to IMAGE_MAX_DIMENSION.
+        const longEdge = Math.max(meta.width, meta.height);
+        assert.ok(
+          longEdge <= IMAGE_MAX_DIMENSION,
+          `Committed header image long edge (${meta.width}x${meta.height}) should be <= IMAGE_MAX_DIMENSION (${IMAGE_MAX_DIMENSION})`,
+        );
+
+        // And the resize should actually have happened (source was 5000x3000 → expect width=4096)
+        assert.equal(meta.width, IMAGE_MAX_DIMENSION, 'Resized width should equal IMAGE_MAX_DIMENSION');
+      },
+    },
+
+    // --- Auth rejection tests ---
+
+    {
+      name: 'unauthenticated-rejected',
+      auth: 'none',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.post('backend-manager/admin/post', {
+          title: 'Test Post',
+          url: 'test-post',
+          description: 'Test description',
+          headerImageURL: 'https://example.com/image.jpg',
+          body: 'Test content',
+        });
+
+        assert.isError(response, 401, 'Create post should fail without authentication');
+      },
+    },
+
+    {
+      name: 'non-admin-rejected',
+      auth: 'basic',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.post('backend-manager/admin/post', {
+          title: 'Test Post',
+          url: 'test-post',
+          description: 'Test description',
+          headerImageURL: 'https://example.com/image.jpg',
+          body: 'Test content',
+        });
+
+        assert.isError(response, 403, 'Create post should fail for non-admin user');
+      },
+    },
+
+    // --- Cleanup ---
+
+    {
+      name: 'cleanup',
+      auth: 'admin',
+      timeout: 60000,
+
+      async run({ state }) {
+        if (!process.env.GH_TOKEN || !state.postPath) {
+          return;
+        }
+
+        const octokit = new Octokit({ auth: process.env.GH_TOKEN });
+
+        // Delete the test post
+        try {
+          const { data: fileData } = await octokit.rest.repos.getContent({
+            owner: state.owner,
+            repo: state.repo,
+            path: state.postPath,
+          });
+
+          await octokit.rest.repos.deleteFile({
+            owner: state.owner,
+            repo: state.repo,
+            path: state.postPath,
+            message: '🧹 @omega.js/backend test cleanup: delete create-post test',
+            sha: fileData.sha,
+          });
+        } catch (e) {
+          // File might not exist, ignore
+        }
+
+        // Delete uploaded test images
+        const imagePath = `src/assets/images/blog/post-${state.postId}/`;
+        try {
+          const { data: dirData } = await octokit.rest.repos.getContent({
+            owner: state.owner,
+            repo: state.repo,
+            path: imagePath,
+          });
+
+          // Delete each image file
+          for (const file of dirData) {
+            await octokit.rest.repos.deleteFile({
+              owner: state.owner,
+              repo: state.repo,
+              path: file.path,
+              message: `🧹 @omega.js/backend test cleanup: delete test image ${file.name}`,
+              sha: file.sha,
+            });
+          }
+        } catch (e) {
+          // Directory might not exist, ignore
+        }
+
+        // Cancel any running workflows triggered by our test commits
+        try {
+          const { data: runs } = await octokit.rest.actions.listWorkflowRunsForRepo({
+            owner: state.owner,
+            repo: state.repo,
+            status: 'in_progress',
+            per_page: 10,
+          });
+
+          for (const run of runs.workflow_runs) {
+            if (run.head_commit?.message?.includes('@omega.js/backend test')) {
+              try {
+                await octokit.rest.actions.cancelWorkflowRun({
+                  owner: state.owner,
+                  repo: state.repo,
+                  run_id: run.id,
+                });
+              } catch (e) {
+                // May already be completed, ignore
+              }
+            }
+          }
+        } catch (e) {
+          // Workflow cancellation failed, not critical
+        }
+      },
+    },
+  ],
+});

package/test/routes/admin/database.test.js

@@ -0,0 +1,133 @@
+/**
+ * Test: GET/POST /admin/database
+ * Tests the admin Realtime Database read/write endpoints
+ * Requires admin authentication
+ */
+
+const defineCases = require('../../../dist/vendor/devkit/test/define-cases.js');
+const TEST_PATH = '_test/database-test';
+
+module.exports = defineCases({
+  description: 'Admin Realtime Database read/write operations',
+  type: 'group',
+  tests: [
+    // Test 1: Setup - write test data first
+    {
+      name: 'setup-test-data',
+      auth: 'admin',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const testData = {
+          testField: 'database-test-value',
+          timestamp: new Date().toISOString(),
+          nested: {
+            field1: 'nested-value',
+            field2: 123,
+          },
+        };
+
+        const writeResponse = await http.post('backend-manager/admin/database', {
+          path: TEST_PATH,
+          document: testData,
+        });
+
+        assert.isSuccess(writeResponse, 'Setup: Database write should succeed');
+      },
+    },
+
+    // Test 2: Admin can read data
+    {
+      name: 'admin-read-succeeds',
+      auth: 'admin',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const readResponse = await http.get('backend-manager/admin/database', {
+          path: TEST_PATH,
+        });
+
+        assert.isSuccess(readResponse, 'Database read should succeed with admin auth');
+        assert.hasProperty(readResponse, 'data.testField', 'Response should contain test data');
+        assert.equal(
+          readResponse.data.testField,
+          'database-test-value',
+          'Read data should match written data'
+        );
+        assert.hasProperty(readResponse, 'data.nested.field1', 'Response should contain nested data');
+        assert.equal(
+          readResponse.data.nested.field2,
+          123,
+          'Nested field should match written data'
+        );
+      },
+    },
+
+    // Test 3: Reading non-existent path returns empty/null
+    {
+      name: 'read-nonexistent-returns-null',
+      auth: 'admin',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const readResponse = await http.get('backend-manager/admin/database', {
+          path: '_test/nonexistent-path-12345',
+        });
+
+        assert.isSuccess(readResponse, 'Reading non-existent path should succeed');
+        const data = readResponse.data;
+        const isEmpty = data === null
+          || data === undefined
+          || (typeof data === 'object' && Object.keys(data).length === 0);
+        assert.ok(
+          isEmpty,
+          `Non-existent path should return null, undefined, or empty object, got: ${JSON.stringify(data)}`
+        );
+      },
+    },
+
+    // Test 4: Missing path returns 400 error
+    {
+      name: 'missing-path-rejected',
+      auth: 'admin',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const readResponse = await http.get('backend-manager/admin/database', {});
+
+        assert.isError(readResponse, 400, 'Missing path should return 400');
+      },
+    },
+
+    // Test 5: Unauthenticated request fails
+    {
+      name: 'unauthenticated-rejected',
+      auth: 'none',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const readResponse = await http.get('backend-manager/admin/database', {
+          path: TEST_PATH,
+        });
+
+        assert.isError(readResponse, 401, 'Database read should fail without authentication');
+      },
+    },
+
+    // Test 6: Non-admin user fails
+    {
+      name: 'non-admin-rejected',
+      auth: 'basic',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const readResponse = await http.get('backend-manager/admin/database', {
+          path: TEST_PATH,
+        });
+
+        assert.isError(readResponse, 403, 'Database read should fail for non-admin user');
+      },
+    },
+
+  ],
+});

package/test/routes/admin/deduplicate-image-alts.test.js

@@ -0,0 +1,191 @@
+/**
+ * Test: routes/admin/post/deduplicate-image-alts
+ * Unit tests for the alt-text dedup helper used by the admin/post route.
+ *
+ * Run: npx omega test routes/admin/deduplicate-image-alts
+ *
+ * Contract:
+ *   - Header images are never modified.
+ *   - Two non-header images with the same alt AND different URLs:
+ *     the second's alt is suffixed with " (2)" (and " (3)" for the third, etc.)
+ *     and the body is rewritten to match.
+ *   - Two non-header images with the same alt AND the same URL:
+ *     the second reuses the first's (possibly already-suffixed) alt — no change.
+ *   - Images with distinct alts are untouched.
+ */
+const deduplicateImageAlts = require('../../../dist/manager/routes/admin/post/deduplicate-image-alts');
+const defineCases = require('../../../dist/vendor/devkit/test/define-cases.js');
+
+module.exports = defineCases({
+  description: 'routes/admin/post/deduplicate-image-alts',
+  type: 'group',
+
+  tests: [
+    // ─── Happy path: no collisions ───
+
+    {
+      name: 'distinct-alts-are-untouched',
+      async run({ assert }) {
+        const images = [
+          { src: 'https://a.com/1.jpg', alt: 'Cat', header: false },
+          { src: 'https://a.com/2.jpg', alt: 'Dog', header: false },
+        ];
+        const body = '![Cat](https://a.com/1.jpg)\n\n![Dog](https://a.com/2.jpg)';
+        const result = deduplicateImageAlts(images, body);
+
+        assert.equal(result.images[0].alt, 'Cat', 'First image alt unchanged');
+        assert.equal(result.images[1].alt, 'Dog', 'Second image alt unchanged');
+        assert.equal(result.body, body, 'Body is unchanged when no collisions');
+      },
+    },
+
+    // ─── The bug: same alt, different URLs ───
+
+    {
+      name: 'same-alt-different-urls-suffixes-second',
+      async run({ assert }) {
+        const sharedAlt = '62f9b399-92c2-40c2-8ec4-e05b54077aaa';
+        const images = [
+          { src: 'https://a.com/1.jpg', alt: sharedAlt, header: false },
+          { src: 'https://a.com/2.jpg', alt: sharedAlt, header: false },
+        ];
+        const body = `![${sharedAlt}](https://a.com/1.jpg)\n\nsome text\n\n![${sharedAlt}](https://a.com/2.jpg)`;
+        const result = deduplicateImageAlts(images, body);
+
+        assert.equal(result.images[0].alt, sharedAlt, 'First image keeps original alt');
+        assert.equal(result.images[1].alt, `${sharedAlt} (2)`, 'Second image alt is suffixed with " (2)"');
+        assert.ok(
+          result.body.includes(`![${sharedAlt}](https://a.com/1.jpg)`),
+          'Body still contains the first image with original alt',
+        );
+        assert.ok(
+          result.body.includes(`![${sharedAlt} (2)](https://a.com/2.jpg)`),
+          'Body contains the second image with suffixed alt',
+        );
+      },
+    },
+
+    {
+      name: 'three-images-same-alt-different-urls-counts-up',
+      async run({ assert }) {
+        const sharedAlt = 'Logo';
+        const images = [
+          { src: 'https://a.com/1.jpg', alt: sharedAlt, header: false },
+          { src: 'https://a.com/2.jpg', alt: sharedAlt, header: false },
+          { src: 'https://a.com/3.jpg', alt: sharedAlt, header: false },
+        ];
+        const body = `![${sharedAlt}](https://a.com/1.jpg)\n![${sharedAlt}](https://a.com/2.jpg)\n![${sharedAlt}](https://a.com/3.jpg)`;
+        const result = deduplicateImageAlts(images, body);
+
+        assert.equal(result.images[0].alt, 'Logo');
+        assert.equal(result.images[1].alt, 'Logo (2)');
+        assert.equal(result.images[2].alt, 'Logo (3)');
+        assert.ok(result.body.includes('![Logo](https://a.com/1.jpg)'));
+        assert.ok(result.body.includes('![Logo (2)](https://a.com/2.jpg)'));
+        assert.ok(result.body.includes('![Logo (3)](https://a.com/3.jpg)'));
+      },
+    },
+
+    // ─── Same alt, SAME URL: legitimate duplicate, no change ───
+
+    {
+      name: 'same-alt-same-url-is-not-a-collision',
+      async run({ assert }) {
+        const sharedAlt = 'Logo';
+        const sharedUrl = 'https://a.com/logo.jpg';
+        const images = [
+          { src: sharedUrl, alt: sharedAlt, header: false },
+          { src: sharedUrl, alt: sharedAlt, header: false },
+        ];
+        const body = `![${sharedAlt}](${sharedUrl})\n\n![${sharedAlt}](${sharedUrl})`;
+        const result = deduplicateImageAlts(images, body);
+
+        assert.equal(result.images[0].alt, sharedAlt, 'First image alt unchanged');
+        assert.equal(result.images[1].alt, sharedAlt, 'Second image alt unchanged (same URL)');
+        assert.equal(result.body, body, 'Body unchanged when URLs match');
+      },
+    },
+
+    // ─── Header image is never touched ───
+
+    {
+      name: 'header-image-with-shared-alt-is-not-modified',
+      async run({ assert }) {
+        const sharedAlt = 'banner';
+        const images = [
+          { src: 'https://a.com/header.jpg', alt: sharedAlt, header: true },
+          { src: 'https://a.com/body.jpg', alt: sharedAlt, header: false },
+        ];
+        const body = `![${sharedAlt}](https://a.com/body.jpg)`;
+        const result = deduplicateImageAlts(images, body);
+
+        assert.equal(result.images[0].alt, sharedAlt, 'Header image alt unchanged');
+        assert.equal(
+          result.images[1].alt,
+          sharedAlt,
+          'Body image alt unchanged because header is excluded from collision tracking',
+        );
+        assert.equal(result.body, body, 'Body unchanged');
+      },
+    },
+
+    // ─── Mixed scenarios ───
+
+    {
+      name: 'mixed-A-B-A-C-only-C-collides-with-A-once',
+      async run({ assert }) {
+        // Pattern: A, B, A (same URL as first A), C (different URL, same alt as A)
+        // Expected: A and A reuse, C gets " (2)" suffix because its alt collides with A.
+        const altA = 'Shared';
+        const altB = 'Other';
+        const urlA = 'https://a.com/a.jpg';
+        const urlB = 'https://a.com/b.jpg';
+        const urlC = 'https://a.com/c.jpg';
+
+        const images = [
+          { src: urlA, alt: altA, header: false },
+          { src: urlB, alt: altB, header: false },
+          { src: urlA, alt: altA, header: false }, // Same URL as image 1 — legit duplicate
+          { src: urlC, alt: altA, header: false }, // Different URL, same alt — collision
+        ];
+        const body = `![${altA}](${urlA})\n![${altB}](${urlB})\n![${altA}](${urlA})\n![${altA}](${urlC})`;
+        const result = deduplicateImageAlts(images, body);
+
+        assert.equal(result.images[0].alt, altA, 'Image 1 unchanged');
+        assert.equal(result.images[1].alt, altB, 'Image 2 (different alt) unchanged');
+        assert.equal(result.images[2].alt, altA, 'Image 3 (same URL as 1) unchanged');
+        assert.equal(result.images[3].alt, `${altA} (2)`, 'Image 4 (different URL, same alt) gets " (2)"');
+        assert.ok(result.body.includes(`![${altA} (2)](${urlC})`), 'Body has the C image with suffixed alt');
+      },
+    },
+
+    // ─── Edge cases ───
+
+    {
+      name: 'empty-images-array-returns-empty',
+      async run({ assert }) {
+        const result = deduplicateImageAlts([], 'some body');
+        assert.deepEqual(result.images, [], 'images is empty');
+        assert.equal(result.body, 'some body', 'body unchanged');
+      },
+    },
+
+    {
+      name: 'no-collisions-among-different-alts',
+      async run({ assert }) {
+        const images = [
+          { src: 'https://a.com/1.jpg', alt: 'A', header: false },
+          { src: 'https://a.com/2.jpg', alt: 'B', header: false },
+          { src: 'https://a.com/3.jpg', alt: 'C', header: false },
+        ];
+        const body = '![A](https://a.com/1.jpg)\n![B](https://a.com/2.jpg)\n![C](https://a.com/3.jpg)';
+        const result = deduplicateImageAlts(images, body);
+
+        assert.equal(result.images[0].alt, 'A');
+        assert.equal(result.images[1].alt, 'B');
+        assert.equal(result.images[2].alt, 'C');
+        assert.equal(result.body, body, 'Body unchanged');
+      },
+    },
+  ],
+});