@omega.js/backend 0.1.0

package/test/routes/user/feedback.test.js

@@ -0,0 +1,106 @@
+/**
+ * Test: POST /user/feedback
+ * Tests the user submit feedback endpoint
+ * Requires authentication, saves feedback to Firestore
+ * Note: Makes external call to ITW getApp endpoint
+ */
+
+const defineCases = require('../../../dist/vendor/devkit/test/define-cases.js');
+module.exports = defineCases({
+  description: 'User submit feedback',
+  type: 'group',
+  tests: [
+    // Test 1: Authenticated user can submit feedback
+    {
+      name: 'authenticated-user-succeeds',
+      auth: 'basic',
+      timeout: 30000, // Longer timeout due to external API call
+
+      async run({ http, assert }) {
+        const response = await http.post('backend-manager/user/feedback', {
+          rating: 'like',
+          like: 'Great app! Works well.',
+          dislike: '',
+        });
+
+        assert.isSuccess(response, 'Submit feedback should succeed for authenticated user');
+        assert.hasProperty(response, 'data.review', 'Response should contain review decision');
+        assert.hasProperty(response, 'data.originalRequest', 'Response should contain original request');
+      },
+    },
+
+    // Test 2: Feedback with love rating
+    {
+      name: 'love-rating-succeeds',
+      auth: 'basic',
+      timeout: 30000,
+
+      async run({ http, assert }) {
+        const response = await http.post('backend-manager/user/feedback', {
+          rating: 'love',
+          like: 'Absolutely love this app! Best thing ever! Highly recommend!',
+          dislike: '',
+        });
+
+        assert.isSuccess(response, 'Submit feedback with love rating should succeed');
+        assert.hasProperty(response, 'data.review.promptReview', 'Response should have promptReview flag');
+        assert.ok(
+          typeof response.data.review.promptReview === 'boolean',
+          'promptReview should be a boolean'
+        );
+      },
+    },
+
+    // Test 3: Feedback with dislike
+    {
+      name: 'dislike-feedback-succeeds',
+      auth: 'basic',
+      timeout: 30000,
+
+      async run({ http, assert }) {
+        const response = await http.post('backend-manager/user/feedback', {
+          rating: 'dislike',
+          like: '',
+          dislike: 'Could use some improvements in the UI',
+        });
+
+        assert.isSuccess(response, 'Submit negative feedback should succeed');
+        assert.hasProperty(response, 'data.review', 'Response should contain review decision');
+      },
+    },
+
+    // Test 4: Premium user can submit feedback
+    {
+      name: 'premium-user-succeeds',
+      auth: 'premium-active',
+      timeout: 30000,
+
+      async run({ http, assert }) {
+        const response = await http.post('backend-manager/user/feedback', {
+          rating: 'like',
+          like: 'Premium features are great!',
+          dislike: '',
+        });
+
+        assert.isSuccess(response, 'Submit feedback should succeed for premium user');
+      },
+    },
+
+    // Test 5: Unauthenticated request fails
+    {
+      name: 'unauthenticated-rejected',
+      auth: 'none',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.post('backend-manager/user/feedback', {
+          rating: 'like',
+          like: 'Test',
+          dislike: '',
+        });
+
+        assert.isError(response, 401, 'Submit feedback should fail without authentication');
+      },
+    },
+  ],
+});

package/test/routes/user/orders.test.js

@@ -0,0 +1,233 @@
+/**
+ * Test: GET /user/orders — the account page's read path into payments-orders
+ * ([#672](https://github.com/Omega-JS-Stack/omega/issues/672)).
+ *
+ * `payments-orders` is admin-only to clients and a one-time purchase writes
+ * nothing to users/{uid}, so no browser could see a one-time purchase at all —
+ * while the confirmation copy and the receipt email both told the customer to
+ * find it in their account. This route is the way in, and it is server-side
+ * through the admin SDK: the Firestore rules are untouched, so the ownership
+ * filter here IS the authorization.
+ *
+ * Called directly against the webhook suites' in-memory Firestore stand-in (no
+ * emulator): the subject is which orders come back, in what order, and how
+ * little of each one does.
+ *
+ * Run: npx omega test backend:routes/user/orders
+ */
+const handler = require('../../../dist/manager/routes/user/orders/get.js');
+const { buildAdmin } = require('../../events/payments/_webhook-harness.js');
+const defineCases = require('../../../dist/vendor/devkit/test/define-cases.js');
+
+const OWNER = '_test-orders-owner';
+const STRANGER = '_test-orders-stranger';
+
+const DAY = 24 * 60 * 60;
+
+/** An order as the webhook pipeline writes it, with the noise a browser must never see */
+function order(id, { owner = OWNER, type = 'one-time', ago = DAY, status = 'completed', extra = {} } = {}) {
+  const createdUNIX = Math.floor(Date.now() / 1000) - ago;
+
+  return {
+    id: id,
+    type: type,
+    owner: owner,
+    productId: 'credits-100',
+    provider: 'stripe',
+    resourceId: `_test-cs-${id}`,
+    unified: {
+      product: { id: 'credits-100', name: '100 Credits' },
+      status: status,
+      payment: { provider: 'stripe', orderId: id, resourceId: `_test-cs-${id}`, price: 9.99, currency: 'USD' },
+    },
+    // The material the summary must leave behind
+    raw: { object: 'checkout.session', customer_details: { email: 'buyer@test.dev' } },
+    request: { ip: '203.0.113.7', userAgent: 'Mozilla/5.0' },
+    attribution: { source: 'newsletter' },
+    metadata: { created: { timestamp: new Date(createdUNIX * 1000).toISOString(), timestampUNIX: createdUNIX } },
+    ...extra,
+  };
+}
+
+function caller(uid, { admin: isAdmin = false, authenticated = true } = {}) {
+  return { authenticated, auth: { uid: uid }, roles: { admin: isAdmin } };
+}
+
+/**
+ * Run the route against a seeded store
+ *
+ * @param {object} options
+ * @param {object} options.seed - payments-orders documents by path
+ * @param {object} options.user - The resolved caller
+ * @param {object} options.settings - The resolved request settings
+ * @returns {Promise<{ code: number|null, body: any, logs: string[] }>}
+ */
+async function callRoute({ seed, user, settings }) {
+  const { admin } = buildAdmin({ seed: seed });
+  const logs = [];
+  const sent = { code: null, body: null };
+
+  const ctx = {
+    log: (...args) => logs.push(args.join(' ')),
+    warn: (...args) => logs.push(args.join(' ')),
+    error: (...args) => logs.push(args.join(' ')),
+    respond: (body, options) => {
+      sent.body = body;
+      sent.code = options?.code || 200;
+      return sent;
+    },
+  };
+
+  await handler({ ctx, user, settings, libraries: { admin } });
+
+  return { ...sent, logs };
+}
+
+module.exports = defineCases({
+  description: 'GET /user/orders: a caller reads their own purchase history',
+  type: 'group',
+  timeout: 15000,
+
+  tests: [
+    {
+      name: 'lists-the-callers-own-orders-newest-first',
+      async run({ assert }) {
+        const { code, body } = await callRoute({
+          seed: {
+            'payments-orders/1111-1111-1111': order('1111-1111-1111', { ago: 3 * DAY }),
+            'payments-orders/2222-2222-2222': order('2222-2222-2222', { ago: 1 * DAY }),
+            'payments-orders/3333-3333-3333': order('3333-3333-3333', { ago: 10 * DAY }),
+          },
+          user: caller(OWNER),
+          settings: { uid: OWNER, limit: 25 },
+        });
+
+        assert.equal(code, 200, `The caller's own history is theirs to read, got ${code}: ${body}`);
+        assert.deepEqual(
+          body.orders.map((entry) => entry.id),
+          ['2222-2222-2222', '1111-1111-1111', '3333-3333-3333'],
+          'Newest purchase first — the account page lists a history, not a set',
+        );
+      },
+    },
+
+    {
+      name: 'never-lists-somebody-elses-purchase',
+      async run({ assert }) {
+        const { body } = await callRoute({
+          seed: {
+            'payments-orders/4444-4444-4444': order('4444-4444-4444'),
+            'payments-orders/5555-5555-5555': order('5555-5555-5555', { owner: STRANGER }),
+          },
+          user: caller(OWNER),
+          settings: { uid: OWNER, limit: 25 },
+        });
+
+        assert.deepEqual(body.orders.map((entry) => entry.id), ['4444-4444-4444'], 'Only the caller\'s own order comes back');
+      },
+    },
+
+    {
+      name: 'a-non-admin-cannot-ask-about-another-account',
+      async run({ assert }) {
+        const { code, body } = await callRoute({
+          seed: { 'payments-orders/6666-6666-6666': order('6666-6666-6666', { owner: STRANGER }) },
+          user: caller(OWNER),
+          settings: { uid: STRANGER, limit: 25 },
+        });
+
+        assert.equal(code, 403, `Reading another account's purchases is an admin act, got ${code}`);
+        assert.match(`${body}`, /admin/i, 'And it says so');
+      },
+    },
+
+    {
+      name: 'an-unauthenticated-caller-is-refused',
+      async run({ assert }) {
+        const { code } = await callRoute({
+          seed: {},
+          user: caller(OWNER, { authenticated: false }),
+          settings: { uid: OWNER, limit: 25 },
+        });
+
+        assert.equal(code, 401, `A purchase history is never public, got ${code}`);
+      },
+    },
+
+    {
+      name: 'the-summary-carries-what-the-page-shows-and-nothing-else',
+      async run({ assert }) {
+        const { body } = await callRoute({
+          seed: { 'payments-orders/7777-7777-7777': order('7777-7777-7777') },
+          user: caller(OWNER),
+          settings: { uid: OWNER, limit: 25 },
+        });
+
+        const entry = body.orders[0];
+
+        assert.equal(entry.productName, '100 Credits', 'What was bought');
+        assert.equal(entry.amount, 9.99, 'For how much');
+        assert.equal(entry.currency, 'USD', 'In what currency');
+        assert.equal(entry.status, 'completed', 'And what state it is in');
+        assert.ok(entry.date.timestampUNIX > 0, 'And when — the list is ordered by it');
+
+        // The order doc carries the provider's whole raw resource, the request's
+        // IP and user agent, and the attribution that sold it. None of it is the
+        // browser's business.
+        const serialized = JSON.stringify(entry);
+
+        assert.equal(entry.raw, undefined, 'The provider payload never leaves the backend');
+        assert.equal(entry.request, undefined, 'Nor the request context');
+        assert.equal(entry.attribution, undefined, 'Nor the attribution');
+        assert.ok(!serialized.includes('203.0.113.7'), `No IP rides the summary: ${serialized}`);
+        assert.ok(!serialized.includes('buyer@test.dev'), `No provider-side email either: ${serialized}`);
+      },
+    },
+
+    {
+      name: 'refundable-answers-what-the-refund-route-would-answer',
+      async run({ assert }) {
+        const { body } = await callRoute({
+          seed: {
+            'payments-orders/8888-0001-0001': order('8888-0001-0001'),
+            'payments-orders/8888-0002-0002': order('8888-0002-0002', { status: 'refunded' }),
+            'payments-orders/8888-0003-0003': order('8888-0003-0003', { ago: 300 * DAY }),
+            'payments-orders/8888-0004-0004': order('8888-0004-0004', { type: 'subscription' }),
+            'payments-orders/8888-0005-0005': order('8888-0005-0005', { status: 'open' }),
+          },
+          user: caller(OWNER),
+          settings: { uid: OWNER, limit: 25 },
+        });
+
+        const refundable = Object.fromEntries(body.orders.map((entry) => [entry.id, entry.refundable]));
+
+        assert.equal(refundable['8888-0001-0001'], true, 'A recent, unrefunded one-time purchase is refundable');
+        assert.equal(refundable['8888-0002-0002'], false, 'One already refunded is not offered again');
+        assert.equal(refundable['8888-0003-0003'], false, 'Nor one past the 6-month window');
+        assert.equal(refundable['8888-0004-0004'], false, 'A subscription order refunds through the subscription lane, not this one');
+
+        // A checkout that was opened and never paid keeps its provider and its
+        // resourceId, so every other refusal passes it — and the button it used
+        // to earn asks the provider to reverse a charge that never happened
+        assert.equal(refundable['8888-0005-0005'], false, 'A purchase that never completed has nothing to refund');
+      },
+    },
+
+    {
+      name: 'the-limit-cuts-the-list-at-the-newest',
+      async run({ assert }) {
+        const { body } = await callRoute({
+          seed: {
+            'payments-orders/9999-0001-0001': order('9999-0001-0001', { ago: 1 * DAY }),
+            'payments-orders/9999-0002-0002': order('9999-0002-0002', { ago: 2 * DAY }),
+            'payments-orders/9999-0003-0003': order('9999-0003-0003', { ago: 3 * DAY }),
+          },
+          user: caller(OWNER),
+          settings: { uid: OWNER, limit: 2 },
+        });
+
+        assert.deepEqual(body.orders.map((entry) => entry.id), ['9999-0001-0001', '9999-0002-0002'], 'The newest two, not an arbitrary two');
+      },
+    },
+  ],
+});

package/test/routes/user/sessions.test.js

@@ -0,0 +1,231 @@
+/**
+ * Test: GET /user/sessions and DELETE /user/sessions
+ * Tests the user sessions endpoints
+ * GET returns sessions for authenticated users from Realtime Database
+ * DELETE signs out all sessions (revokes refresh tokens and clears session data)
+ */
+
+const defineCases = require('../../../dist/vendor/devkit/test/define-cases.js');
+module.exports = defineCases({
+  description: 'User sessions (get and sign-out)',
+  type: 'group',
+  tests: [
+    // --- GET /user/sessions tests ---
+
+    // Test 1: Authenticated user can get sessions
+    {
+      name: 'get-authenticated-user-succeeds',
+      auth: 'basic',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.get('backend-manager/user/sessions', {});
+
+        assert.isSuccess(response, 'Get active sessions should succeed for authenticated user');
+        assert.ok(
+          typeof response.data === 'object',
+          'Response data should be an object'
+        );
+      },
+    },
+
+    // Test 2: Default session id is 'app'
+    {
+      name: 'get-default-session-is-app',
+      auth: 'basic',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        // With no id specified, should query sessions/app
+        const response = await http.get('backend-manager/user/sessions', {});
+
+        assert.isSuccess(response, 'Get active sessions should succeed');
+        // Response is an object (may be empty if no sessions)
+        assert.ok(
+          response.data !== undefined,
+          'Response should have data'
+        );
+      },
+    },
+
+    // Test 3: Custom session id
+    {
+      name: 'get-custom-session-id',
+      auth: 'basic',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.get('backend-manager/user/sessions', {
+          id: 'custom-session-type',
+        });
+
+        assert.isSuccess(response, 'Get active sessions with custom id should succeed');
+        assert.ok(
+          typeof response.data === 'object',
+          'Response data should be an object'
+        );
+      },
+    },
+
+    // Test 4: Empty sessions returns empty object
+    {
+      name: 'get-no-sessions-returns-empty',
+      auth: 'basic',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        // Query a session type that definitely doesn't exist
+        const response = await http.get('backend-manager/user/sessions', {
+          id: 'nonexistent-session-type-12345',
+        });
+
+        assert.isSuccess(response, 'Get sessions for empty type should succeed');
+        assert.ok(
+          Object.keys(response.data).length === 0,
+          'Empty session type should return empty object'
+        );
+      },
+    },
+
+    // Test 5: The seeded persona's own devices come back (#343)
+    {
+      name: 'get-returns-the-personas-seeded-sessions',
+      auth: 'premium-active',
+      timeout: 15000,
+
+      async run({ http, assert, accounts }) {
+        const response = await http.get('backend-manager/user/sessions', {});
+
+        assert.isSuccess(response, 'Get active sessions should succeed');
+
+        // The boot seed writes these into the Realtime Database from OUTSIDE the
+        // functions runtime, so this is also the proof it wrote the namespace
+        // this route reads (src/test/test-accounts.js sessionsDatabase).
+        const sessions = response.data || {};
+        const ids = Object.keys(sessions).filter((id) => id.startsWith('_test-session-premium-active-'));
+
+        assert.ok(
+          ids.length >= 2,
+          `The Premium persona is seeded as signed in on several devices, so its sessions must come back (got ${Object.keys(sessions).length} session(s))`
+        );
+
+        for (const id of ids) {
+          assert.equal(sessions[id].uid, accounts['premium-active'].uid, `Session ${id} should belong to the persona`);
+          assert.ok(sessions[id].platform, `Session ${id} should name its platform`);
+          assert.ok(sessions[id].timestampUNIX > 0, `Session ${id} should record its last check-in`);
+        }
+      },
+    },
+
+    // Test 6: Admin can get sessions
+    {
+      name: 'get-admin-succeeds',
+      auth: 'admin',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.get('backend-manager/user/sessions', {});
+
+        assert.isSuccess(response, 'Get active sessions should succeed for admin');
+      },
+    },
+
+    // Test 7: Unauthenticated GET request fails
+    {
+      name: 'get-unauthenticated-rejected',
+      auth: 'none',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.get('backend-manager/user/sessions', {});
+
+        assert.isError(response, 401, 'Get active sessions should fail without authentication');
+      },
+    },
+
+    // --- DELETE /user/sessions tests ---
+
+    // Test 8: Authenticated user can sign out all sessions
+    {
+      name: 'delete-authenticated-user-succeeds',
+      auth: 'basic',
+      timeout: 30000, // Longer timeout due to session cleanup
+
+      async run({ http, assert }) {
+        const response = await http.delete('backend-manager/user/sessions', {});
+
+        assert.isSuccess(response, 'Sign out all sessions should succeed for authenticated user');
+        assert.hasProperty(response, 'data.sessions', 'Response should contain sessions count');
+        assert.hasProperty(response, 'data.message', 'Response should contain message');
+        assert.ok(
+          typeof response.data.sessions === 'number',
+          'sessions should be a number'
+        );
+        assert.ok(
+          response.data.sessions >= 0,
+          'sessions count should be non-negative'
+        );
+      },
+    },
+
+    // Test 9: Custom session id for delete
+    {
+      name: 'delete-custom-session-id',
+      auth: 'basic',
+      timeout: 30000,
+
+      async run({ http, assert }) {
+        const response = await http.delete('backend-manager/user/sessions', {
+          id: 'custom-session-type',
+        });
+
+        assert.isSuccess(response, 'Sign out with custom session id should succeed');
+        assert.hasProperty(response, 'data.sessions', 'Response should contain sessions count');
+      },
+    },
+
+    // Test 10: Premium user can sign out all sessions
+    // Note: admin key admin doesn't have auth.uid, so we test with premium user instead
+    {
+      name: 'delete-premium-user-succeeds',
+      auth: 'premium-active',
+      timeout: 30000,
+
+      async run({ http, assert }) {
+        const response = await http.delete('backend-manager/user/sessions', {});
+
+        assert.isSuccess(response, 'Sign out all sessions should succeed for premium user');
+        assert.hasProperty(response, 'data.sessions', 'Response should contain sessions count');
+      },
+    },
+
+    // Test 11: Multiple calls are idempotent
+    {
+      name: 'delete-idempotent-operation',
+      auth: 'basic',
+      timeout: 30000,
+
+      async run({ http, assert }) {
+        // Call twice in a row - both should succeed
+        const response1 = await http.delete('backend-manager/user/sessions', {});
+        const response2 = await http.delete('backend-manager/user/sessions', {});
+
+        assert.isSuccess(response1, 'First sign out should succeed');
+        assert.isSuccess(response2, 'Second sign out should succeed (idempotent)');
+      },
+    },
+
+    // Test 12: Unauthenticated DELETE request fails
+    {
+      name: 'delete-unauthenticated-rejected',
+      auth: 'none',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.delete('backend-manager/user/sessions', {});
+
+        assert.isError(response, 401, 'Sign out all sessions should fail without authentication');
+      },
+    },
+  ],
+});

package/test/routes/user/settings-validate.test.js

@@ -0,0 +1,84 @@
+/**
+ * Test: POST /user/settings/validate
+ * Tests the user validate settings endpoint
+ * Requires authentication and validates settings against schema
+ *
+ * SKIPPED: Requires project-specific defaults.js file which @omega.js/backend test environment doesn't have
+ */
+
+const defineCases = require('../../../dist/vendor/devkit/test/define-cases.js');
+module.exports = defineCases({
+  description: 'User validate settings',
+  skip: 'Requires project-specific defaults.js file',
+  type: 'group',
+  tests: [
+    // Test 1: Authenticated user can validate settings
+    {
+      name: 'authenticated-user-succeeds',
+      auth: 'basic',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.post('backend-manager/user/settings/validate', {
+          existingSettings: {},
+          newSettings: {},
+        });
+
+        assert.isSuccess(response, 'Validate settings should succeed for authenticated user');
+      },
+    },
+
+    // Test 2: With existing settings
+    {
+      name: 'with-existing-settings',
+      auth: 'basic',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.post('backend-manager/user/settings/validate', {
+          existingSettings: {
+            theme: 'dark',
+            notifications: true,
+          },
+          newSettings: {
+            theme: 'light',
+          },
+        });
+
+        assert.isSuccess(response, 'Validate settings with data should succeed');
+      },
+    },
+
+    // Test 3: Premium user can validate settings
+    {
+      name: 'premium-user-succeeds',
+      auth: 'premium-active',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.post('backend-manager/user/settings/validate', {
+          existingSettings: {},
+          newSettings: {},
+        });
+
+        assert.isSuccess(response, 'Validate settings should succeed for premium user');
+      },
+    },
+
+    // Test 4: Unauthenticated request fails
+    {
+      name: 'unauthenticated-rejected',
+      auth: 'none',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.post('backend-manager/user/settings/validate', {
+          existingSettings: {},
+          newSettings: {},
+        });
+
+        assert.isError(response, 401, 'Validate settings should fail without authentication');
+      },
+    },
+  ],
+});