@open-mercato/channel-discord 0.6.8-develop.7090.1.4dbca7b350

package/src/modules/channel_discord/__integration__/TC-CHANNEL-DISCORD-004.spec.ts

@@ -0,0 +1,83 @@
+import { expect, test } from '@playwright/test'
+import { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api'
+import { readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures'
+import {
+  deleteChannelIfExists,
+  isChannelSeedingAvailable,
+  seedConnectedChannel,
+  seedInboundMessage,
+} from '@open-mercato/core/helpers/integration/communicationChannelsFixtures'
+
+/**
+ * TC-CHANNEL-DISCORD-004 — reactions on a Discord-provider message.
+ * Source: .ai/specs/2026-06-19-discord-communication-channel-integration.md
+ *
+ * `MESSAGE_REACTION_ADD` / `MESSAGE_REACTION_REMOVE` are bridged into the hub's
+ * existing reaction routes, which resolve the owning channel through the
+ * `ChannelThreadMapping` an inbound message leaves behind. This spec proves that
+ * resolution works when the inbound traffic carries `providerKey: 'discord'` —
+ * i.e. the provider needs no reaction storage of its own — by adding and then
+ * removing a reaction on a seeded Discord message.
+ *
+ * Driven via the env-gated test-seed fixture (`OM_ENABLE_TEST_CHANNEL_SEEDING`);
+ * skips when the gate is off.
+ */
+test.describe('TC-CHANNEL-DISCORD-004: reactions round-trip on a discord message', () => {
+  test('a reaction can be added to and removed from a discord-provider message', async ({
+    request,
+  }) => {
+    test.slow()
+    let token: string | null = null
+    let channelId: string | null = null
+    try {
+      token = await getAuthToken(request, 'admin')
+      const seedingAvailable = await isChannelSeedingAvailable(request, token)
+      test.skip(
+        !seedingAvailable,
+        'OM_ENABLE_TEST_CHANNEL_SEEDING is not enabled in this environment; cannot emit inbound messages.',
+      )
+
+      const stamp = Date.now()
+      channelId = await seedConnectedChannel(request, token, {
+        displayName: `TC-CHANNEL-DISCORD-004 ${stamp}`,
+        externalIdentifier: `discord-004-${stamp}@test-seed.local`,
+      })
+
+      const seeded = await seedInboundMessage(request, token, {
+        channelId,
+        providerKey: 'discord',
+        from: `discord-user-${stamp}`,
+        subject: `Discord reaction target ${stamp}`,
+        bodyText: 'react to me',
+        messageId: `discord-message-${stamp}`,
+        // The reaction route resolves the owning channel through this mapping.
+        createThreadMapping: true,
+      })
+
+      const added = await apiRequest(
+        request,
+        'POST',
+        `/api/communication_channels/messages/${seeded.messageId}/reactions`,
+        { token, data: { emoji: '👍' } },
+      )
+      expect(added.status(), 'adding a reaction to a discord message should return 201').toBe(201)
+      const addedBody = await readJsonSafe<{ id?: string; emoji?: string; messageId?: string }>(added)
+      expect(addedBody?.emoji, 'the reaction echoes the emoji').toBe('👍')
+      expect(addedBody?.messageId, 'the reaction is bound to the seeded discord message').toBe(
+        seeded.messageId,
+      )
+
+      const reactionId = addedBody?.id
+      expect(reactionId, 'the reaction response must carry an id to remove it by').toBeTruthy()
+      const removed = await apiRequest(
+        request,
+        'DELETE',
+        `/api/communication_channels/messages/${seeded.messageId}/reactions/${reactionId}`,
+        { token },
+      )
+      expect(removed.status(), 'removing the reaction should return 204').toBe(204)
+    } finally {
+      await deleteChannelIfExists(request, token, channelId)
+    }
+  })
+})

package/src/modules/channel_discord/__integration__/TC-CHANNEL-DISCORD-005.spec.ts

@@ -0,0 +1,156 @@
+import { expect, test } from '@playwright/test'
+import {
+  createDiscordSigner,
+  freshTimestamp,
+  interactionsUrl,
+  pingInteractionBody,
+  slashCommandInteractionBody,
+  staleTimestamp,
+} from './helpers/discordSignature'
+
+/**
+ * TC-CHANNEL-DISCORD-005 — Interactions endpoint security (fail-closed).
+ * Source: .ai/specs/2026-06-19-discord-communication-channel-integration.md
+ *
+ * `POST /api/channel_discord/interactions` is deliberately unauthenticated at
+ * the platform layer — the Ed25519 signature IS the auth. This spec drives the
+ * REAL route (DB fan-out over candidate channels included) and asserts it is
+ * fail-closed on every rejection path:
+ *
+ *  - no signature headers at all           → 401
+ *  - a syntactically valid but wrong signature → 401
+ *  - a body altered after signing          → 401
+ *  - a signed timestamp outside the replay window → 401 `stale_timestamp`,
+ *    which also proves the freshness guard runs BEFORE the per-candidate
+ *    verify fan-out (constant cost for a replayed capture)
+ *  - a fully-formed slash command signed by an unknown key → 401, never a
+ *    deferred ack: since #4663 a deferred ack promises a hub write and a
+ *    follow-up, so it must stay strictly behind the signature gate
+ *
+ * A rejection must never leak which tenants have Discord channels, so the
+ * response body is asserted to carry nothing but the error code.
+ *
+ * The success paths — PONG (`{ type: 1 }`) and the dispatched slash command /
+ * component (`{ type: 5 }` plus the hub job and the Discord follow-up) — need a
+ * channel whose stored public key matches the signer; connecting one requires a
+ * live bot token. That half stays unit-tested, in
+ * `lib/__tests__/interactions-handler.test.ts`,
+ * `lib/__tests__/interactions-dispatch.test.ts`,
+ * `lib/__tests__/capabilities.test.ts` (the capability parity check) and
+ * `workers/__tests__/discord-interactions.test.ts`.
+ */
+test.describe('TC-CHANNEL-DISCORD-005: interactions endpoint is fail-closed', () => {
+  test('an unsigned interaction is rejected', async ({ request }) => {
+    const bare = await request.post(interactionsUrl(), {
+      headers: { 'content-type': 'application/json' },
+      data: pingInteractionBody(),
+    })
+    expect(bare.status(), 'a request with no signature headers must be rejected').toBe(401)
+    expect(
+      await bare.json(),
+      'with no signed timestamp the freshness guard answers first — it runs before the signature fan-out',
+    ).toEqual({ error: 'stale_timestamp' })
+
+    const timestamped = await request.post(interactionsUrl(), {
+      headers: { 'content-type': 'application/json', 'x-signature-timestamp': freshTimestamp() },
+      data: pingInteractionBody(),
+    })
+    expect(timestamped.status(), 'a fresh timestamp with no signature must still be rejected').toBe(401)
+    expect(await timestamped.json(), 'the rejection must not leak candidate channels').toEqual({
+      error: 'invalid_signature',
+    })
+  })
+
+  test('a signature from an unknown key is rejected', async ({ request }) => {
+    const signer = createDiscordSigner()
+    const timestamp = freshTimestamp()
+    const body = pingInteractionBody()
+
+    const response = await request.post(interactionsUrl(), {
+      headers: {
+        'content-type': 'application/json',
+        'x-signature-ed25519': signer.sign(timestamp, body),
+        'x-signature-timestamp': timestamp,
+      },
+      data: body,
+    })
+    expect(
+      response.status(),
+      'a cryptographically valid signature from a key no channel stores must still be rejected',
+    ).toBe(401)
+    expect(await response.json()).toEqual({ error: 'invalid_signature' })
+  })
+
+  test('a body altered after signing is rejected', async ({ request }) => {
+    const signer = createDiscordSigner()
+    const timestamp = freshTimestamp()
+    const signed = pingInteractionBody()
+    const tampered = JSON.stringify({ ...JSON.parse(signed), type: 2 })
+
+    const response = await request.post(interactionsUrl(), {
+      headers: {
+        'content-type': 'application/json',
+        'x-signature-ed25519': signer.sign(timestamp, signed),
+        'x-signature-timestamp': timestamp,
+      },
+      data: tampered,
+    })
+    expect(response.status(), 'a tampered body must be rejected').toBe(401)
+    expect(await response.json()).toEqual({ error: 'invalid_signature' })
+  })
+
+  test('a replayed (stale) timestamp is rejected before the candidate fan-out', async ({
+    request,
+  }) => {
+    const signer = createDiscordSigner()
+    const timestamp = staleTimestamp()
+    const body = pingInteractionBody()
+
+    const response = await request.post(interactionsUrl(), {
+      headers: {
+        'content-type': 'application/json',
+        'x-signature-ed25519': signer.sign(timestamp, body),
+        'x-signature-timestamp': timestamp,
+      },
+      data: body,
+    })
+    expect(response.status(), 'a stale signed timestamp must be rejected').toBe(401)
+    expect(
+      await response.json(),
+      'the replay guard must answer before any per-candidate verification',
+    ).toEqual({ error: 'stale_timestamp' })
+  })
+
+  test('an unverified slash command gets no deferred ack and no dispatch', async ({ request }) => {
+    // The endpoint now DISPATCHES verified commands (issue #4663), which means a
+    // deferred ack is a promise to write into a tenant's hub and post back to
+    // Discord. That promise must stay behind the signature gate: a command
+    // signed by a key no channel stores is rejected exactly like a PING, never
+    // acknowledged with `{ type: 5 }`.
+    const signer = createDiscordSigner()
+    const timestamp = freshTimestamp()
+    const body = slashCommandInteractionBody()
+
+    const response = await request.post(interactionsUrl(), {
+      headers: {
+        'content-type': 'application/json',
+        'x-signature-ed25519': signer.sign(timestamp, body),
+        'x-signature-timestamp': timestamp,
+      },
+      data: body,
+    })
+    expect(response.status(), 'an unverified slash command must be rejected, not deferred').toBe(401)
+    expect(await response.json()).toEqual({ error: 'invalid_signature' })
+  })
+
+  test('a non-JSON body cannot crash the endpoint', async ({ request }) => {
+    const response = await request.post(interactionsUrl(), {
+      headers: { 'content-type': 'application/json' },
+      data: 'not json at all',
+    })
+    expect(
+      response.status(),
+      'an unsigned garbage body must be refused by the signature gate, never 5xx',
+    ).toBe(401)
+  })
+})

package/src/modules/channel_discord/__integration__/TC-CHANNEL-DISCORD-006.spec.ts

@@ -0,0 +1,144 @@
+import { expect, test } from '@playwright/test'
+import { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api'
+import { readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures'
+import { deleteEntityIfExists } from '@open-mercato/core/helpers/integration/crmFixtures'
+import {
+  deleteChannelIfExists,
+  isChannelSeedingAvailable,
+  seedConnectedChannel,
+  seedInboundMessage,
+} from '@open-mercato/core/helpers/integration/communicationChannelsFixtures'
+import { drainEventsQueue } from './helpers/eventsQueue'
+
+/**
+ * TC-CHANNEL-DISCORD-006 — contact resolution for an inbound Discord message.
+ * Source: .ai/specs/2026-06-19-discord-communication-channel-integration.md
+ *
+ * The provider deliberately ships NO contact-resolution logic: an inbound
+ * Discord message reaches the CRM through the same hub event and the same
+ * persistent `customers:link-channel-message-received` subscriber as e-mail.
+ * This spec proves that claim end to end — a Discord-provider inbound message
+ * whose sender matches a Person's stored address lands exactly one interaction
+ * on that Person's timeline, attributed to the `discord` provider.
+ *
+ * That "exactly one" matters: a provider that duplicated the hub's linking would
+ * show up here as two interactions.
+ *
+ * Driven via the env-gated test-seed fixture (`OM_ENABLE_TEST_CHANNEL_SEEDING`);
+ * skips when the gate is off.
+ */
+type Interaction = {
+  id: string
+  interactionType: string
+  title: string | null
+  body: string | null
+  visibility: string | null
+  authorUserId: string | null
+}
+
+async function drainAndListInteractions(
+  request: Parameters<typeof apiRequest>[0],
+  token: string,
+  personId: string,
+  timeoutMs = 20_000,
+): Promise<Interaction[]> {
+  const deadline = Date.now() + timeoutMs
+  let last: Interaction[] = []
+  while (Date.now() < deadline) {
+    await drainEventsQueue()
+    const response = await apiRequest(
+      request,
+      'GET',
+      `/api/customers/interactions?entityId=${encodeURIComponent(personId)}&interactionType=email`,
+      { token },
+    )
+    if (response.ok()) {
+      const body = await readJsonSafe<{ items?: Interaction[] }>(response)
+      last = Array.isArray(body?.items) ? body!.items : []
+      if (last.length > 0) return last
+    }
+    await new Promise((resolve) => setTimeout(resolve, 250))
+  }
+  return last
+}
+
+test.describe('TC-CHANNEL-DISCORD-006: inbound discord message resolves to a contact', () => {
+  test('an inbound discord message from a known contact creates exactly one interaction', async ({
+    request,
+  }) => {
+    test.slow()
+    let token: string | null = null
+    let personId: string | null = null
+    let channelId: string | null = null
+    let interactionId: string | null = null
+    try {
+      token = await getAuthToken(request, 'admin')
+      const seedingAvailable = await isChannelSeedingAvailable(request, token)
+      test.skip(
+        !seedingAvailable,
+        'OM_ENABLE_TEST_CHANNEL_SEEDING is not enabled in this environment; cannot emit inbound messages.',
+      )
+
+      const stamp = Date.now()
+      const senderAddress = `discord-006-sender-${stamp}@example.com`
+
+      const person = await apiRequest(request, 'POST', '/api/customers/people', {
+        token,
+        data: {
+          firstName: 'Discord006',
+          lastName: `Contact${stamp}`,
+          displayName: `Discord006 Contact ${stamp}`,
+          primaryEmail: senderAddress,
+        },
+      })
+      expect(person.ok(), 'creating the contact fixture should succeed').toBeTruthy()
+      const personBody = await readJsonSafe<{ id?: string }>(person)
+      personId = personBody?.id ?? null
+      expect(personId, 'the person fixture must return an id').toBeTruthy()
+
+      channelId = await seedConnectedChannel(request, token, {
+        displayName: `TC-CHANNEL-DISCORD-006 ${stamp}`,
+        externalIdentifier: `discord-006-${stamp}@test-seed.local`,
+      })
+
+      const subject = `Discord inbound from a known contact ${stamp}`
+      const bodyText = 'this should land on the CRM timeline'
+      await seedInboundMessage(request, token, {
+        channelId,
+        providerKey: 'discord',
+        from: senderAddress,
+        subject,
+        bodyText,
+        messageId: `discord-message-006-${stamp}`,
+      })
+
+      const items = await drainAndListInteractions(request, token, personId as string)
+      expect(items.length, 'exactly one interaction must be linked to the contact').toBe(1)
+      const interaction = items[0]
+      interactionId = interaction.id
+      expect(interaction.interactionType, 'channel messages land as email interactions').toBe('email')
+      // Title + body identify THIS Discord message. The interactions list
+      // projection does not expose `externalMessageId` / `channelProviderKey`,
+      // so link identity and provider attribution are asserted where they are
+      // written, in the hub handler's own unit tests.
+      expect(interaction.title, 'the interaction must carry the discord message subject').toBe(subject)
+      expect(interaction.body, 'the interaction must carry the discord message body').toBe(bodyText)
+      expect(
+        interaction.visibility,
+        'a user-owned channel produces a private inbound interaction',
+      ).toBe('private')
+      expect(
+        interaction.authorUserId,
+        'the interaction must be authored by the channel owner, not left unattributed',
+      ).toBeTruthy()
+    } finally {
+      if (token) {
+        await deleteEntityIfExists(request, token, '/api/customers/interactions', interactionId)
+      }
+      await deleteChannelIfExists(request, token, channelId)
+      if (token) {
+        await deleteEntityIfExists(request, token, '/api/customers/people', personId)
+      }
+    }
+  })
+})

package/src/modules/channel_discord/__integration__/TC-CHANNEL-DISCORD-007.spec.ts

@@ -0,0 +1,119 @@
+import { expect, test } from '@playwright/test'
+import { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api'
+import { readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures'
+import {
+  deleteChannelIfExists,
+  isChannelSeedingAvailable,
+  seedConnectedChannel,
+  seedInboundMessage,
+} from '@open-mercato/core/helpers/integration/communicationChannelsFixtures'
+
+/**
+ * TC-CHANNEL-DISCORD-007 — health surface for a channel carrying Discord traffic.
+ * Source: .ai/specs/2026-06-19-discord-communication-channel-integration.md
+ *
+ * Operators diagnose a Discord channel through the hub's health route, so this
+ * spec pins that surface: it is tenant-scoped (401 unauthenticated, 400 on a
+ * malformed id, 404 for a channel the caller does not own) and it reports a
+ * fixed numeric shape that includes Discord-provider links.
+ *
+ * The provider's own probe (`channelDiscordHealthCheck`: healthy on a valid bot
+ * token, unhealthy on Discord's 401) calls the Discord API and is unit-tested
+ * against a stubbed REST client in `lib/__tests__/adapter.test.ts`.
+ */
+const UNKNOWN_CHANNEL_ID = '00000000-0000-4000-8000-0000000d1c07'
+
+test.describe('TC-CHANNEL-DISCORD-007: channel health surface', () => {
+  test('requires authentication', async ({ request }) => {
+    const response = await apiRequest(
+      request,
+      'GET',
+      `/api/communication_channels/channels/${UNKNOWN_CHANNEL_ID}/health`,
+      // Intentionally empty token — this assertion is the 401 unauth path.
+      { token: '' },
+    )
+    expect(response.status(), 'health must reject an unauthenticated caller').toBe(401)
+  })
+
+  test('rejects a malformed channel id', async ({ request }) => {
+    const token = await getAuthToken(request, 'admin')
+    const response = await apiRequest(
+      request,
+      'GET',
+      '/api/communication_channels/channels/not-a-uuid/health',
+      { token },
+    )
+    expect(response.status(), 'a non-uuid channel id must be a 400, not a 500').toBe(400)
+  })
+
+  test('rejects a channel the caller does not own', async ({ request }) => {
+    const token = await getAuthToken(request, 'admin')
+    const response = await apiRequest(
+      request,
+      'GET',
+      `/api/communication_channels/channels/${UNKNOWN_CHANNEL_ID}/health`,
+      { token },
+    )
+    expect(response.status(), 'an unknown/foreign channel must be 404').toBe(404)
+  })
+
+  test('reports a numeric delivery snapshot that includes discord traffic', async ({ request }) => {
+    test.slow()
+    let token: string | null = null
+    let channelId: string | null = null
+    try {
+      token = await getAuthToken(request, 'admin')
+      const seedingAvailable = await isChannelSeedingAvailable(request, token)
+      test.skip(
+        !seedingAvailable,
+        'OM_ENABLE_TEST_CHANNEL_SEEDING is not enabled in this environment; cannot seed a channel.',
+      )
+
+      const stamp = Date.now()
+      channelId = await seedConnectedChannel(request, token, {
+        displayName: `TC-CHANNEL-DISCORD-007 ${stamp}`,
+        externalIdentifier: `discord-007-${stamp}@test-seed.local`,
+      })
+      await seedInboundMessage(request, token, {
+        channelId,
+        providerKey: 'discord',
+        from: `discord-user-${stamp}`,
+        subject: `Discord health seed ${stamp}`,
+        bodyText: 'seed message for the health window',
+        messageId: `discord-message-007-${stamp}`,
+      })
+
+      const response = await apiRequest(
+        request,
+        'GET',
+        `/api/communication_channels/channels/${channelId}/health`,
+        { token },
+      )
+      expect(response.status(), 'GET /channels/[id]/health should return 200').toBe(200)
+      const body = await readJsonSafe<{
+        channelId?: string
+        windowHours?: number
+        counts?: Record<string, number>
+        totalsLast24h?: number
+        recentFailures?: unknown[]
+      }>(response)
+
+      expect(body?.channelId, 'health must be scoped to the requested channel').toBe(channelId)
+      expect(typeof body?.windowHours, 'the health window must be reported').toBe('number')
+      expect(
+        Object.keys(body?.counts ?? {}),
+        'the delivery-status breakdown must keep its fixed shape',
+      ).toEqual(expect.arrayContaining(['sent', 'delivered', 'failed', 'pending', 'queued']))
+      for (const [status, value] of Object.entries(body?.counts ?? {})) {
+        expect(typeof value, `counts.${status} must be numeric`).toBe('number')
+      }
+      expect(
+        body?.totalsLast24h ?? 0,
+        'the seeded discord message must be inside the 24h window',
+      ).toBeGreaterThanOrEqual(1)
+      expect(Array.isArray(body?.recentFailures), 'recentFailures must always be an array').toBe(true)
+    } finally {
+      await deleteChannelIfExists(request, token, channelId)
+    }
+  })
+})

package/src/modules/channel_discord/__integration__/TC-CHANNEL-DISCORD-008.spec.ts

@@ -0,0 +1,75 @@
+import { expect, test } from '@playwright/test'
+import { createDiscordSigner, freshTimestamp, interactionsUrl, pingInteractionBody } from './helpers/discordSignature'
+
+/**
+ * TC-CHANNEL-DISCORD-008 — tenant isolation on the shared interactions endpoint.
+ * Source: .ai/specs/2026-06-19-discord-communication-channel-integration.md
+ *
+ * One unauthenticated URL serves every tenant's Discord application, so the
+ * candidate fan-out is the isolation boundary: a request is pinned to the single
+ * channel whose stored public key verifies it, and a request that verifies
+ * against none must be indistinguishable from any other rejection.
+ *
+ * This spec drives the real route with two independent applications' keys and
+ * asserts the endpoint is a black box: identical status, identical body, no
+ * channel id, tenant id, organization id or count anywhere in the response, and
+ * no timing-visible difference in shape between them. That is the observable
+ * half of the isolation contract on an instance with no connected Discord
+ * channel — the positive half (a signature pinning exactly its own tenant, and
+ * never another's) requires two live bot tokens and is unit-tested as
+ * "per-tenant public-key pinning" in `lib/__tests__/interactions-handler.test.ts`.
+ */
+const LEAKY_KEYS = ['channelId', 'tenantId', 'organizationId', 'candidates', 'channels']
+
+test.describe('TC-CHANNEL-DISCORD-008: interactions endpoint leaks no tenant state', () => {
+  test('two different applications get byte-identical rejections', async ({ request }) => {
+    const bodies: unknown[] = []
+    const statuses: number[] = []
+
+    for (const label of ['tenant-a', 'tenant-b']) {
+      const signer = createDiscordSigner()
+      const timestamp = freshTimestamp()
+      const body = JSON.stringify({ ...JSON.parse(pingInteractionBody()), application_id: label })
+      const response = await request.post(interactionsUrl(), {
+        headers: {
+          'content-type': 'application/json',
+          'x-signature-ed25519': signer.sign(timestamp, body),
+          'x-signature-timestamp': timestamp,
+        },
+        data: body,
+      })
+      statuses.push(response.status())
+      bodies.push(await response.json())
+    }
+
+    expect(statuses, 'both applications must be rejected the same way').toEqual([401, 401])
+    expect(
+      bodies[0],
+      'the rejection body must not vary with the caller — that variance would be a tenant oracle',
+    ).toEqual(bodies[1])
+  })
+
+  test('a rejection body carries no tenant-scoped identifiers', async ({ request }) => {
+    const signer = createDiscordSigner()
+    const timestamp = freshTimestamp()
+    const body = pingInteractionBody()
+    const response = await request.post(interactionsUrl(), {
+      headers: {
+        'content-type': 'application/json',
+        'x-signature-ed25519': signer.sign(timestamp, body),
+        'x-signature-timestamp': timestamp,
+      },
+      data: body,
+    })
+
+    expect(response.status()).toBe(401)
+    const raw = await response.text()
+    for (const key of LEAKY_KEYS) {
+      expect(raw, `an unverified caller must not learn "${key}"`).not.toContain(key)
+    }
+    expect(
+      Object.keys((await response.json()) as Record<string, unknown>),
+      'the rejection body is exactly one error code',
+    ).toEqual(['error'])
+  })
+})

package/src/modules/channel_discord/__integration__/helpers/discordSignature.ts

@@ -0,0 +1,77 @@
+import { createPrivateKey, generateKeyPairSync, sign as signEd25519 } from 'node:crypto'
+
+/**
+ * Ed25519 request-signing helpers for the Discord Interactions integration
+ * tests. Discord signs `timestamp + rawBody` with the application's Ed25519 key
+ * and sends the signature in `X-Signature-Ed25519`; the provider route verifies
+ * it against every candidate channel's stored public key and is fail-closed.
+ *
+ * The tests generate their own keypair so they never need a real Discord
+ * application, and so a signature that is cryptographically perfect but belongs
+ * to no connected channel is still rejected — which is the property under test.
+ */
+
+export type DiscordSigner = {
+  /** Raw 32-byte Ed25519 public key, hex encoded — the shape Discord shows in the portal. */
+  publicKeyHex: string
+  /** Sign `timestamp + body` exactly the way Discord does. */
+  sign: (timestamp: string, body: string) => string
+}
+
+export function createDiscordSigner(): DiscordSigner {
+  const { publicKey, privateKey } = generateKeyPairSync('ed25519')
+  const spki = publicKey.export({ format: 'der', type: 'spki' }) as Buffer
+  // SPKI for Ed25519 is a fixed 12-byte header followed by the raw 32-byte key.
+  const rawPublicKey = spki.subarray(spki.length - 32)
+  const key = createPrivateKey(privateKey.export({ format: 'pem', type: 'pkcs8' }) as string)
+  return {
+    publicKeyHex: rawPublicKey.toString('hex'),
+    sign: (timestamp: string, body: string) =>
+      signEd25519(null, Buffer.from(`${timestamp}${body}`, 'utf8'), key).toString('hex'),
+  }
+}
+
+/** A PING interaction body — the handshake Discord sends when an endpoint URL is saved. */
+export function pingInteractionBody(): string {
+  return JSON.stringify({ type: 1, id: 'integration-ping', application_id: 'integration' })
+}
+
+/**
+ * A fully-formed `APPLICATION_COMMAND` body — everything the dispatch path needs
+ * (id, follow-up token, application, channel and invoking user), so a rejection
+ * can only come from the signature gate and never from an incomplete payload.
+ */
+export function slashCommandInteractionBody(): string {
+  return JSON.stringify({
+    type: 2,
+    id: 'integration-command',
+    token: 'integration-follow-up-token',
+    application_id: 'integration',
+    channel_id: 'integration-channel',
+    member: { user: { id: 'integration-user', username: 'integration' } },
+    data: { name: 'mercato', options: [{ name: 'message', value: 'integration probe' }] },
+  })
+}
+
+/** Current unix seconds as the signed timestamp header value. */
+export function freshTimestamp(): string {
+  return String(Math.floor(Date.now() / 1000))
+}
+
+/** A timestamp far outside the provider's replay window (DISCORD_SIGNATURE_MAX_SKEW_SECONDS = 300). */
+export function staleTimestamp(): string {
+  return String(Math.floor(Date.now() / 1000) - 3600)
+}
+
+export const INTERACTIONS_PATH = '/api/channel_discord/interactions'
+
+/**
+ * The interactions endpoint is posted with a RAW body (the signature covers the
+ * exact bytes), so these specs bypass `apiRequest` and call Playwright's request
+ * context directly — which means they must resolve `BASE_URL` the same way the
+ * shared helper does.
+ */
+export function interactionsUrl(): string {
+  const base = process.env.BASE_URL?.trim()
+  return base ? `${base}${INTERACTIONS_PATH}` : INTERACTIONS_PATH
+}

package/src/modules/channel_discord/__integration__/helpers/eventsQueue.ts

@@ -0,0 +1,26 @@
+import path from 'node:path'
+import { config as loadEnv } from 'dotenv'
+import { drainIntegrationQueue } from '@open-mercato/core/helpers/integration/queue'
+
+/**
+ * The hub emits `communication_channels.message.received` through the `events`
+ * queue, where the persistent `customers:link-channel-message-received`
+ * subscriber consumes it. Integration specs that assert on the CRM side of an
+ * inbound Discord message must drain that queue first.
+ *
+ * Mirrors the customers module's own inbound-email helper: the Playwright
+ * process is the monorepo while the job was created by the app under test, so
+ * the drain runs from the app root (`OM_TEST_APP_ROOT` when set).
+ */
+export const APP_ROOT = process.env.OM_TEST_APP_ROOT?.trim()
+  ? path.resolve(process.env.OM_TEST_APP_ROOT as string)
+  : path.resolve(process.cwd(), 'apps/mercato')
+
+if (!process.env.OM_TEST_APP_ROOT?.trim()) {
+  loadEnv({ path: path.resolve(APP_ROOT, '.env') })
+  process.env.QUEUE_BASE_DIR = path.resolve(APP_ROOT, '.mercato/queue')
+}
+
+export async function drainEventsQueue(): Promise<void> {
+  await drainIntegrationQueue('events', { appRoot: APP_ROOT })
+}