@tollwyn/baukasten 0.0.2 → 1.2.3

package/dist/testing/connection.js

@@ -0,0 +1,303 @@
+// The connection test of a product, which its e2e/baukasten.spec.ts (a stub) runs against the built
+// product with the doubles. Playwright comes from the product, handed in by the stub, so that one
+// copy of it runs; the package names it no peer, since npm keeps an optional peer of a dependency in
+// the image of every product (`devOptional` outlives `npm prune --omit=dev`). The product's own
+// variables come from the environment of the test run: its playwright.config.ts sets those its
+// configuration requires.
+import { fileURLToPath } from 'node:url';
+import { z } from 'zod';
+import { SECURITY_HEADERS } from '../server/headers.js';
+import { TEXTS } from '../texts.js';
+import { spawnNode, startApp } from './app.js';
+import { newCaller, open, waitForHydration } from './browser.js';
+import { createTestDatabase } from './database.js';
+import { linkIn, startSmtp } from './smtp.js';
+import { startStripe } from './stripe.js';
+const MIGRATE = fileURLToPath(new URL('../bin/migrate.js', import.meta.url));
+/** What the delivery service sets in production, as far as the test sets it itself. */
+const STANDARD = {
+    NODE_ENV: 'production',
+    MAIL_FROM: 'hello@example.com',
+    MAIL_FROM_NAME: 'Connection Test',
+    OPERATOR_NAME: 'Connection Test Operator',
+    OPERATOR_ADDRESS: 'Street 1, 5400 Baden',
+    OPERATOR_REGISTER: 'none',
+    OPERATOR_VAT: 'none',
+    OPERATOR_JURISDICTION: 'Baden',
+    HOSTING_LOCATION: 'Example Hosting, Nuremberg',
+    VERTRIEB_TOKEN: 'v'.repeat(64)
+};
+const VIA = 'connection-test';
+const EMAIL = 'connection-test@example.com';
+const SESSION = '__Host-session';
+/** The product's own variables from the environment of the test run; loud on a required one missing. */
+function ownVariables(env) {
+    const given = {};
+    const lacking = [];
+    for (const [name, schema] of Object.entries(env)) {
+        const value = process.env[name];
+        if (value !== undefined)
+            given[name] = value;
+        else if (!schema.safeParse(undefined).success)
+            lacking.push(name);
+    }
+    if (lacking.length > 0) {
+        throw new Error(`the connection test takes the product's own variables from the environment of the test run, which lacks ${lacking.join(', ')}: set them in playwright.config.ts`);
+    }
+    return given;
+}
+/** Registers the connection test of `product` with the test and expect of the product's Playwright. */
+export function connectionTest(product, playwright) {
+    const { test, expect } = playwright;
+    const t = TEXTS[product.language];
+    const home = product.accounts.home;
+    const [price] = product.catalog.products.flatMap((sold) => sold.prices);
+    if (price === undefined)
+        throw new Error('the catalog of the product names no price');
+    test.describe('the connection of the baukasten', () => {
+        test.describe.configure({ mode: 'serial' });
+        let database;
+        let smtp;
+        let stripe;
+        let app;
+        let context;
+        let page;
+        let key;
+        /** Undoes what beforeAll set up, as far as it came, the last first. */
+        const undo = [];
+        const bearer = (secret) => ({
+            ...newCaller().headers,
+            Authorization: `Bearer ${secret}`
+        });
+        const cookies = async () => (await context.cookies()).map((cookie) => cookie.name);
+        async function logIn(password) {
+            await open(page, `${app.url}/login`);
+            await page.getByLabel(t.login.email, { exact: true }).fill(EMAIL);
+            await page.getByLabel(t.login.password, { exact: true }).fill(password);
+            await page.getByRole('button', { name: t.login.button }).click();
+            await expect(page).toHaveURL(`${app.url}${home}`);
+        }
+        async function logOut() {
+            await page
+                .getByRole('navigation', { name: t.frame.accountMenu })
+                .getByRole('button', { name: t.frame.logOut })
+                .click();
+            await expect(page).toHaveURL(`${app.url}/logout`);
+            await waitForHydration(page);
+        }
+        test.beforeAll(async ({ browser }) => {
+            const own = ownVariables(product.env);
+            database = await createTestDatabase();
+            undo.push(() => database.drop());
+            smtp = await startSmtp();
+            undo.push(() => smtp.stop());
+            stripe = await startStripe();
+            undo.push(() => stripe.stop());
+            app = await startApp({
+                env: { ...STANDARD, ...own, DATABASE_URL: database.url },
+                smtp,
+                stripe
+            });
+            undo.push(() => app.stop());
+            // The catalog at the double, as the migration sets it up before every start.
+            const migrate = spawnNode([MIGRATE], {
+                ...STANDARD,
+                ...own,
+                DATABASE_URL: database.url,
+                PUBLIC_ORIGIN: app.url,
+                PORT: new URL(app.url).port,
+                SMTP_HOST: smtp.host,
+                SMTP_PORT: String(smtp.port),
+                STRIPE_SECRET_KEY: 'rk_test_double',
+                STRIPE_API_BASE: stripe.url,
+                STRIPE_WEBHOOK_SECRET: stripe.webhookSecret
+            });
+            expect(await migrate.exited, JSON.stringify(migrate.logs)).toBe(0);
+            context = await browser.newContext({ extraHTTPHeaders: newCaller().headers });
+            undo.push(() => context.close());
+            page = await context.newPage();
+        });
+        test.afterAll(async () => {
+            // Every step, though one before it failed: the test database goes in any case.
+            const failed = [];
+            for (const step of undo.reverse()) {
+                try {
+                    await step();
+                }
+                catch (error) {
+                    failed.push(error);
+                }
+            }
+            if (failed.length > 0)
+                throw new AggregateError(failed, 'cleaning up after the connection test failed');
+        });
+        test('a Kennung travels from a page to the sign-up, and the mail confirms the address', async () => {
+            await open(page, `${app.url}/imprint?via=${VIA}`);
+            await page
+                .getByRole('navigation', { name: t.frame.accountMenu })
+                .getByRole('link', { name: t.frame.signUp })
+                .click();
+            await expect(page).toHaveURL(`${app.url}/signup?via=${VIA}`);
+            expect(await cookies()).toEqual([]);
+            await page.getByLabel(t.signup.email, { exact: true }).fill(EMAIL);
+            await page.getByLabel(t.signup.password, { exact: true }).fill('the first password');
+            const terms = t.signup.terms;
+            await page
+                .getByRole('checkbox', { name: `${terms.before}${terms.link}${terms.after}` })
+                .check();
+            await page.getByRole('checkbox', { name: t.signup.business }).check();
+            await page.getByRole('button', { name: t.signup.button }).click();
+            await expect(page).toHaveURL(`${app.url}${home}`);
+            expect(await context.cookies()).toEqual([
+                expect.objectContaining({ name: SESSION, httpOnly: true, secure: true, sameSite: 'Lax' })
+            ]);
+            const mail = await smtp.next(EMAIL);
+            await open(page, linkIn(mail.text, `${app.url}/verify-email?token=`));
+            await page.getByRole('button', { name: t.verify.button }).click();
+            await expect(page).toHaveURL(`${app.url}/account?verified`);
+        });
+        test('log out and in, and a new password by mail', async () => {
+            await logOut();
+            await logIn('the first password');
+            await logOut();
+            await open(page, `${app.url}/forgot-password`);
+            await page.getByLabel(t.forgot.email, { exact: true }).fill(EMAIL);
+            await page.getByRole('button', { name: t.forgot.button }).click();
+            await expect(page.getByRole('status')).toHaveText(t.forgot.sent);
+            const mail = await smtp.next(EMAIL);
+            await open(page, linkIn(mail.text, `${app.url}/reset-password?token=`));
+            await page.getByLabel(t.reset.password, { exact: true }).fill('the second password');
+            await page.getByRole('button', { name: t.reset.button }).click();
+            await expect(page).toHaveURL(`${app.url}${home}`);
+            await logOut();
+            await logIn('the second password');
+        });
+        test('an API key reads its account', async ({ request }) => {
+            await open(page, `${app.url}/account`);
+            await page.getByLabel(t.account.keys.name, { exact: true }).fill('connection test');
+            await page.getByRole('button', { name: t.account.keys.button }).click();
+            const shown = page.locator('code.bk-secret');
+            await expect(shown).toHaveText(new RegExp(`^${product.accounts.keyPrefix}_[A-Za-z0-9_-]+$`));
+            key = (await shown.innerText()).trim();
+            const account = await request.get(`${app.url}/api/v1/account`, { headers: bearer(key) });
+            expect(account.status()).toBe(200);
+            const body = await account.json();
+            expect(body).toMatchObject({ email: EMAIL, email_verified: true });
+        });
+        test('Checkout pays the first price of the catalog, and the account opens the customer portal', async ({ request }) => {
+            const checkout = await request.post(`${app.url}/api/v1/billing/checkout`, {
+                headers: bearer(key),
+                data: { price: price.lookupKey }
+            });
+            expect(checkout.status()).toBe(200);
+            const opened = await checkout.json();
+            await page.goto(z.object({ url: z.string() }).parse(opened).url);
+            await expect(page).toHaveTitle('Stripe Checkout (test double)');
+            await page.getByRole('button', { name: 'Pay' }).click();
+            await expect(page).toHaveURL(`${app.url}/account`);
+            await waitForHydration(page);
+            await page.getByRole('button', { name: t.account.billing.button }).click();
+            await expect(page).toHaveTitle('Stripe customer portal (test double)');
+            await page.getByRole('link', { name: 'Back' }).click();
+            await expect(page).toHaveURL(`${app.url}/account`);
+            await waitForHydration(page);
+        });
+        test('the sales numbers count the account and its payment under its Kennung', async ({ request }) => {
+            const refused = await request.get(`${app.url}/vertrieb/zahlen`);
+            expect(refused.status()).toBe(401);
+            const numbers = await request.get(`${app.url}/vertrieb/zahlen`, {
+                headers: { Authorization: `Bearer ${STANDARD.VERTRIEB_TOKEN}` }
+            });
+            expect(numbers.status()).toBe(200);
+            const body = await numbers.json();
+            expect(body).toMatchObject({
+                je_kennung: [
+                    {
+                        kennung: VIA,
+                        werte: expect.arrayContaining([
+                            { name: 'Konten', wert: 1 },
+                            { name: 'Zahlende', wert: 1 }
+                        ]),
+                        umsatz: { cent: price.amount, waehrung: product.catalog.currency }
+                    }
+                ]
+            });
+        });
+        test('the legal pages name the operator, in the language of the product', async () => {
+            const footer = t.frame;
+            for (const [path, link] of [
+                ['imprint', footer.imprint],
+                ['privacy', footer.privacy],
+                ['terms', footer.terms]
+            ]) {
+                await open(page, `${app.url}/${path}`);
+                await expect(page.locator('html')).toHaveAttribute('lang', product.language);
+                await expect(page.getByRole('contentinfo').getByRole('link', { name: link, exact: true })).toHaveAttribute('href', `/${path}`);
+                const text = await page.getByRole('main').innerText();
+                expect(text, path).toContain(STANDARD.OPERATOR_NAME);
+                expect(text, path).toContain(STANDARD.OPERATOR_ADDRESS);
+                expect(text, path).not.toMatch(/undefined|null|NaN|\[object/);
+            }
+        });
+        test('a page carries the security headers and its policy, and the session is the only cookie', async () => {
+            const response = await page.goto(`${app.url}/account`);
+            if (response === null)
+                throw new Error('the page gave no response');
+            const headers = response.headers();
+            for (const [name, value] of Object.entries(SECURITY_HEADERS)) {
+                expect(headers[name], name).toBe(value);
+            }
+            expect(headers['content-security-policy']).toMatch(/script-src 'self'/);
+            expect(headers['content-security-policy']).toContain("frame-ancestors 'none'");
+            expect(await cookies()).toEqual([SESSION]);
+        });
+        test('the head shows the logo of the product, and its icon and the picture of a shared link load', async ({ request }) => {
+            await open(page, `${app.url}/imprint`);
+            const head = page.getByRole('banner');
+            const brand = product.brand;
+            if (brand === undefined) {
+                // Without marks the frame names the product as text.
+                await expect(head.getByRole('link', { name: STANDARD.MAIL_FROM_NAME })).toBeVisible();
+                return;
+            }
+            const logo = head.getByRole('img', { name: STANDARD.MAIL_FROM_NAME });
+            await expect(logo).toHaveAttribute('src', brand.logo.src);
+            // After hydration the head may name the icon at the whole address of the page.
+            const icon = brand.icon.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+            await expect(page.locator('link[rel="icon"]')).toHaveAttribute('href', new RegExp(`^(${app.url.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')})?${icon}$`));
+            await expect(page.locator('meta[property="og:image"]')).toHaveAttribute('content', new URL(brand.image, app.url).href);
+            const files = [
+                [brand.logo.src, 'image/svg+xml'],
+                [brand.icon, brand.icon.endsWith('.svg') ? 'image/svg+xml' : 'image/png'],
+                [brand.image, 'image/png']
+            ];
+            for (const [path, type] of files) {
+                const file = await request.get(`${app.url}${path}`, { headers: newCaller().headers });
+                expect(file.status(), path).toBe(200);
+                expect(file.headers()['content-type'], path).toBe(type);
+            }
+            // A PNG names its width and height at the start of its first chunk: 1200 × 630 for a link.
+            const image = await (await request.get(`${app.url}${brand.image}`)).body();
+            expect(image.subarray(1, 4).toString('latin1')).toBe('PNG');
+            expect([image.readUInt32BE(16), image.readUInt32BE(20)]).toEqual([1200, 630]);
+        });
+        test('deleting the account ends its key and its subscriptions, and logs out', async ({ request }) => {
+            await open(page, `${app.url}/account`);
+            await page.getByLabel(t.account.delete.confirm, { exact: true }).fill(EMAIL);
+            await page.getByRole('button', { name: t.account.delete.button }).click();
+            await expect(page).toHaveURL(`${app.url}/logout?deleted`);
+            expect(await cookies()).toEqual([]);
+            const account = await request.get(`${app.url}/api/v1/account`, { headers: bearer(key) });
+            expect(account.status()).toBe(401);
+            await stripe.idle();
+            const running = [...stripe.subscriptions.values()].filter((s) => s.status === 'active');
+            expect(running).toEqual([]);
+        });
+        test('the log of the product is JSON lines without the address, and stderr stays empty, to its end', async () => {
+            await app.stop();
+            expect(app.logs.filter((line) => 'notJson' in line)).toEqual([]);
+            expect(JSON.stringify(app.logs)).not.toContain(EMAIL);
+            expect(app.stderr()).toBe('');
+        });
+    });
+}

package/dist/testing/database.d.ts

@@ -0,0 +1,21 @@
+import pg from 'pg';
+import { type Art } from '../server/adapter/migrate.js';
+export interface TestDatabase {
+    url: string;
+    /** Runs SQL in the database, for what a test sets up or looks at; one pool, opened on first use. */
+    query<T extends pg.QueryResultRow = pg.QueryResultRow>(sql: string, params?: unknown[]): Promise<T[]>;
+    /** Closes the pool and drops the database. */
+    drop(): Promise<void>;
+}
+/** Postgres allows 63 characters for a name. */
+export declare function testDatabaseName(server: string, suffix: string): string;
+/**
+ * Creates the database; `migrate: false` leaves it empty, `root` is the root of the product
+ * (default: the working directory), whose `migrations/` holds the second layer, and `art` the art of
+ * the product (default: a web app), whose layer of the baukasten comes first.
+ */
+export declare function createTestDatabase(options?: {
+    migrate?: boolean;
+    root?: string;
+    art?: Art;
+}): Promise<TestDatabase>;

package/dist/testing/database.js

@@ -0,0 +1,54 @@
+// A test database's name starts with that of the server database of TEST_DATABASE_URL, so that the
+// test databases of one worktree or container stay recognisable.
+import { randomBytes } from 'node:crypto';
+import pg from 'pg';
+import { migrate, migrationSources } from '../server/adapter/migrate.js';
+/** Postgres allows 63 characters for a name. */
+export function testDatabaseName(server, suffix) {
+    return `${server.slice(0, 63 - suffix.length - 1)}_${suffix}`;
+}
+function serverUrl() {
+    const url = process.env.TEST_DATABASE_URL;
+    if (url === undefined || url === '') {
+        throw new Error('TEST_DATABASE_URL is not set: it names a Postgres server on which the tests may create and drop databases');
+    }
+    return new URL(url);
+}
+async function onServer(server, sql) {
+    const client = new pg.Client({ connectionString: server.toString() });
+    await client.connect();
+    try {
+        await client.query(sql);
+    }
+    finally {
+        await client.end();
+    }
+}
+/**
+ * Creates the database; `migrate: false` leaves it empty, `root` is the root of the product
+ * (default: the working directory), whose `migrations/` holds the second layer, and `art` the art of
+ * the product (default: a web app), whose layer of the baukasten comes first.
+ */
+export async function createTestDatabase(options = {}) {
+    const server = serverUrl();
+    const name = testDatabaseName(server.pathname.slice(1), randomBytes(6).toString('hex'));
+    await onServer(server, `CREATE DATABASE "${name}"`);
+    const url = new URL(server);
+    url.pathname = `/${name}`;
+    let pool;
+    const database = {
+        url: url.toString(),
+        async query(sql, params) {
+            pool ??= new pg.Pool({ connectionString: url.toString(), max: 2 });
+            return (await pool.query(sql, params)).rows;
+        },
+        async drop() {
+            await pool?.end();
+            await onServer(server, `DROP DATABASE IF EXISTS "${name}" WITH (FORCE)`);
+        }
+    };
+    if (options.migrate ?? true) {
+        await migrate(database.url, migrationSources(options.root ?? process.cwd(), options.art ?? 'webapp'));
+    }
+    return database;
+}

package/dist/testing/env-example.d.ts

@@ -0,0 +1,4 @@
+import type { Product } from '../product.js';
+import { type ShopifyApp } from '../shopify/app.js';
+/** What is wrong with the text of `.env.example`; empty when nothing is. */
+export declare function envExampleProblems(text: string, product: Product | ShopifyApp): string[];

package/dist/testing/env-example.js

@@ -0,0 +1,33 @@
+import { isShopifyApp } from '../shopify/app.js';
+import { SHOPIFY_VARIABLES, WEBAPP_VARIABLES } from '../variables.js';
+const LINE = /^([A-Z][A-Z0-9_]*)=(.*)$/;
+/** What is wrong with the text of `.env.example`; empty when nothing is. */
+export function envExampleProblems(text, product) {
+    const problems = [];
+    const named = [];
+    text.split(/\r?\n/).forEach((line, index) => {
+        if (line.trim() === '' || line.startsWith('#'))
+            return;
+        const match = LINE.exec(line);
+        const name = match?.[1];
+        if (match === null || name === undefined) {
+            problems.push(`.env.example line ${index + 1} is neither a comment nor NAME=`);
+            return;
+        }
+        if (match[2] !== '') {
+            problems.push(`.env.example sets a value in line ${index + 1} (${name}); it names variables only`);
+        }
+        if (named.includes(name))
+            problems.push(`.env.example names ${name} twice`);
+        named.push(name);
+    });
+    const baukasten = isShopifyApp(product) ? SHOPIFY_VARIABLES : WEBAPP_VARIABLES;
+    const read = [...baukasten, ...Object.keys(product.env)];
+    const lacking = read.filter((name) => !named.includes(name));
+    if (lacking.length > 0)
+        problems.push(`.env.example lacks ${lacking.join(', ')}`);
+    const unread = named.filter((name) => !read.includes(name));
+    if (unread.length > 0)
+        problems.push(`.env.example names what nothing reads: ${unread.join(', ')}`);
+    return problems;
+}

package/dist/testing/index.d.ts

@@ -0,0 +1,9 @@
+export { freePort, spawnNode, startApp, type AppProcess, type LogLine, type RunningApp } from './app.js';
+export { connectionTest } from './connection.js';
+export { HYDRATED, newCaller, open, waitForHydration, type PageLike } from './browser.js';
+export { createTestDatabase, type TestDatabase } from './database.js';
+export { envExampleProblems } from './env-example.js';
+export { shopifyConnectionTest } from './shopify-connection.js';
+export { startShopify, type AdminAnswer, type DoubleShop, type ShopifyDouble } from './shopify.js';
+export { linkIn, startSmtp, type ReceivedMail, type SmtpDouble } from './smtp.js';
+export { startStripe, stripeSignature, type DoubleEndpoint, type DoublePrice, type DoubleSession, type DoubleSubscription, type StripeDouble } from './stripe.js';

package/dist/testing/index.js

@@ -0,0 +1,9 @@
+export { freePort, spawnNode, startApp } from './app.js';
+export { connectionTest } from './connection.js';
+export { HYDRATED, newCaller, open, waitForHydration } from './browser.js';
+export { createTestDatabase } from './database.js';
+export { envExampleProblems } from './env-example.js';
+export { shopifyConnectionTest } from './shopify-connection.js';
+export { startShopify } from './shopify.js';
+export { linkIn, startSmtp } from './smtp.js';
+export { startStripe, stripeSignature } from './stripe.js';

package/dist/testing/shopify-connection.d.ts

@@ -0,0 +1,8 @@
+import type { expect as Expect, test as Test } from '@playwright/test';
+import type { ProductEnv } from '../product.js';
+import type { ShopifyApp } from '../shopify/app.js';
+/** Registers the connection test of `app` with the test and expect of the app's Playwright. */
+export declare function shopifyConnectionTest<E extends ProductEnv>(app: ShopifyApp<E>, playwright: {
+    test: typeof Test;
+    expect: typeof Expect;
+}): void;