@wopr-network/platform-ui-core 1.0.0

package/src/__tests__/provider-key-api.test.ts

@@ -0,0 +1,134 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mockFetch = vi.fn();
+global.fetch = mockFetch;
+
+vi.mock("@/lib/api-config", () => ({
+  API_BASE_URL: "http://localhost:3001/api",
+  PLATFORM_BASE_URL: "http://localhost:3001",
+}));
+
+vi.mock("@/lib/fetch-utils", () => ({
+  handleUnauthorized: vi.fn(() => {
+    throw new Error("Unauthorized");
+  }),
+  UnauthorizedError: class extends Error {
+    constructor(msg = "Session expired") {
+      super(msg);
+      this.name = "UnauthorizedError";
+    }
+  },
+}));
+
+vi.mock("@/lib/trpc", () => ({
+  trpcVanilla: {},
+}));
+
+import { removeProviderKey, saveProviderKey } from "@/lib/api";
+
+describe("saveProviderKey tenant-key integration", () => {
+  beforeEach(() => {
+    mockFetch.mockReset();
+  });
+
+  it("calls PUT /api/tenant-keys/:provider before posting to providers", async () => {
+    const tenantKeyResponse = {
+      provider: "anthropic",
+      hasKey: true,
+      maskedKey: "sk-ant-...xy",
+      createdAt: null,
+      updatedAt: null,
+    };
+    const providerKeyResponse = {
+      id: "pk-new",
+      provider: "anthropic",
+      maskedKey: "sk-ant-...xy",
+      status: "valid",
+      lastChecked: null,
+      defaultModel: null,
+      models: [],
+    };
+
+    mockFetch
+      .mockResolvedValueOnce({
+        ok: true,
+        status: 200,
+        json: () => Promise.resolve(tenantKeyResponse),
+      })
+      .mockResolvedValueOnce({
+        ok: true,
+        status: 200,
+        json: () => Promise.resolve(providerKeyResponse),
+      });
+
+    await saveProviderKey("anthropic", "sk-ant-real-key");
+
+    expect(mockFetch).toHaveBeenCalledTimes(2);
+    expect(mockFetch).toHaveBeenNthCalledWith(
+      1,
+      "http://localhost:3001/api/tenant-keys/anthropic",
+      expect.objectContaining({ method: "PUT", body: JSON.stringify({ key: "sk-ant-real-key" }) }),
+    );
+    expect(mockFetch).toHaveBeenNthCalledWith(
+      2,
+      "http://localhost:3001/api/settings/providers",
+      expect.objectContaining({ method: "POST" }),
+    );
+  });
+});
+
+describe("removeProviderKey tenant-key integration", () => {
+  beforeEach(() => {
+    mockFetch.mockReset();
+  });
+
+  it("calls DELETE /api/tenant-keys/:provider before deleting from providers", async () => {
+    mockFetch
+      .mockResolvedValueOnce({
+        ok: true,
+        status: 204,
+        json: () => Promise.resolve({}),
+      })
+      .mockResolvedValueOnce({
+        ok: true,
+        status: 204,
+        json: () => Promise.resolve({}),
+      });
+
+    await removeProviderKey("pk-1", "anthropic");
+
+    expect(mockFetch).toHaveBeenNthCalledWith(
+      1,
+      "http://localhost:3001/api/tenant-keys/anthropic",
+      expect.objectContaining({ method: "DELETE" }),
+    );
+    expect(mockFetch).toHaveBeenNthCalledWith(
+      2,
+      "http://localhost:3001/api/settings/providers/pk-1",
+      expect.objectContaining({ method: "DELETE" }),
+    );
+  });
+
+  it("still deletes from providers even if tenant-key delete fails", async () => {
+    mockFetch
+      .mockResolvedValueOnce({
+        ok: false,
+        status: 404,
+        statusText: "Not Found",
+        json: () => Promise.resolve({}),
+      })
+      .mockResolvedValueOnce({
+        ok: true,
+        status: 204,
+        json: () => Promise.resolve({}),
+      });
+
+    await removeProviderKey("pk-missing", "anthropic");
+
+    expect(mockFetch).toHaveBeenCalledTimes(2);
+    expect(mockFetch).toHaveBeenLastCalledWith(
+      "http://localhost:3001/api/settings/providers/pk-missing",
+      expect.objectContaining({ method: "DELETE" }),
+    );
+  });
+});

package/src/__tests__/resend-verification-button.test.tsx

@@ -0,0 +1,104 @@
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { describe, expect, it, vi } from "vitest";
+
+const mockSendVerificationEmail = vi.fn().mockResolvedValue({ data: {}, error: null });
+
+vi.mock("better-auth/react", () => ({
+  createAuthClient: () => ({
+    useSession: () => ({ data: null, isPending: false, error: null }),
+    signIn: { email: vi.fn(), social: vi.fn() },
+    signUp: { email: vi.fn() },
+    signOut: vi.fn(),
+    sendVerificationEmail: mockSendVerificationEmail,
+  }),
+}));
+
+vi.mock("framer-motion", () => ({
+  motion: {
+    div: ({ children, ...props }: React.PropsWithChildren<Record<string, unknown>>) => (
+      <div {...props}>{children}</div>
+    ),
+    p: ({ children, ...props }: React.PropsWithChildren<Record<string, unknown>>) => (
+      <p {...props}>{children}</p>
+    ),
+  },
+}));
+
+describe("ResendVerificationButton", () => {
+  it("renders button with correct text", async () => {
+    const { ResendVerificationButton } = await import(
+      "@/components/auth/resend-verification-button"
+    );
+    render(<ResendVerificationButton email="test@example.com" />);
+
+    expect(screen.getByRole("button", { name: /Resend verification email/ })).toBeInTheDocument();
+  });
+
+  it("calls sendVerificationEmail on click", async () => {
+    const user = userEvent.setup();
+    const { ResendVerificationButton } = await import(
+      "@/components/auth/resend-verification-button"
+    );
+    render(<ResendVerificationButton email="test@example.com" />);
+
+    await user.click(screen.getByRole("button", { name: /Resend verification email/ }));
+
+    expect(mockSendVerificationEmail).toHaveBeenCalledWith({
+      email: "test@example.com",
+      callbackURL: "/auth/verify?status=success",
+    });
+  });
+
+  it("shows success message after sending", async () => {
+    const user = userEvent.setup();
+    const { ResendVerificationButton } = await import(
+      "@/components/auth/resend-verification-button"
+    );
+    render(<ResendVerificationButton email="test@example.com" />);
+
+    await user.click(screen.getByRole("button", { name: /Resend verification email/ }));
+
+    expect(screen.getByText("Verification email sent!")).toBeInTheDocument();
+  });
+
+  it("shows error message when send fails", async () => {
+    mockSendVerificationEmail.mockResolvedValueOnce({
+      data: null,
+      error: { message: "Rate limited" },
+    });
+    const user = userEvent.setup();
+    const { ResendVerificationButton } = await import(
+      "@/components/auth/resend-verification-button"
+    );
+    render(<ResendVerificationButton email="test@example.com" />);
+
+    await user.click(screen.getByRole("button", { name: /Resend verification email/ }));
+
+    expect(screen.getByText("Rate limited")).toBeInTheDocument();
+  });
+
+  it("disables button when email is empty", async () => {
+    const { ResendVerificationButton } = await import(
+      "@/components/auth/resend-verification-button"
+    );
+    render(<ResendVerificationButton email="" />);
+
+    expect(screen.getByRole("button", { name: /Resend verification email/ })).toBeDisabled();
+  });
+
+  it("disables button after successful send", async () => {
+    const user = userEvent.setup();
+    const { ResendVerificationButton } = await import(
+      "@/components/auth/resend-verification-button"
+    );
+    render(<ResendVerificationButton email="test@example.com" />);
+
+    await user.click(screen.getByRole("button", { name: /Resend verification email/ }));
+
+    // After success, button should be disabled (in cooldown)
+    expect(screen.getByRole("button")).toBeDisabled();
+    // Button text should show countdown
+    expect(screen.getByRole("button")).toHaveTextContent(/Resend in \d+s/);
+  });
+});

package/src/__tests__/sanitize-redirect-url.test.ts

@@ -0,0 +1,47 @@
+import { describe, expect, it } from "vitest";
+import { sanitizeRedirectUrl } from "@/lib/utils";
+
+describe("sanitizeRedirectUrl", () => {
+  it("allows valid relative paths", () => {
+    expect(sanitizeRedirectUrl("/dashboard")).toBe("/dashboard");
+    expect(sanitizeRedirectUrl("/settings")).toBe("/settings");
+    expect(sanitizeRedirectUrl("/settings/profile")).toBe("/settings/profile");
+  });
+
+  it("rejects absolute URLs to external origins", () => {
+    expect(sanitizeRedirectUrl("https://evil.com/phishing")).toBe("/");
+    expect(sanitizeRedirectUrl("http://evil.com")).toBe("/");
+  });
+
+  it("rejects protocol-relative URLs", () => {
+    expect(sanitizeRedirectUrl("//evil.com")).toBe("/");
+    expect(sanitizeRedirectUrl("//evil.com/path")).toBe("/");
+  });
+
+  it("falls back to / for null and undefined", () => {
+    expect(sanitizeRedirectUrl(null)).toBe("/");
+    expect(sanitizeRedirectUrl(undefined)).toBe("/");
+  });
+
+  it("falls back to / for empty string", () => {
+    expect(sanitizeRedirectUrl("")).toBe("/");
+  });
+
+  it("allows root path", () => {
+    expect(sanitizeRedirectUrl("/")).toBe("/");
+  });
+
+  it("allows paths with query strings", () => {
+    expect(sanitizeRedirectUrl("/settings?tab=billing")).toBe("/settings?tab=billing");
+  });
+});
+
+// This test documents the fix — signup previously passed raw callbackUrl to OAuthButtons
+describe("signup page callbackUrl sanitization", () => {
+  it("sanitizeRedirectUrl rejects external URLs that could be passed as callbackUrl", () => {
+    // Before fix: searchParams.get("callbackUrl") ?? "/" was passed directly
+    // After fix: sanitizeRedirectUrl(searchParams.get("callbackUrl")) is used
+    const maliciousParam = "https://evil.com/phishing";
+    expect(sanitizeRedirectUrl(maliciousParam)).toBe("/");
+  });
+});

package/src/__tests__/secrets-audit-pagination.test.tsx

@@ -0,0 +1,139 @@
+import { cleanup, render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import type React from "react";
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+// Mock framer-motion to avoid animation issues in tests
+vi.mock("framer-motion", () => ({
+  AnimatePresence: ({ children }: { children: React.ReactNode }) => children,
+  motion: {
+    div: ({ children, ...props }: Record<string, unknown>) => {
+      const { initial, animate, exit, transition, ...rest } = props;
+      void initial;
+      void animate;
+      void exit;
+      void transition;
+      return (
+        <div {...(rest as React.HTMLAttributes<HTMLDivElement>)}>{children as React.ReactNode}</div>
+      );
+    },
+  },
+}));
+
+// Mock the API module
+vi.mock("@/lib/api", () => ({
+  listSecrets: vi.fn().mockResolvedValue([
+    {
+      id: "sec-1",
+      name: "Test Secret",
+      type: "api-token",
+      createdAt: "2026-01-01T00:00:00Z",
+      lastUsedAt: null,
+      expiresAt: null,
+    },
+  ]),
+  createSecret: vi.fn(),
+  deleteSecret: vi.fn(),
+  rotateSecret: vi.fn(),
+  fetchSecretAudit: vi.fn(),
+  apiFetch: vi.fn(),
+}));
+
+import { fetchSecretAudit } from "@/lib/api";
+
+// Generate N audit entries
+function makeEntries(n: number) {
+  return Array.from({ length: n }, (_, i) => ({
+    id: `audit-${i}`,
+    secretId: "sec-1",
+    action: "accessed" as const,
+    actorType: "plugin" as const,
+    actorName: `Actor ${i}`,
+    timestamp: new Date(2026, 0, 1, 0, i).toISOString(),
+  }));
+}
+
+describe("AuditPanel pagination", () => {
+  afterEach(() => {
+    cleanup();
+    vi.clearAllMocks();
+  });
+
+  it("shows only 10 entries initially and a Load more button when >10 exist", async () => {
+    const user = userEvent.setup();
+    const entries = makeEntries(25);
+    vi.mocked(fetchSecretAudit).mockResolvedValue(entries);
+
+    const { default: SecretsPage } = await import("@/app/(dashboard)/settings/secrets/page");
+    render(<SecretsPage />);
+
+    // Wait for secrets to load, then click audit toggle
+    const auditBtn = await screen.findByRole("button", { name: /access log/i });
+    await user.click(auditBtn);
+
+    // Should show first 10
+    await screen.findByText("Actor 0");
+    expect(screen.getByText("Actor 9")).toBeInTheDocument();
+    expect(screen.queryByText("Actor 10")).not.toBeInTheDocument();
+
+    // Should show load more button
+    const loadMore = screen.getByRole("button", { name: /load \d+ more/i });
+    expect(loadMore).toBeInTheDocument();
+  });
+
+  it("loads 10 more entries on click", async () => {
+    const user = userEvent.setup();
+    const entries = makeEntries(25);
+    vi.mocked(fetchSecretAudit).mockResolvedValue(entries);
+
+    const { default: SecretsPage } = await import("@/app/(dashboard)/settings/secrets/page");
+    render(<SecretsPage />);
+
+    const auditBtn = await screen.findByRole("button", { name: /access log/i });
+    await user.click(auditBtn);
+    await screen.findByText("Actor 0");
+
+    const loadMore = screen.getByRole("button", { name: /load \d+ more/i });
+    await user.click(loadMore);
+
+    // Now 20 visible
+    expect(screen.getByText("Actor 19")).toBeInTheDocument();
+    expect(screen.queryByText("Actor 20")).not.toBeInTheDocument();
+  });
+
+  it("hides Load more button when all entries are visible", async () => {
+    const user = userEvent.setup();
+    const entries = makeEntries(15);
+    vi.mocked(fetchSecretAudit).mockResolvedValue(entries);
+
+    const { default: SecretsPage } = await import("@/app/(dashboard)/settings/secrets/page");
+    render(<SecretsPage />);
+
+    const auditBtn = await screen.findByRole("button", { name: /access log/i });
+    await user.click(auditBtn);
+    await screen.findByText("Actor 0");
+
+    const loadMore = screen.getByRole("button", { name: /load \d+ more/i });
+    await user.click(loadMore);
+
+    // All 15 visible now
+    expect(screen.getByText("Actor 14")).toBeInTheDocument();
+    // No more button
+    expect(screen.queryByRole("button", { name: /load \d+ more/i })).not.toBeInTheDocument();
+  });
+
+  it("does not show Load more button when <=10 entries", async () => {
+    const user = userEvent.setup();
+    const entries = makeEntries(5);
+    vi.mocked(fetchSecretAudit).mockResolvedValue(entries);
+
+    const { default: SecretsPage } = await import("@/app/(dashboard)/settings/secrets/page");
+    render(<SecretsPage />);
+
+    const auditBtn = await screen.findByRole("button", { name: /access log/i });
+    await user.click(auditBtn);
+    await screen.findByText("Actor 0");
+
+    expect(screen.queryByRole("button", { name: /load \d+ more/i })).not.toBeInTheDocument();
+  });
+});