backend-manager 5.0.148 → 5.0.150

package/test/helpers/email.js

@@ -76,7 +76,7 @@ module.exports = {
       async run({ http, assert }) {
         const response = await http.post('admin/email', {
           subject: 'BEM Test Email - Bad UID',
-          to: 'uid:nonexistent_uid_12345',
+          to: 'nonexistent_uid_12345',
           copy: false,
         });
 
@@ -141,7 +141,7 @@ module.exports = {
       async run({ http, assert, accounts }) {
         const response = await http.post('admin/email', {
           subject: 'BEM Test Email - UID Recipient',
-          to: `uid:${accounts.admin.uid}`,
+          to: accounts.admin.uid,
           copy: false,
           data: {
             email: {
@@ -167,7 +167,7 @@ module.exports = {
           to: [
             `_test-receiver@${config.domain}`,
             { email: `_test-receiver-2@${config.domain}`, name: 'Receiver 2' },
-            `uid:${accounts.admin.uid}`,
+            accounts.admin.uid,
           ],
           copy: false,
           data: {
@@ -378,18 +378,131 @@ module.exports = {
         assert.isSuccess(response, 'Should send email');
         assert.equal(response.data.status, 'sent', 'Status should be sent');
 
-        const appImages = response.data.options.dynamicTemplateData.app.images;
+        const brandImages = response.data.options.dynamicTemplateData.brand.images;
 
         // Any image that was an SVG should now be a PNG (-x.svg → -1024.png)
-        for (const [key, value] of Object.entries(appImages)) {
+        for (const [key, value] of Object.entries(brandImages)) {
           assert.ok(
             !String(value || '').endsWith('.svg'),
-            `app.images.${key} should not be an SVG (got: ${value})`,
+            `brand.images.${key} should not be an SVG (got: ${value})`,
           );
         }
       },
     },
 
+    // --- Sender Resolution ---
+
+    {
+      name: 'sender-orders-resolves-from-and-asm',
+      auth: 'admin',
+      timeout: 30000,
+
+      async run({ http, assert, config }) {
+        const response = await http.post('admin/email', {
+          subject: 'BEM Test Email - Sender Orders',
+          to: `_test-receiver@${config.domain}`,
+          sender: 'orders',
+          copy: false,
+          data: {
+            email: {
+              subject: 'BEM Test Email - Sender Orders',
+              body: 'Testing sender resolution for orders.',
+            },
+          },
+        });
+
+        assert.isSuccess(response, 'Should send email with orders sender');
+        assert.equal(response.data.status, 'sent', 'Status should be sent');
+        assert.ok(response.data.options.from.email.startsWith('orders@'), 'From email should start with orders@');
+        assert.ok(response.data.options.from.name.includes('Orders'), 'From name should include Orders');
+        assert.ok(response.data.options.asm, 'Should have ASM group');
+        assert.ok(response.data.options.replyTo.startsWith('orders@'), 'replyTo should match from address');
+      },
+    },
+
+    {
+      name: 'sender-security-resolves-from-asm-and-unsubscribe',
+      auth: 'admin',
+      timeout: 30000,
+
+      async run({ http, assert, config }) {
+        const response = await http.post('admin/email', {
+          subject: 'BEM Test Email - Sender Security',
+          to: `_test-receiver@${config.domain}`,
+          sender: 'security',
+          copy: false,
+          data: {
+            email: {
+              subject: 'BEM Test Email - Sender Security',
+              body: 'Testing that security sender resolves correctly.',
+            },
+          },
+        });
+
+        assert.isSuccess(response, 'Should send email with security sender');
+        assert.equal(response.data.status, 'sent', 'Status should be sent');
+        assert.ok(response.data.options.from.email.startsWith('security@'), 'From email should start with security@');
+        assert.ok(response.data.options.asm, 'Should have ASM group');
+        assert.ok(response.data.options.headers['List-Unsubscribe'], 'Should have List-Unsubscribe header');
+        assert.ok(response.data.options.dynamicTemplateData.email.unsubscribeUrl, 'Should have unsubscribeUrl');
+      },
+    },
+
+    {
+      name: 'sender-explicit-from-overrides-sender',
+      auth: 'admin',
+      timeout: 30000,
+
+      async run({ http, assert, config }) {
+        const customFrom = { email: `custom@${config.domain}`, name: 'Custom Sender' };
+
+        const response = await http.post('admin/email', {
+          subject: 'BEM Test Email - From Override',
+          to: `_test-receiver@${config.domain}`,
+          sender: 'orders',
+          from: customFrom,
+          copy: false,
+          data: {
+            email: {
+              subject: 'BEM Test Email - From Override',
+              body: 'Testing that explicit from overrides sender.',
+            },
+          },
+        });
+
+        assert.isSuccess(response, 'Should send email with explicit from');
+        assert.equal(response.data.status, 'sent', 'Status should be sent');
+        assert.equal(response.data.options.from.email, customFrom.email, 'Explicit from should override sender');
+        assert.equal(response.data.options.from.name, customFrom.name, 'Explicit from name should override sender');
+      },
+    },
+
+    {
+      name: 'sender-unknown-falls-back-to-defaults',
+      auth: 'admin',
+      timeout: 30000,
+
+      async run({ http, assert, config }) {
+        const response = await http.post('admin/email', {
+          subject: 'BEM Test Email - Unknown Sender',
+          to: `_test-receiver@${config.domain}`,
+          sender: 'nonexistent',
+          copy: false,
+          data: {
+            email: {
+              subject: 'BEM Test Email - Unknown Sender',
+              body: 'Testing that unknown sender falls back to brand defaults.',
+            },
+          },
+        });
+
+        assert.isSuccess(response, 'Should send email with default from');
+        assert.equal(response.data.status, 'sent', 'Status should be sent');
+        assert.ok(response.data.options.from.email, 'Should have a from email (brand default)');
+        assert.ok(response.data.options.asm, 'Should have default ASM group');
+      },
+    },
+
     {
       name: 'sendat-iso-string-accepted',
       auth: 'admin',

package/test/helpers/marketing-lifecycle.js

@@ -0,0 +1,121 @@
+/**
+ * Test: Marketing lifecycle (add → sync → remove)
+ * End-to-end suite testing the full marketing contact flow via routes
+ *
+ * Requires TEST_EXTENDED_MODE=true and SENDGRID_API_KEY / BEEHIIV_API_KEY env vars.
+ * These tests hit real external APIs.
+ */
+module.exports = {
+  description: 'Marketing lifecycle (add → sync → remove)',
+  type: 'suite',
+  timeout: 60000,
+  skip: !process.env.TEST_EXTENDED_MODE ? 'TEST_EXTENDED_MODE not set' : false,
+
+  tests: [
+    // Step 0: Pre-clean test contacts from providers (in case a previous run left them)
+    {
+      name: 'pre-clean-test-contacts',
+      auth: 'admin',
+
+      async run({ http, config, state }) {
+        const testEmail = `lifecycle.test+bem@${config.domain}`;
+        state.testEmail = testEmail;
+
+        // Delete from all providers — handles "not found" gracefully
+        await http.delete('marketing/contact', { email: testEmail }).catch(() => {});
+      },
+    },
+
+    // Step 1: Add a contact via POST /marketing/contact
+    {
+      name: 'add-contact',
+      auth: 'admin',
+
+      async run({ http, assert, state }) {
+        const response = await http.post('marketing/contact', {
+          email: state.testEmail,
+          firstName: 'Lifecycle',
+          lastName: 'Test',
+          source: 'bem-test-lifecycle',
+        });
+
+        assert.isSuccess(response, 'Add contact should succeed');
+        assert.propertyEquals(response, 'data.success', true, 'success should be true');
+
+        if (process.env.SENDGRID_API_KEY) {
+          assert.hasProperty(response, 'data.providers.sendgrid', 'Should have SendGrid result');
+          assert.propertyEquals(response, 'data.providers.sendgrid.success', true, 'SendGrid add should succeed');
+        }
+
+        if (process.env.BEEHIIV_API_KEY) {
+          assert.hasProperty(response, 'data.providers.beehiiv', 'Should have Beehiiv result');
+          assert.propertyEquals(response, 'data.providers.beehiiv.success', true, 'Beehiiv add should succeed');
+        }
+      },
+    },
+
+    // Step 2: Sync by UID via PUT /marketing/contact
+    // Tests the full sync pipeline: UID resolution → buildFields → upsert with custom fields
+    {
+      name: 'sync-contact-by-uid',
+      auth: 'admin',
+
+      async run({ http, assert, accounts }) {
+        // Sync the admin test account — exercises UID→doc resolution + buildFields
+        const response = await http.put('marketing/contact', {
+          uid: accounts.admin.uid,
+        });
+
+        assert.isSuccess(response, 'Sync contact should succeed');
+        assert.propertyEquals(response, 'data.success', true, 'success should be true');
+
+        if (process.env.SENDGRID_API_KEY) {
+          assert.hasProperty(response, 'data.providers.sendgrid', 'Should have SendGrid result');
+          assert.propertyEquals(response, 'data.providers.sendgrid.success', true, 'SendGrid sync should succeed');
+        }
+
+        if (process.env.BEEHIIV_API_KEY) {
+          assert.hasProperty(response, 'data.providers.beehiiv', 'Should have Beehiiv result');
+          assert.propertyEquals(response, 'data.providers.beehiiv.success', true, 'Beehiiv sync should succeed');
+        }
+      },
+    },
+
+    // Step 3: Remove the contact via DELETE /marketing/contact
+    {
+      name: 'remove-contact',
+      auth: 'admin',
+
+      async run({ http, assert, state }) {
+        const response = await http.delete('marketing/contact', {
+          email: state.testEmail,
+        });
+
+        assert.isSuccess(response, 'Remove contact should succeed');
+        assert.propertyEquals(response, 'data.success', true, 'success should be true');
+
+        if (process.env.SENDGRID_API_KEY) {
+          assert.hasProperty(response, 'data.providers.sendgrid', 'Should have SendGrid result');
+          assert.propertyEquals(response, 'data.providers.sendgrid.success', true, 'SendGrid remove should succeed');
+        }
+
+        if (process.env.BEEHIIV_API_KEY) {
+          assert.hasProperty(response, 'data.providers.beehiiv', 'Should have Beehiiv result');
+          assert.propertyEquals(response, 'data.providers.beehiiv.success', true, 'Beehiiv remove should succeed');
+        }
+      },
+    },
+
+    // Step 4: Clean up the admin test contact that sync added
+    {
+      name: 'cleanup-synced-admin-contact',
+      auth: 'admin',
+
+      async run({ http, accounts }) {
+        await http.delete('marketing/contact', {
+          email: accounts.admin.email,
+        }).catch(() => {});
+      },
+    },
+  ],
+};

package/test/helpers/user.js

@@ -410,7 +410,7 @@ module.exports = {
         const user = createUser({});
         const expectedKeys = [
           'auth', 'subscription', 'roles', 'flags', 'affiliate',
-          'activity', 'api', 'usage', 'personal', 'oauth2', 'attribution',
+          'activity', 'api', 'usage', 'personal', 'oauth2', 'attribution', 'metadata',
         ];
 
         for (const key of expectedKeys) {
@@ -425,7 +425,7 @@ module.exports = {
         const user = createUser({});
         const expectedKeys = [
           'auth', 'subscription', 'roles', 'flags', 'affiliate',
-          'activity', 'api', 'usage', 'personal', 'oauth2', 'attribution',
+          'activity', 'api', 'usage', 'personal', 'oauth2', 'attribution', 'metadata',
         ];
 
         for (const key of Object.keys(user)) {

package/test/routes/admin/create-post.js

@@ -113,13 +113,13 @@ module.exports = {
           return;
         }
 
-        if (!config.githubRepoWebsite) {
+        if (!config.github?.repo_website) {
           assert.fail('githubRepoWebsite not configured');
           return;
         }
 
         // Parse owner/repo for cleanup later
-        const repoMatch = config.githubRepoWebsite.match(/github\.com\/([^/]+)\/([^/]+)/);
+        const repoMatch = config.github?.repo_website.match(/github\.com\/([^/]+)\/([^/]+)/);
         if (!repoMatch) {
           assert.fail('Could not parse githubRepoWebsite');
           return;

package/test/routes/admin/post.js

@@ -115,7 +115,7 @@ module.exports = {
       skip: !process.env.GITHUB_TOKEN ? 'GITHUB_TOKEN env var not set' : false,
 
       async run({ assert, state, config }) {
-        if (!config.githubRepoWebsite) {
+        if (!config.github?.repo_website) {
           assert.fail('githubRepoWebsite not configured');
           return;
         }
@@ -123,7 +123,7 @@ module.exports = {
         const octokit = new Octokit({ auth: process.env.GITHUB_TOKEN });
 
         // Parse owner/repo from githubRepoWebsite
-        const repoMatch = config.githubRepoWebsite.match(/github\.com\/([^/]+)\/([^/]+)/);
+        const repoMatch = config.github?.repo_website.match(/github\.com\/([^/]+)\/([^/]+)/);
         if (!repoMatch) {
           assert.fail('Could not parse githubRepoWebsite');
           return;

package/test/routes/admin/repo-content.js

@@ -155,14 +155,14 @@ module.exports = {
       timeout: 60000,
 
       async run({ state, config }) {
-        if (!process.env.GITHUB_TOKEN || !config.githubRepoWebsite) {
+        if (!process.env.GITHUB_TOKEN || !config.github?.repo_website) {
           return;
         }
 
         const octokit = new Octokit({ auth: process.env.GITHUB_TOKEN });
 
         // Parse owner/repo from githubRepoWebsite (e.g., 'https://github.com/owner/repo')
-        const repoMatch = config.githubRepoWebsite.match(/github\.com\/([^/]+)\/([^/]+)/);
+        const repoMatch = config.github?.repo_website.match(/github\.com\/([^/]+)\/([^/]+)/);
         if (!repoMatch) {
           return;
         }

package/test/routes/marketing/contact.js

@@ -208,46 +208,9 @@ module.exports = {
       },
     },
 
-    // Test 7: Admin can specify providers
+    // Test 7: Mailbox verification (only runs if TEST_EXTENDED_MODE and ZEROBOUNCE_API_KEY are set)
     {
-      name: 'add-admin-specify-providers',
-      auth: 'admin',
-      timeout: 30000,
-
-      async run({ http, assert, config, state }) {
-        const testEmail = TEST_EMAILS.valid(config.domain);
-        state.testEmail = testEmail;
-
-        const response = await http.post('marketing/contact', {
-          email: testEmail,
-          source: 'bem-test',
-          providers: ['sendgrid'], // Only SendGrid, not Beehiiv
-          // No firstName/lastName - should be inferred as "Rachel Greene"
-        });
-
-        assert.isSuccess(response, 'Add marketing contact with specific providers should succeed');
-
-        // Provider calls only happen in extended mode
-        if (process.env.TEST_EXTENDED_MODE) {
-          // Should only have sendgrid result (since we specified providers: ['sendgrid'])
-          assert.hasProperty(response.data.providers, 'sendgrid', 'Should have SendGrid result');
-          state.sendgridAdded = response.data?.providers?.sendgrid?.success;
-          // Beehiiv not called since we only specified sendgrid
-        }
-      },
-
-      async cleanup({ state, http }) {
-        if (!process.env.TEST_EXTENDED_MODE || !state.testEmail) {
-          return;
-        }
-
-        await http.delete('marketing/contact', { email: state.testEmail });
-      },
-    },
-
-    // Test 8: ZeroBounce validation (only runs if TEST_EXTENDED_MODE and ZEROBOUNCE_API_KEY are set)
-    {
-      name: 'add-zerobounce-validation',
+      name: 'add-mailbox-validation',
       auth: 'admin',
       timeout: 30000,
       skip: !process.env.TEST_EXTENDED_MODE || !process.env.ZEROBOUNCE_API_KEY
@@ -261,7 +224,6 @@ module.exports = {
         const response = await http.post('marketing/contact', {
           email: testEmail,
           source: 'bem-test',
-          // No firstName/lastName - should be inferred as "Rachel Greene"
         });
 
         assert.isSuccess(response, 'Add marketing contact should succeed');
@@ -270,17 +232,17 @@ module.exports = {
         assert.hasProperty(response, 'data.validation', 'Response should contain validation');
         assert.hasProperty(response, 'data.validation.checks', 'Validation should contain checks');
 
-        // ZeroBounce should be in checks when key is set
-        assert.hasProperty(response, 'data.validation.checks.zerobounce', 'Should have ZeroBounce check');
+        // Mailbox check should be in checks when key is set
+        assert.hasProperty(response, 'data.validation.checks.mailbox', 'Should have mailbox check');
 
-        const zbResult = response.data.validation.checks.zerobounce;
+        const mbResult = response.data.validation.checks.mailbox;
 
-        // If ZeroBounce is out of credits, skip test - not a failure
-        if (zbResult.error?.includes('out of credits')) {
-          skip('ZeroBounce out of credits');
+        // If out of credits, skip test - not a failure
+        if (mbResult.error?.includes('out of credits')) {
+          skip('Mailbox verification out of credits');
         }
 
-        assert.hasProperty(zbResult, 'status', 'ZeroBounce should return status');
+        assert.hasProperty(mbResult, 'status', 'Mailbox check should return status');
 
         state.sendgridAdded = response.data?.providers?.sendgrid?.success;
         state.beehiivAdded = response.data?.providers?.beehiiv?.success;
@@ -295,9 +257,9 @@ module.exports = {
       },
     },
 
-    // Test 9: ZeroBounce rejects invalid email (only runs if TEST_EXTENDED_MODE and ZEROBOUNCE_API_KEY are set)
+    // Test 9: Mailbox verification rejects invalid email (only runs if TEST_EXTENDED_MODE and ZEROBOUNCE_API_KEY are set)
     {
-      name: 'add-zerobounce-rejects-invalid',
+      name: 'add-mailbox-rejects-invalid',
       auth: 'admin',
       timeout: 30000,
       skip: !process.env.TEST_EXTENDED_MODE || !process.env.ZEROBOUNCE_API_KEY
@@ -305,30 +267,28 @@ module.exports = {
         : false,
 
       async run({ http, assert, skip }) {
-        // Use fake email that ZeroBounce should flag as invalid
+        // Use fake email that mailbox verification should flag as invalid
         const testEmail = TEST_EMAILS.invalid();
 
         const response = await http.post('marketing/contact', {
           email: testEmail,
           source: 'bem-test',
-          // No firstName/lastName - AI will try to infer from "test"
         });
 
-        // Should still succeed (we fail open) but ZeroBounce should report invalid
+        // Should still succeed (we fail open) but mailbox should report invalid
         assert.isSuccess(response, 'Request should succeed even with invalid email');
 
-        const zbResult = response.data?.validation?.checks?.zerobounce;
+        const mbResult = response.data?.validation?.checks?.mailbox;
 
-        // If ZeroBounce is out of credits, skip test - not a failure
-        if (zbResult?.error?.includes('out of credits')) {
-          skip('ZeroBounce out of credits');
+        // If out of credits, skip test - not a failure
+        if (mbResult?.error?.includes('out of credits')) {
+          skip('Mailbox verification out of credits');
         }
 
-        // ZeroBounce should return a status indicating the email is not valid
-        if (zbResult) {
-          assert.hasProperty(zbResult, 'status', 'Should have status');
-          // Status should NOT be 'valid' for this fake email
-          assert.notEqual(zbResult.status, 'valid', 'Fake email should not be marked valid');
+        // Mailbox should return a status indicating the email is not valid
+        if (mbResult) {
+          assert.hasProperty(mbResult, 'status', 'Should have status');
+          assert.notEqual(mbResult.status, 'valid', 'Fake email should not be marked valid');
         }
       },
     },

package/test/routes/payments/cancel.js

@@ -66,6 +66,18 @@ module.exports = {
       },
     },
 
+    {
+      name: 'rejects-subscription-younger-than-24-hours',
+      async run({ http, assert }) {
+        // cancel-too-young starts with startDate set to now (< 24 hours old)
+        const response = await http.as('cancel-too-young').post('payments/cancel', {
+          confirmed: true,
+        });
+
+        assert.isError(response, 400, 'Should reject subscription younger than 24 hours');
+      },
+    },
+
     {
       name: 'rejects-unknown-processor',
       async run({ http, assert }) {
@@ -101,6 +113,12 @@ module.exports = {
             && userDoc?.subscription?.status === 'active';
         }, 15000, 500);
 
+        // Backdate startDate so the 24-hour guard doesn't block cancellation
+        const twoDaysAgo = new Date(Date.now() - 2 * 24 * 60 * 60 * 1000);
+        await firestore.set(`users/${uid}`, {
+          subscription: { payment: { startDate: { timestamp: twoDaysAgo.toISOString(), timestampUNIX: twoDaysAgo.getTime() } } },
+        }, { merge: true });
+
         // Step 2: Call the cancel endpoint
         const cancelResponse = await http.as('route-cancel-success').post('payments/cancel', {
           confirmed: true,