backend-manager 5.9.4 → 5.9.6

package/test/routes/admin/create-post.js

@@ -1,364 +0,0 @@
-/**
- * Test: POST /admin/post
- * Tests the admin create post endpoint
- * Creates blog posts via GitHub with image extraction and @post/ body rewriting
- * Requires admin/blogger role, GitHub API key, and repo_website config
- */
-const { Octokit } = require('@octokit/rest');
-const sharp = require('sharp');
-
-const { IMAGE_MAX_DIMENSION } = require('../../../src/manager/routes/admin/post/post');
-
-module.exports = {
-  description: 'Admin create post on GitHub',
-  type: 'suite',
-  timeout: 300000, // 5 minutes total for the suite
-
-  tests: [
-    // --- Validation tests (no GitHub needed) ---
-
-    {
-      name: 'missing-title-rejected',
-      auth: 'admin',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.post('backend-manager/admin/post', {
-          url: 'test-post',
-          description: 'Test description',
-          headerImageURL: 'https://example.com/image.jpg',
-          body: 'Test content',
-        });
-
-        assert.isError(response, 400, 'Missing title should return 400');
-      },
-    },
-
-    {
-      name: 'missing-url-rejected',
-      auth: 'admin',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.post('backend-manager/admin/post', {
-          title: 'Test Post',
-          description: 'Test description',
-          headerImageURL: 'https://example.com/image.jpg',
-          body: 'Test content',
-        });
-
-        assert.isError(response, 400, 'Missing URL should return 400');
-      },
-    },
-
-    {
-      name: 'missing-description-rejected',
-      auth: 'admin',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.post('backend-manager/admin/post', {
-          title: 'Test Post',
-          url: 'test-post',
-          headerImageURL: 'https://example.com/image.jpg',
-          body: 'Test content',
-        });
-
-        assert.isError(response, 400, 'Missing description should return 400');
-      },
-    },
-
-    {
-      name: 'missing-header-image-rejected',
-      auth: 'admin',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.post('backend-manager/admin/post', {
-          title: 'Test Post',
-          url: 'test-post',
-          description: 'Test description',
-          body: 'Test content',
-        });
-
-        assert.isError(response, 400, 'Missing headerImageURL should return 400');
-      },
-    },
-
-    {
-      name: 'missing-body-rejected',
-      auth: 'admin',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.post('backend-manager/admin/post', {
-          title: 'Test Post',
-          url: 'test-post',
-          description: 'Test description',
-          headerImageURL: 'https://example.com/image.jpg',
-        });
-
-        assert.isError(response, 400, 'Missing body should return 400');
-      },
-    },
-
-    // --- Integration: create post with inline image, verify @post/ rewriting ---
-
-    {
-      name: 'create-post-rewrites-body-images',
-      auth: 'admin',
-      timeout: 120000,
-      skip: !process.env.TEST_EXTENDED_MODE ? 'TEST_EXTENDED_MODE env var not set' : false,
-
-      async run({ http, assert, state, config }) {
-        if (!process.env.GH_TOKEN) {
-          assert.fail('GH_TOKEN env var not set');
-          return;
-        }
-
-        if (!config.github?.repo_website) {
-          assert.fail('githubRepoWebsite not configured');
-          return;
-        }
-
-        // Parse owner/repo for cleanup later
-        const repoMatch = config.github?.repo_website.match(/github\.com\/([^/]+)\/([^/]+)/);
-        if (!repoMatch) {
-          assert.fail('Could not parse githubRepoWebsite');
-          return;
-        }
-
-        state.owner = repoMatch[1];
-        state.repo = repoMatch[2];
-
-        // Use a real public .jpg for the inline image
-        const inlineImageURL = 'https://picsum.photos/id/10/200/200.jpg';
-        // Oversized header image (long edge 5000px > IMAGE_MAX_DIMENSION 4096px) to
-        // verify the resize step runs end-to-end and the committed file is clamped.
-        const headerImageURL = 'https://picsum.photos/id/1/5000/3000.jpg';
-
-        const response = await http.post('backend-manager/admin/post', {
-          title: 'BEM Test Create Post',
-          url: 'bem-test-create-post',
-          description: 'Test post created by BEM test suite to verify @post/ body rewriting.',
-          headerImageURL: headerImageURL,
-          body: `# BEM Test Create Post\n\nSome intro text.\n\n![Test inline image](${inlineImageURL})\n\nMore text after the image.`,
-          postPath: 'guest',
-        });
-
-        assert.isSuccess(response, 'Create post should succeed');
-        assert.hasProperty(response, 'data.id', 'Response should have post id');
-        assert.hasProperty(response, 'data.path', 'Response should have post file path');
-
-        // Store for cleanup
-        state.postId = response.data.id;
-        state.postPath = response.data.path;
-      },
-    },
-
-    {
-      name: 'verify-body-has-at-post-prefix',
-      auth: 'admin',
-      timeout: 30000,
-      skip: !process.env.TEST_EXTENDED_MODE ? 'TEST_EXTENDED_MODE env var not set' : false,
-
-      async run({ assert, state }) {
-        if (!state.postPath) {
-          return; // Previous test didn't run
-        }
-
-        const octokit = new Octokit({ auth: process.env.GH_TOKEN });
-
-        // Fetch the committed post from GitHub
-        const { data: fileData } = await octokit.rest.repos.getContent({
-          owner: state.owner,
-          repo: state.repo,
-          path: state.postPath,
-        });
-
-        const content = Buffer.from(fileData.content, 'base64').toString();
-        state.currentSha = fileData.sha;
-
-        // The body should contain @post/ prefix instead of the original external URL
-        assert.ok(
-          content.includes('@post/'),
-          'Post body should contain @post/ prefix for downloaded images',
-        );
-
-        assert.ok(
-          !content.includes('picsum.photos/id/10'),
-          'Post body should NOT contain the original external inline image URL',
-        );
-      },
-    },
-
-    {
-      name: 'verify-oversized-header-image-was-resized',
-      auth: 'admin',
-      timeout: 30000,
-      skip: !process.env.TEST_EXTENDED_MODE ? 'TEST_EXTENDED_MODE env var not set' : false,
-
-      async run({ assert, state }) {
-        if (!state.postId) {
-          return; // Previous test didn't run
-        }
-
-        const octokit = new Octokit({ auth: process.env.GH_TOKEN });
-        const imageDir = `src/assets/images/blog/post-${state.postId}/`;
-
-        // List committed images and pick the header (matches the slugified URL "bem-test-create-post")
-        const { data: dirData } = await octokit.rest.repos.getContent({
-          owner: state.owner,
-          repo: state.repo,
-          path: imageDir,
-        });
-
-        const headerFile = dirData.find((f) => f.name === 'bem-test-create-post.jpg');
-        assert.ok(headerFile, 'Header image should be committed at expected slug');
-
-        // Fetch the raw bytes and read dimensions
-        const { data: blob } = await octokit.rest.git.getBlob({
-          owner: state.owner,
-          repo: state.repo,
-          file_sha: headerFile.sha,
-        });
-
-        const buffer = Buffer.from(blob.content, 'base64');
-        const meta = await sharp(buffer).metadata();
-
-        // The source we requested was 5000x3000 (over the 4096 limit).
-        // After resize, the long edge should be clamped to IMAGE_MAX_DIMENSION.
-        const longEdge = Math.max(meta.width, meta.height);
-        assert.ok(
-          longEdge <= IMAGE_MAX_DIMENSION,
-          `Committed header image long edge (${meta.width}x${meta.height}) should be <= IMAGE_MAX_DIMENSION (${IMAGE_MAX_DIMENSION})`,
-        );
-
-        // And the resize should actually have happened (source was 5000x3000 → expect width=4096)
-        assert.equal(meta.width, IMAGE_MAX_DIMENSION, 'Resized width should equal IMAGE_MAX_DIMENSION');
-      },
-    },
-
-    // --- Auth rejection tests ---
-
-    {
-      name: 'unauthenticated-rejected',
-      auth: 'none',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.post('backend-manager/admin/post', {
-          title: 'Test Post',
-          url: 'test-post',
-          description: 'Test description',
-          headerImageURL: 'https://example.com/image.jpg',
-          body: 'Test content',
-        });
-
-        assert.isError(response, 401, 'Create post should fail without authentication');
-      },
-    },
-
-    {
-      name: 'non-admin-rejected',
-      auth: 'basic',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.post('backend-manager/admin/post', {
-          title: 'Test Post',
-          url: 'test-post',
-          description: 'Test description',
-          headerImageURL: 'https://example.com/image.jpg',
-          body: 'Test content',
-        });
-
-        assert.isError(response, 403, 'Create post should fail for non-admin user');
-      },
-    },
-
-    // --- Cleanup ---
-
-    {
-      name: 'cleanup',
-      auth: 'admin',
-      timeout: 60000,
-
-      async run({ state }) {
-        if (!process.env.GH_TOKEN || !state.postPath) {
-          return;
-        }
-
-        const octokit = new Octokit({ auth: process.env.GH_TOKEN });
-
-        // Delete the test post
-        try {
-          const { data: fileData } = await octokit.rest.repos.getContent({
-            owner: state.owner,
-            repo: state.repo,
-            path: state.postPath,
-          });
-
-          await octokit.rest.repos.deleteFile({
-            owner: state.owner,
-            repo: state.repo,
-            path: state.postPath,
-            message: '🧹 BEM test cleanup: delete create-post test',
-            sha: fileData.sha,
-          });
-        } catch (e) {
-          // File might not exist, ignore
-        }
-
-        // Delete uploaded test images
-        const imagePath = `src/assets/images/blog/post-${state.postId}/`;
-        try {
-          const { data: dirData } = await octokit.rest.repos.getContent({
-            owner: state.owner,
-            repo: state.repo,
-            path: imagePath,
-          });
-
-          // Delete each image file
-          for (const file of dirData) {
-            await octokit.rest.repos.deleteFile({
-              owner: state.owner,
-              repo: state.repo,
-              path: file.path,
-              message: `🧹 BEM test cleanup: delete test image ${file.name}`,
-              sha: file.sha,
-            });
-          }
-        } catch (e) {
-          // Directory might not exist, ignore
-        }
-
-        // Cancel any running workflows triggered by our test commits
-        try {
-          const { data: runs } = await octokit.rest.actions.listWorkflowRunsForRepo({
-            owner: state.owner,
-            repo: state.repo,
-            status: 'in_progress',
-            per_page: 10,
-          });
-
-          for (const run of runs.workflow_runs) {
-            if (run.head_commit?.message?.includes('BEM test')) {
-              try {
-                await octokit.rest.actions.cancelWorkflowRun({
-                  owner: state.owner,
-                  repo: state.repo,
-                  run_id: run.id,
-                });
-              } catch (e) {
-                // May already be completed, ignore
-              }
-            }
-          }
-        } catch (e) {
-          // Workflow cancellation failed, not critical
-        }
-      },
-    },
-  ],
-};

package/test/routes/admin/database.js

@@ -1,131 +0,0 @@
-/**
- * Test: GET/POST /admin/database
- * Tests the admin Realtime Database read/write endpoints
- * Requires admin authentication
- */
-const TEST_PATH = '_test/database-test';
-
-module.exports = {
-  description: 'Admin Realtime Database read/write operations',
-  type: 'group',
-  tests: [
-    // Test 1: Setup - write test data first
-    {
-      name: 'setup-test-data',
-      auth: 'admin',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const testData = {
-          testField: 'database-test-value',
-          timestamp: new Date().toISOString(),
-          nested: {
-            field1: 'nested-value',
-            field2: 123,
-          },
-        };
-
-        const writeResponse = await http.post('backend-manager/admin/database', {
-          path: TEST_PATH,
-          document: testData,
-        });
-
-        assert.isSuccess(writeResponse, 'Setup: Database write should succeed');
-      },
-    },
-
-    // Test 2: Admin can read data
-    {
-      name: 'admin-read-succeeds',
-      auth: 'admin',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const readResponse = await http.get('backend-manager/admin/database', {
-          path: TEST_PATH,
-        });
-
-        assert.isSuccess(readResponse, 'Database read should succeed with admin auth');
-        assert.hasProperty(readResponse, 'data.testField', 'Response should contain test data');
-        assert.equal(
-          readResponse.data.testField,
-          'database-test-value',
-          'Read data should match written data'
-        );
-        assert.hasProperty(readResponse, 'data.nested.field1', 'Response should contain nested data');
-        assert.equal(
-          readResponse.data.nested.field2,
-          123,
-          'Nested field should match written data'
-        );
-      },
-    },
-
-    // Test 3: Reading non-existent path returns empty/null
-    {
-      name: 'read-nonexistent-returns-null',
-      auth: 'admin',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const readResponse = await http.get('backend-manager/admin/database', {
-          path: '_test/nonexistent-path-12345',
-        });
-
-        assert.isSuccess(readResponse, 'Reading non-existent path should succeed');
-        const data = readResponse.data;
-        const isEmpty = data === null
-          || data === undefined
-          || (typeof data === 'object' && Object.keys(data).length === 0);
-        assert.ok(
-          isEmpty,
-          `Non-existent path should return null, undefined, or empty object, got: ${JSON.stringify(data)}`
-        );
-      },
-    },
-
-    // Test 4: Missing path returns 400 error
-    {
-      name: 'missing-path-rejected',
-      auth: 'admin',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const readResponse = await http.get('backend-manager/admin/database', {});
-
-        assert.isError(readResponse, 400, 'Missing path should return 400');
-      },
-    },
-
-    // Test 5: Unauthenticated request fails
-    {
-      name: 'unauthenticated-rejected',
-      auth: 'none',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const readResponse = await http.get('backend-manager/admin/database', {
-          path: TEST_PATH,
-        });
-
-        assert.isError(readResponse, 401, 'Database read should fail without authentication');
-      },
-    },
-
-    // Test 6: Non-admin user fails
-    {
-      name: 'non-admin-rejected',
-      auth: 'basic',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const readResponse = await http.get('backend-manager/admin/database', {
-          path: TEST_PATH,
-        });
-
-        assert.isError(readResponse, 403, 'Database read should fail for non-admin user');
-      },
-    },
-
-  ],
-};

package/test/routes/admin/deduplicate-image-alts.js

@@ -1,190 +0,0 @@
-/**
- * Test: routes/admin/post/deduplicate-image-alts
- * Unit tests for the alt-text dedup helper used by the admin/post route.
- *
- * Run: npx mgr test routes/admin/deduplicate-image-alts
- *
- * Contract:
- *   - Header images are never modified.
- *   - Two non-header images with the same alt AND different URLs:
- *     the second's alt is suffixed with " (2)" (and " (3)" for the third, etc.)
- *     and the body is rewritten to match.
- *   - Two non-header images with the same alt AND the same URL:
- *     the second reuses the first's (possibly already-suffixed) alt — no change.
- *   - Images with distinct alts are untouched.
- */
-const deduplicateImageAlts = require('../../../src/manager/routes/admin/post/deduplicate-image-alts');
-
-module.exports = {
-  description: 'routes/admin/post/deduplicate-image-alts',
-  type: 'group',
-
-  tests: [
-    // ─── Happy path: no collisions ───
-
-    {
-      name: 'distinct-alts-are-untouched',
-      async run({ assert }) {
-        const images = [
-          { src: 'https://a.com/1.jpg', alt: 'Cat', header: false },
-          { src: 'https://a.com/2.jpg', alt: 'Dog', header: false },
-        ];
-        const body = '![Cat](https://a.com/1.jpg)\n\n![Dog](https://a.com/2.jpg)';
-        const result = deduplicateImageAlts(images, body);
-
-        assert.equal(result.images[0].alt, 'Cat', 'First image alt unchanged');
-        assert.equal(result.images[1].alt, 'Dog', 'Second image alt unchanged');
-        assert.equal(result.body, body, 'Body is unchanged when no collisions');
-      },
-    },
-
-    // ─── The bug: same alt, different URLs ───
-
-    {
-      name: 'same-alt-different-urls-suffixes-second',
-      async run({ assert }) {
-        const sharedAlt = '62f9b399-92c2-40c2-8ec4-e05b54077aaa';
-        const images = [
-          { src: 'https://a.com/1.jpg', alt: sharedAlt, header: false },
-          { src: 'https://a.com/2.jpg', alt: sharedAlt, header: false },
-        ];
-        const body = `![${sharedAlt}](https://a.com/1.jpg)\n\nsome text\n\n![${sharedAlt}](https://a.com/2.jpg)`;
-        const result = deduplicateImageAlts(images, body);
-
-        assert.equal(result.images[0].alt, sharedAlt, 'First image keeps original alt');
-        assert.equal(result.images[1].alt, `${sharedAlt} (2)`, 'Second image alt is suffixed with " (2)"');
-        assert.ok(
-          result.body.includes(`![${sharedAlt}](https://a.com/1.jpg)`),
-          'Body still contains the first image with original alt',
-        );
-        assert.ok(
-          result.body.includes(`![${sharedAlt} (2)](https://a.com/2.jpg)`),
-          'Body contains the second image with suffixed alt',
-        );
-      },
-    },
-
-    {
-      name: 'three-images-same-alt-different-urls-counts-up',
-      async run({ assert }) {
-        const sharedAlt = 'Logo';
-        const images = [
-          { src: 'https://a.com/1.jpg', alt: sharedAlt, header: false },
-          { src: 'https://a.com/2.jpg', alt: sharedAlt, header: false },
-          { src: 'https://a.com/3.jpg', alt: sharedAlt, header: false },
-        ];
-        const body = `![${sharedAlt}](https://a.com/1.jpg)\n![${sharedAlt}](https://a.com/2.jpg)\n![${sharedAlt}](https://a.com/3.jpg)`;
-        const result = deduplicateImageAlts(images, body);
-
-        assert.equal(result.images[0].alt, 'Logo');
-        assert.equal(result.images[1].alt, 'Logo (2)');
-        assert.equal(result.images[2].alt, 'Logo (3)');
-        assert.ok(result.body.includes('![Logo](https://a.com/1.jpg)'));
-        assert.ok(result.body.includes('![Logo (2)](https://a.com/2.jpg)'));
-        assert.ok(result.body.includes('![Logo (3)](https://a.com/3.jpg)'));
-      },
-    },
-
-    // ─── Same alt, SAME URL: legitimate duplicate, no change ───
-
-    {
-      name: 'same-alt-same-url-is-not-a-collision',
-      async run({ assert }) {
-        const sharedAlt = 'Logo';
-        const sharedUrl = 'https://a.com/logo.jpg';
-        const images = [
-          { src: sharedUrl, alt: sharedAlt, header: false },
-          { src: sharedUrl, alt: sharedAlt, header: false },
-        ];
-        const body = `![${sharedAlt}](${sharedUrl})\n\n![${sharedAlt}](${sharedUrl})`;
-        const result = deduplicateImageAlts(images, body);
-
-        assert.equal(result.images[0].alt, sharedAlt, 'First image alt unchanged');
-        assert.equal(result.images[1].alt, sharedAlt, 'Second image alt unchanged (same URL)');
-        assert.equal(result.body, body, 'Body unchanged when URLs match');
-      },
-    },
-
-    // ─── Header image is never touched ───
-
-    {
-      name: 'header-image-with-shared-alt-is-not-modified',
-      async run({ assert }) {
-        const sharedAlt = 'banner';
-        const images = [
-          { src: 'https://a.com/header.jpg', alt: sharedAlt, header: true },
-          { src: 'https://a.com/body.jpg', alt: sharedAlt, header: false },
-        ];
-        const body = `![${sharedAlt}](https://a.com/body.jpg)`;
-        const result = deduplicateImageAlts(images, body);
-
-        assert.equal(result.images[0].alt, sharedAlt, 'Header image alt unchanged');
-        assert.equal(
-          result.images[1].alt,
-          sharedAlt,
-          'Body image alt unchanged because header is excluded from collision tracking',
-        );
-        assert.equal(result.body, body, 'Body unchanged');
-      },
-    },
-
-    // ─── Mixed scenarios ───
-
-    {
-      name: 'mixed-A-B-A-C-only-C-collides-with-A-once',
-      async run({ assert }) {
-        // Pattern: A, B, A (same URL as first A), C (different URL, same alt as A)
-        // Expected: A and A reuse, C gets " (2)" suffix because its alt collides with A.
-        const altA = 'Shared';
-        const altB = 'Other';
-        const urlA = 'https://a.com/a.jpg';
-        const urlB = 'https://a.com/b.jpg';
-        const urlC = 'https://a.com/c.jpg';
-
-        const images = [
-          { src: urlA, alt: altA, header: false },
-          { src: urlB, alt: altB, header: false },
-          { src: urlA, alt: altA, header: false }, // Same URL as image 1 — legit duplicate
-          { src: urlC, alt: altA, header: false }, // Different URL, same alt — collision
-        ];
-        const body = `![${altA}](${urlA})\n![${altB}](${urlB})\n![${altA}](${urlA})\n![${altA}](${urlC})`;
-        const result = deduplicateImageAlts(images, body);
-
-        assert.equal(result.images[0].alt, altA, 'Image 1 unchanged');
-        assert.equal(result.images[1].alt, altB, 'Image 2 (different alt) unchanged');
-        assert.equal(result.images[2].alt, altA, 'Image 3 (same URL as 1) unchanged');
-        assert.equal(result.images[3].alt, `${altA} (2)`, 'Image 4 (different URL, same alt) gets " (2)"');
-        assert.ok(result.body.includes(`![${altA} (2)](${urlC})`), 'Body has the C image with suffixed alt');
-      },
-    },
-
-    // ─── Edge cases ───
-
-    {
-      name: 'empty-images-array-returns-empty',
-      async run({ assert }) {
-        const result = deduplicateImageAlts([], 'some body');
-        assert.deepEqual(result.images, [], 'images is empty');
-        assert.equal(result.body, 'some body', 'body unchanged');
-      },
-    },
-
-    {
-      name: 'no-collisions-among-different-alts',
-      async run({ assert }) {
-        const images = [
-          { src: 'https://a.com/1.jpg', alt: 'A', header: false },
-          { src: 'https://a.com/2.jpg', alt: 'B', header: false },
-          { src: 'https://a.com/3.jpg', alt: 'C', header: false },
-        ];
-        const body = '![A](https://a.com/1.jpg)\n![B](https://a.com/2.jpg)\n![C](https://a.com/3.jpg)';
-        const result = deduplicateImageAlts(images, body);
-
-        assert.equal(result.images[0].alt, 'A');
-        assert.equal(result.images[1].alt, 'B');
-        assert.equal(result.images[2].alt, 'C');
-        assert.equal(result.body, body, 'Body unchanged');
-      },
-    },
-  ],
-};