backend-manager 5.9.4 → 5.9.6

package/test/routes/test/usage.js

@@ -1,342 +0,0 @@
-/**
- * Test: POST /test/usage
- * Tests the usage tracking API
- * This is a suite because we need to track state and verify increments
- */
-module.exports = {
-  description: 'Usage tracking API',
-  type: 'suite',
-  timeout: 30000,
-
-  tests: [
-    // Test 1: Store initial usage state
-    {
-      name: 'store-initial-usage',
-      async run({ firestore, assert, state, accounts }) {
-        // Get the basic account's current usage to track changes
-        const userDoc = await firestore.get(`users/${accounts.basic.uid}`);
-
-        state.initialUsage = userDoc?.usage || {};
-
-        // Store initial values for requests metric (may not exist yet)
-        state.initialMonthly = state.initialUsage?.requests?.monthly || 0;
-        state.initialDaily = state.initialUsage?.requests?.daily || 0;
-        state.initialTotal = state.initialUsage?.requests?.total || 0;
-
-        assert.ok(true, 'Initial usage state captured');
-      },
-    },
-
-    // Test 2: Increment usage with default values
-    {
-      name: 'increment-default',
-      async run({ http, assert, state }) {
-        const response = await http.as('basic').post('backend-manager/test/usage', {});
-
-        assert.isSuccess(response, 'Usage increment should succeed');
-        assert.hasProperty(response, 'data.metric', 'Response should contain metric name');
-        assert.hasProperty(response, 'data.amount', 'Response should contain amount');
-        assert.hasProperty(response, 'data.before', 'Response should contain before values');
-        assert.hasProperty(response, 'data.after', 'Response should contain after values');
-
-        // Verify defaults
-        assert.equal(response.data.metric, 'requests', 'Metric should be requests');
-        assert.equal(response.data.amount, 1, 'Default amount should be 1');
-
-        // Verify monthly incremented
-        assert.equal(
-          response.data.after.monthly,
-          response.data.before.monthly + 1,
-          'Monthly should be incremented by 1'
-        );
-
-        // Verify daily incremented
-        assert.equal(
-          response.data.after.daily,
-          response.data.before.daily + 1,
-          'Daily should be incremented by 1'
-        );
-
-        // Verify total incremented
-        assert.equal(
-          response.data.after.total,
-          response.data.before.total + 1,
-          'Total should be incremented by 1'
-        );
-
-        // Store for next test
-        state.afterFirstIncrement = response.data.after;
-      },
-    },
-
-    // Test 3: Verify usage persisted to Firestore
-    {
-      name: 'verify-usage-persisted',
-      async run({ firestore, assert, state, accounts }) {
-        const userDoc = await firestore.get(`users/${accounts.basic.uid}`);
-
-        assert.ok(userDoc?.usage, 'User should have usage object');
-        assert.ok(userDoc?.usage?.requests, 'User should have requests usage');
-
-        assert.equal(
-          userDoc.usage.requests.monthly,
-          state.afterFirstIncrement.monthly,
-          'Persisted monthly should match API response'
-        );
-        assert.equal(
-          userDoc.usage.requests.daily,
-          state.afterFirstIncrement.daily,
-          'Persisted daily should match API response'
-        );
-        assert.equal(
-          userDoc.usage.requests.total,
-          state.afterFirstIncrement.total,
-          'Persisted total should match API response'
-        );
-
-        // Verify last timestamp exists
-        assert.ok(userDoc.usage.requests.last, 'Should have last object');
-        assert.ok(userDoc.usage.requests.last.timestamp, 'Should have last.timestamp');
-        assert.ok(userDoc.usage.requests.last.timestampUNIX, 'Should have last.timestampUNIX');
-      },
-    },
-
-    // Test 4: Increment with custom amount
-    {
-      name: 'increment-custom-amount',
-      async run({ http, assert, state }) {
-        const response = await http.as('basic').post('backend-manager/test/usage', {
-          amount: 5,
-        });
-
-        assert.isSuccess(response, 'Custom amount increment should succeed');
-        assert.equal(response.data.amount, 5, 'Amount should be 5');
-
-        // Verify all counters incremented by 5
-        assert.equal(
-          response.data.after.monthly,
-          response.data.before.monthly + 5,
-          'Monthly should be incremented by 5'
-        );
-        assert.equal(
-          response.data.after.daily,
-          response.data.before.daily + 5,
-          'Daily should be incremented by 5'
-        );
-        assert.equal(
-          response.data.after.total,
-          response.data.before.total + 5,
-          'Total should be incremented by 5'
-        );
-
-        state.afterCustomAmount = response.data.after;
-      },
-    },
-
-    // Test 5: Verify custom amount persisted
-    {
-      name: 'verify-custom-amount-persisted',
-      async run({ firestore, assert, state, accounts }) {
-        const userDoc = await firestore.get(`users/${accounts.basic.uid}`);
-
-        assert.ok(userDoc?.usage?.requests, 'User should have requests usage');
-
-        assert.equal(
-          userDoc.usage.requests.monthly,
-          state.afterCustomAmount.monthly,
-          'Requests monthly should be persisted'
-        );
-        assert.equal(
-          userDoc.usage.requests.daily,
-          state.afterCustomAmount.daily,
-          'Requests daily should be persisted'
-        );
-        assert.equal(
-          userDoc.usage.requests.total,
-          state.afterCustomAmount.total,
-          'Requests total should be persisted'
-        );
-      },
-    },
-
-    // Test 6: Multiple increments accumulate
-    {
-      name: 'multiple-increments-accumulate',
-      async run({ http, assert, state }) {
-        // First increment
-        const response1 = await http.as('basic').post('backend-manager/test/usage', {});
-
-        assert.isSuccess(response1, 'First increment should succeed');
-
-        // Second increment
-        const response2 = await http.as('basic').post('backend-manager/test/usage', {});
-
-        assert.isSuccess(response2, 'Second increment should succeed');
-
-        // Third increment with custom amount
-        const response3 = await http.as('basic').post('backend-manager/test/usage', {
-          amount: 3,
-        });
-
-        assert.isSuccess(response3, 'Third increment should succeed');
-
-        // Verify accumulation: should be initial + 1 (test 2) + 5 (test 4) + 1 + 1 + 3 = initial + 11
-        const expectedMonthly = state.initialMonthly + 11;
-        const expectedDaily = state.initialDaily + 11;
-        const expectedTotal = state.initialTotal + 11;
-
-        assert.equal(
-          response3.data.after.monthly,
-          expectedMonthly,
-          `Monthly should accumulate to ${expectedMonthly}`
-        );
-        assert.equal(
-          response3.data.after.daily,
-          expectedDaily,
-          `Daily should accumulate to ${expectedDaily}`
-        );
-        assert.equal(
-          response3.data.after.total,
-          expectedTotal,
-          `Total should accumulate to ${expectedTotal}`
-        );
-      },
-    },
-
-    // Test 7: Unauthenticated usage tracks by IP in usage collection
-    {
-      name: 'unauthenticated-usage-by-ip',
-      async run({ http, assert, state }) {
-        // Unauthenticated requests use IP as key (no proxy headers in emulator, so falls back to 'unknown')
-        state.unauthKey = 'unknown';
-
-        const response = await http.as('none').post('backend-manager/test/usage', {});
-
-        assert.isSuccess(response, 'Unauthenticated usage increment should succeed');
-        assert.equal(response.data.authenticated, false, 'Should report as unauthenticated');
-        assert.equal(response.data.key, state.unauthKey, 'Key should be unknown');
-
-        // Verify all counters incremented
-        assert.equal(response.data.after.monthly, response.data.before.monthly + 1, 'Monthly should increment by 1');
-        assert.equal(response.data.after.daily, response.data.before.daily + 1, 'Daily should increment by 1');
-
-        state.unauthMonthly = response.data.after.monthly;
-      },
-    },
-
-    // Test 8: Verify unauthenticated usage persisted to usage collection
-    {
-      name: 'verify-unauthenticated-usage-persisted',
-      async run({ firestore, assert, state }) {
-        const usageDoc = await firestore.get(`usage/${state.unauthKey}`);
-
-        assert.ok(usageDoc, 'Usage doc should exist in usage collection');
-        assert.ok(usageDoc?.requests, 'Usage doc should have the requests metric');
-        assert.equal(usageDoc.requests.monthly, state.unauthMonthly, 'Persisted monthly should match');
-      },
-    },
-
-    // Test 9: Cron resets daily counters for authenticated users
-    {
-      name: 'cron-resets-daily-counters',
-      // bm_cronDaily runs all daily jobs serially; reset-usage is at the end of
-      // the alphabetical sequence. In EXTENDED mode the real-API jobs ahead of
-      // it can take ~50s combined — override the suite's 30s default.
-      timeout: 75000,
-      async run({ assert, firestore, state, accounts, waitFor, pubsub }) {
-        // Verify daily counter is > 0 before cron
-        const beforeDoc = await firestore.get(`users/${accounts.basic.uid}`);
-        assert.ok(beforeDoc?.usage?.requests?.daily > 0, 'Daily counter should be > 0 before cron');
-
-        // Store monthly and total before cron (should NOT be reset by daily cron)
-        state.monthlyBeforeCron = beforeDoc.usage.requests.monthly;
-        state.totalBeforeCron = beforeDoc.usage.requests.total;
-
-        // Trigger cron via PubSub
-        await pubsub.trigger('bm_cronDaily');
-
-        // Wait for cron to reset daily counter.
-        // bm_cronDaily executes every registered daily job sequentially. In EXTENDED
-        // mode the real-API jobs (marketing-newsletter-generate, expire-paypal-cancellations,
-        // blog-auto-publisher, etc.) can take 40-50s combined before reset-usage
-        // (alphabetical tail) gets its turn. 70s gives that the headroom it needs;
-        // the per-test `timeout` below matches.
-        try {
-          await waitFor(
-            async () => {
-              const doc = await firestore.get(`users/${accounts.basic.uid}`);
-              return doc?.usage?.requests?.daily === 0;
-            },
-            70000,
-            500
-          );
-          assert.ok(true, 'Daily counter was reset to 0 by cron');
-        } catch (error) {
-          assert.fail('Daily counter should be reset to 0 within 70s');
-        }
-      },
-    },
-
-    // Test 10: Cron preserves monthly and total counters (non-1st of month)
-    {
-      name: 'cron-preserves-monthly-and-total',
-      async run({ assert, firestore, state, accounts }) {
-        const afterDoc = await firestore.get(`users/${accounts.basic.uid}`);
-
-        assert.equal(
-          afterDoc.usage.requests.monthly,
-          state.monthlyBeforeCron,
-          'Monthly counter should be preserved after daily cron'
-        );
-        assert.equal(
-          afterDoc.usage.requests.total,
-          state.totalBeforeCron,
-          'Total counter should be preserved after daily cron'
-        );
-      },
-    },
-
-    // Test 11: Cron deletes unauthenticated usage collection
-    {
-      name: 'cron-deletes-unauthenticated-usage',
-      async run({ assert, firestore, state, waitFor }) {
-        // The cron was already triggered in test 9, so the usage collection should be deleted
-        try {
-          await waitFor(
-            async () => {
-              const doc = await firestore.get(`usage/${state.unauthKey}`);
-              return !doc;
-            },
-            10000,
-            500
-          );
-          assert.ok(true, 'Usage collection doc was deleted by cron');
-        } catch (error) {
-          assert.fail('Usage collection doc should be deleted within 10s');
-        }
-      },
-    },
-
-    // Test 12: Daily counter accumulates after cron reset
-    {
-      name: 'daily-counter-accumulates-after-reset',
-      async run({ http, assert }) {
-        // After cron reset daily to 0, new increments should start from 0
-        const response = await http.as('basic').post('backend-manager/test/usage', {
-          amount: 3,
-        });
-
-        assert.isSuccess(response, 'Increment after cron reset should succeed');
-        assert.equal(response.data.before.daily, 0, 'Daily should be 0 after cron reset');
-        assert.equal(response.data.after.daily, 3, 'Daily should be 3 after increment');
-
-        // Monthly should have continued accumulating (not reset)
-        assert.equal(
-          response.data.after.monthly,
-          response.data.before.monthly + 3,
-          'Monthly should continue accumulating'
-        );
-      },
-    },
-  ],
-};

package/test/routes/user/api-keys.js

@@ -1,156 +0,0 @@
-/**
- * Test: POST /user/api-keys
- * Tests the user regenerate API keys endpoint
- * This is a suite because we need to track state and restore original keys
- */
-module.exports = {
-  description: 'User regenerate API keys',
-  type: 'suite',
-  timeout: 30000,
-
-  tests: [
-    // Test 1: Store original keys
-    {
-      name: 'store-original-keys',
-      async run({ firestore, assert, state, accounts }) {
-        // Get the basic account's current keys to restore later
-        const userDoc = await firestore.get(`users/${accounts.basic.uid}`);
-
-        assert.ok(userDoc, 'User doc should exist');
-        assert.hasProperty({ data: userDoc }, 'data.api.clientId', 'User should have clientId');
-        assert.hasProperty({ data: userDoc }, 'data.api.privateKey', 'User should have privateKey');
-
-        state.originalClientId = userDoc.api.clientId;
-        state.originalPrivateKey = userDoc.api.privateKey;
-
-        assert.ok(state.originalClientId, 'Original clientId should exist');
-        assert.ok(state.originalPrivateKey, 'Original privateKey should exist');
-      },
-    },
-
-    // Test 2: Regenerate both keys (default)
-    {
-      name: 'regenerate-both-keys',
-      async run({ http, assert, state }) {
-        const response = await http.as('basic').post('backend-manager/user/api-keys', {});
-
-        assert.isSuccess(response, 'Regenerate API keys should succeed');
-        assert.hasProperty(response, 'data.clientId', 'Response should contain new clientId');
-        assert.hasProperty(response, 'data.privateKey', 'Response should contain new privateKey');
-
-        // Keys should be different from original
-        assert.notEqual(
-          response.data.clientId,
-          state.originalClientId,
-          'New clientId should be different from original'
-        );
-        assert.notEqual(
-          response.data.privateKey,
-          state.originalPrivateKey,
-          'New privateKey should be different from original'
-        );
-
-        // Store new keys for verification
-        state.newClientId = response.data.clientId;
-        state.newPrivateKey = response.data.privateKey;
-      },
-    },
-
-    // Test 3: Verify keys are persisted in Firestore
-    {
-      name: 'verify-keys-persisted',
-      async run({ firestore, assert, state, accounts }) {
-        const userDoc = await firestore.get(`users/${accounts.basic.uid}`);
-
-        assert.equal(
-          userDoc.api.clientId,
-          state.newClientId,
-          'Persisted clientId should match returned value'
-        );
-        assert.equal(
-          userDoc.api.privateKey,
-          state.newPrivateKey,
-          'Persisted privateKey should match returned value'
-        );
-      },
-    },
-
-    // Test 4: Regenerate only clientId
-    // Note: After test 2, the privateKey changed so we need to use the new one
-    {
-      name: 'regenerate-only-clientId',
-      async run({ http, assert, state }) {
-        // Use the new privateKey from test 2 since old one is invalid
-        const response = await http.withPrivateKey(state.newPrivateKey).post('backend-manager/user/api-keys', {
-          keys: ['clientId'],
-        });
-
-        assert.isSuccess(response, 'Regenerate clientId only should succeed');
-        assert.hasProperty(response, 'data.clientId', 'Response should contain new clientId');
-        assert.ok(
-          !response.data.privateKey,
-          'Response should NOT contain privateKey when only clientId requested'
-        );
-        assert.notEqual(
-          response.data.clientId,
-          state.newClientId,
-          'New clientId should be different from previous'
-        );
-      },
-    },
-
-    // Test 5: Regenerate only privateKey
-    {
-      name: 'regenerate-only-privateKey',
-      async run({ http, assert, state, accounts, firestore }) {
-        // Get current clientId to verify it stays the same
-        const beforeDoc = await firestore.get(`users/${accounts.basic.uid}`);
-        const currentClientId = beforeDoc.api.clientId;
-
-        // Still use newPrivateKey since test 4 didn't change it
-        const response = await http.withPrivateKey(state.newPrivateKey).post('backend-manager/user/api-keys', {
-          keys: ['privateKey'],
-        });
-
-        assert.isSuccess(response, 'Regenerate privateKey only should succeed');
-        assert.hasProperty(response, 'data.privateKey', 'Response should contain new privateKey');
-        assert.ok(
-          !response.data.clientId,
-          'Response should NOT contain clientId when only privateKey requested'
-        );
-
-        // Verify clientId stayed the same
-        const afterDoc = await firestore.get(`users/${accounts.basic.uid}`);
-        assert.equal(
-          afterDoc.api.clientId,
-          currentClientId,
-          'clientId should remain unchanged when only privateKey regenerated'
-        );
-      },
-    },
-
-    // Test 6: Unauthenticated request fails
-    {
-      name: 'unauthenticated-rejected',
-      async run({ http, assert }) {
-        const response = await http.as('none').post('backend-manager/user/api-keys', {});
-
-        assert.isError(response, 401, 'Regenerate API keys should fail without authentication');
-      },
-    },
-
-    // Test 7: Restore original keys
-    {
-      name: 'restore-original-keys',
-      async run({ firestore, state, accounts }) {
-        // Restore original keys so other tests aren't affected
-        await firestore.set(`users/${accounts.basic.uid}`, {
-          api: {
-            clientId: state.originalClientId,
-            privateKey: state.originalPrivateKey,
-          },
-        }, { merge: true });
-      },
-    },
-  ],
-};

package/test/routes/user/delete.js

@@ -1,136 +0,0 @@
-/**
- * Test: DELETE /user
- * User deletion flow tests
- * Tests:
- * - Users with active subscriptions cannot delete themselves
- * - Users cannot delete other users
- * - Users can delete themselves after subscription is removed
- * - Admins can delete any user
- */
-module.exports = {
-  description: 'User deletion flow',
-  type: 'suite',
-
-  tests: [
-    // --- Self-deletion tests ---
-    {
-      name: 'verify-delete-user-exists',
-      async run({ firestore, assert, state, accounts }) {
-        // Get the delete test account uid
-        state.deleteUid = accounts.delete.uid;
-
-        // Verify the user doc exists
-        const userDoc = await firestore.get(`users/${state.deleteUid}`);
-
-        assert.ok(userDoc, 'Delete user doc should exist before deletion');
-        assert.ok(userDoc?.auth?.uid === state.deleteUid, 'User doc should have correct uid');
-      },
-    },
-
-    {
-      name: 'delete-blocked-with-subscription',
-      async run({ http, assert }) {
-        // Auth as the delete user and try to delete themselves
-        // Should be blocked due to active subscription
-        const deleteResponse = await http.as('delete').delete('backend-manager/user', {});
-
-        assert.isError(deleteResponse, 400, 'Deletion should be blocked with active subscription');
-        assert.ok(
-          deleteResponse.error?.includes('paid subscription'),
-          `Error should mention paid subscription: ${deleteResponse.error}`,
-        );
-      },
-    },
-
-    // NOTE: The DELETE /user API ignores the payload uid parameter for non-admin users.
-    // It always uses the authenticated user's uid from resolveUser().
-    // This means non-admins cannot delete other users by design - the uid param is simply ignored.
-    // A test for "delete other user blocked" would be misleading since it would actually
-    // try to delete the authenticated user (basic), not the target user.
-    // If we want to explicitly block this, the API should be updated to check payload.uid
-    // against user.auth.uid and return a 403 if they don't match.
-
-    {
-      name: 'remove-subscription-from-delete-user',
-      async run({ firestore, state }) {
-        // Remove the subscription (set to null to overwrite)
-        await firestore.set(`users/${state.deleteUid}`, { subscription: null }, { merge: true });
-      },
-    },
-
-    {
-      name: 'delete-user-succeeds',
-      async run({ http, assert }) {
-        // Auth as the delete user and delete themselves
-        const deleteResponse = await http.as('delete').delete('backend-manager/user', {});
-
-        assert.isSuccess(deleteResponse, `DELETE /user should succeed: ${JSON.stringify(deleteResponse, null, 2)}`);
-      },
-    },
-
-    {
-      name: 'verify-firestore-doc-deleted',
-      async run({ firestore, assert, state, waitFor }) {
-        // on-delete handler deletes Firestore doc when Auth user is deleted
-        // Wait for the deletion to complete
-        const docDeleted = await waitFor(async () => {
-          const userDoc = await firestore.get(`users/${state.deleteUid}`);
-          return !userDoc;
-        }, 10000, 500);
-
-        assert.ok(docDeleted, 'Firestore doc should be deleted after Auth user deletion');
-      },
-    },
-
-    // --- Admin deletion tests ---
-    {
-      name: 'verify-admin-delete-target-exists',
-      async run({ firestore, assert, state, accounts }) {
-        // Get the delete-by-admin test account uid
-        state.adminDeleteUid = accounts['delete-by-admin'].uid;
-
-        // Verify the user doc exists
-        const userDoc = await firestore.get(`users/${state.adminDeleteUid}`);
-
-        assert.ok(userDoc, 'Admin delete target user doc should exist');
-        assert.ok(userDoc?.auth?.uid === state.adminDeleteUid, 'User doc should have correct uid');
-      },
-    },
-
-    {
-      name: 'admin-can-delete-other-user',
-      async run({ http, assert, state }) {
-        // Auth as admin (using backendManagerKey) and delete another user
-        const deleteResponse = await http.as('admin').delete('backend-manager/user', {
-          uid: state.adminDeleteUid,
-        });
-
-        assert.isSuccess(deleteResponse, `Admin should be able to delete another user: ${JSON.stringify(deleteResponse, null, 2)}`);
-      },
-    },
-
-    {
-      name: 'verify-admin-deleted-user-firestore-deleted',
-      async run({ firestore, assert, state, waitFor }) {
-        // on-delete handler deletes Firestore doc when Auth user is deleted
-        // Wait for the deletion to complete
-        const docDeleted = await waitFor(async () => {
-          const userDoc = await firestore.get(`users/${state.adminDeleteUid}`);
-          return !userDoc;
-        }, 10000, 500);
-
-        assert.ok(docDeleted, 'Firestore doc should be deleted after admin deletion');
-      },
-    },
-
-    // --- Auth rejection test (at end per convention) ---
-    {
-      name: 'unauthenticated-rejected',
-      async run({ http, assert }) {
-        const deleteResponse = await http.as('none').delete('backend-manager/user', {});
-
-        assert.isError(deleteResponse, 401, 'Delete should fail without authentication');
-      },
-    },
-  ],
-};