backend-manager 5.9.5 → 5.9.6

package/test/routes/admin/post.js

@@ -1,368 +0,0 @@
-/**
- * Test: PUT /admin/post
- * Tests the admin edit post endpoint
- * Edits blog post content in a GitHub repository
- * Requires admin/blogger role, GitHub API key, and repo_website config
- *
- * This is a suite because we need to:
- * 1. Create a test post file via Octokit
- * 2. Wait for GitHub to index it (for code search)
- * 3. Edit it via the API
- * 4. Clean up the test file
- */
-const { Octokit } = require('@octokit/rest');
-
-// Test post configuration
-const TEST_POST_SLUG = 'bem-test-post';
-const TEST_POST_ID = Date.now();
-
-// Generate frontmatter for the test post
-function generatePostContent(body) {
-  const frontmatter = `layout: blueprint/blog/post
-
-meta:
-  title: BEM Test Post
-  description: This is a test post created by BEM test suite.
-  og:image: ''
-
-post:
-  title: BEM Test Post
-  id: ${TEST_POST_ID}
-  description: This is a test post created by BEM test suite.
-  author: guest
-  tags: []
-  categories: []`;
-
-  return `---\n${frontmatter}\n---\n\n${body}`;
-}
-
-module.exports = {
-  description: 'Admin edit post on GitHub',
-  type: 'suite',
-  timeout: 300000, // 5 minutes total for the suite
-  skip: !process.env.TEST_EXTENDED_MODE ? 'TEST_EXTENDED_MODE env var not set (skipping GitHub edit tests)' : false,
-
-  tests: [
-    // Test 1: Missing URL returns 400 error
-    {
-      name: 'missing-url-rejected',
-      auth: 'admin',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.put('backend-manager/admin/post', {
-          body: 'Test content',
-        });
-
-        assert.isError(response, 400, 'Missing URL should return 400');
-      },
-    },
-
-    // Test 2: Missing body returns 400 error
-    {
-      name: 'missing-body-rejected',
-      auth: 'admin',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.put('backend-manager/admin/post', {
-          url: 'https://example.com/blog/test-post',
-        });
-
-        assert.isError(response, 400, 'Missing body should return 400');
-      },
-    },
-
-    // Test 3: Non-existent post returns 404
-    {
-      name: 'nonexistent-post-returns-404',
-      auth: 'admin',
-      timeout: 60000,
-
-      async run({ http, assert, config }) {
-        const response = await http.put('backend-manager/admin/post', {
-          url: `https://${config.domain}/blog/nonexistent-test-post-12345`,
-          body: 'This is test content from BEM test suite.',
-        });
-
-        assert.isError(response, 404, 'Non-existent post should return 404');
-      },
-    },
-
-    // Test 4: Non-existent repo returns 404
-    // PUT first calls content/post to fetch the existing post; with a unique URL that's never been
-    // created, the fetch itself returns 404 before we ever try to push to the nonexistent repo.
-    {
-      name: 'nonexistent-repo-returns-404',
-      auth: 'admin',
-      timeout: 30000,
-
-      async run({ http, assert }) {
-        const response = await http.put('backend-manager/admin/post', {
-          url: `https://example.com/blog/never-created-${Date.now()}`,
-          body: 'Test content',
-          githubUser: 'nonexistent-user-12345',
-          githubRepo: 'nonexistent-repo-12345',
-        });
-
-        assert.isError(response, 404, 'Non-existent repo or post should return 404');
-      },
-    },
-
-    // Test 5: Create a test post via Octokit
-    {
-      name: 'create-test-post',
-      auth: 'admin',
-      timeout: 60000,
-      skip: !process.env.GH_TOKEN ? 'GH_TOKEN env var not set' : false,
-
-      async run({ assert, state, config }) {
-        if (!config.github?.repo_website) {
-          assert.fail('githubRepoWebsite not configured');
-          return;
-        }
-
-        const octokit = new Octokit({ auth: process.env.GH_TOKEN });
-
-        // Parse owner/repo from githubRepoWebsite
-        const repoMatch = config.github?.repo_website.match(/github\.com\/([^/]+)\/([^/]+)/);
-        if (!repoMatch) {
-          assert.fail('Could not parse githubRepoWebsite');
-          return;
-        }
-
-        state.owner = repoMatch[1];
-        state.repo = repoMatch[2];
-
-        // Build the post path (matches the structure expected by fetch-post)
-        const date = new Date().toISOString().split('T')[0]; // YYYY-MM-DD
-        const year = date.split('-')[0];
-        state.postPath = `src/_posts/${year}/guest/${date}-${TEST_POST_SLUG}.md`;
-        state.postSlug = TEST_POST_SLUG;
-
-        // Create the post content
-        const originalBody = 'This is the original content of the test post.\n\nIt will be edited by the BEM test suite.';
-        state.originalBody = originalBody;
-        const content = generatePostContent(originalBody);
-
-        // Check if the file already exists (from a previous failed run)
-        let existingSha;
-        try {
-          const existing = await octokit.rest.repos.getContent({
-            owner: state.owner,
-            repo: state.repo,
-            path: state.postPath,
-          });
-          existingSha = existing.data.sha;
-        } catch (e) {
-          // File doesn't exist, that's fine
-        }
-
-        // Create or update the file via Octokit
-        const createResult = await octokit.rest.repos.createOrUpdateFileContents({
-          owner: state.owner,
-          repo: state.repo,
-          path: state.postPath,
-          message: `🧪 BEM test: create test post for edit-post test`,
-          content: Buffer.from(content).toString('base64'),
-          sha: existingSha, // Include SHA if file exists
-        }).catch(e => e);
-
-        if (createResult instanceof Error) {
-          assert.fail(`Failed to create test post: ${createResult.message}`);
-          return;
-        }
-
-        assert.ok(createResult.data.content.sha, 'Post should be created with a SHA');
-        state.postSha = createResult.data.content.sha;
-      },
-    },
-
-    // Test 6: Verify the file exists via GitHub API (not code search)
-    {
-      name: 'verify-file-exists',
-      auth: 'admin',
-      timeout: 30000,
-      skip: !process.env.GH_TOKEN ? 'GH_TOKEN env var not set' : false,
-
-      async run({ assert, state, config }) {
-        if (!state.postPath) {
-          return; // Previous test didn't run
-        }
-
-        state.postUrl = `https://${config.domain}/blog/${state.postSlug}`;
-
-        const octokit = new Octokit({ auth: process.env.GH_TOKEN });
-
-        // Verify the file exists via direct API (not code search)
-        const { data: fileData } = await octokit.rest.repos.getContent({
-          owner: state.owner,
-          repo: state.repo,
-          path: state.postPath,
-        });
-
-        assert.ok(fileData.sha, 'File should exist in GitHub repo');
-        state.currentSha = fileData.sha;
-      },
-    },
-
-    // Test 7: Edit the test post via PUT /admin/post
-    // NOTE: This may fail if GitHub's code search hasn't indexed the file yet
-    // The edit-post API uses fetch-post which relies on code search
-    {
-      name: 'edit-test-post',
-      auth: 'admin',
-      timeout: 60000,
-      skip: !process.env.GH_TOKEN ? 'GH_TOKEN env var not set' : false,
-
-      async run({ http, assert, state }) {
-        if (!state.postUrl) {
-          return; // Previous tests didn't run
-        }
-
-        const newBody = 'This content was EDITED by the BEM test suite.\n\nThe edit was successful!';
-        state.editedBody = newBody;
-
-        const response = await http.put('backend-manager/admin/post', {
-          url: state.postUrl,
-          body: newBody,
-        });
-
-        // If fetch-post can't find the file (not indexed yet), it returns 404
-        // This is a known limitation - the file exists but code search hasn't indexed it
-        if (response.status === 404 && response.error?.includes('not found')) {
-          state.editSkipped = true;
-          assert.ok(true, 'Edit skipped - GitHub code search has not indexed the file yet (this is expected for new files)');
-          return;
-        }
-
-        assert.isSuccess(response, 'Edit post should succeed');
-        assert.hasProperty(response, 'data.url', 'Response should have url');
-      },
-    },
-
-    // Test 8: Verify the edit was applied (using Octokit directly)
-    {
-      name: 'verify-edit',
-      auth: 'admin',
-      timeout: 30000,
-      skip: !process.env.GH_TOKEN ? 'GH_TOKEN env var not set' : false,
-
-      async run({ assert, state }) {
-        if (!state.postPath || state.editSkipped) {
-          assert.ok(true, 'Skipping verify - edit was not performed');
-          return;
-        }
-
-        const octokit = new Octokit({ auth: process.env.GH_TOKEN });
-
-        // Fetch the file directly from GitHub
-        const { data: fileData } = await octokit.rest.repos.getContent({
-          owner: state.owner,
-          repo: state.repo,
-          path: state.postPath,
-        });
-
-        // Decode the content
-        const content = Buffer.from(fileData.content, 'base64').toString();
-
-        assert.ok(
-          content.includes('EDITED by the BEM test suite'),
-          'Post content should contain the edited text'
-        );
-      },
-    },
-
-    // --- Auth rejection tests (at end per convention) ---
-    {
-      name: 'unauthenticated-rejected',
-      auth: 'none',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.put('backend-manager/admin/post', {
-          url: 'https://example.com/blog/test-post',
-          body: 'Test content',
-        });
-
-        assert.isError(response, 401, 'Edit post should fail without authentication');
-      },
-    },
-
-    {
-      name: 'non-admin-rejected',
-      auth: 'basic',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.put('backend-manager/admin/post', {
-          url: 'https://example.com/blog/test-post',
-          body: 'Test content',
-        });
-
-        assert.isError(response, 403, 'Edit post should fail for non-admin user');
-      },
-    },
-
-    // Cleanup - delete test post and cancel workflows
-    {
-      name: 'cleanup',
-      auth: 'admin',
-      timeout: 60000,
-
-      async run({ state }) {
-        if (!process.env.GH_TOKEN || !state.postPath) {
-          return;
-        }
-
-        const octokit = new Octokit({ auth: process.env.GH_TOKEN });
-
-        // Get the current SHA (may have changed after edit)
-        try {
-          const { data: fileData } = await octokit.rest.repos.getContent({
-            owner: state.owner,
-            repo: state.repo,
-            path: state.postPath,
-          });
-
-          // Delete the test post
-          await octokit.rest.repos.deleteFile({
-            owner: state.owner,
-            repo: state.repo,
-            path: state.postPath,
-            message: `🧹 BEM test cleanup: delete test post`,
-            sha: fileData.sha,
-          });
-        } catch (e) {
-          // File might not exist, ignore
-        }
-
-        // Cancel any running workflows triggered by our test commits
-        try {
-          const { data: runs } = await octokit.rest.actions.listWorkflowRunsForRepo({
-            owner: state.owner,
-            repo: state.repo,
-            status: 'in_progress',
-            per_page: 10,
-          });
-
-          for (const run of runs.workflow_runs) {
-            if (run.head_commit?.message?.includes('BEM test')) {
-              try {
-                await octokit.rest.actions.cancelWorkflowRun({
-                  owner: state.owner,
-                  repo: state.repo,
-                  run_id: run.id,
-                });
-              } catch (e) {
-                // May already be completed, ignore
-              }
-            }
-          }
-        } catch (e) {
-          // Workflow cancellation failed, not critical
-        }
-      },
-    },
-  ],
-};

package/test/routes/admin/repo-content.js

@@ -1,223 +0,0 @@
-/**
- * Test: POST /admin/repo/content
- * Tests the admin write repo content endpoint
- * Writes arbitrary content to a GitHub repository
- * Requires admin/blogger role, GitHub API key, and repo_website config
- *
- * IMPORTANT: These tests require GH_TOKEN and github.repo_website to be configured.
- * If GitHub is not configured, the tests will fail.
- *
- * This is a suite because we need to clean up created files and cancel workflows after tests.
- */
-const { Octokit } = require('@octokit/rest');
-
-// Test file paths that will be created and need cleanup
-const TEST_FILES = [
-  '_test/bem-write-test.txt',
-  '_test/type-test.txt',
-];
-
-module.exports = {
-  description: 'Admin write content to GitHub repo',
-  type: 'suite',
-  timeout: 120000,
-  skip: !process.env.TEST_EXTENDED_MODE ? 'TEST_EXTENDED_MODE env var not set (skipping GitHub write tests)' : false,
-
-  tests: [
-    // Test 1: Missing path returns 400 error
-    {
-      name: 'missing-path-rejected',
-      auth: 'admin',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.post('backend-manager/admin/repo/content', {
-          content: 'Test content',
-        });
-
-        assert.isError(response, 400, 'Missing path should return 400');
-      },
-    },
-
-    // Test 2: Missing content returns 400 error
-    {
-      name: 'missing-content-rejected',
-      auth: 'admin',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.post('backend-manager/admin/repo/content', {
-          path: '_test/bem-test-file.txt',
-        });
-
-        assert.isError(response, 400, 'Missing content should return 400');
-      },
-    },
-
-    // Test 3: Admin can write content
-    {
-      name: 'admin-can-write-content',
-      auth: 'admin',
-      timeout: 60000,
-
-      async run({ http, assert, state }) {
-        const uniqueContent = `BEM Test - ${new Date().toISOString()}`;
-        const response = await http.post('backend-manager/admin/repo/content', {
-          path: '_test/bem-write-test.txt',
-          content: uniqueContent,
-        });
-
-        assert.isSuccess(response, 'Admin should be able to write content');
-        assert.hasProperty(response, 'data.path', 'Response should contain path');
-        assert.equal(response.data.path, '_test/bem-write-test.txt', 'Path should match');
-
-        // Store for cleanup
-        state.filesCreated = state.filesCreated || [];
-        state.filesCreated.push('_test/bem-write-test.txt');
-      },
-    },
-
-    // Test 4: Content type defaults to text
-    {
-      name: 'content-type-default',
-      auth: 'admin',
-      timeout: 30000,
-
-      async run({ http, assert, state }) {
-        const response = await http.post('backend-manager/admin/repo/content', {
-          path: '_test/type-test.txt',
-          content: 'Test content with default type',
-        });
-
-        assert.isSuccess(response, 'Write with default type should succeed');
-        assert.hasProperty(response, 'data.type', 'Response should contain type');
-        assert.equal(response.data.type, 'text', 'Default type should be text');
-
-        // Store for cleanup
-        state.filesCreated = state.filesCreated || [];
-        state.filesCreated.push('_test/type-test.txt');
-      },
-    },
-
-    // Test 5: Non-existent repo returns 404
-    {
-      name: 'nonexistent-repo-returns-404',
-      auth: 'admin',
-      timeout: 30000,
-
-      async run({ http, assert }) {
-        const response = await http.post('backend-manager/admin/repo/content', {
-          path: '_test/custom-repo-test.txt',
-          content: 'Test content',
-          githubUser: 'nonexistent-user-12345',
-          githubRepo: 'nonexistent-repo-12345',
-        });
-
-        assert.isError(response, 404, 'Non-existent repo should return 404');
-      },
-    },
-
-    // --- Auth rejection tests (at end per convention) ---
-    {
-      name: 'unauthenticated-rejected',
-      auth: 'none',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.post('backend-manager/admin/repo/content', {
-          path: '_test/bem-test-file.txt',
-          content: 'Test content',
-        });
-
-        assert.isError(response, 401, 'Write repo content should fail without authentication');
-      },
-    },
-
-    {
-      name: 'non-admin-rejected',
-      auth: 'basic',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.post('backend-manager/admin/repo/content', {
-          path: '_test/bem-test-file.txt',
-          content: 'Test content',
-        });
-
-        assert.isError(response, 403, 'Write repo content should fail for non-admin user');
-      },
-    },
-
-    // Cleanup - delete test files and cancel workflows
-    {
-      name: 'cleanup',
-      auth: 'admin',
-      timeout: 60000,
-
-      async run({ state, config }) {
-        if (!process.env.GH_TOKEN || !config.github?.repo_website) {
-          return;
-        }
-
-        const octokit = new Octokit({ auth: process.env.GH_TOKEN });
-
-        // Parse owner/repo from githubRepoWebsite (e.g., 'https://github.com/owner/repo')
-        const repoMatch = config.github?.repo_website.match(/github\.com\/([^/]+)\/([^/]+)/);
-        if (!repoMatch) {
-          return;
-        }
-        const owner = repoMatch[1];
-        const repo = repoMatch[2];
-
-        // Delete test files
-        const filesToDelete = state.filesCreated || TEST_FILES;
-        for (const filePath of filesToDelete) {
-          try {
-            const { data: fileData } = await octokit.rest.repos.getContent({
-              owner,
-              repo,
-              path: filePath,
-            });
-
-            await octokit.rest.repos.deleteFile({
-              owner,
-              repo,
-              path: filePath,
-              message: `🧹 BEM test cleanup: ${filePath}`,
-              sha: fileData.sha,
-            });
-          } catch (e) {
-            // File might not exist, ignore
-          }
-        }
-
-        // Cancel running workflows triggered by our test commits
-        try {
-          const { data: runs } = await octokit.rest.actions.listWorkflowRunsForRepo({
-            owner,
-            repo,
-            status: 'in_progress',
-            per_page: 10,
-          });
-
-          for (const run of runs.workflow_runs) {
-            if (run.head_commit?.message?.includes('admin:write-repo-content')
-                || run.head_commit?.message?.includes('BEM test cleanup')) {
-              try {
-                await octokit.rest.actions.cancelWorkflowRun({
-                  owner,
-                  repo,
-                  run_id: run.id,
-                });
-              } catch (e) {
-                // May already be completed, ignore
-              }
-            }
-          }
-        } catch (e) {
-          // Workflow cancellation failed, not critical
-        }
-      },
-    },
-  ],
-};

package/test/routes/admin/stats.js

@@ -1,112 +0,0 @@
-/**
- * Test: GET /admin/stats
- * Tests the admin get stats endpoint
- * Requires admin authentication
- */
-module.exports = {
-  description: 'Admin get stats operation',
-  type: 'group',
-  tests: [
-    // Test 1: Admin can get stats
-    {
-      name: 'admin-get-stats-succeeds',
-      auth: 'admin',
-      timeout: 30000,
-
-      async run({ http, assert }) {
-        const response = await http.get('backend-manager/admin/stats', {});
-
-        assert.isSuccess(response, 'Get stats should succeed with admin auth');
-        assert.ok(
-          typeof response.data === 'object',
-          'Response data should be an object'
-        );
-      },
-    },
-
-    // Test 2: Stats contains users field
-    {
-      name: 'stats-contains-users',
-      auth: 'admin',
-      timeout: 30000,
-
-      async run({ http, assert }) {
-        const response = await http.get('backend-manager/admin/stats', {});
-
-        assert.isSuccess(response, 'Get stats should succeed');
-        assert.hasProperty(response, 'data.users', 'Stats should contain users field');
-        assert.hasProperty(response, 'data.users.total', 'Users should have total field');
-        assert.ok(
-          typeof response.data.users.total === 'number',
-          'users.total should be a number'
-        );
-      },
-    },
-
-    // Test 3: Stats with update flag refreshes data
-    {
-      name: 'stats-with-update',
-      auth: 'admin',
-      timeout: 60000,
-
-      async run({ http, assert }) {
-        const response = await http.get('backend-manager/admin/stats', {
-          update: { users: true },
-        });
-
-        assert.isSuccess(response, 'Get stats with update should succeed');
-        assert.hasProperty(response, 'data.users.total', 'Updated stats should have users.total');
-        assert.ok(
-          response.data.users.total >= 0,
-          'users.total should be a non-negative number'
-        );
-      },
-    },
-
-    // Test 4: Stats contains metadata
-    {
-      name: 'stats-has-metadata',
-      auth: 'admin',
-      timeout: 30000,
-
-      async run({ http, assert }) {
-        await http.get('backend-manager/admin/stats', {
-          update: { users: true },
-        });
-
-        const response = await http.get('backend-manager/admin/stats', {});
-
-        assert.isSuccess(response, 'Get stats should succeed');
-        if (response.data.metadata) {
-          assert.hasProperty(response, 'data.metadata.updated', 'Metadata should have updated timestamp');
-        }
-      },
-    },
-
-    // Test 5: Unauthenticated request fails
-    {
-      name: 'unauthenticated-rejected',
-      auth: 'none',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.get('backend-manager/admin/stats', {});
-
-        assert.isError(response, 401, 'Get stats should fail without authentication');
-      },
-    },
-
-    // Test 6: Non-admin user fails
-    {
-      name: 'non-admin-rejected',
-      auth: 'user',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.get('backend-manager/admin/stats', {});
-
-        assert.isError(response, 403, 'Get stats should fail for non-admin user');
-      },
-    },
-  ],
-};