backend-manager 5.9.5 → 5.9.7

package/test/routes/content/post.js

@@ -1,54 +0,0 @@
-/**
- * Test: GET /content/post
- * Tests the content fetch post endpoint
- * Fetches blog post content from GitHub
- * Requires GitHub API key and repo_website config
- */
-module.exports = {
-  description: 'General fetch post from GitHub',
-  type: 'group',
-  tests: [
-    // Test 1: Missing URL returns 400 error
-    {
-      name: 'missing-url-rejected',
-      auth: 'none',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.get('backend-manager/content/post', {});
-
-        assert.isError(response, 400, 'Missing URL should return 400');
-      },
-    },
-
-    // Test 2: Non-existent post returns 404
-    {
-      name: 'nonexistent-post-returns-404',
-      auth: 'none',
-      timeout: 30000,
-
-      async run({ http, assert }) {
-        const response = await http.get('backend-manager/content/post', {
-          url: 'https://example.com/blog/this-post-definitely-does-not-exist-12345',
-        });
-
-        assert.isError(response, 404, 'Non-existent post should return 404');
-      },
-    },
-
-    // Test 3: Authenticated user fetching non-existent post returns 404
-    {
-      name: 'authenticated-nonexistent-returns-404',
-      auth: 'basic',
-      timeout: 30000,
-
-      async run({ http, assert }) {
-        const response = await http.get('backend-manager/content/post', {
-          url: 'https://example.com/blog/nonexistent-test-post-12345',
-        });
-
-        assert.isError(response, 404, 'Non-existent post should return 404');
-      },
-    },
-  ],
-};

package/test/routes/general/uuid.js

@@ -1,115 +0,0 @@
-/**
- * Test: UUID Route
- * Tests the new RESTful UUID endpoint using proper HTTP verbs
- */
-module.exports = {
-  description: 'UUID route',
-  type: 'group',
-  tests: [
-    {
-      name: 'v4-random-uuid',
-      auth: 'none',
-      timeout: 10000,
-
-      async run({ http, assert }) {
-        // POST /backend-manager/general/uuid
-        const response = await http.post('backend-manager/general/uuid', {
-          version: '4',
-        });
-
-        assert.isSuccess(response, 'UUID v4 generation should succeed');
-        assert.hasProperty(response, 'data.uuid', 'Response should contain uuid');
-        assert.match(
-          response.data.uuid,
-          /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,
-          'UUID v4 should have correct format'
-        );
-
-        return { success: true };
-      },
-    },
-
-    {
-      name: 'v5-namespaced-uuid',
-      auth: 'none',
-      timeout: 10000,
-
-      async run({ http, assert }) {
-        const response = await http.post('backend-manager/general/uuid', {
-          version: '5',
-          name: 'test-name-for-uuid',
-        });
-
-        assert.isSuccess(response, 'UUID v5 generation should succeed');
-        assert.hasProperty(response, 'data.uuid', 'Response should contain uuid');
-        assert.match(
-          response.data.uuid,
-          /^[0-9a-f]{8}-[0-9a-f]{4}-5[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,
-          'UUID v5 should have correct format'
-        );
-
-        return { success: true };
-      },
-    },
-
-    {
-      name: 'v5-deterministic',
-      auth: 'none',
-      timeout: 10000,
-
-      async run({ http, assert }) {
-        const response1 = await http.post('backend-manager/general/uuid', {
-          version: '5',
-          name: 'test-name-for-uuid',
-        });
-
-        const response2 = await http.post('backend-manager/general/uuid', {
-          version: '5',
-          name: 'test-name-for-uuid',
-        });
-
-        assert.isSuccess(response1, 'First UUID v5 generation should succeed');
-        assert.isSuccess(response2, 'Second UUID v5 generation should succeed');
-        assert.equal(
-          response1.data.uuid,
-          response2.data.uuid,
-          'UUID v5 should be deterministic - same input should produce same output'
-        );
-
-        return { success: true };
-      },
-    },
-
-    {
-      name: 'v5-requires-name',
-      auth: 'none',
-      timeout: 10000,
-
-      async run({ http, assert }) {
-        const response = await http.post('backend-manager/general/uuid', {
-          version: '5',
-        });
-
-        assert.isError(response, 400, 'UUID v5 without name should return 400');
-
-        return { success: true };
-      },
-    },
-
-    {
-      name: 'invalid-version-rejected',
-      auth: 'none',
-      timeout: 10000,
-
-      async run({ http, assert }) {
-        const response = await http.post('backend-manager/general/uuid', {
-          version: '99',
-        });
-
-        assert.isError(response, 400, 'Invalid version should return 400');
-
-        return { success: true };
-      },
-    },
-  ],
-};

package/test/routes/marketing/campaign.js

@@ -1,125 +0,0 @@
-/**
- * Test: POST /marketing/campaign — Send a marketing campaign (Single Send)
- *
- * Normal mode: creates campaign doc in Firestore, verifies structure
- * Extended mode (TEST_EXTENDED_MODE=true): sends a real test campaign via SendGrid/Beehiiv
- *   targeting the test_admin segment (hello@itwcreativeworks.com only)
- */
-
-module.exports = {
-  description: 'Marketing campaign (POST create + send)',
-  type: 'group',
-  tests: [
-    {
-      name: 'send-test-campaign',
-      auth: 'admin',
-      timeout: 60000,
-      skip: !process.env.TEST_EXTENDED_MODE
-        ? 'TEST_EXTENDED_MODE not set (real provider send)'
-        : false,
-
-      async run({ http, assert, state }) {
-        const response = await http.post('backend-manager/marketing/campaign', {
-          name: 'BEM Test Campaign',
-          subject: 'Test Marketing Email',
-          content: '# Hello\n\nThis is a **test marketing email** sent from the BEM test suite.\n\nIf you received this, the SendGrid Single Send pipeline is working.',
-          test: true,
-          sendAt: 'now',
-        });
-
-        assert.isSuccess(response, 'Campaign creation should succeed');
-        assert.hasProperty(response, 'data.id', 'Response should contain campaign ID');
-        assert.hasProperty(response, 'data.providers', 'Response should contain provider results');
-
-        const providers = response.data.providers || {};
-
-        console.log('Campaign results:', JSON.stringify(providers, null, 2));
-
-        if (providers.campaigns) {
-          state.sendgridId = providers.campaigns.id;
-
-          assert.propertyEquals(
-            response, 'data.providers.campaigns.success', true,
-            `SendGrid should succeed. Error: ${providers.campaigns.error || 'none'}`,
-          );
-        }
-
-        if (providers.newsletter) {
-          assert.hasProperty(response, 'data.providers.newsletter', 'Should have Beehiiv result');
-        }
-
-        state.campaignId = response.data.id;
-      },
-
-      async cleanup({ state }) {
-        if (state.campaignId) {
-          console.log(`Campaign ID: ${state.campaignId}`);
-        }
-        if (state.sendgridId) {
-          console.log(`SendGrid Single Send ID: ${state.sendgridId}`);
-        }
-      },
-    },
-
-    {
-      name: 'create-future-campaign-is-pending',
-      auth: 'admin',
-      timeout: 30000,
-
-      async run({ http, assert, firestore }) {
-        // Future sendAt → campaign is saved as 'pending' for cron pickup, not sent immediately
-        const futureDate = new Date(Date.now() + 7 * 24 * 60 * 60 * 1000).toISOString();
-
-        const response = await http.post('backend-manager/marketing/campaign', {
-          name: 'Future Campaign',
-          subject: 'Future Subject',
-          content: 'Future content',
-          test: true,
-          sendAt: futureDate,
-        });
-
-        assert.isSuccess(response, 'Future campaign creation should succeed');
-        assert.hasProperty(response, 'data.id', 'Response should contain campaign ID');
-        assert.propertyEquals(response, 'data.status', 'pending', 'Future campaign should be pending');
-
-        const doc = await firestore.get(`marketing-campaigns/${response.data.id}`);
-        assert.ok(doc, 'Campaign doc should exist in Firestore');
-        assert.equal(doc.status, 'pending', 'Firestore doc status should be pending');
-        assert.equal(doc.settings.name, 'Future Campaign', 'Name should match input');
-        assert.propertyEquals(response, 'data.providers', null, 'Future campaign should not have provider results');
-      },
-    },
-
-    {
-      name: 'campaign-requires-admin',
-      auth: 'user',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.post('backend-manager/marketing/campaign', {
-          name: 'Unauthorized Campaign',
-          subject: 'Should fail',
-          content: 'Should fail',
-        });
-
-        assert.isError(response, 403, 'Non-admin should get 403');
-      },
-    },
-
-    {
-      name: 'campaign-requires-auth',
-      auth: 'none',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.post('backend-manager/marketing/campaign', {
-          name: 'Unauthenticated Campaign',
-          subject: 'Should fail',
-          content: 'Should fail',
-        });
-
-        assert.isError(response, 401, 'Unauthenticated should get 401');
-      },
-    },
-  ],
-};

package/test/routes/marketing/contact.js

@@ -1,370 +0,0 @@
-/**
- * Test: POST /marketing/contact and DELETE /marketing/contact
- * Tests the marketing contact endpoints for adding/removing users to SendGrid/Beehiiv
- *
- * Set TEST_EXTENDED_MODE=true to run tests against real SendGrid/Beehiiv APIs
- * (requires SENDGRID_API_KEY and BEEHIIV_API_KEY env vars)
- */
-
-// Test email patterns - look like real emails but +bem suffix identifies them for cleanup.
-// Names should be inferred by AI from the email local part.
-//
-// Fixed test domain (`acme.com`) — deterministic across brands. Using the running brand's
-// domain caused cross-brand state divergence in SendGrid/Beehiiv and non-deterministic
-// company inference (different domain → different inferred company name).
-//
-// `valid`: use a name that won't be flagged as fictional/placeholder by the AI prompt.
-// (The infer-contact prompt rejects fictional names — e.g. "rachel.greene" sometimes
-// matches the Friends character and returns empty. Use a more anonymous name.)
-//
-// `invalid`: must reach the mailbox verification check (so previous checks all pass — must
-// NOT start with "test"/"example" which are in BLOCKED_LOCAL_PATTERNS, NOT be on
-// a corporate/disposable domain). Real-looking name on a real domain with no actual
-// mailbox there is the safest pick.
-const TEST_DOMAIN = 'acme.com';
-const TEST_EMAILS = {
-  valid: () => `sarah.martinez+bem@${TEST_DOMAIN}`,         // Should infer: Sarah Martinez
-  invalid: () => `nonexistent.user+bem@${TEST_DOMAIN}`,     // No such mailbox — mailbox verification should flag as invalid
-};
-
-module.exports = {
-  description: 'Marketing contact (POST add + DELETE remove)',
-  type: 'group',
-  tests: [
-    // --- POST /marketing/contact tests ---
-
-    // Test 1: Admin can add valid email (with real provider calls if TEST_EXTENDED_MODE is set)
-    {
-      name: 'add-admin-valid-email-succeeds',
-      auth: 'admin',
-      timeout: 30000,
-
-      async run({ http, assert, state, config }) {
-        const testEmail = TEST_EMAILS.valid();
-        state.testEmail = testEmail;
-
-        const response = await http.post('backend-manager/marketing/contact', {
-          email: testEmail,
-          source: 'bem-test',
-          // skipValidation bypasses the mailbox verification check — the test email
-          // doesn't have a real mailbox so the provider (correctly) marks it as not
-          // deliverable. We're testing the route flow, not the deliverability check itself.
-          skipValidation: true,
-          // No firstName/lastName - should be inferred as "Rachel Greene"
-        });
-
-        assert.isSuccess(response, 'Add marketing contact should succeed for admin');
-        assert.hasProperty(response, 'data.success', 'Response should contain success');
-        assert.propertyEquals(response, 'data.success', true, 'success should be true');
-
-        // Admin gets detailed response
-        assert.hasProperty(response, 'data.providers', 'Admin response should contain providers');
-
-        // If TEST_EXTENDED_MODE is set, verify provider results
-        if (process.env.TEST_EXTENDED_MODE) {
-          const providers = response.data.providers || {};
-
-          if (process.env.SENDGRID_API_KEY) {
-            assert.hasProperty(response, 'data.providers.campaigns', 'Should have SendGrid result');
-            if (providers.campaigns?.success) {
-              state.sendgridAdded = true;
-            } else {
-              // Log error for debugging but don't fail - could be list matching issue
-              console.log('SendGrid result:', providers.campaigns);
-            }
-          }
-
-          if (process.env.BEEHIIV_API_KEY && config.marketing?.newsletter?.publicationId) {
-            assert.hasProperty(response, 'data.providers.newsletter', 'Should have Beehiiv result');
-            if (providers.newsletter?.success) {
-              state.beehiivAdded = true;
-            } else {
-              console.log('Beehiiv result:', providers.newsletter);
-            }
-          }
-        }
-      },
-
-      async cleanup({ state, http }) {
-        // Only cleanup if TEST_EXTENDED_MODE is set and contacts were added
-        if (!process.env.TEST_EXTENDED_MODE || !state.testEmail) {
-          return;
-        }
-
-        console.log(`Cleaning up test contact: ${state.testEmail}`);
-
-        const result = await http.delete('backend-manager/marketing/contact', {
-          email: state.testEmail,
-        });
-        console.log('Cleanup result:', result.data);
-      },
-    },
-
-    // Test 2: Invalid email format rejected
-    {
-      name: 'add-invalid-email-format-rejected',
-      auth: 'admin',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.post('backend-manager/marketing/contact', {
-          email: 'not-a-valid-email',
-          source: 'bem-test',
-        });
-
-        assert.isError(response, 400, 'Invalid email format should return 400');
-      },
-    },
-
-    // Test 3: Missing email rejected
-    {
-      name: 'add-missing-email-rejected',
-      auth: 'admin',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.post('backend-manager/marketing/contact', {
-          firstName: 'Test',
-          source: 'bem-test',
-        });
-
-        assert.isError(response, 400, 'Missing email should return 400');
-      },
-    },
-
-    // Test 4: Disposable email rejected
-    {
-      name: 'add-disposable-email-rejected',
-      auth: 'admin',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.post('backend-manager/marketing/contact', {
-          email: 'test@mailinator.com',
-          source: 'bem-test',
-        });
-
-        assert.isError(response, 400, 'Disposable email should return 400');
-      },
-    },
-
-    // Test 5: Name inferred from email (AI only — requires extended mode)
-    {
-      name: 'add-name-inferred-from-email',
-      skip: !process.env.TEST_EXTENDED_MODE ? 'TEST_EXTENDED_MODE not set (AI inference requires OPENAI_API_KEY)' : false,
-      auth: 'admin',
-      timeout: 30000,
-
-      async run({ http, assert, state }) {
-        // Use valid email without providing name - should infer "Rachel Greene"
-        const testEmail = TEST_EMAILS.valid();
-        state.testEmail = testEmail;
-
-        const response = await http.post('backend-manager/marketing/contact', {
-          email: testEmail,
-          source: 'bem-test',
-          // No firstName/lastName - should be inferred
-        });
-
-        assert.isSuccess(response, 'Add marketing contact should succeed');
-
-        // Check name was inferred
-        assert.hasProperty(response, 'data.nameInferred', 'Should have nameInferred');
-        assert.ok(
-          response.data.nameInferred.firstName || response.data.nameInferred.lastName,
-          'Name should be inferred from email'
-        );
-        assert.hasProperty(response.data.nameInferred, 'method', 'Should include inference method');
-
-        // Track if providers were called
-        if (process.env.TEST_EXTENDED_MODE) {
-          state.sendgridAdded = response.data?.providers?.campaigns?.success;
-          state.beehiivAdded = response.data?.providers?.newsletter?.success;
-        }
-      },
-
-      async cleanup({ state, http }) {
-        if (!process.env.TEST_EXTENDED_MODE || !state.testEmail) {
-          return;
-        }
-
-        await http.delete('backend-manager/marketing/contact', { email: state.testEmail });
-      },
-    },
-
-    // Test 6: Admin can skip validation (use disposable domain but skip check)
-    {
-      name: 'add-admin-skip-validation',
-      auth: 'admin',
-      timeout: 30000,
-
-      async run({ http, assert, state }) {
-        // Use disposable domain - normally blocked, but skipValidation bypasses
-        const testEmail = 'rachel.greene+bem@mailinator.com';
-        state.testEmail = testEmail;
-
-        const response = await http.post('backend-manager/marketing/contact', {
-          email: testEmail,
-          source: 'bem-test',
-          skipValidation: true,
-        });
-
-        // Should succeed because validation was skipped
-        assert.isSuccess(response, 'Add marketing contact with skipValidation should succeed');
-
-        if (process.env.TEST_EXTENDED_MODE) {
-          state.sendgridAdded = response.data?.providers?.campaigns?.success;
-          state.beehiivAdded = response.data?.providers?.newsletter?.success;
-        }
-      },
-
-      async cleanup({ state, http }) {
-        if (!process.env.TEST_EXTENDED_MODE || !state.testEmail) {
-          return;
-        }
-
-        await http.delete('backend-manager/marketing/contact', { email: state.testEmail });
-      },
-    },
-
-    // Test 7: Mailbox verification (only runs if TEST_EXTENDED_MODE and a mailbox API key are set)
-    {
-      name: 'add-mailbox-validation',
-      auth: 'admin',
-      timeout: 30000,
-      skip: !process.env.TEST_EXTENDED_MODE || !(process.env.NEVERBOUNCE_API_KEY || process.env.ZEROBOUNCE_API_KEY)
-        ? 'TEST_EXTENDED_MODE or mailbox API key not set'
-        : false,
-
-      async run({ http, assert, state, skip }) {
-        const testEmail = TEST_EMAILS.valid();
-        state.testEmail = testEmail;
-
-        const response = await http.post('backend-manager/marketing/contact', {
-          email: testEmail,
-          source: 'bem-test',
-        });
-
-        assert.isSuccess(response, 'Add marketing contact should succeed');
-
-        // Check that validation info is included
-        assert.hasProperty(response, 'data.validation', 'Response should contain validation');
-        assert.hasProperty(response, 'data.validation.checks', 'Validation should contain checks');
-
-        // Mailbox check should be in checks when key is set
-        assert.hasProperty(response, 'data.validation.checks.mailbox', 'Should have mailbox check');
-
-        const mbResult = response.data.validation.checks.mailbox;
-
-        // If out of credits, skip test - not a failure
-        if (mbResult.error?.includes('out of credits')) {
-          skip('Mailbox verification out of credits');
-        }
-
-        assert.hasProperty(mbResult, 'status', 'Mailbox check should return status');
-
-        state.sendgridAdded = response.data?.providers?.campaigns?.success;
-        state.beehiivAdded = response.data?.providers?.newsletter?.success;
-      },
-
-      async cleanup({ state, http }) {
-        if (!state.testEmail) {
-          return;
-        }
-
-        await http.delete('backend-manager/marketing/contact', { email: state.testEmail });
-      },
-    },
-
-    // Test 9: Mailbox verification rejects invalid email (only runs if TEST_EXTENDED_MODE and a mailbox API key are set)
-    {
-      name: 'add-mailbox-rejects-invalid',
-      auth: 'admin',
-      timeout: 30000,
-      skip: !process.env.TEST_EXTENDED_MODE || !(process.env.NEVERBOUNCE_API_KEY || process.env.ZEROBOUNCE_API_KEY)
-        ? 'TEST_EXTENDED_MODE or mailbox API key not set'
-        : false,
-
-      async run({ http, assert, skip }) {
-        // Email that should reach the mailbox provider and be flagged as undeliverable.
-        // Must NOT trip earlier checks (localPart blocklist, disposable, corporate).
-        const testEmail = TEST_EMAILS.invalid();
-
-        const response = await http.post('backend-manager/marketing/contact', {
-          email: testEmail,
-          source: 'bem-test',
-        });
-
-        // With no ZeroBounce credits the route fails-open and returns 200; with credits
-        // the route should EITHER succeed (200) and report invalid in checks, OR error
-        // (400) with "Email validation failed". Either is correct behavior — what we
-        // verify here is that mailbox check ran and didn't mark the email as `valid`.
-        const mbResult = response.data?.validation?.checks?.mailbox;
-
-        // If credits are out, the test can't actually exercise rejection — skip.
-        if (mbResult?.error?.includes('out of credits') || mbResult?.error?.includes('Invalid API key')) {
-          skip('Mailbox verification out of credits');
-        }
-
-        // If the response was a 400, that's the legitimate rejection path — done.
-        if (response.status === 400) {
-          return;
-        }
-
-        // Otherwise expect a 200 with a non-"valid" mailbox status.
-        assert.isSuccess(response, 'Request should succeed (fail-open) or error 400');
-        if (mbResult) {
-          assert.hasProperty(mbResult, 'status', 'Should have status');
-          assert.notEqual(mbResult.status, 'valid', 'Fake email should not be marked valid');
-        }
-      },
-    },
-
-    // --- Auth rejection tests ---
-    {
-      name: 'add-unauthenticated-rejected',
-      auth: 'none',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        // Public request without auth must be rejected. The exact rejection mechanism
-        // depends on environment:
-        //   - Production: missing reCAPTCHA token → 403
-        //   - Local emulator (BEM_TESTING=true): reCAPTCHA is bypassed, but unauthenticated
-        //     users hit the marketing-subscribe rate limit (quota 0/0) → 429
-        // Both are correct: the route protects itself from anonymous abuse. Accept either.
-        const response = await http.post('backend-manager/marketing/contact', {
-          email: TEST_EMAILS.valid(),
-          source: 'bem-test',
-        });
-
-        assert.ok(!response.success, 'Public request should be rejected');
-        assert.ok(
-          response.status === 403 || response.status === 429,
-          `Expected 403 or 429 but got ${response.status}`
-        );
-      },
-    },
-
-    // --- DELETE /marketing/contact tests ---
-
-    // Test: Final cleanup (runs last to clean up test contacts from providers)
-    {
-      name: 'delete-cleanup-test-contacts',
-      auth: 'admin',
-      timeout: 30000,
-      skip: !process.env.TEST_EXTENDED_MODE ? 'TEST_EXTENDED_MODE not set' : false,
-
-      async run({ http, assert }) {
-        // Clean up the rachel.greene+bem test contact from marketing providers
-        const testEmail = TEST_EMAILS.valid();
-
-        const response = await http.delete('backend-manager/marketing/contact', {
-          email: testEmail,
-        });
-
-        assert.isSuccess(response, 'Remove marketing contact should succeed');
-      },
-    },
-  ],
-};