backend-manager 5.9.7 → 5.9.8

package/test/routes/admin/post.js

@@ -0,0 +1,368 @@
+/**
+ * Test: PUT /admin/post
+ * Tests the admin edit post endpoint
+ * Edits blog post content in a GitHub repository
+ * Requires admin/blogger role, GitHub API key, and repo_website config
+ *
+ * This is a suite because we need to:
+ * 1. Create a test post file via Octokit
+ * 2. Wait for GitHub to index it (for code search)
+ * 3. Edit it via the API
+ * 4. Clean up the test file
+ */
+const { Octokit } = require('@octokit/rest');
+
+// Test post configuration
+const TEST_POST_SLUG = 'bem-test-post';
+const TEST_POST_ID = Date.now();
+
+// Generate frontmatter for the test post
+function generatePostContent(body) {
+  const frontmatter = `layout: blueprint/blog/post
+
+meta:
+  title: BEM Test Post
+  description: This is a test post created by BEM test suite.
+  og:image: ''
+
+post:
+  title: BEM Test Post
+  id: ${TEST_POST_ID}
+  description: This is a test post created by BEM test suite.
+  author: guest
+  tags: []
+  categories: []`;
+
+  return `---\n${frontmatter}\n---\n\n${body}`;
+}
+
+module.exports = {
+  description: 'Admin edit post on GitHub',
+  type: 'suite',
+  timeout: 300000, // 5 minutes total for the suite
+  skip: !process.env.TEST_EXTENDED_MODE ? 'TEST_EXTENDED_MODE env var not set (skipping GitHub edit tests)' : false,
+
+  tests: [
+    // Test 1: Missing URL returns 400 error
+    {
+      name: 'missing-url-rejected',
+      auth: 'admin',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.put('backend-manager/admin/post', {
+          body: 'Test content',
+        });
+
+        assert.isError(response, 400, 'Missing URL should return 400');
+      },
+    },
+
+    // Test 2: Missing body returns 400 error
+    {
+      name: 'missing-body-rejected',
+      auth: 'admin',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.put('backend-manager/admin/post', {
+          url: 'https://example.com/blog/test-post',
+        });
+
+        assert.isError(response, 400, 'Missing body should return 400');
+      },
+    },
+
+    // Test 3: Non-existent post returns 404
+    {
+      name: 'nonexistent-post-returns-404',
+      auth: 'admin',
+      timeout: 60000,
+
+      async run({ http, assert, config }) {
+        const response = await http.put('backend-manager/admin/post', {
+          url: `https://${config.domain}/blog/nonexistent-test-post-12345`,
+          body: 'This is test content from BEM test suite.',
+        });
+
+        assert.isError(response, 404, 'Non-existent post should return 404');
+      },
+    },
+
+    // Test 4: Non-existent repo returns 404
+    // PUT first calls content/post to fetch the existing post; with a unique URL that's never been
+    // created, the fetch itself returns 404 before we ever try to push to the nonexistent repo.
+    {
+      name: 'nonexistent-repo-returns-404',
+      auth: 'admin',
+      timeout: 30000,
+
+      async run({ http, assert }) {
+        const response = await http.put('backend-manager/admin/post', {
+          url: `https://example.com/blog/never-created-${Date.now()}`,
+          body: 'Test content',
+          githubUser: 'nonexistent-user-12345',
+          githubRepo: 'nonexistent-repo-12345',
+        });
+
+        assert.isError(response, 404, 'Non-existent repo or post should return 404');
+      },
+    },
+
+    // Test 5: Create a test post via Octokit
+    {
+      name: 'create-test-post',
+      auth: 'admin',
+      timeout: 60000,
+      skip: !process.env.GH_TOKEN ? 'GH_TOKEN env var not set' : false,
+
+      async run({ assert, state, config }) {
+        if (!config.github?.repo_website) {
+          assert.fail('githubRepoWebsite not configured');
+          return;
+        }
+
+        const octokit = new Octokit({ auth: process.env.GH_TOKEN });
+
+        // Parse owner/repo from githubRepoWebsite
+        const repoMatch = config.github?.repo_website.match(/github\.com\/([^/]+)\/([^/]+)/);
+        if (!repoMatch) {
+          assert.fail('Could not parse githubRepoWebsite');
+          return;
+        }
+
+        state.owner = repoMatch[1];
+        state.repo = repoMatch[2];
+
+        // Build the post path (matches the structure expected by fetch-post)
+        const date = new Date().toISOString().split('T')[0]; // YYYY-MM-DD
+        const year = date.split('-')[0];
+        state.postPath = `src/_posts/${year}/guest/${date}-${TEST_POST_SLUG}.md`;
+        state.postSlug = TEST_POST_SLUG;
+
+        // Create the post content
+        const originalBody = 'This is the original content of the test post.\n\nIt will be edited by the BEM test suite.';
+        state.originalBody = originalBody;
+        const content = generatePostContent(originalBody);
+
+        // Check if the file already exists (from a previous failed run)
+        let existingSha;
+        try {
+          const existing = await octokit.rest.repos.getContent({
+            owner: state.owner,
+            repo: state.repo,
+            path: state.postPath,
+          });
+          existingSha = existing.data.sha;
+        } catch (e) {
+          // File doesn't exist, that's fine
+        }
+
+        // Create or update the file via Octokit
+        const createResult = await octokit.rest.repos.createOrUpdateFileContents({
+          owner: state.owner,
+          repo: state.repo,
+          path: state.postPath,
+          message: `🧪 BEM test: create test post for edit-post test`,
+          content: Buffer.from(content).toString('base64'),
+          sha: existingSha, // Include SHA if file exists
+        }).catch(e => e);
+
+        if (createResult instanceof Error) {
+          assert.fail(`Failed to create test post: ${createResult.message}`);
+          return;
+        }
+
+        assert.ok(createResult.data.content.sha, 'Post should be created with a SHA');
+        state.postSha = createResult.data.content.sha;
+      },
+    },
+
+    // Test 6: Verify the file exists via GitHub API (not code search)
+    {
+      name: 'verify-file-exists',
+      auth: 'admin',
+      timeout: 30000,
+      skip: !process.env.GH_TOKEN ? 'GH_TOKEN env var not set' : false,
+
+      async run({ assert, state, config }) {
+        if (!state.postPath) {
+          return; // Previous test didn't run
+        }
+
+        state.postUrl = `https://${config.domain}/blog/${state.postSlug}`;
+
+        const octokit = new Octokit({ auth: process.env.GH_TOKEN });
+
+        // Verify the file exists via direct API (not code search)
+        const { data: fileData } = await octokit.rest.repos.getContent({
+          owner: state.owner,
+          repo: state.repo,
+          path: state.postPath,
+        });
+
+        assert.ok(fileData.sha, 'File should exist in GitHub repo');
+        state.currentSha = fileData.sha;
+      },
+    },
+
+    // Test 7: Edit the test post via PUT /admin/post
+    // NOTE: This may fail if GitHub's code search hasn't indexed the file yet
+    // The edit-post API uses fetch-post which relies on code search
+    {
+      name: 'edit-test-post',
+      auth: 'admin',
+      timeout: 60000,
+      skip: !process.env.GH_TOKEN ? 'GH_TOKEN env var not set' : false,
+
+      async run({ http, assert, state }) {
+        if (!state.postUrl) {
+          return; // Previous tests didn't run
+        }
+
+        const newBody = 'This content was EDITED by the BEM test suite.\n\nThe edit was successful!';
+        state.editedBody = newBody;
+
+        const response = await http.put('backend-manager/admin/post', {
+          url: state.postUrl,
+          body: newBody,
+        });
+
+        // If fetch-post can't find the file (not indexed yet), it returns 404
+        // This is a known limitation - the file exists but code search hasn't indexed it
+        if (response.status === 404 && response.error?.includes('not found')) {
+          state.editSkipped = true;
+          assert.ok(true, 'Edit skipped - GitHub code search has not indexed the file yet (this is expected for new files)');
+          return;
+        }
+
+        assert.isSuccess(response, 'Edit post should succeed');
+        assert.hasProperty(response, 'data.url', 'Response should have url');
+      },
+    },
+
+    // Test 8: Verify the edit was applied (using Octokit directly)
+    {
+      name: 'verify-edit',
+      auth: 'admin',
+      timeout: 30000,
+      skip: !process.env.GH_TOKEN ? 'GH_TOKEN env var not set' : false,
+
+      async run({ assert, state }) {
+        if (!state.postPath || state.editSkipped) {
+          assert.ok(true, 'Skipping verify - edit was not performed');
+          return;
+        }
+
+        const octokit = new Octokit({ auth: process.env.GH_TOKEN });
+
+        // Fetch the file directly from GitHub
+        const { data: fileData } = await octokit.rest.repos.getContent({
+          owner: state.owner,
+          repo: state.repo,
+          path: state.postPath,
+        });
+
+        // Decode the content
+        const content = Buffer.from(fileData.content, 'base64').toString();
+
+        assert.ok(
+          content.includes('EDITED by the BEM test suite'),
+          'Post content should contain the edited text'
+        );
+      },
+    },
+
+    // --- Auth rejection tests (at end per convention) ---
+    {
+      name: 'unauthenticated-rejected',
+      auth: 'none',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.put('backend-manager/admin/post', {
+          url: 'https://example.com/blog/test-post',
+          body: 'Test content',
+        });
+
+        assert.isError(response, 401, 'Edit post should fail without authentication');
+      },
+    },
+
+    {
+      name: 'non-admin-rejected',
+      auth: 'basic',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.put('backend-manager/admin/post', {
+          url: 'https://example.com/blog/test-post',
+          body: 'Test content',
+        });
+
+        assert.isError(response, 403, 'Edit post should fail for non-admin user');
+      },
+    },
+
+    // Cleanup - delete test post and cancel workflows
+    {
+      name: 'cleanup',
+      auth: 'admin',
+      timeout: 60000,
+
+      async run({ state }) {
+        if (!process.env.GH_TOKEN || !state.postPath) {
+          return;
+        }
+
+        const octokit = new Octokit({ auth: process.env.GH_TOKEN });
+
+        // Get the current SHA (may have changed after edit)
+        try {
+          const { data: fileData } = await octokit.rest.repos.getContent({
+            owner: state.owner,
+            repo: state.repo,
+            path: state.postPath,
+          });
+
+          // Delete the test post
+          await octokit.rest.repos.deleteFile({
+            owner: state.owner,
+            repo: state.repo,
+            path: state.postPath,
+            message: `🧹 BEM test cleanup: delete test post`,
+            sha: fileData.sha,
+          });
+        } catch (e) {
+          // File might not exist, ignore
+        }
+
+        // Cancel any running workflows triggered by our test commits
+        try {
+          const { data: runs } = await octokit.rest.actions.listWorkflowRunsForRepo({
+            owner: state.owner,
+            repo: state.repo,
+            status: 'in_progress',
+            per_page: 10,
+          });
+
+          for (const run of runs.workflow_runs) {
+            if (run.head_commit?.message?.includes('BEM test')) {
+              try {
+                await octokit.rest.actions.cancelWorkflowRun({
+                  owner: state.owner,
+                  repo: state.repo,
+                  run_id: run.id,
+                });
+              } catch (e) {
+                // May already be completed, ignore
+              }
+            }
+          }
+        } catch (e) {
+          // Workflow cancellation failed, not critical
+        }
+      },
+    },
+  ],
+};

package/test/routes/admin/repo-content.js

@@ -0,0 +1,223 @@
+/**
+ * Test: POST /admin/repo/content
+ * Tests the admin write repo content endpoint
+ * Writes arbitrary content to a GitHub repository
+ * Requires admin/blogger role, GitHub API key, and repo_website config
+ *
+ * IMPORTANT: These tests require GH_TOKEN and github.repo_website to be configured.
+ * If GitHub is not configured, the tests will fail.
+ *
+ * This is a suite because we need to clean up created files and cancel workflows after tests.
+ */
+const { Octokit } = require('@octokit/rest');
+
+// Test file paths that will be created and need cleanup
+const TEST_FILES = [
+  '_test/bem-write-test.txt',
+  '_test/type-test.txt',
+];
+
+module.exports = {
+  description: 'Admin write content to GitHub repo',
+  type: 'suite',
+  timeout: 120000,
+  skip: !process.env.TEST_EXTENDED_MODE ? 'TEST_EXTENDED_MODE env var not set (skipping GitHub write tests)' : false,
+
+  tests: [
+    // Test 1: Missing path returns 400 error
+    {
+      name: 'missing-path-rejected',
+      auth: 'admin',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.post('backend-manager/admin/repo/content', {
+          content: 'Test content',
+        });
+
+        assert.isError(response, 400, 'Missing path should return 400');
+      },
+    },
+
+    // Test 2: Missing content returns 400 error
+    {
+      name: 'missing-content-rejected',
+      auth: 'admin',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.post('backend-manager/admin/repo/content', {
+          path: '_test/bem-test-file.txt',
+        });
+
+        assert.isError(response, 400, 'Missing content should return 400');
+      },
+    },
+
+    // Test 3: Admin can write content
+    {
+      name: 'admin-can-write-content',
+      auth: 'admin',
+      timeout: 60000,
+
+      async run({ http, assert, state }) {
+        const uniqueContent = `BEM Test - ${new Date().toISOString()}`;
+        const response = await http.post('backend-manager/admin/repo/content', {
+          path: '_test/bem-write-test.txt',
+          content: uniqueContent,
+        });
+
+        assert.isSuccess(response, 'Admin should be able to write content');
+        assert.hasProperty(response, 'data.path', 'Response should contain path');
+        assert.equal(response.data.path, '_test/bem-write-test.txt', 'Path should match');
+
+        // Store for cleanup
+        state.filesCreated = state.filesCreated || [];
+        state.filesCreated.push('_test/bem-write-test.txt');
+      },
+    },
+
+    // Test 4: Content type defaults to text
+    {
+      name: 'content-type-default',
+      auth: 'admin',
+      timeout: 30000,
+
+      async run({ http, assert, state }) {
+        const response = await http.post('backend-manager/admin/repo/content', {
+          path: '_test/type-test.txt',
+          content: 'Test content with default type',
+        });
+
+        assert.isSuccess(response, 'Write with default type should succeed');
+        assert.hasProperty(response, 'data.type', 'Response should contain type');
+        assert.equal(response.data.type, 'text', 'Default type should be text');
+
+        // Store for cleanup
+        state.filesCreated = state.filesCreated || [];
+        state.filesCreated.push('_test/type-test.txt');
+      },
+    },
+
+    // Test 5: Non-existent repo returns 404
+    {
+      name: 'nonexistent-repo-returns-404',
+      auth: 'admin',
+      timeout: 30000,
+
+      async run({ http, assert }) {
+        const response = await http.post('backend-manager/admin/repo/content', {
+          path: '_test/custom-repo-test.txt',
+          content: 'Test content',
+          githubUser: 'nonexistent-user-12345',
+          githubRepo: 'nonexistent-repo-12345',
+        });
+
+        assert.isError(response, 404, 'Non-existent repo should return 404');
+      },
+    },
+
+    // --- Auth rejection tests (at end per convention) ---
+    {
+      name: 'unauthenticated-rejected',
+      auth: 'none',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.post('backend-manager/admin/repo/content', {
+          path: '_test/bem-test-file.txt',
+          content: 'Test content',
+        });
+
+        assert.isError(response, 401, 'Write repo content should fail without authentication');
+      },
+    },
+
+    {
+      name: 'non-admin-rejected',
+      auth: 'basic',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.post('backend-manager/admin/repo/content', {
+          path: '_test/bem-test-file.txt',
+          content: 'Test content',
+        });
+
+        assert.isError(response, 403, 'Write repo content should fail for non-admin user');
+      },
+    },
+
+    // Cleanup - delete test files and cancel workflows
+    {
+      name: 'cleanup',
+      auth: 'admin',
+      timeout: 60000,
+
+      async run({ state, config }) {
+        if (!process.env.GH_TOKEN || !config.github?.repo_website) {
+          return;
+        }
+
+        const octokit = new Octokit({ auth: process.env.GH_TOKEN });
+
+        // Parse owner/repo from githubRepoWebsite (e.g., 'https://github.com/owner/repo')
+        const repoMatch = config.github?.repo_website.match(/github\.com\/([^/]+)\/([^/]+)/);
+        if (!repoMatch) {
+          return;
+        }
+        const owner = repoMatch[1];
+        const repo = repoMatch[2];
+
+        // Delete test files
+        const filesToDelete = state.filesCreated || TEST_FILES;
+        for (const filePath of filesToDelete) {
+          try {
+            const { data: fileData } = await octokit.rest.repos.getContent({
+              owner,
+              repo,
+              path: filePath,
+            });
+
+            await octokit.rest.repos.deleteFile({
+              owner,
+              repo,
+              path: filePath,
+              message: `🧹 BEM test cleanup: ${filePath}`,
+              sha: fileData.sha,
+            });
+          } catch (e) {
+            // File might not exist, ignore
+          }
+        }
+
+        // Cancel running workflows triggered by our test commits
+        try {
+          const { data: runs } = await octokit.rest.actions.listWorkflowRunsForRepo({
+            owner,
+            repo,
+            status: 'in_progress',
+            per_page: 10,
+          });
+
+          for (const run of runs.workflow_runs) {
+            if (run.head_commit?.message?.includes('admin:write-repo-content')
+                || run.head_commit?.message?.includes('BEM test cleanup')) {
+              try {
+                await octokit.rest.actions.cancelWorkflowRun({
+                  owner,
+                  repo,
+                  run_id: run.id,
+                });
+              } catch (e) {
+                // May already be completed, ignore
+              }
+            }
+          }
+        } catch (e) {
+          // Workflow cancellation failed, not critical
+        }
+      },
+    },
+  ],
+};

package/test/routes/admin/stats.js

@@ -0,0 +1,112 @@
+/**
+ * Test: GET /admin/stats
+ * Tests the admin get stats endpoint
+ * Requires admin authentication
+ */
+module.exports = {
+  description: 'Admin get stats operation',
+  type: 'group',
+  tests: [
+    // Test 1: Admin can get stats
+    {
+      name: 'admin-get-stats-succeeds',
+      auth: 'admin',
+      timeout: 30000,
+
+      async run({ http, assert }) {
+        const response = await http.get('backend-manager/admin/stats', {});
+
+        assert.isSuccess(response, 'Get stats should succeed with admin auth');
+        assert.ok(
+          typeof response.data === 'object',
+          'Response data should be an object'
+        );
+      },
+    },
+
+    // Test 2: Stats contains users field
+    {
+      name: 'stats-contains-users',
+      auth: 'admin',
+      timeout: 30000,
+
+      async run({ http, assert }) {
+        const response = await http.get('backend-manager/admin/stats', {});
+
+        assert.isSuccess(response, 'Get stats should succeed');
+        assert.hasProperty(response, 'data.users', 'Stats should contain users field');
+        assert.hasProperty(response, 'data.users.total', 'Users should have total field');
+        assert.ok(
+          typeof response.data.users.total === 'number',
+          'users.total should be a number'
+        );
+      },
+    },
+
+    // Test 3: Stats with update flag refreshes data
+    {
+      name: 'stats-with-update',
+      auth: 'admin',
+      timeout: 60000,
+
+      async run({ http, assert }) {
+        const response = await http.get('backend-manager/admin/stats', {
+          update: { users: true },
+        });
+
+        assert.isSuccess(response, 'Get stats with update should succeed');
+        assert.hasProperty(response, 'data.users.total', 'Updated stats should have users.total');
+        assert.ok(
+          response.data.users.total >= 0,
+          'users.total should be a non-negative number'
+        );
+      },
+    },
+
+    // Test 4: Stats contains metadata
+    {
+      name: 'stats-has-metadata',
+      auth: 'admin',
+      timeout: 30000,
+
+      async run({ http, assert }) {
+        await http.get('backend-manager/admin/stats', {
+          update: { users: true },
+        });
+
+        const response = await http.get('backend-manager/admin/stats', {});
+
+        assert.isSuccess(response, 'Get stats should succeed');
+        if (response.data.metadata) {
+          assert.hasProperty(response, 'data.metadata.updated', 'Metadata should have updated timestamp');
+        }
+      },
+    },
+
+    // Test 5: Unauthenticated request fails
+    {
+      name: 'unauthenticated-rejected',
+      auth: 'none',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.get('backend-manager/admin/stats', {});
+
+        assert.isError(response, 401, 'Get stats should fail without authentication');
+      },
+    },
+
+    // Test 6: Non-admin user fails
+    {
+      name: 'non-admin-rejected',
+      auth: 'user',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.get('backend-manager/admin/stats', {});
+
+        assert.isError(response, 403, 'Get stats should fail for non-admin user');
+      },
+    },
+  ],
+};