backend-manager 5.9.7 → 5.9.8

package/test/routes/test/usage.js

@@ -0,0 +1,342 @@
+/**
+ * Test: POST /test/usage
+ * Tests the usage tracking API
+ * This is a suite because we need to track state and verify increments
+ */
+module.exports = {
+  description: 'Usage tracking API',
+  type: 'suite',
+  timeout: 30000,
+
+  tests: [
+    // Test 1: Store initial usage state
+    {
+      name: 'store-initial-usage',
+      async run({ firestore, assert, state, accounts }) {
+        // Get the basic account's current usage to track changes
+        const userDoc = await firestore.get(`users/${accounts.basic.uid}`);
+
+        state.initialUsage = userDoc?.usage || {};
+
+        // Store initial values for requests metric (may not exist yet)
+        state.initialMonthly = state.initialUsage?.requests?.monthly || 0;
+        state.initialDaily = state.initialUsage?.requests?.daily || 0;
+        state.initialTotal = state.initialUsage?.requests?.total || 0;
+
+        assert.ok(true, 'Initial usage state captured');
+      },
+    },
+
+    // Test 2: Increment usage with default values
+    {
+      name: 'increment-default',
+      async run({ http, assert, state }) {
+        const response = await http.as('basic').post('backend-manager/test/usage', {});
+
+        assert.isSuccess(response, 'Usage increment should succeed');
+        assert.hasProperty(response, 'data.metric', 'Response should contain metric name');
+        assert.hasProperty(response, 'data.amount', 'Response should contain amount');
+        assert.hasProperty(response, 'data.before', 'Response should contain before values');
+        assert.hasProperty(response, 'data.after', 'Response should contain after values');
+
+        // Verify defaults
+        assert.equal(response.data.metric, 'requests', 'Metric should be requests');
+        assert.equal(response.data.amount, 1, 'Default amount should be 1');
+
+        // Verify monthly incremented
+        assert.equal(
+          response.data.after.monthly,
+          response.data.before.monthly + 1,
+          'Monthly should be incremented by 1'
+        );
+
+        // Verify daily incremented
+        assert.equal(
+          response.data.after.daily,
+          response.data.before.daily + 1,
+          'Daily should be incremented by 1'
+        );
+
+        // Verify total incremented
+        assert.equal(
+          response.data.after.total,
+          response.data.before.total + 1,
+          'Total should be incremented by 1'
+        );
+
+        // Store for next test
+        state.afterFirstIncrement = response.data.after;
+      },
+    },
+
+    // Test 3: Verify usage persisted to Firestore
+    {
+      name: 'verify-usage-persisted',
+      async run({ firestore, assert, state, accounts }) {
+        const userDoc = await firestore.get(`users/${accounts.basic.uid}`);
+
+        assert.ok(userDoc?.usage, 'User should have usage object');
+        assert.ok(userDoc?.usage?.requests, 'User should have requests usage');
+
+        assert.equal(
+          userDoc.usage.requests.monthly,
+          state.afterFirstIncrement.monthly,
+          'Persisted monthly should match API response'
+        );
+        assert.equal(
+          userDoc.usage.requests.daily,
+          state.afterFirstIncrement.daily,
+          'Persisted daily should match API response'
+        );
+        assert.equal(
+          userDoc.usage.requests.total,
+          state.afterFirstIncrement.total,
+          'Persisted total should match API response'
+        );
+
+        // Verify last timestamp exists
+        assert.ok(userDoc.usage.requests.last, 'Should have last object');
+        assert.ok(userDoc.usage.requests.last.timestamp, 'Should have last.timestamp');
+        assert.ok(userDoc.usage.requests.last.timestampUNIX, 'Should have last.timestampUNIX');
+      },
+    },
+
+    // Test 4: Increment with custom amount
+    {
+      name: 'increment-custom-amount',
+      async run({ http, assert, state }) {
+        const response = await http.as('basic').post('backend-manager/test/usage', {
+          amount: 5,
+        });
+
+        assert.isSuccess(response, 'Custom amount increment should succeed');
+        assert.equal(response.data.amount, 5, 'Amount should be 5');
+
+        // Verify all counters incremented by 5
+        assert.equal(
+          response.data.after.monthly,
+          response.data.before.monthly + 5,
+          'Monthly should be incremented by 5'
+        );
+        assert.equal(
+          response.data.after.daily,
+          response.data.before.daily + 5,
+          'Daily should be incremented by 5'
+        );
+        assert.equal(
+          response.data.after.total,
+          response.data.before.total + 5,
+          'Total should be incremented by 5'
+        );
+
+        state.afterCustomAmount = response.data.after;
+      },
+    },
+
+    // Test 5: Verify custom amount persisted
+    {
+      name: 'verify-custom-amount-persisted',
+      async run({ firestore, assert, state, accounts }) {
+        const userDoc = await firestore.get(`users/${accounts.basic.uid}`);
+
+        assert.ok(userDoc?.usage?.requests, 'User should have requests usage');
+
+        assert.equal(
+          userDoc.usage.requests.monthly,
+          state.afterCustomAmount.monthly,
+          'Requests monthly should be persisted'
+        );
+        assert.equal(
+          userDoc.usage.requests.daily,
+          state.afterCustomAmount.daily,
+          'Requests daily should be persisted'
+        );
+        assert.equal(
+          userDoc.usage.requests.total,
+          state.afterCustomAmount.total,
+          'Requests total should be persisted'
+        );
+      },
+    },
+
+    // Test 6: Multiple increments accumulate
+    {
+      name: 'multiple-increments-accumulate',
+      async run({ http, assert, state }) {
+        // First increment
+        const response1 = await http.as('basic').post('backend-manager/test/usage', {});
+
+        assert.isSuccess(response1, 'First increment should succeed');
+
+        // Second increment
+        const response2 = await http.as('basic').post('backend-manager/test/usage', {});
+
+        assert.isSuccess(response2, 'Second increment should succeed');
+
+        // Third increment with custom amount
+        const response3 = await http.as('basic').post('backend-manager/test/usage', {
+          amount: 3,
+        });
+
+        assert.isSuccess(response3, 'Third increment should succeed');
+
+        // Verify accumulation: should be initial + 1 (test 2) + 5 (test 4) + 1 + 1 + 3 = initial + 11
+        const expectedMonthly = state.initialMonthly + 11;
+        const expectedDaily = state.initialDaily + 11;
+        const expectedTotal = state.initialTotal + 11;
+
+        assert.equal(
+          response3.data.after.monthly,
+          expectedMonthly,
+          `Monthly should accumulate to ${expectedMonthly}`
+        );
+        assert.equal(
+          response3.data.after.daily,
+          expectedDaily,
+          `Daily should accumulate to ${expectedDaily}`
+        );
+        assert.equal(
+          response3.data.after.total,
+          expectedTotal,
+          `Total should accumulate to ${expectedTotal}`
+        );
+      },
+    },
+
+    // Test 7: Unauthenticated usage tracks by IP in usage collection
+    {
+      name: 'unauthenticated-usage-by-ip',
+      async run({ http, assert, state }) {
+        // Unauthenticated requests use IP as key (no proxy headers in emulator, so falls back to 'unknown')
+        state.unauthKey = 'unknown';
+
+        const response = await http.as('none').post('backend-manager/test/usage', {});
+
+        assert.isSuccess(response, 'Unauthenticated usage increment should succeed');
+        assert.equal(response.data.authenticated, false, 'Should report as unauthenticated');
+        assert.equal(response.data.key, state.unauthKey, 'Key should be unknown');
+
+        // Verify all counters incremented
+        assert.equal(response.data.after.monthly, response.data.before.monthly + 1, 'Monthly should increment by 1');
+        assert.equal(response.data.after.daily, response.data.before.daily + 1, 'Daily should increment by 1');
+
+        state.unauthMonthly = response.data.after.monthly;
+      },
+    },
+
+    // Test 8: Verify unauthenticated usage persisted to usage collection
+    {
+      name: 'verify-unauthenticated-usage-persisted',
+      async run({ firestore, assert, state }) {
+        const usageDoc = await firestore.get(`usage/${state.unauthKey}`);
+
+        assert.ok(usageDoc, 'Usage doc should exist in usage collection');
+        assert.ok(usageDoc?.requests, 'Usage doc should have the requests metric');
+        assert.equal(usageDoc.requests.monthly, state.unauthMonthly, 'Persisted monthly should match');
+      },
+    },
+
+    // Test 9: Cron resets daily counters for authenticated users
+    {
+      name: 'cron-resets-daily-counters',
+      // bm_cronDaily runs all daily jobs serially; reset-usage is at the end of
+      // the alphabetical sequence. In EXTENDED mode the real-API jobs ahead of
+      // it can take ~50s combined — override the suite's 30s default.
+      timeout: 75000,
+      async run({ assert, firestore, state, accounts, waitFor, pubsub }) {
+        // Verify daily counter is > 0 before cron
+        const beforeDoc = await firestore.get(`users/${accounts.basic.uid}`);
+        assert.ok(beforeDoc?.usage?.requests?.daily > 0, 'Daily counter should be > 0 before cron');
+
+        // Store monthly and total before cron (should NOT be reset by daily cron)
+        state.monthlyBeforeCron = beforeDoc.usage.requests.monthly;
+        state.totalBeforeCron = beforeDoc.usage.requests.total;
+
+        // Trigger cron via PubSub
+        await pubsub.trigger('bm_cronDaily');
+
+        // Wait for cron to reset daily counter.
+        // bm_cronDaily executes every registered daily job sequentially. In EXTENDED
+        // mode the real-API jobs (marketing-newsletter-generate, expire-paypal-cancellations,
+        // blog-auto-publisher, etc.) can take 40-50s combined before reset-usage
+        // (alphabetical tail) gets its turn. 70s gives that the headroom it needs;
+        // the per-test `timeout` below matches.
+        try {
+          await waitFor(
+            async () => {
+              const doc = await firestore.get(`users/${accounts.basic.uid}`);
+              return doc?.usage?.requests?.daily === 0;
+            },
+            70000,
+            500
+          );
+          assert.ok(true, 'Daily counter was reset to 0 by cron');
+        } catch (error) {
+          assert.fail('Daily counter should be reset to 0 within 70s');
+        }
+      },
+    },
+
+    // Test 10: Cron preserves monthly and total counters (non-1st of month)
+    {
+      name: 'cron-preserves-monthly-and-total',
+      async run({ assert, firestore, state, accounts }) {
+        const afterDoc = await firestore.get(`users/${accounts.basic.uid}`);
+
+        assert.equal(
+          afterDoc.usage.requests.monthly,
+          state.monthlyBeforeCron,
+          'Monthly counter should be preserved after daily cron'
+        );
+        assert.equal(
+          afterDoc.usage.requests.total,
+          state.totalBeforeCron,
+          'Total counter should be preserved after daily cron'
+        );
+      },
+    },
+
+    // Test 11: Cron deletes unauthenticated usage collection
+    {
+      name: 'cron-deletes-unauthenticated-usage',
+      async run({ assert, firestore, state, waitFor }) {
+        // The cron was already triggered in test 9, so the usage collection should be deleted
+        try {
+          await waitFor(
+            async () => {
+              const doc = await firestore.get(`usage/${state.unauthKey}`);
+              return !doc;
+            },
+            10000,
+            500
+          );
+          assert.ok(true, 'Usage collection doc was deleted by cron');
+        } catch (error) {
+          assert.fail('Usage collection doc should be deleted within 10s');
+        }
+      },
+    },
+
+    // Test 12: Daily counter accumulates after cron reset
+    {
+      name: 'daily-counter-accumulates-after-reset',
+      async run({ http, assert }) {
+        // After cron reset daily to 0, new increments should start from 0
+        const response = await http.as('basic').post('backend-manager/test/usage', {
+          amount: 3,
+        });
+
+        assert.isSuccess(response, 'Increment after cron reset should succeed');
+        assert.equal(response.data.before.daily, 0, 'Daily should be 0 after cron reset');
+        assert.equal(response.data.after.daily, 3, 'Daily should be 3 after increment');
+
+        // Monthly should have continued accumulating (not reset)
+        assert.equal(
+          response.data.after.monthly,
+          response.data.before.monthly + 3,
+          'Monthly should continue accumulating'
+        );
+      },
+    },
+  ],
+};

package/test/routes/user/api-keys.js

@@ -0,0 +1,156 @@
+/**
+ * Test: POST /user/api-keys
+ * Tests the user regenerate API keys endpoint
+ * This is a suite because we need to track state and restore original keys
+ */
+module.exports = {
+  description: 'User regenerate API keys',
+  type: 'suite',
+  timeout: 30000,
+
+  tests: [
+    // Test 1: Store original keys
+    {
+      name: 'store-original-keys',
+      async run({ firestore, assert, state, accounts }) {
+        // Get the basic account's current keys to restore later
+        const userDoc = await firestore.get(`users/${accounts.basic.uid}`);
+
+        assert.ok(userDoc, 'User doc should exist');
+        assert.hasProperty({ data: userDoc }, 'data.api.clientId', 'User should have clientId');
+        assert.hasProperty({ data: userDoc }, 'data.api.privateKey', 'User should have privateKey');
+
+        state.originalClientId = userDoc.api.clientId;
+        state.originalPrivateKey = userDoc.api.privateKey;
+
+        assert.ok(state.originalClientId, 'Original clientId should exist');
+        assert.ok(state.originalPrivateKey, 'Original privateKey should exist');
+      },
+    },
+
+    // Test 2: Regenerate both keys (default)
+    {
+      name: 'regenerate-both-keys',
+      async run({ http, assert, state }) {
+        const response = await http.as('basic').post('backend-manager/user/api-keys', {});
+
+        assert.isSuccess(response, 'Regenerate API keys should succeed');
+        assert.hasProperty(response, 'data.clientId', 'Response should contain new clientId');
+        assert.hasProperty(response, 'data.privateKey', 'Response should contain new privateKey');
+
+        // Keys should be different from original
+        assert.notEqual(
+          response.data.clientId,
+          state.originalClientId,
+          'New clientId should be different from original'
+        );
+        assert.notEqual(
+          response.data.privateKey,
+          state.originalPrivateKey,
+          'New privateKey should be different from original'
+        );
+
+        // Store new keys for verification
+        state.newClientId = response.data.clientId;
+        state.newPrivateKey = response.data.privateKey;
+      },
+    },
+
+    // Test 3: Verify keys are persisted in Firestore
+    {
+      name: 'verify-keys-persisted',
+      async run({ firestore, assert, state, accounts }) {
+        const userDoc = await firestore.get(`users/${accounts.basic.uid}`);
+
+        assert.equal(
+          userDoc.api.clientId,
+          state.newClientId,
+          'Persisted clientId should match returned value'
+        );
+        assert.equal(
+          userDoc.api.privateKey,
+          state.newPrivateKey,
+          'Persisted privateKey should match returned value'
+        );
+      },
+    },
+
+    // Test 4: Regenerate only clientId
+    // Note: After test 2, the privateKey changed so we need to use the new one
+    {
+      name: 'regenerate-only-clientId',
+      async run({ http, assert, state }) {
+        // Use the new privateKey from test 2 since old one is invalid
+        const response = await http.withPrivateKey(state.newPrivateKey).post('backend-manager/user/api-keys', {
+          keys: ['clientId'],
+        });
+
+        assert.isSuccess(response, 'Regenerate clientId only should succeed');
+        assert.hasProperty(response, 'data.clientId', 'Response should contain new clientId');
+        assert.ok(
+          !response.data.privateKey,
+          'Response should NOT contain privateKey when only clientId requested'
+        );
+        assert.notEqual(
+          response.data.clientId,
+          state.newClientId,
+          'New clientId should be different from previous'
+        );
+      },
+    },
+
+    // Test 5: Regenerate only privateKey
+    {
+      name: 'regenerate-only-privateKey',
+      async run({ http, assert, state, accounts, firestore }) {
+        // Get current clientId to verify it stays the same
+        const beforeDoc = await firestore.get(`users/${accounts.basic.uid}`);
+        const currentClientId = beforeDoc.api.clientId;
+
+        // Still use newPrivateKey since test 4 didn't change it
+        const response = await http.withPrivateKey(state.newPrivateKey).post('backend-manager/user/api-keys', {
+          keys: ['privateKey'],
+        });
+
+        assert.isSuccess(response, 'Regenerate privateKey only should succeed');
+        assert.hasProperty(response, 'data.privateKey', 'Response should contain new privateKey');
+        assert.ok(
+          !response.data.clientId,
+          'Response should NOT contain clientId when only privateKey requested'
+        );
+
+        // Verify clientId stayed the same
+        const afterDoc = await firestore.get(`users/${accounts.basic.uid}`);
+        assert.equal(
+          afterDoc.api.clientId,
+          currentClientId,
+          'clientId should remain unchanged when only privateKey regenerated'
+        );
+      },
+    },
+
+    // Test 6: Unauthenticated request fails
+    {
+      name: 'unauthenticated-rejected',
+      async run({ http, assert }) {
+        const response = await http.as('none').post('backend-manager/user/api-keys', {});
+
+        assert.isError(response, 401, 'Regenerate API keys should fail without authentication');
+      },
+    },
+
+    // Test 7: Restore original keys
+    {
+      name: 'restore-original-keys',
+      async run({ firestore, state, accounts }) {
+        // Restore original keys so other tests aren't affected
+        await firestore.set(`users/${accounts.basic.uid}`, {
+          api: {
+            clientId: state.originalClientId,
+            privateKey: state.originalPrivateKey,
+          },
+        }, { merge: true });
+      },
+    },
+  ],
+};

package/test/routes/user/delete.js

@@ -0,0 +1,136 @@
+/**
+ * Test: DELETE /user
+ * User deletion flow tests
+ * Tests:
+ * - Users with active subscriptions cannot delete themselves
+ * - Users cannot delete other users
+ * - Users can delete themselves after subscription is removed
+ * - Admins can delete any user
+ */
+module.exports = {
+  description: 'User deletion flow',
+  type: 'suite',
+
+  tests: [
+    // --- Self-deletion tests ---
+    {
+      name: 'verify-delete-user-exists',
+      async run({ firestore, assert, state, accounts }) {
+        // Get the delete test account uid
+        state.deleteUid = accounts.delete.uid;
+
+        // Verify the user doc exists
+        const userDoc = await firestore.get(`users/${state.deleteUid}`);
+
+        assert.ok(userDoc, 'Delete user doc should exist before deletion');
+        assert.ok(userDoc?.auth?.uid === state.deleteUid, 'User doc should have correct uid');
+      },
+    },
+
+    {
+      name: 'delete-blocked-with-subscription',
+      async run({ http, assert }) {
+        // Auth as the delete user and try to delete themselves
+        // Should be blocked due to active subscription
+        const deleteResponse = await http.as('delete').delete('backend-manager/user', {});
+
+        assert.isError(deleteResponse, 400, 'Deletion should be blocked with active subscription');
+        assert.ok(
+          deleteResponse.error?.includes('paid subscription'),
+          `Error should mention paid subscription: ${deleteResponse.error}`,
+        );
+      },
+    },
+
+    // NOTE: The DELETE /user API ignores the payload uid parameter for non-admin users.
+    // It always uses the authenticated user's uid from resolveUser().
+    // This means non-admins cannot delete other users by design - the uid param is simply ignored.
+    // A test for "delete other user blocked" would be misleading since it would actually
+    // try to delete the authenticated user (basic), not the target user.
+    // If we want to explicitly block this, the API should be updated to check payload.uid
+    // against user.auth.uid and return a 403 if they don't match.
+
+    {
+      name: 'remove-subscription-from-delete-user',
+      async run({ firestore, state }) {
+        // Remove the subscription (set to null to overwrite)
+        await firestore.set(`users/${state.deleteUid}`, { subscription: null }, { merge: true });
+      },
+    },
+
+    {
+      name: 'delete-user-succeeds',
+      async run({ http, assert }) {
+        // Auth as the delete user and delete themselves
+        const deleteResponse = await http.as('delete').delete('backend-manager/user', {});
+
+        assert.isSuccess(deleteResponse, `DELETE /user should succeed: ${JSON.stringify(deleteResponse, null, 2)}`);
+      },
+    },
+
+    {
+      name: 'verify-firestore-doc-deleted',
+      async run({ firestore, assert, state, waitFor }) {
+        // on-delete handler deletes Firestore doc when Auth user is deleted
+        // Wait for the deletion to complete
+        const docDeleted = await waitFor(async () => {
+          const userDoc = await firestore.get(`users/${state.deleteUid}`);
+          return !userDoc;
+        }, 10000, 500);
+
+        assert.ok(docDeleted, 'Firestore doc should be deleted after Auth user deletion');
+      },
+    },
+
+    // --- Admin deletion tests ---
+    {
+      name: 'verify-admin-delete-target-exists',
+      async run({ firestore, assert, state, accounts }) {
+        // Get the delete-by-admin test account uid
+        state.adminDeleteUid = accounts['delete-by-admin'].uid;
+
+        // Verify the user doc exists
+        const userDoc = await firestore.get(`users/${state.adminDeleteUid}`);
+
+        assert.ok(userDoc, 'Admin delete target user doc should exist');
+        assert.ok(userDoc?.auth?.uid === state.adminDeleteUid, 'User doc should have correct uid');
+      },
+    },
+
+    {
+      name: 'admin-can-delete-other-user',
+      async run({ http, assert, state }) {
+        // Auth as admin (using backendManagerKey) and delete another user
+        const deleteResponse = await http.as('admin').delete('backend-manager/user', {
+          uid: state.adminDeleteUid,
+        });
+
+        assert.isSuccess(deleteResponse, `Admin should be able to delete another user: ${JSON.stringify(deleteResponse, null, 2)}`);
+      },
+    },
+
+    {
+      name: 'verify-admin-deleted-user-firestore-deleted',
+      async run({ firestore, assert, state, waitFor }) {
+        // on-delete handler deletes Firestore doc when Auth user is deleted
+        // Wait for the deletion to complete
+        const docDeleted = await waitFor(async () => {
+          const userDoc = await firestore.get(`users/${state.adminDeleteUid}`);
+          return !userDoc;
+        }, 10000, 500);
+
+        assert.ok(docDeleted, 'Firestore doc should be deleted after admin deletion');
+      },
+    },
+
+    // --- Auth rejection test (at end per convention) ---
+    {
+      name: 'unauthenticated-rejected',
+      async run({ http, assert }) {
+        const deleteResponse = await http.as('none').delete('backend-manager/user', {});
+
+        assert.isError(deleteResponse, 401, 'Delete should fail without authentication');
+      },
+    },
+  ],
+};