backend-manager 5.9.7 → 5.9.9

package/test/routes/content/post.js

@@ -0,0 +1,54 @@
+/**
+ * Test: GET /content/post
+ * Tests the content fetch post endpoint
+ * Fetches blog post content from GitHub
+ * Requires GitHub API key and repo_website config
+ */
+module.exports = {
+  description: 'General fetch post from GitHub',
+  type: 'group',
+  tests: [
+    // Test 1: Missing URL returns 400 error
+    {
+      name: 'missing-url-rejected',
+      auth: 'none',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.get('backend-manager/content/post', {});
+
+        assert.isError(response, 400, 'Missing URL should return 400');
+      },
+    },
+
+    // Test 2: Non-existent post returns 404
+    {
+      name: 'nonexistent-post-returns-404',
+      auth: 'none',
+      timeout: 30000,
+
+      async run({ http, assert }) {
+        const response = await http.get('backend-manager/content/post', {
+          url: 'https://example.com/blog/this-post-definitely-does-not-exist-12345',
+        });
+
+        assert.isError(response, 404, 'Non-existent post should return 404');
+      },
+    },
+
+    // Test 3: Authenticated user fetching non-existent post returns 404
+    {
+      name: 'authenticated-nonexistent-returns-404',
+      auth: 'basic',
+      timeout: 30000,
+
+      async run({ http, assert }) {
+        const response = await http.get('backend-manager/content/post', {
+          url: 'https://example.com/blog/nonexistent-test-post-12345',
+        });
+
+        assert.isError(response, 404, 'Non-existent post should return 404');
+      },
+    },
+  ],
+};

package/test/routes/general/uuid.js

@@ -0,0 +1,115 @@
+/**
+ * Test: UUID Route
+ * Tests the new RESTful UUID endpoint using proper HTTP verbs
+ */
+module.exports = {
+  description: 'UUID route',
+  type: 'group',
+  tests: [
+    {
+      name: 'v4-random-uuid',
+      auth: 'none',
+      timeout: 10000,
+
+      async run({ http, assert }) {
+        // POST /backend-manager/general/uuid
+        const response = await http.post('backend-manager/general/uuid', {
+          version: '4',
+        });
+
+        assert.isSuccess(response, 'UUID v4 generation should succeed');
+        assert.hasProperty(response, 'data.uuid', 'Response should contain uuid');
+        assert.match(
+          response.data.uuid,
+          /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,
+          'UUID v4 should have correct format'
+        );
+
+        return { success: true };
+      },
+    },
+
+    {
+      name: 'v5-namespaced-uuid',
+      auth: 'none',
+      timeout: 10000,
+
+      async run({ http, assert }) {
+        const response = await http.post('backend-manager/general/uuid', {
+          version: '5',
+          name: 'test-name-for-uuid',
+        });
+
+        assert.isSuccess(response, 'UUID v5 generation should succeed');
+        assert.hasProperty(response, 'data.uuid', 'Response should contain uuid');
+        assert.match(
+          response.data.uuid,
+          /^[0-9a-f]{8}-[0-9a-f]{4}-5[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,
+          'UUID v5 should have correct format'
+        );
+
+        return { success: true };
+      },
+    },
+
+    {
+      name: 'v5-deterministic',
+      auth: 'none',
+      timeout: 10000,
+
+      async run({ http, assert }) {
+        const response1 = await http.post('backend-manager/general/uuid', {
+          version: '5',
+          name: 'test-name-for-uuid',
+        });
+
+        const response2 = await http.post('backend-manager/general/uuid', {
+          version: '5',
+          name: 'test-name-for-uuid',
+        });
+
+        assert.isSuccess(response1, 'First UUID v5 generation should succeed');
+        assert.isSuccess(response2, 'Second UUID v5 generation should succeed');
+        assert.equal(
+          response1.data.uuid,
+          response2.data.uuid,
+          'UUID v5 should be deterministic - same input should produce same output'
+        );
+
+        return { success: true };
+      },
+    },
+
+    {
+      name: 'v5-requires-name',
+      auth: 'none',
+      timeout: 10000,
+
+      async run({ http, assert }) {
+        const response = await http.post('backend-manager/general/uuid', {
+          version: '5',
+        });
+
+        assert.isError(response, 400, 'UUID v5 without name should return 400');
+
+        return { success: true };
+      },
+    },
+
+    {
+      name: 'invalid-version-rejected',
+      auth: 'none',
+      timeout: 10000,
+
+      async run({ http, assert }) {
+        const response = await http.post('backend-manager/general/uuid', {
+          version: '99',
+        });
+
+        assert.isError(response, 400, 'Invalid version should return 400');
+
+        return { success: true };
+      },
+    },
+  ],
+};

package/test/routes/marketing/campaign.js

@@ -0,0 +1,125 @@
+/**
+ * Test: POST /marketing/campaign — Send a marketing campaign (Single Send)
+ *
+ * Normal mode: creates campaign doc in Firestore, verifies structure
+ * Extended mode (TEST_EXTENDED_MODE=true): sends a real test campaign via SendGrid/Beehiiv
+ *   targeting the test_admin segment (hello@itwcreativeworks.com only)
+ */
+
+module.exports = {
+  description: 'Marketing campaign (POST create + send)',
+  type: 'group',
+  tests: [
+    {
+      name: 'send-test-campaign',
+      auth: 'admin',
+      timeout: 60000,
+      skip: !process.env.TEST_EXTENDED_MODE
+        ? 'TEST_EXTENDED_MODE not set (real provider send)'
+        : false,
+
+      async run({ http, assert, state }) {
+        const response = await http.post('backend-manager/marketing/campaign', {
+          name: 'BEM Test Campaign',
+          subject: 'Test Marketing Email',
+          content: '# Hello\n\nThis is a **test marketing email** sent from the BEM test suite.\n\nIf you received this, the SendGrid Single Send pipeline is working.',
+          test: true,
+          sendAt: 'now',
+        });
+
+        assert.isSuccess(response, 'Campaign creation should succeed');
+        assert.hasProperty(response, 'data.id', 'Response should contain campaign ID');
+        assert.hasProperty(response, 'data.providers', 'Response should contain provider results');
+
+        const providers = response.data.providers || {};
+
+        console.log('Campaign results:', JSON.stringify(providers, null, 2));
+
+        if (providers.campaigns) {
+          state.sendgridId = providers.campaigns.id;
+
+          assert.propertyEquals(
+            response, 'data.providers.campaigns.success', true,
+            `SendGrid should succeed. Error: ${providers.campaigns.error || 'none'}`,
+          );
+        }
+
+        if (providers.newsletter) {
+          assert.hasProperty(response, 'data.providers.newsletter', 'Should have Beehiiv result');
+        }
+
+        state.campaignId = response.data.id;
+      },
+
+      async cleanup({ state }) {
+        if (state.campaignId) {
+          console.log(`Campaign ID: ${state.campaignId}`);
+        }
+        if (state.sendgridId) {
+          console.log(`SendGrid Single Send ID: ${state.sendgridId}`);
+        }
+      },
+    },
+
+    {
+      name: 'create-future-campaign-is-pending',
+      auth: 'admin',
+      timeout: 30000,
+
+      async run({ http, assert, firestore }) {
+        // Future sendAt → campaign is saved as 'pending' for cron pickup, not sent immediately
+        const futureDate = new Date(Date.now() + 7 * 24 * 60 * 60 * 1000).toISOString();
+
+        const response = await http.post('backend-manager/marketing/campaign', {
+          name: 'Future Campaign',
+          subject: 'Future Subject',
+          content: 'Future content',
+          test: true,
+          sendAt: futureDate,
+        });
+
+        assert.isSuccess(response, 'Future campaign creation should succeed');
+        assert.hasProperty(response, 'data.id', 'Response should contain campaign ID');
+        assert.propertyEquals(response, 'data.status', 'pending', 'Future campaign should be pending');
+
+        const doc = await firestore.get(`marketing-campaigns/${response.data.id}`);
+        assert.ok(doc, 'Campaign doc should exist in Firestore');
+        assert.equal(doc.status, 'pending', 'Firestore doc status should be pending');
+        assert.equal(doc.settings.name, 'Future Campaign', 'Name should match input');
+        assert.propertyEquals(response, 'data.providers', null, 'Future campaign should not have provider results');
+      },
+    },
+
+    {
+      name: 'campaign-requires-admin',
+      auth: 'user',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.post('backend-manager/marketing/campaign', {
+          name: 'Unauthorized Campaign',
+          subject: 'Should fail',
+          content: 'Should fail',
+        });
+
+        assert.isError(response, 403, 'Non-admin should get 403');
+      },
+    },
+
+    {
+      name: 'campaign-requires-auth',
+      auth: 'none',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.post('backend-manager/marketing/campaign', {
+          name: 'Unauthenticated Campaign',
+          subject: 'Should fail',
+          content: 'Should fail',
+        });
+
+        assert.isError(response, 401, 'Unauthenticated should get 401');
+      },
+    },
+  ],
+};

package/test/routes/marketing/contact.js

@@ -0,0 +1,370 @@
+/**
+ * Test: POST /marketing/contact and DELETE /marketing/contact
+ * Tests the marketing contact endpoints for adding/removing users to SendGrid/Beehiiv
+ *
+ * Set TEST_EXTENDED_MODE=true to run tests against real SendGrid/Beehiiv APIs
+ * (requires SENDGRID_API_KEY and BEEHIIV_API_KEY env vars)
+ */
+
+// Test email patterns - look like real emails but +bem suffix identifies them for cleanup.
+// Names should be inferred by AI from the email local part.
+//
+// Fixed test domain (`acme.com`) — deterministic across brands. Using the running brand's
+// domain caused cross-brand state divergence in SendGrid/Beehiiv and non-deterministic
+// company inference (different domain → different inferred company name).
+//
+// `valid`: use a name that won't be flagged as fictional/placeholder by the AI prompt.
+// (The infer-contact prompt rejects fictional names — e.g. "rachel.greene" sometimes
+// matches the Friends character and returns empty. Use a more anonymous name.)
+//
+// `invalid`: must reach the mailbox verification check (so previous checks all pass — must
+// NOT start with "test"/"example" which are in BLOCKED_LOCAL_PATTERNS, NOT be on
+// a corporate/disposable domain). Real-looking name on a real domain with no actual
+// mailbox there is the safest pick.
+const TEST_DOMAIN = 'acme.com';
+const TEST_EMAILS = {
+  valid: () => `sarah.martinez+bem@${TEST_DOMAIN}`,         // Should infer: Sarah Martinez
+  invalid: () => `nonexistent.user+bem@${TEST_DOMAIN}`,     // No such mailbox — mailbox verification should flag as invalid
+};
+
+module.exports = {
+  description: 'Marketing contact (POST add + DELETE remove)',
+  type: 'group',
+  tests: [
+    // --- POST /marketing/contact tests ---
+
+    // Test 1: Admin can add valid email (with real provider calls if TEST_EXTENDED_MODE is set)
+    {
+      name: 'add-admin-valid-email-succeeds',
+      auth: 'admin',
+      timeout: 30000,
+
+      async run({ http, assert, state, config }) {
+        const testEmail = TEST_EMAILS.valid();
+        state.testEmail = testEmail;
+
+        const response = await http.post('backend-manager/marketing/contact', {
+          email: testEmail,
+          source: 'bem-test',
+          // skipValidation bypasses the mailbox verification check — the test email
+          // doesn't have a real mailbox so the provider (correctly) marks it as not
+          // deliverable. We're testing the route flow, not the deliverability check itself.
+          skipValidation: true,
+          // No firstName/lastName - should be inferred as "Rachel Greene"
+        });
+
+        assert.isSuccess(response, 'Add marketing contact should succeed for admin');
+        assert.hasProperty(response, 'data.success', 'Response should contain success');
+        assert.propertyEquals(response, 'data.success', true, 'success should be true');
+
+        // Admin gets detailed response
+        assert.hasProperty(response, 'data.providers', 'Admin response should contain providers');
+
+        // If TEST_EXTENDED_MODE is set, verify provider results
+        if (process.env.TEST_EXTENDED_MODE) {
+          const providers = response.data.providers || {};
+
+          if (process.env.SENDGRID_API_KEY) {
+            assert.hasProperty(response, 'data.providers.campaigns', 'Should have SendGrid result');
+            if (providers.campaigns?.success) {
+              state.sendgridAdded = true;
+            } else {
+              // Log error for debugging but don't fail - could be list matching issue
+              console.log('SendGrid result:', providers.campaigns);
+            }
+          }
+
+          if (process.env.BEEHIIV_API_KEY && config.marketing?.newsletter?.publicationId) {
+            assert.hasProperty(response, 'data.providers.newsletter', 'Should have Beehiiv result');
+            if (providers.newsletter?.success) {
+              state.beehiivAdded = true;
+            } else {
+              console.log('Beehiiv result:', providers.newsletter);
+            }
+          }
+        }
+      },
+
+      async cleanup({ state, http }) {
+        // Only cleanup if TEST_EXTENDED_MODE is set and contacts were added
+        if (!process.env.TEST_EXTENDED_MODE || !state.testEmail) {
+          return;
+        }
+
+        console.log(`Cleaning up test contact: ${state.testEmail}`);
+
+        const result = await http.delete('backend-manager/marketing/contact', {
+          email: state.testEmail,
+        });
+        console.log('Cleanup result:', result.data);
+      },
+    },
+
+    // Test 2: Invalid email format rejected
+    {
+      name: 'add-invalid-email-format-rejected',
+      auth: 'admin',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.post('backend-manager/marketing/contact', {
+          email: 'not-a-valid-email',
+          source: 'bem-test',
+        });
+
+        assert.isError(response, 400, 'Invalid email format should return 400');
+      },
+    },
+
+    // Test 3: Missing email rejected
+    {
+      name: 'add-missing-email-rejected',
+      auth: 'admin',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.post('backend-manager/marketing/contact', {
+          firstName: 'Test',
+          source: 'bem-test',
+        });
+
+        assert.isError(response, 400, 'Missing email should return 400');
+      },
+    },
+
+    // Test 4: Disposable email rejected
+    {
+      name: 'add-disposable-email-rejected',
+      auth: 'admin',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.post('backend-manager/marketing/contact', {
+          email: 'test@mailinator.com',
+          source: 'bem-test',
+        });
+
+        assert.isError(response, 400, 'Disposable email should return 400');
+      },
+    },
+
+    // Test 5: Name inferred from email (AI only — requires extended mode)
+    {
+      name: 'add-name-inferred-from-email',
+      skip: !process.env.TEST_EXTENDED_MODE ? 'TEST_EXTENDED_MODE not set (AI inference requires OPENAI_API_KEY)' : false,
+      auth: 'admin',
+      timeout: 30000,
+
+      async run({ http, assert, state }) {
+        // Use valid email without providing name - should infer "Rachel Greene"
+        const testEmail = TEST_EMAILS.valid();
+        state.testEmail = testEmail;
+
+        const response = await http.post('backend-manager/marketing/contact', {
+          email: testEmail,
+          source: 'bem-test',
+          // No firstName/lastName - should be inferred
+        });
+
+        assert.isSuccess(response, 'Add marketing contact should succeed');
+
+        // Check name was inferred
+        assert.hasProperty(response, 'data.nameInferred', 'Should have nameInferred');
+        assert.ok(
+          response.data.nameInferred.firstName || response.data.nameInferred.lastName,
+          'Name should be inferred from email'
+        );
+        assert.hasProperty(response.data.nameInferred, 'method', 'Should include inference method');
+
+        // Track if providers were called
+        if (process.env.TEST_EXTENDED_MODE) {
+          state.sendgridAdded = response.data?.providers?.campaigns?.success;
+          state.beehiivAdded = response.data?.providers?.newsletter?.success;
+        }
+      },
+
+      async cleanup({ state, http }) {
+        if (!process.env.TEST_EXTENDED_MODE || !state.testEmail) {
+          return;
+        }
+
+        await http.delete('backend-manager/marketing/contact', { email: state.testEmail });
+      },
+    },
+
+    // Test 6: Admin can skip validation (use disposable domain but skip check)
+    {
+      name: 'add-admin-skip-validation',
+      auth: 'admin',
+      timeout: 30000,
+
+      async run({ http, assert, state }) {
+        // Use disposable domain - normally blocked, but skipValidation bypasses
+        const testEmail = 'rachel.greene+bem@mailinator.com';
+        state.testEmail = testEmail;
+
+        const response = await http.post('backend-manager/marketing/contact', {
+          email: testEmail,
+          source: 'bem-test',
+          skipValidation: true,
+        });
+
+        // Should succeed because validation was skipped
+        assert.isSuccess(response, 'Add marketing contact with skipValidation should succeed');
+
+        if (process.env.TEST_EXTENDED_MODE) {
+          state.sendgridAdded = response.data?.providers?.campaigns?.success;
+          state.beehiivAdded = response.data?.providers?.newsletter?.success;
+        }
+      },
+
+      async cleanup({ state, http }) {
+        if (!process.env.TEST_EXTENDED_MODE || !state.testEmail) {
+          return;
+        }
+
+        await http.delete('backend-manager/marketing/contact', { email: state.testEmail });
+      },
+    },
+
+    // Test 7: Mailbox verification (only runs if TEST_EXTENDED_MODE and a mailbox API key are set)
+    {
+      name: 'add-mailbox-validation',
+      auth: 'admin',
+      timeout: 30000,
+      skip: !process.env.TEST_EXTENDED_MODE || !(process.env.NEVERBOUNCE_API_KEY || process.env.ZEROBOUNCE_API_KEY)
+        ? 'TEST_EXTENDED_MODE or mailbox API key not set'
+        : false,
+
+      async run({ http, assert, state, skip }) {
+        const testEmail = TEST_EMAILS.valid();
+        state.testEmail = testEmail;
+
+        const response = await http.post('backend-manager/marketing/contact', {
+          email: testEmail,
+          source: 'bem-test',
+        });
+
+        assert.isSuccess(response, 'Add marketing contact should succeed');
+
+        // Check that validation info is included
+        assert.hasProperty(response, 'data.validation', 'Response should contain validation');
+        assert.hasProperty(response, 'data.validation.checks', 'Validation should contain checks');
+
+        // Mailbox check should be in checks when key is set
+        assert.hasProperty(response, 'data.validation.checks.mailbox', 'Should have mailbox check');
+
+        const mbResult = response.data.validation.checks.mailbox;
+
+        // If out of credits, skip test - not a failure
+        if (mbResult.error?.includes('out of credits')) {
+          skip('Mailbox verification out of credits');
+        }
+
+        assert.hasProperty(mbResult, 'status', 'Mailbox check should return status');
+
+        state.sendgridAdded = response.data?.providers?.campaigns?.success;
+        state.beehiivAdded = response.data?.providers?.newsletter?.success;
+      },
+
+      async cleanup({ state, http }) {
+        if (!state.testEmail) {
+          return;
+        }
+
+        await http.delete('backend-manager/marketing/contact', { email: state.testEmail });
+      },
+    },
+
+    // Test 9: Mailbox verification rejects invalid email (only runs if TEST_EXTENDED_MODE and a mailbox API key are set)
+    {
+      name: 'add-mailbox-rejects-invalid',
+      auth: 'admin',
+      timeout: 30000,
+      skip: !process.env.TEST_EXTENDED_MODE || !(process.env.NEVERBOUNCE_API_KEY || process.env.ZEROBOUNCE_API_KEY)
+        ? 'TEST_EXTENDED_MODE or mailbox API key not set'
+        : false,
+
+      async run({ http, assert, skip }) {
+        // Email that should reach the mailbox provider and be flagged as undeliverable.
+        // Must NOT trip earlier checks (localPart blocklist, disposable, corporate).
+        const testEmail = TEST_EMAILS.invalid();
+
+        const response = await http.post('backend-manager/marketing/contact', {
+          email: testEmail,
+          source: 'bem-test',
+        });
+
+        // With no ZeroBounce credits the route fails-open and returns 200; with credits
+        // the route should EITHER succeed (200) and report invalid in checks, OR error
+        // (400) with "Email validation failed". Either is correct behavior — what we
+        // verify here is that mailbox check ran and didn't mark the email as `valid`.
+        const mbResult = response.data?.validation?.checks?.mailbox;
+
+        // If credits are out, the test can't actually exercise rejection — skip.
+        if (mbResult?.error?.includes('out of credits') || mbResult?.error?.includes('Invalid API key')) {
+          skip('Mailbox verification out of credits');
+        }
+
+        // If the response was a 400, that's the legitimate rejection path — done.
+        if (response.status === 400) {
+          return;
+        }
+
+        // Otherwise expect a 200 with a non-"valid" mailbox status.
+        assert.isSuccess(response, 'Request should succeed (fail-open) or error 400');
+        if (mbResult) {
+          assert.hasProperty(mbResult, 'status', 'Should have status');
+          assert.notEqual(mbResult.status, 'valid', 'Fake email should not be marked valid');
+        }
+      },
+    },
+
+    // --- Auth rejection tests ---
+    {
+      name: 'add-unauthenticated-rejected',
+      auth: 'none',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        // Public request without auth must be rejected. The exact rejection mechanism
+        // depends on environment:
+        //   - Production: missing reCAPTCHA token → 403
+        //   - Local emulator (BEM_TESTING=true): reCAPTCHA is bypassed, but unauthenticated
+        //     users hit the marketing-subscribe rate limit (quota 0/0) → 429
+        // Both are correct: the route protects itself from anonymous abuse. Accept either.
+        const response = await http.post('backend-manager/marketing/contact', {
+          email: TEST_EMAILS.valid(),
+          source: 'bem-test',
+        });
+
+        assert.ok(!response.success, 'Public request should be rejected');
+        assert.ok(
+          response.status === 403 || response.status === 429,
+          `Expected 403 or 429 but got ${response.status}`
+        );
+      },
+    },
+
+    // --- DELETE /marketing/contact tests ---
+
+    // Test: Final cleanup (runs last to clean up test contacts from providers)
+    {
+      name: 'delete-cleanup-test-contacts',
+      auth: 'admin',
+      timeout: 30000,
+      skip: !process.env.TEST_EXTENDED_MODE ? 'TEST_EXTENDED_MODE not set' : false,
+
+      async run({ http, assert }) {
+        // Clean up the rachel.greene+bem test contact from marketing providers
+        const testEmail = TEST_EMAILS.valid();
+
+        const response = await http.delete('backend-manager/marketing/contact', {
+          email: testEmail,
+        });
+
+        assert.isSuccess(response, 'Remove marketing contact should succeed');
+      },
+    },
+  ],
+};