create-ailk 0.20.0 → 0.22.0

package/templates/apps/web/app/[locale]/careers/__tests__/apply.actions.test.ts

@@ -0,0 +1,310 @@
+/**
+ * The job page's apply action (#8746 D4, D5; AC-5): a submission writes one
+ * lead through the site's lead writer with source `flow:job-application`,
+ * `name` = first + last, and the posting's slug as the hidden `job` value.
+ */
+
+import {
+  __resetRateLimit,
+  checkRateLimit,
+} from "../../../../src/lib/rate-limit";
+import { captureLeadAction } from "../[slug]/apply.actions";
+
+jest.mock("@working-theory/api-client", () => ({
+  leads: { submit: jest.fn() },
+  visitorForwardHeaders: jest.requireActual("@working-theory/api-client")
+    .visitorForwardHeaders,
+}));
+
+jest.mock("next/headers", () => ({
+  __esModule: true,
+  headers: jest.fn().mockResolvedValue({ get: () => null }),
+  cookies: jest.fn().mockResolvedValue({ get: () => undefined }),
+}));
+
+const mockGetLocale = jest.fn();
+const mockGetTranslations = jest.fn();
+jest.mock("next-intl/server", () => ({
+  getLocale: (...args: unknown[]) => mockGetLocale(...args),
+  getTranslations: (...args: unknown[]) => mockGetTranslations(...args),
+}));
+
+const mockInviteHref = jest.fn();
+// eslint-disable-next-line no-restricted-syntax -- accountInviteHref reads the generated topology (build output); this file asserts the action's own decision
+jest.mock("../../../../lib/account-invite", () => ({
+  accountInviteHref: (...args: unknown[]) => mockInviteHref(...args),
+}));
+
+import { leads } from "@working-theory/api-client";
+import { headers } from "next/headers";
+const mockSubmit = leads.submit as jest.Mock;
+const mockHeaders = headers as jest.Mock;
+
+const JOB = "content-strategist";
+
+function form(fields: Record<string, string>): FormData {
+  const fd = new FormData();
+  for (const [key, value] of Object.entries(fields)) fd.append(key, value);
+  return fd;
+}
+
+const VALID = {
+  first_name: "Ada",
+  last_name: "Lovelace",
+  email: "ada@example.com",
+  consent: "true",
+};
+
+type SubmitBody = {
+  source: string;
+  email: string;
+  payload: Record<string, unknown>;
+};
+const submitted = (): SubmitBody => mockSubmit.mock.calls[0][0] as SubmitBody;
+
+beforeEach(() => {
+  mockSubmit.mockResolvedValue({ ok: true, status: 201, body: { ok: true } });
+  mockGetLocale.mockResolvedValue("en");
+  mockGetTranslations.mockResolvedValue((key: string) =>
+    key === "trackInAccount" ? "Track this in your account" : key,
+  );
+  mockInviteHref.mockReturnValue("/sign-in?next=%2Faccount&email=ada%40example.com");
+});
+
+afterEach(() => {
+  jest.clearAllMocks();
+  mockHeaders.mockResolvedValue({ get: () => null });
+  __resetRateLimit();
+  delete process.env.AILK_LEAD_SITE;
+});
+
+describe("captureLeadAction on a job page (#8746 AC-5)", () => {
+  it("writes one flow:job-application lead with name = first + last and the hidden job slug", async () => {
+    const result = await captureLeadAction(JOB, null, form(VALID));
+
+    expect(result).toEqual({ kind: "success" });
+    expect(mockSubmit).toHaveBeenCalledTimes(1);
+    const body = submitted();
+    expect(body.source).toBe("flow:job-application");
+    expect(body.email).toBe("ada@example.com");
+    expect(body.payload).toEqual({
+      name: "Ada Lovelace",
+      first_name: "Ada",
+      last_name: "Lovelace",
+      job: JOB,
+      page: "careers",
+    });
+    expect(body).not.toHaveProperty("siteId");
+  });
+
+  it("carries phone and a LinkedIn URL, a bare domain gaining https://", async () => {
+    await captureLeadAction(
+      JOB,
+      null,
+      form({
+        ...VALID,
+        phone: "+1 555 0100",
+        linkedin_url: "linkedin.com/in/ada",
+      }),
+    );
+    expect(submitted().payload).toMatchObject({
+      phone: "+1 555 0100",
+      linkedin_url: "https://linkedin.com/in/ada",
+    });
+  });
+
+  it("keeps an extra field the owner added to the magnet, and no field overrides job, name or source", async () => {
+    await captureLeadAction(
+      JOB,
+      null,
+      form({
+        ...VALID,
+        cover_letter: "Hello",
+        job: "other-job",
+        name: "Mallory",
+        source: "web",
+      }),
+    );
+    const body = submitted();
+    expect(body.source).toBe("flow:job-application");
+    expect(body.payload).toMatchObject({
+      cover_letter: "Hello",
+      job: JOB,
+      name: "Ada Lovelace",
+    });
+  });
+
+  it.each([
+    ["first_name", { ...VALID, first_name: " " }],
+    ["last_name", { ...VALID, last_name: "" }],
+    ["email", { ...VALID, email: "not-an-email" }],
+    ["linkedin_url", { ...VALID, linkedin_url: "not a url" }],
+    ["linkedin_url", { ...VALID, linkedin_url: "javascript:alert(1)" }],
+    [
+      "linkedin_url",
+      { ...VALID, linkedin_url: "https://linkedin.com@evil.example/in/ada" },
+    ],
+    ["consent", { ...VALID, consent: "" }],
+  ])(
+    "refuses a bad %s with a field error and sends nothing",
+    async (field, fields) => {
+      const result = await captureLeadAction(JOB, null, form(fields));
+      expect(result).toMatchObject({
+        kind: "error",
+        fieldErrors: { [field]: expect.any(String) },
+      });
+      expect(mockSubmit).not.toHaveBeenCalled();
+    },
+  );
+
+  it("refuses a job value that is not a slug, sending nothing", async () => {
+    const result = await captureLeadAction("../../etc", null, form(VALID));
+    expect(result).toMatchObject({ kind: "error" });
+    expect(mockSubmit).not.toHaveBeenCalled();
+  });
+
+  it.each([[["eng-lead"]], [123]])(
+    "refuses a bound job of the wrong type (%p), sending nothing",
+    async (job) => {
+      // eslint-disable-next-line no-restricted-syntax -- a tampered bound argument is exactly a value of the wrong type
+      const tampered = job as unknown as string;
+      const result = await captureLeadAction(tampered, null, form(VALID));
+      expect(result).toMatchObject({ kind: "error" });
+      expect(mockSubmit).not.toHaveBeenCalled();
+    },
+  );
+
+  it("reads host:port without a scheme as a bare domain", async () => {
+    await captureLeadAction(
+      JOB,
+      null,
+      form({ ...VALID, linkedin_url: "www.linkedin.com:443/in/ada" }),
+    );
+    expect(submitted().payload).toMatchObject({
+      linkedin_url: "https://www.linkedin.com:443/in/ada",
+    });
+  });
+
+  it("shares /contact's per-visitor bucket", async () => {
+    mockHeaders.mockResolvedValue({
+      get: (name: string) =>
+        name === "x-forwarded-for" ? "203.0.113.7" : null,
+    });
+    for (let i = 0; i < 30; i += 1)
+      checkRateLimit("contact:203.0.113.7", 30, 10 * 60 * 1000);
+    expect(await captureLeadAction(JOB, null, form(VALID))).toMatchObject({
+      kind: "error",
+    });
+    expect(mockSubmit).not.toHaveBeenCalled();
+  });
+
+  it("answers a filled honeypot as success and sends nothing", async () => {
+    const result = await captureLeadAction(
+      JOB,
+      null,
+      form({ ...VALID, ailk_hp: "bot" }),
+    );
+    expect(result).toEqual({ kind: "success" });
+    expect(mockSubmit).not.toHaveBeenCalled();
+  });
+
+  it("maps lead_capture_not_configured and an unreachable API to unavailable", async () => {
+    mockSubmit.mockResolvedValueOnce({
+      ok: false,
+      status: 503,
+      body: { error: "lead_capture_not_configured" },
+    });
+    expect(await captureLeadAction(JOB, null, form(VALID))).toEqual({
+      kind: "unavailable",
+    });
+    mockSubmit.mockRejectedValueOnce(new Error("fetch failed"));
+    expect(await captureLeadAction(JOB, null, form(VALID))).toEqual({
+      kind: "unavailable",
+    });
+  });
+
+  it("answers any other refusal with the generic error", async () => {
+    mockSubmit.mockResolvedValueOnce({
+      ok: false,
+      status: 400,
+      body: { error: "invalid" },
+    });
+    expect(await captureLeadAction(JOB, null, form(VALID))).toMatchObject({
+      kind: "error",
+      message: expect.any(String),
+    });
+  });
+
+  it("limits one visitor to 30 applications per 10 minutes", async () => {
+    mockHeaders.mockResolvedValue({
+      get: (name: string) =>
+        name === "x-forwarded-for" ? "203.0.113.9" : null,
+    });
+    for (let i = 0; i < 30; i += 1) {
+      expect(await captureLeadAction(JOB, null, form(VALID))).toEqual({
+        kind: "success",
+      });
+    }
+    expect(await captureLeadAction(JOB, null, form(VALID))).toMatchObject({
+      kind: "error",
+    });
+    expect(mockSubmit).toHaveBeenCalledTimes(30);
+  });
+});
+
+describe("the thank-you's account link (#8771 AC-6)", () => {
+  const invite = () =>
+    mockSubmit.mockResolvedValue({
+      ok: true,
+      status: 201,
+      body: { ok: true, next: { completion: "invite" } },
+    });
+
+  it("an invite answer returns the prefilled link and label", async () => {
+    invite();
+
+    const result = await captureLeadAction(JOB, null, form(VALID));
+
+    expect(result).toEqual({
+      kind: "success",
+      next: {
+        href: "/sign-in?next=%2Faccount&email=ada%40example.com",
+        label: "Track this in your account",
+      },
+    });
+    expect(mockInviteHref).toHaveBeenCalledWith("en", "ada@example.com");
+  });
+
+  it.each([
+    ["no next", { ok: true }],
+    ["a checkout next", { ok: true, next: { completion: "checkout", checkoutOffering: "retainer" } }],
+  ])("%s: exactly { kind: 'success' }", async (_name, body) => {
+    mockSubmit.mockResolvedValue({ ok: true, status: 201, body });
+
+    await expect(captureLeadAction(JOB, null, form(VALID))).resolves.toEqual({ kind: "success" });
+    expect(mockInviteHref).not.toHaveBeenCalled();
+  });
+
+  it("a site with no sign-in (href null) is exactly { kind: 'success' }", async () => {
+    invite();
+    mockInviteHref.mockReturnValue(null);
+    await expect(captureLeadAction(JOB, null, form(VALID))).resolves.toEqual({ kind: "success" });
+  });
+
+  it.each([
+    ["getLocale", () => mockGetLocale.mockRejectedValue(new Error("x"))],
+    ["accountInviteHref", () => mockInviteHref.mockImplementation(() => { throw new Error("x"); })],
+    ["getTranslations", () => mockGetTranslations.mockRejectedValue(new Error("x"))],
+  ])("a throw from %s after the write is still a success", async (_name, arm) => {
+    invite();
+    arm();
+    await expect(captureLeadAction(JOB, null, form(VALID))).resolves.toEqual({ kind: "success" });
+    expect(mockSubmit).toHaveBeenCalledTimes(1);
+  });
+
+  it("a filled honeypot is exactly { kind: 'success' } and writes nothing", async () => {
+    const result = await captureLeadAction(JOB, null, form({ ...VALID, ailk_hp: "http://x" }));
+    expect(result).toEqual({ kind: "success" });
+    expect(mockSubmit).not.toHaveBeenCalled();
+  });
+});

package/templates/apps/web/app/[locale]/careers/__tests__/job-application-form.test.ts

@@ -0,0 +1,143 @@
+/**
+ * jobApplicationFormFromConfig (#8746 D4, D5; AC-4): the Job application
+ * magnet's field step mapped onto the shared form block, and the built-in
+ * form that stands in for an absent or switched-off magnet.
+ */
+import {
+  jobApplicationFlowConfig,
+  type FlowConfig,
+} from "@working-theory/validation";
+
+import {
+  jobApplicationFormFallback,
+  jobApplicationFormFromConfig,
+} from "../[slug]/job-application-form";
+
+// jsdom has no `structuredClone`; the config is plain JSON.
+const clone = (): FlowConfig =>
+  JSON.parse(JSON.stringify(jobApplicationFlowConfig)) as FlowConfig;
+
+describe("jobApplicationFormFromConfig (#8746 D5, AC-4)", () => {
+  it("maps the seeded config to First, Last, Email, Phone and LinkedIn URL, with the step's title and submit label", () => {
+    const view = jobApplicationFormFromConfig(jobApplicationFlowConfig, "en");
+    expect(view?.title).toBe("Job application");
+    expect(view?.fields).toEqual([
+      {
+        name: "first_name",
+        type: "text",
+        label: "First name",
+        required: true,
+        colSpan: 1,
+      },
+      {
+        name: "last_name",
+        type: "text",
+        label: "Last name",
+        required: true,
+        colSpan: 1,
+      },
+      {
+        name: "email",
+        type: "email",
+        label: "Email",
+        required: true,
+        colSpan: 1,
+      },
+      {
+        name: "phone",
+        type: "tel",
+        label: "Phone",
+        required: false,
+        colSpan: 1,
+      },
+      {
+        name: "linkedin_url",
+        type: "url",
+        label: "LinkedIn URL",
+        required: false,
+        colSpan: 2,
+      },
+    ]);
+    expect(view?.submitLabel).toBe("Submit application");
+  });
+
+  it("keeps an owner's edited label and an added full-width field", () => {
+    const config = clone();
+    const step = config.steps[0] as Extract<
+      FlowConfig["steps"][number],
+      { type: "field" }
+    >;
+    step.fields[4]!.copy = { label: { en: "Portfolio" } };
+    step.fields.push({
+      name: "cover_letter",
+      inputType: "textarea",
+      copy: { label: { en: "Cover letter" } },
+    });
+    const view = jobApplicationFormFromConfig(config, "en");
+    expect(view?.fields.map((f) => [f.name, f.label, f.colSpan])).toEqual([
+      ["first_name", "First name", 1],
+      ["last_name", "Last name", 1],
+      ["email", "Email", 1],
+      ["phone", "Phone", 1],
+      ["linkedin_url", "Portfolio", 2],
+      ["cover_letter", "Cover letter", 2],
+    ]);
+  });
+
+  it.each(["first_name", "last_name", "email"])(
+    "answers null when the step has no %s field",
+    (name) => {
+      const config = clone();
+      const step = config.steps[0] as Extract<
+        FlowConfig["steps"][number],
+        { type: "field" }
+      >;
+      step.fields = step.fields.filter((f) => f.name !== name);
+      expect(jobApplicationFormFromConfig(config, "en")).toBeNull();
+    },
+  );
+
+  it("answers null when the first step is not a field step", () => {
+    const config = clone();
+    (config.steps[0] as { type: string }).type = "segmentation";
+    expect(jobApplicationFormFromConfig(config, "en")).toBeNull();
+  });
+});
+
+describe("a consent field on the magnet (#8746 D5)", () => {
+  it("labels the terms box with the step's first consent field, which is not drawn as a field", () => {
+    const config = clone();
+    const step = config.steps[0] as Extract<
+      FlowConfig["steps"][number],
+      { type: "field" }
+    >;
+    step.fields.push({
+      name: "retention",
+      inputType: "consent",
+      required: true,
+      purposes: ["service_terms"],
+      copy: {
+        label: {
+          en: "I agree my application is kept for 12 months under the [Privacy Policy](privacy).",
+        },
+      },
+    });
+    const view = jobApplicationFormFromConfig(config, "en");
+    expect(view?.consentStatement).toBe(
+      "I agree my application is kept for 12 months under the [Privacy Policy](privacy).",
+    );
+    expect(view?.fields.map((f) => f.name)).not.toContain("retention");
+  });
+
+  it("the seeded config carries none, so the page keeps the catalog's statement", () => {
+    expect(jobApplicationFormFallback("en").consentStatement).toBeUndefined();
+  });
+});
+
+describe("jobApplicationFormFallback (#8746 D5, AC-4)", () => {
+  it("is the seeded config's own form", () => {
+    expect(jobApplicationFormFallback("en")).toEqual(
+      jobApplicationFormFromConfig(jobApplicationFlowConfig, "en"),
+    );
+  });
+});