create-ailk 0.21.0 → 0.23.0

package/templates/apps/web/lib/__tests__/newsletter.actions.test.ts

@@ -0,0 +1,293 @@
+/**
+ * subscribeNewsletterAction (#6730 D9) — the Server Action twin of the
+ * `ailkSubscribeNewsletter` MCP tool.
+ */
+
+import { subscribeNewsletterAction } from "../newsletter.actions.js";
+
+// `visitorForwardHeaders` stays real (#7394) so AC-9 compares the action's
+// `init` with the helper's own output.
+// `flows.get` answers 404 by default — a Free build with no flow route — so
+// the #6730 cases below take `leads.subscribe`; the #8847 cases serve the
+// newsletter magnet.
+jest.mock("@working-theory/api-client", () => ({
+  flows: {
+    get: jest.fn().mockResolvedValue({ ok: false, status: 404, body: {} }),
+    submitStep: jest.fn(),
+  },
+  leads: { subscribe: jest.fn() },
+  visitorForwardHeaders: jest.requireActual("@working-theory/api-client")
+    .visitorForwardHeaders,
+}));
+
+// next/headers' `headers()` is request-scoped in Next; outside it, it is
+// mocked here the way flow.actions.test.ts does (#7394 AC-9).
+jest.mock("next/headers", () => ({
+  __esModule: true,
+  headers: jest.fn().mockResolvedValue({ get: () => null }),
+}));
+
+jest.mock("next-intl/server", () => ({
+  __esModule: true,
+  getLocale: jest.fn().mockResolvedValue("en"),
+}));
+
+import { flows, leads, visitorForwardHeaders } from "@working-theory/api-client";
+import { newsletterFlowConfig } from "@working-theory/validation";
+import { headers } from "next/headers";
+const mockSubscribe = leads.subscribe as jest.Mock;
+const mockFlowsGet = flows.get as jest.Mock;
+const mockSubmitStep = flows.submitStep as jest.Mock;
+
+// The action's magnet read is shared for a few seconds per module instance;
+// each test starts an hour later so none sees another's read.
+let clock = 1_900_000_000_000;
+jest.spyOn(Date, "now").mockImplementation(() => clock);
+beforeEach(() => {
+  clock += 60 * 60 * 1000;
+});
+const mockHeaders = headers as jest.Mock;
+
+function formWith(email: string): FormData {
+  const fd = new FormData();
+  fd.append("email", email);
+  fd.append("consent", "true");
+  return fd;
+}
+
+afterEach(() => {
+  jest.clearAllMocks();
+  mockHeaders.mockResolvedValue({ get: () => null });
+});
+
+describe("subscribeNewsletterAction", () => {
+  it("calls leads.subscribe with source newsletter and the address", async () => {
+    mockSubscribe.mockResolvedValueOnce({ ok: true, body: { id: "subscr_1", persisted: "db" } });
+
+    const result = await subscribeNewsletterAction(null, formWith("ada@example.com"));
+
+    expect(result).toEqual({ kind: "success" });
+    expect(mockSubscribe).toHaveBeenCalledWith(
+      expect.objectContaining({ source: "newsletter", email: "ada@example.com" }),
+    );
+  });
+
+  it("an invalid address → a field error, no API call", async () => {
+    const result = await subscribeNewsletterAction(null, formWith("not-an-email"));
+
+    expect(result).toMatchObject({ kind: "error", fieldErrors: { email: expect.any(String) } });
+    expect(mockSubscribe).not.toHaveBeenCalled();
+  });
+
+  it("503 lead_capture_not_configured → unavailable", async () => {
+    mockSubscribe.mockResolvedValueOnce({
+      ok: false,
+      status: 503,
+      body: { error: "lead_capture_not_configured" },
+    });
+
+    const result = await subscribeNewsletterAction(null, formWith("ada@example.com"));
+
+    expect(result).toEqual({ kind: "unavailable" });
+  });
+
+  it("any other failure → the generic error, never success", async () => {
+    mockSubscribe.mockResolvedValueOnce({ ok: false, status: 503, body: { error: "persist_failed" } });
+    expect(await subscribeNewsletterAction(null, formWith("a@b.co"))).toMatchObject({
+      kind: "error",
+    });
+
+    mockSubscribe.mockRejectedValueOnce(new Error("ECONNREFUSED"));
+    jest.spyOn(console, "error").mockImplementationOnce(() => undefined);
+    expect(await subscribeNewsletterAction(null, formWith("a@b.co"))).toMatchObject({
+      kind: "error",
+    });
+  });
+
+  it("a filled honeypot → success, and nothing is sent", async () => {
+    const fd = formWith("ada@example.com");
+    fd.append("ailk_hp", "spam");
+
+    expect(await subscribeNewsletterAction(null, fd)).toEqual({ kind: "success" });
+    expect(mockSubscribe).not.toHaveBeenCalled();
+  });
+});
+
+// #7394 AC-9 — a spoke forwards its visitor to the hub's leads rate limit.
+describe("subscribeNewsletterAction — visitor forwarding (#7394)", () => {
+  const FORWARD_KEY = "0123456789abcdef".repeat(4); // gitleaks:allow — test fixture, not a credential (#7394)
+  const ENV_KEYS = ["AILK_VISITOR_FORWARD_KEY", "AILK_API_URL"] as const;
+  const priorEnv = new Map(ENV_KEYS.map((name) => [name, process.env[name]]));
+
+  beforeEach(() => {
+    process.env.AILK_VISITOR_FORWARD_KEY = FORWARD_KEY;
+    process.env.AILK_API_URL = "https://hub.example";
+  });
+
+  afterAll(() => {
+    for (const [name, value] of priorEnv) {
+      if (value === undefined) delete process.env[name];
+      else process.env[name] = value;
+    }
+  });
+
+  it("passes the helper's two headers as init", async () => {
+    const incoming = {
+      get: (name: string) => (name === "x-forwarded-for" ? "203.0.113.5" : null),
+    };
+    mockHeaders.mockResolvedValue(incoming);
+    mockSubscribe.mockResolvedValueOnce({ ok: true, body: { id: "subscr_1", persisted: "db" } });
+
+    const result = await subscribeNewsletterAction(null, formWith("ada@example.com"));
+
+    expect(result).toEqual({ kind: "success" });
+    const expected = visitorForwardHeaders(incoming, FORWARD_KEY);
+    expect(expected).toEqual({
+      "x-ailk-visitor-ip": "203.0.113.5",
+      "x-ailk-visitor-forward-key": FORWARD_KEY,
+    });
+    expect(mockSubscribe).toHaveBeenCalledWith(expect.any(Object), { headers: expected });
+  });
+
+  it("calls leads.subscribe with one argument when headers() throws, and still succeeds", async () => {
+    mockHeaders.mockRejectedValue(new Error("outside a request scope"));
+    mockSubscribe.mockResolvedValueOnce({ ok: true, body: { id: "subscr_1", persisted: "db" } });
+
+    const result = await subscribeNewsletterAction(null, formWith("ada@example.com"));
+
+    expect(result).toEqual({ kind: "success" });
+    expect(mockSubscribe).toHaveBeenCalledTimes(1);
+    expect(mockSubscribe.mock.calls[0]).toHaveLength(1);
+  });
+});
+
+describe("subscribeNewsletterAction — through the newsletter magnet (#8847 D11, AC-6)", () => {
+  function servedMagnet(): void {
+    const { completionEmail: _omitted, ...body } = newsletterFlowConfig;
+    mockFlowsGet.mockResolvedValue({ ok: true, status: 200, body });
+  }
+  afterEach(() => {
+    mockFlowsGet.mockResolvedValue({ ok: false, status: 404, body: {} });
+  });
+
+  it("a ticked post submits the magnet's step once, with the consent purpose, and never leads.subscribe", async () => {
+    servedMagnet();
+    mockSubmitStep.mockResolvedValueOnce({
+      ok: true,
+      status: 200,
+      body: { sessionId: "s1", nextStepKey: null, completed: true },
+    });
+
+    const result = await subscribeNewsletterAction(null, formWith("a@b.co"));
+
+    expect(result).toEqual({ kind: "success" });
+    expect(mockSubmitStep).toHaveBeenCalledTimes(1);
+    expect(mockSubmitStep).toHaveBeenCalledWith("newsletter", {
+      stepKey: "subscribe",
+      values: { email: "a@b.co", "terms.newsletter": true },
+      locale: "en",
+    });
+    expect(mockSubscribe).not.toHaveBeenCalled();
+  });
+
+  it("a post without consent → fieldErrors.consent, and no API call", async () => {
+    servedMagnet();
+    const fd = new FormData();
+    fd.append("email", "a@b.co");
+
+    const result = await subscribeNewsletterAction(null, fd);
+
+    expect(result).toEqual({
+      kind: "error",
+      fieldErrors: { consent: "Please accept the terms to subscribe." },
+    });
+    expect(mockSubmitStep).not.toHaveBeenCalled();
+    expect(mockSubscribe).not.toHaveBeenCalled();
+  });
+
+  it.each([
+    ["a 503 lead_capture_not_configured", { ok: false, status: 503, body: { error: "lead_capture_not_configured" } }],
+    ["an unreachable hub (status 0)", { ok: false, status: 0, body: null }],
+    ["a 502", { ok: false, status: 502, body: null }],
+  ])("%s → unavailable", async (_label, answer) => {
+    servedMagnet();
+    mockSubmitStep.mockResolvedValueOnce(answer);
+
+    expect(await subscribeNewsletterAction(null, formWith("a@b.co"))).toEqual({ kind: "unavailable" });
+  });
+
+  it("any other refusal → the generic error", async () => {
+    servedMagnet();
+    mockSubmitStep.mockResolvedValueOnce({ ok: false, status: 400, body: { error: "invalid" } });
+
+    expect(await subscribeNewsletterAction(null, formWith("a@b.co"))).toMatchObject({ kind: "error" });
+  });
+
+  it("a wizard-built newsletter with no consent field submits without one (review H1)", async () => {
+    const { completionEmail: _omitted, ...body } = newsletterFlowConfig;
+    const step = body.steps[0] as { fields: Array<{ name: string }> };
+    mockFlowsGet.mockResolvedValue({
+      ok: true,
+      status: 200,
+      body: { ...body, steps: [{ ...step, fields: step.fields.filter((f) => f.name === "email") }] },
+    });
+    mockSubmitStep.mockResolvedValueOnce({
+      ok: true,
+      status: 200,
+      body: { sessionId: "s1", nextStepKey: null, completed: true },
+    });
+    const fd = new FormData();
+    fd.append("email", "a@b.co");
+
+    expect(await subscribeNewsletterAction(null, fd)).toEqual({ kind: "success" });
+    expect(mockSubmitStep).toHaveBeenCalledWith("newsletter", {
+      stepKey: "subscribe",
+      values: { email: "a@b.co" },
+      locale: "en",
+    });
+  });
+
+  it("with no magnet, a post without consent is refused and nothing is sent", async () => {
+    const fd = new FormData();
+    fd.append("email", "a@b.co");
+
+    expect(await subscribeNewsletterAction(null, fd)).toMatchObject({
+      kind: "error",
+      fieldErrors: { consent: expect.any(String) },
+    });
+    expect(mockSubscribe).not.toHaveBeenCalled();
+  });
+
+  it("forwards the visitor's address to the step route, and refuses a visitor's 31st post in ten minutes (security review)", async () => {
+    servedMagnet();
+    mockHeaders.mockResolvedValue({
+      get: (name: string) => (name === "x-forwarded-for" ? "203.0.113.9" : null),
+    });
+    mockSubmitStep.mockResolvedValue({
+      ok: true,
+      status: 200,
+      body: { sessionId: "s1", nextStepKey: null, completed: true },
+    });
+
+    for (let i = 0; i < 30; i += 1) {
+      expect(await subscribeNewsletterAction(null, formWith(`a${i}@b.co`))).toEqual({ kind: "success" });
+    }
+    expect(mockSubmitStep.mock.calls[0]![2]).toEqual({
+      headers: expect.objectContaining({ "x-forwarded-for": "203.0.113.9" }),
+    });
+
+    expect(await subscribeNewsletterAction(null, formWith("late@b.co"))).toMatchObject({
+      kind: "error",
+      message: expect.any(String),
+    });
+    expect(mockSubmitStep).toHaveBeenCalledTimes(30);
+  });
+
+  it("with flows.get 404 (a Free build) the same post calls leads.subscribe and not submitStep", async () => {
+    mockSubscribe.mockResolvedValueOnce({ ok: true, body: { id: "subscr_1", persisted: "db" } });
+
+    expect(await subscribeNewsletterAction(null, formWith("a@b.co"))).toEqual({ kind: "success" });
+    expect(mockSubscribe).toHaveBeenCalledTimes(1);
+    expect(mockSubmitStep).not.toHaveBeenCalled();
+  });
+});