domma-cms 0.112.1 → 0.114.0

package/plugins/support/tests/api.test.js

@@ -0,0 +1,265 @@
+/**
+ * Both sides at once: SITE apps whose fetch is wired straight into a MANAGER app
+ * via inject, against the real collection service in the domma-cms checkout
+ * `make test` runs in. The collection is made for the test and removed after.
+ * Mail goes to an array, never out.
+ */
+import {test, before, after} from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import Fastify from 'fastify';
+import support from '../plugin.js';
+import {getEntry, updateEntry} from '../../../server/services/collections.js';
+
+const COLL = path.resolve('content/collections/support-tickets');
+const TOKENS = {'tok-acme': 'acme', 'tok-beta': 'beta', 'tok-flood': 'flood'};
+const SITES = {acme: {name: 'Acme Ltd', host: 'acme.example.test', cmsVersion: '0.113.0'}, beta: {name: 'Beta Co', host: 'beta.example.test'}};
+let manager;
+let dataDir;
+let managerUp = true;
+const mails = [];
+const notices = [];
+const siteNotices = [];
+const mail = {send: async (m) => { mails.push(m); return true; }, siteUrl: () => 'https://dcm.example.test'};
+
+let hang = false;
+const fetchInto = (app) => async (url, init = {}) => {
+    if (hang) return new Promise(() => {});     // a manager that never answers
+    if (!managerUp) throw new Error('connect ECONNREFUSED 127.0.0.1:8192');
+    const res = await app.inject({method: init.method || 'GET', url: new URL(url).pathname, headers: init.headers, payload: init.body});
+    return {status: res.statusCode, json: async () => res.json()};
+};
+
+const ANN = {id: 'u1', name: 'Ann', email: 'ann@acme.test'};
+
+async function site({token, user = ANN, settings = {}, env, screenWaitMs} = {}) {
+    const app = Fastify();
+    await app.register(support, {
+        ...(screenWaitMs && {screenWaitMs}),
+        auth: {authenticate: async (req) => { req.user = user; }, requirePermission: () => async () => {}},
+        settings, mode: 'sender', timer: false, dataDir: await fs.mkdtemp(path.join(dataDir, 'site-')),
+        env: env ?? {MANAGER_URL: 'http://127.0.0.1:8192/', FLEET_TOKEN: token, SITE_SLUG: TOKENS[token] || 'x'},
+        fetch: fetchInto(manager),
+        hooks: {notify: (n) => siteNotices.push(n), registerNotificationSource() {}}
+    });
+    return app;
+}
+
+const call = async (app, method, url, body, headers) => {
+    const res = await app.inject({method, url, payload: body, headers});
+    let json = null;
+    try { json = res.json(); } catch { /* not JSON */ }
+    return {status: res.statusCode, body: json};
+};
+
+before(async () => {
+    await fs.rm(COLL, {recursive: true, force: true});
+    dataDir = await fs.mkdtemp(path.join(os.tmpdir(), 'support-test-'));
+    manager = Fastify();
+    await manager.register(support, {
+        auth: {authenticate: async (req) => { req.user = {id: 'v1', name: 'Darryl'}; }, requirePermission: () => async () => {}},
+        prefix: '/api/plugins/support', mode: 'receiver', mail, dataDir: await fs.mkdtemp(path.join(dataDir, 'manager-')),
+        settings: {perSiteMax: 30, perSiteMinutes: 10, phone: '+44 1234 567890', hours: 'Always', notifyEmail: 'support@dommajs.test'},
+        slugFromToken: async (h) => TOKENS[String(h || '').replace(/^Bearer\s+/i, '')] || null,
+        siteDirectory: () => SITES,
+        hooks: {notify: (n) => notices.push(n), registerNotificationSource() {}}
+    });
+});
+
+after(async () => {
+    await manager?.close();
+    await fs.rm(COLL, {recursive: true, force: true});
+    await fs.rm(dataDir, {recursive: true, force: true});
+});
+
+test('a request travels: site -> manager inbox, Domma emailed, urgent shows red', async () => {
+    const acme = await site({token: 'tok-acme'});
+    const sent = await call(acme, 'POST', '/tickets', {subject: 'Checkout broken', body: 'Customers cannot pay.', priority: 'urgent', category: 'problem'});
+    assert.equal(sent.status, 201);
+    assert.equal(sent.body.state, 'sent');
+
+    const inbox = await call(manager, 'GET', '/api/plugins/support/tickets');
+    const t = inbox.body.tickets.find(x => x.ref === sent.body.ref);
+    assert.equal(t.site, 'acme');
+    assert.equal(t.siteName, 'Acme Ltd');
+    assert.equal(t.userEmail, 'ann@acme.test');
+    assert.equal(t.status, 'open');
+    assert.equal(t.cmsVersion, '0.113.0', 'the registry says which engine the site runs');
+
+    const m = mails.find(x => x.to === 'support@dommajs.test' && x.subject.includes('Checkout broken'));
+    assert.match(m.subject, /^\[URGENT\] Support request from Acme Ltd/);
+    assert.equal(m.replyTo, 'ann@acme.test');
+    assert.ok(m.text.includes(`https://dcm.example.test/admin/#/plugins/support/${t.id}`));
+    assert.ok(notices.some(n => n.title.startsWith('URGENT')));
+
+    const count = await call(manager, 'GET', '/api/plugins/support/count');
+    assert.equal(count.body.tone, 'danger');
+    assert.equal(count.body.count, 1);
+});
+
+test('Domma replies: the customer is emailed a link to their own admin, and the site sees it unread', async () => {
+    const acme = await site({token: 'tok-acme'});
+    const {body: s} = await call(acme, 'POST', '/tickets', {subject: 'How do I add a page?', body: 'New here.'});
+    const t = (await call(manager, 'GET', '/api/plugins/support/tickets')).body.tickets.find(x => x.ref === s.ref);
+    mails.length = 0;
+    const r = await call(manager, 'POST', `/api/plugins/support/tickets/${t.id}/reply`, {body: 'Pages > New page.'});
+    assert.equal(r.body.status, 'answered');
+    const toAnn = mails.find(x => x.to === 'ann@acme.test');
+    assert.equal(toAnn.subject, 'Re: How do I add a page?');
+    assert.ok(toAnn.text.includes(`https://acme.example.test/admin/#/plugins/support/${s.ref}`));
+
+    const list = await call(acme, 'GET', '/tickets');
+    const mine = list.body.tickets.find(x => x.ref === s.ref);
+    assert.equal(mine.unread, true);
+    assert.equal(mine.messages.at(-1).body, 'Pages > New page.');
+    assert.ok(siteNotices.some(n => n.link === `#/plugins/support/${s.ref}`));
+    assert.equal((await call(acme, 'GET', '/count')).body.count, 1);
+    // Read it: the badge goes calm.
+    await call(acme, 'PUT', `/tickets/${s.ref}/seen`, {at: mine.messages.at(-1).at});
+    assert.equal((await call(acme, 'GET', '/count')).body.inventory, true);
+
+    // The customer writes again: open, and Domma hears.
+    mails.length = 0;
+    const again = await call(acme, 'POST', `/tickets/${s.ref}/messages`, {body: 'Thanks! And menus?'});
+    assert.equal(again.body.state, 'sent');
+    assert.equal((await call(manager, 'GET', `/api/plugins/support/tickets/${t.id}`)).body.status, 'open');
+    assert.ok(mails.some(x => x.to === 'support@dommajs.test' && x.subject.startsWith('Reply from Acme Ltd')));
+
+    // They resolve it themselves.
+    await call(acme, 'POST', `/tickets/${s.ref}/close`);
+    assert.equal((await call(manager, 'GET', `/api/plugins/support/tickets/${t.id}`)).body.status, 'closed');
+});
+
+test('a site never sees another site\'s requests, nor internal notes', async () => {
+    const acme = await site({token: 'tok-acme'});
+    const beta = await site({token: 'tok-beta', user: {id: 'b1', name: 'Bob', email: 'bob@beta.test'}});
+    const {body: s} = await call(beta, 'POST', '/tickets', {subject: 'Beta only', body: 'private'});
+    const t = (await call(manager, 'GET', '/api/plugins/support/tickets')).body.tickets.find(x => x.ref === s.ref);
+    await call(manager, 'PUT', `/api/plugins/support/tickets/${t.id}`, {notes: 'secret note'});
+    assert.ok(!(await call(acme, 'GET', '/tickets')).body.tickets.some(x => x.ref === s.ref));
+    const mine = (await call(beta, 'GET', '/tickets')).body.tickets.find(x => x.ref === s.ref);
+    assert.equal(mine.notes, undefined);
+    // Acme cannot write into Beta's request by guessing its ref.
+    const bad = await call(manager, 'POST', '/api/plugins/support/fleet/messages', {ticketRef: s.ref, ref: 'x', body: 'hijack'},
+        {authorization: 'Bearer tok-acme'});
+    assert.equal(bad.status, 404);
+    assert.equal((await call(manager, 'POST', '/api/plugins/support/fleet/tickets', {}, {authorization: 'Bearer nope'})).status, 401);
+});
+
+test('while the manager restarts, a request waits on the site and goes later - once', async () => {
+    const acme = await site({token: 'tok-acme'});
+    managerUp = false;
+    const s = await call(acme, 'POST', '/tickets', {subject: 'Sent while down', body: 'hello'});
+    assert.equal(s.body.state, 'waiting');
+    const follow = await call(acme, 'POST', `/tickets/${s.body.ref}/messages`, {body: 'and more'});
+    assert.equal(follow.body.state, 'waiting');
+    const offline = await call(acme, 'GET', '/tickets');
+    assert.equal(offline.body.tickets.find(x => x.ref === s.body.ref).statusLabel, 'Waiting to send');
+    managerUp = true;
+    const list = await call(acme, 'GET', '/tickets');
+    const t = list.body.tickets.find(x => x.ref === s.body.ref);
+    assert.equal(t.status, 'open');
+    assert.deepEqual(t.messages.map(m => m.body), ['hello', 'and more'], 'the follow-up went after its request');
+    await call(acme, 'GET', '/tickets');
+    const all = (await call(manager, 'GET', '/api/plugins/support/tickets')).body.tickets.filter(x => x.ref === s.body.ref);
+    assert.equal(all.length, 1);
+    assert.equal(all[0].messages.length, 2);
+});
+
+test('the contact card: the manager\'s reaches every site; a standalone site still has one', async () => {
+    const acme = await site({token: 'tok-acme', settings: {hours: 'site default'}});
+    assert.equal((await call(acme, 'GET', '/mode')).body.contact.hours, 'site default', 'before the first sync');
+    await call(acme, 'GET', '/tickets');
+    const card = (await call(acme, 'GET', '/mode')).body.contact;
+    assert.equal(card.hours, 'Always');
+    assert.equal(card.phone, '+44 1234 567890');
+
+    const alone = await site({env: {}});
+    const mode = (await call(alone, 'GET', '/mode')).body;
+    assert.equal(mode.connected, false);
+    assert.equal(mode.contact.email, 'support@dommajs.org');
+    assert.equal((await call(alone, 'POST', '/tickets', {subject: 's', body: 'b'})).status, 409);
+});
+
+test('one site cannot flood the inbox', async () => {
+    const flood = await site({token: 'tok-flood'});
+    const codes = [];
+    for (let i = 0; i < 32; i++) {
+        const r = await call(manager, 'POST', '/api/plugins/support/fleet/tickets', {ref: `f${i}`, subject: 's', body: 'b'},
+            {authorization: 'Bearer tok-flood'});
+        codes.push(r.status);
+    }
+    assert.deepEqual(codes.filter(c => c === 429).length, 2);
+    void flood;
+});
+
+
+// ---- Review findings -------------------------------------------------------------
+
+test('review: two syncs at once send a waiting request once', async () => {
+    const acme = await site({token: 'tok-acme'});
+    managerUp = false;
+    const s = (await call(acme, 'POST', '/tickets', {subject: 'Race me', body: 'once'})).body;
+    managerUp = true;
+    await Promise.all([call(acme, 'GET', '/tickets'), call(acme, 'GET', '/tickets'), call(acme, 'GET', '/count')]);
+    const all = (await call(manager, 'GET', '/api/plugins/support/tickets')).body.tickets.filter(x => x.ref === s.ref);
+    assert.equal(all.length, 1);
+});
+
+test('review: a customer message lost on the manager is sent again', async () => {
+    const acme = await site({token: 'tok-acme'});
+    const s = (await call(acme, 'POST', '/tickets', {subject: 'Lost one', body: 'first'})).body;
+    await call(acme, 'POST', `/tickets/${s.ref}/messages`, {body: 'second'});
+    const t = (await call(manager, 'GET', '/api/plugins/support/tickets')).body.tickets.find(x => x.ref === s.ref);
+    // Simulate a concurrent write that dropped it.
+    const e = await getEntry('support-tickets', t.id);
+    await updateEntry('support-tickets', t.id, {...e.data, messages: e.data.messages.slice(0, 1)});
+    await call(acme, 'GET', '/tickets');          // notices it is missing, marks it waiting
+    await call(acme, 'GET', '/tickets');          // sends it again
+    const after = (await call(manager, 'GET', `/api/plugins/support/tickets/${t.id}`)).body;
+    assert.deepEqual(after.messages.map(m => m.body), ['first', 'second']);
+});
+
+test('review: concurrent turns on one request are all kept', async () => {
+    const acme = await site({token: 'tok-acme'});
+    const s = (await call(acme, 'POST', '/tickets', {subject: 'Busy', body: 'open'})).body;
+    const t = (await call(manager, 'GET', '/api/plugins/support/tickets')).body.tickets.find(x => x.ref === s.ref);
+    await Promise.all([
+        call(manager, 'POST', `/api/plugins/support/tickets/${t.id}/reply`, {body: 'from Domma'}),
+        call(manager, 'POST', '/api/plugins/support/fleet/messages', {ticketRef: s.ref, ref: 'c-x', body: 'from Ann'}, {authorization: 'Bearer tok-acme'}),
+        call(manager, 'PUT', `/api/plugins/support/tickets/${t.id}`, {notes: 'n'})
+    ]);
+    const after = (await call(manager, 'GET', `/api/plugins/support/tickets/${t.id}`)).body;
+    assert.deepEqual(after.messages.map(m => m.body).sort(), ['from Ann', 'from Domma', 'open']);
+    assert.equal(after.notes, 'n');
+});
+
+test('review: control characters are stripped, so nothing is too big to ever send', async () => {
+    const acme = await site({token: 'tok-acme'});
+    const r = await call(acme, 'POST', '/tickets', {subject: 'ctl', body: 'ok' + '\u0001'.repeat(8000)});
+    assert.equal(r.body.state, 'sent');
+});
+
+test('review: a deleted request does not come back on a retry', async () => {
+    const payload = {ref: 'zombie-1', subject: 'Zombie', body: 'b'};
+    const first = await call(manager, 'POST', '/api/plugins/support/fleet/tickets', payload, {authorization: 'Bearer tok-beta'});
+    await call(manager, 'DELETE', `/api/plugins/support/tickets/${first.body.id}`);
+    const retry = await call(manager, 'POST', '/api/plugins/support/fleet/tickets', payload, {authorization: 'Bearer tok-beta'});
+    assert.equal(retry.status, 404);
+});
+
+test('review: a manager that never answers does not hang the screen', async () => {
+    const acme = await site({token: 'tok-acme', screenWaitMs: 300});
+    hang = true;
+    try {
+        const t0 = Date.now();
+        const r = await call(acme, 'GET', '/tickets');
+        assert.ok(Date.now() - t0 < 2000);
+        assert.equal(r.body.reachable, false);
+        const s = await call(acme, 'POST', '/tickets', {subject: 'slow', body: 'b'});
+        assert.equal(s.status, 201);
+        assert.equal(s.body.state, 'waiting');
+    } finally { hang = false; }
+});

package/plugins/support/tests/shape.test.js

@@ -0,0 +1,122 @@
+/** Support - the pure half (lib/shape.js) and the site's merge (lib/sender.js mergeTickets). */
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import {
+    addTurn, buildMessagePayload, buildTicketPayload, cleanRequest, cleanUpdate, contactCard, createThrottle, lastDommaAt,
+    receivedTicket, senderView, telHref, toCustomerEmail, toDommaEmail
+} from '../lib/shape.js';
+import {mergeTickets} from '../lib/sender.js';
+
+const T0 = '2026-10-04T10:00:00.000Z';
+const T1 = '2026-10-04T11:00:00.000Z';
+const T2 = '2026-10-04T12:00:00.000Z';
+
+test('a request needs a subject and a message; unknown choices fall back', () => {
+    assert.equal(cleanRequest({body: 'x'}).error, 'Give it a short subject.');
+    assert.equal(cleanRequest({subject: 'x'}).error, 'Tell us what you need.');
+    const {request} = cleanRequest({subject: '  Site\n down ', body: ' help\r\nplease ', category: 'nope', priority: 'panic', where: '/shop'});
+    assert.deepEqual(request, {category: 'help', priority: 'normal', subject: 'Site down', body: 'help\nplease', where: '/shop'});
+    assert.equal(cleanRequest({subject: 's', body: 'b', priority: 'urgent'}).request.priority, 'urgent');
+});
+
+test('who sent it comes from the session user, never from the form', () => {
+    const {request} = cleanRequest({subject: 's', body: 'b', user: {name: 'Mallory'}});
+    const p = buildTicketPayload({request, user: {id: 'u1', name: 'Ann', email: 'ann@x.test', password: 'no'}, ref: 'r1', site: 'acme'});
+    assert.deepEqual(p.user, {id: 'u1', name: 'Ann', email: 'ann@x.test'});
+    assert.equal(buildMessagePayload({ticketRef: 'r1', ref: 'm1', body: 'hi', user: {name: 'Ann'}}).user.name, 'Ann');
+});
+
+test('the manager files a request under the token\'s site, with the opening message as the first turn', () => {
+    const {data} = receivedTicket({ref: 'r1', subject: 's', body: 'b', site: 'evil', user: {name: 'Ann', email: 'not-an-email'}}, 'acme', T0);
+    assert.equal(data.site, 'acme');
+    assert.equal(data.status, 'open');
+    assert.equal(data.userEmail, '', 'a malformed email is never mailed');
+    assert.deepEqual(data.messages, [{id: 'r1', from: 'customer', name: 'Ann', body: 'b', at: T0}]);
+});
+
+test('turns move the status to whoever has to act next', () => {
+    let {data} = receivedTicket({ref: 'r1', subject: 's', body: 'b', user: {name: 'Ann'}}, 'acme', T0);
+    ({data} = addTurn(data, {from: 'domma', name: 'Darryl', body: 'Try this', id: 'd1', at: T1}));
+    assert.equal(data.status, 'answered');
+    assert.equal(lastDommaAt(data), T1);
+    ({data} = addTurn(data, {from: 'customer', name: 'Ann', body: 'Still broken', id: 'c2', at: T2}));
+    assert.equal(data.status, 'open');
+    ({data} = addTurn(data, {from: 'domma', name: 'Darryl', body: 'Fixed', id: 'd2', at: T2, status: 'closed'}));
+    assert.equal(data.status, 'closed');
+    ({data} = addTurn(data, {from: 'customer', name: 'Ann', body: 'Back again', id: 'c3', at: T2}));
+    assert.equal(data.status, 'open', 'writing reopens');
+    assert.equal(data.history.at(-1).what, 'Reopened');
+    ({data} = addTurn(data, {from: 'customer', name: 'Ann', id: 'c4', at: T2, close: true}));
+    assert.equal(data.status, 'closed');
+    assert.equal(data.messages.length, 5, 'closing adds no message');
+});
+
+test('a turn delivered twice is added once', () => {
+    let {data} = receivedTicket({ref: 'r1', subject: 's', body: 'b'}, 'acme', T0);
+    ({data} = addTurn(data, {from: 'customer', name: 'Ann', body: 'again', id: 'c2', at: T1}));
+    const again = addTurn(data, {from: 'customer', name: 'Ann', body: 'again', id: 'c2', at: T1});
+    assert.equal(again.added, false);
+    assert.equal(again.data.messages.length, 2);
+});
+
+test('a site sees its conversation, never notes or history', () => {
+    const {data} = receivedTicket({ref: 'r1', subject: 's', body: 'b'}, 'acme', T0);
+    const v = senderView({id: 'e1', data: {...data, notes: 'awkward customer'}, meta: {createdAt: T0}});
+    assert.equal(v.notes, undefined);
+    assert.equal(v.history, undefined);
+    assert.equal(v.statusLabel, 'Waiting on Domma');
+});
+
+test('inbox updates are checked', () => {
+    assert.equal(cleanUpdate({}).error, 'Nothing to change.');
+    assert.equal(cleanUpdate({status: 'gone'}).error, 'That is not a status.');
+    assert.deepEqual(cleanUpdate({status: 'closed', notes: ' n ', priority: 'urgent'}).patch, {status: 'closed', notes: 'n', priority: 'urgent'});
+});
+
+test('the contact card lets through only what is well-formed', () => {
+    assert.deepEqual(contactCard({email: 'support@dommajs.org', phone: '+44 (0)1234 567890', hours: 'Mon\nFri', responseTime: 'Soon'}),
+        {email: 'support@dommajs.org', phone: '+44 (0)1234 567890', hours: 'Mon Fri', responseTime: 'Soon'});
+    assert.deepEqual(contactCard({email: 'javascript:alert(1)', phone: 'call me'}), {email: '', phone: '', hours: '', responseTime: ''});
+    assert.equal(telHref('+44 (0)1234 567890'), 'tel:+4401234567890');
+});
+
+test('emails are escaped, flag urgency, and reply to the customer', () => {
+    const {data} = receivedTicket({ref: 'r1', subject: '<b>Down</b>', body: '<script>x</script>', priority: 'urgent',
+        user: {name: 'Ann', email: 'ann@x.test'}}, 'acme', T0);
+    const e = toDommaEmail({ticket: data, siteName: 'Acme', link: 'https://dcm/admin/#/plugins/support/e1', body: data.messages[0].body, isNew: true});
+    assert.match(e.subject, /^\[URGENT\] Support request from Acme: <b>Down<\/b>$/);
+    assert.equal(e.replyTo, 'ann@x.test');
+    assert.ok(!e.html.includes('<script>'));
+    assert.ok(e.html.includes('&lt;script&gt;'));
+    const c = toCustomerEmail({ticket: data, siteName: 'Acme', link: 'https://acme/admin/#/plugins/support/r1', body: 'Fixed', resolved: true});
+    assert.equal(c.subject, 'Re: <b>Down</b>');
+    assert.match(c.text, /marked it as resolved/);
+});
+
+test('the throttle allows max per window, per key', () => {
+    const ok = createThrottle({max: 2, windowMs: 1000});
+    assert.deepEqual([ok('a', 0), ok('a', 1), ok('a', 2), ok('b', 2), ok('a', 1001)], [true, true, false, true, true]);
+});
+
+test('the site\'s list: the manager\'s view, plus what is still waiting here', () => {
+    const remote = [{ref: 'r1', subject: 'One', status: 'answered', lastAt: T1,
+        messages: [{id: 'r1', from: 'customer', body: 'b', at: T0}, {id: 'd1', from: 'domma', body: 'Try', at: T1}]}];
+    const items = [
+        {kind: 'ticket', ref: 'r2', state: 'waiting', createdAt: T2, payload: {subject: 'Two', body: 'b2', user: {name: 'Ann'}}},
+        {kind: 'message', ref: 'm1', ticketRef: 'r1', state: 'waiting', createdAt: T2, payload: {body: 'thanks', user: {name: 'Ann'}}},
+        {kind: 'message', ref: 'm0', ticketRef: 'r1', state: 'waiting', createdAt: T2, payload: {body: '', close: true}}
+    ];
+    const list = mergeTickets(items, remote, {});
+    assert.deepEqual(list.map(t => t.ref), ['r2', 'r1']);
+    assert.equal(list[0].statusLabel, 'Waiting to send');
+    const r1 = list[1];
+    assert.equal(r1.unread, true);
+    assert.equal(r1.messages.at(-1).body, 'thanks');
+    assert.equal(r1.messages.at(-1).pending, true);
+    assert.equal(r1.messages.length, 3, 'a waiting close adds no message');
+    assert.equal(mergeTickets(items, remote, {r1: T1})[1].unread, false);
+    // Offline: the cached list stands in.
+    const offline = mergeTickets([], null, {}, [{ref: 'r1', subject: 'One', status: 'answered', dommaAt: T1}]);
+    assert.equal(offline[0].stale, true);
+    assert.equal(offline[0].unread, true);
+});