evaldoc 1.0.0

package/tests/integration/api-provider-settings.test.js

@@ -0,0 +1,475 @@
+process.env.NODE_ENV = 'test';
+
+jest.mock('firebase-admin', () => require('../mocks/firebase-admin'));
+jest.mock('stripe', () => jest.fn().mockReturnValue({}));
+jest.mock('openai', () => jest.fn().mockImplementation(() => ({
+  chat: { completions: { create: jest.fn().mockResolvedValue({ choices: [{ message: { content: 'mock' } }] }) } }
+})));
+jest.mock('@google/generative-ai', () => ({
+  GoogleGenerativeAI: jest.fn().mockImplementation(() => ({
+    getGenerativeModel: () => ({
+      generateContent: jest.fn().mockResolvedValue({ response: { text: () => 'mock' } })
+    })
+  }))
+}));
+jest.mock('../../functions/src/stripe-config', () => ({ stripe: {} }));
+jest.mock('../../functions/src/payment', () => ({
+  createConnectAccount: jest.fn(),
+  createAccountLink: jest.fn(),
+  refreshAccountStatus: jest.fn(),
+  setProviderPricing: jest.fn(),
+  createCheckoutSession: jest.fn(),
+  createPaymentIntent: jest.fn(),
+  createSubscription: jest.fn(),
+  cancelSubscription: jest.fn(),
+  checkPaymentAccess: jest.fn(),
+  getRevenueAnalytics: jest.fn(),
+  handleStripeWebhook: jest.fn()
+}));
+
+process.env.DEEPSEEK_API_KEY = 'test-key';
+process.env.GEMINI_API_KEY = 'test-key';
+
+const request = require('supertest');
+const admin = require('firebase-admin');
+
+admin.auth().verifyIdToken = jest.fn(async (token) => {
+  if (token === 'valid-doctor-token') return { uid: 'doctor-uid-1', email: 'doc@test.com' };
+  throw new Error('Invalid token');
+});
+
+const app = require('../../server');
+
+describe('Provider Settings API', () => {
+  beforeEach(() => {
+    admin.__reset();
+    admin.__seed('providers', 'doctor-uid-1', {
+      ownerUid: 'doctor-uid-1',
+      handle: 'drsmith',
+      displayName: 'Dr. Smith',
+      specialty: 'General',
+      status: 'published',
+      enabledTopics: ['general_health_info'],
+      plan: 'free',
+      monthlyChatLimit: 50,
+      monthlyChatCount: 5,
+      contactInfo: null,
+      businessHours: null
+    });
+  });
+
+  describe('POST /api/provider/update', () => {
+    it('should update contact info', async () => {
+      const res = await request(app)
+        .post('/api/provider/update')
+        .set('Authorization', 'Bearer valid-doctor-token')
+        .send({
+          contactInfo: {
+            phone: '+1 555-0100',
+            email: 'clinic@example.com',
+            address: '123 Main St'
+          }
+        });
+
+      expect(res.status).toBe(200);
+    });
+
+    it('should update business hours', async () => {
+      const res = await request(app)
+        .post('/api/provider/update')
+        .set('Authorization', 'Bearer valid-doctor-token')
+        .send({
+          businessHours: {
+            open: '09:00',
+            close: '17:00',
+            summary: 'Mon-Fri 9am-5pm'
+          }
+        });
+
+      expect(res.status).toBe(200);
+    });
+
+    it('should update welcome message and status', async () => {
+      const res = await request(app)
+        .post('/api/provider/update')
+        .set('Authorization', 'Bearer valid-doctor-token')
+        .send({
+          welcomeMessage: 'Welcome to our practice!',
+          status: 'draft'
+        });
+
+      expect(res.status).toBe(200);
+    });
+
+    it('should reject unauthenticated requests', async () => {
+      const res = await request(app)
+        .post('/api/provider/update')
+        .send({ status: 'published' });
+
+      expect(res.status).toBe(401);
+    });
+
+    it('should block publishing without verification', async () => {
+      const res = await request(app)
+        .post('/api/provider/update')
+        .set('Authorization', 'Bearer valid-doctor-token')
+        .send({ status: 'published' });
+
+      expect(res.status).toBe(403);
+      expect(res.body.code).toBe('VERIFICATION_REQUIRED');
+    });
+
+    it('should strip HTML from displayName and welcomeMessage', async () => {
+      const res = await request(app)
+        .post('/api/provider/update')
+        .set('Authorization', 'Bearer valid-doctor-token')
+        .send({
+          displayName: '<script>alert("xss")</script>Dr. Evil',
+          welcomeMessage: '<img onerror=alert(1)>Welcome'
+        });
+
+      expect(res.status).toBe(200);
+    });
+
+    it('should silently ignore invalid hex color', async () => {
+      const res = await request(app)
+        .post('/api/provider/update')
+        .set('Authorization', 'Bearer valid-doctor-token')
+        .send({
+          brandPrimaryColor: 'not-a-color',
+          displayName: 'Dr. Smith'
+        });
+
+      expect(res.status).toBe(200);
+    });
+
+    it('should sanitize contactInfo email format', async () => {
+      const res = await request(app)
+        .post('/api/provider/update')
+        .set('Authorization', 'Bearer valid-doctor-token')
+        .send({
+          contactInfo: {
+            phone: '+1 555-0100',
+            email: 'not-valid-email',
+            address: '123 Main St'
+          }
+        });
+
+      expect(res.status).toBe(200);
+    });
+
+    it('should allow publishing when verified', async () => {
+      admin.__seed('providers', 'doctor-uid-1', {
+        ownerUid: 'doctor-uid-1',
+        handle: 'drsmith',
+        displayName: 'Dr. Smith',
+        specialty: 'General',
+        status: 'draft',
+        enabledTopics: ['general_health_info'],
+        plan: 'free',
+        monthlyChatLimit: 50,
+        monthlyChatCount: 5,
+        verificationStatus: 'verified',
+        contactInfo: null,
+        businessHours: null
+      });
+
+      const res = await request(app)
+        .post('/api/provider/update')
+        .set('Authorization', 'Bearer valid-doctor-token')
+        .send({ status: 'published' });
+
+      expect(res.status).toBe(200);
+    });
+  });
+
+  describe('GET /api/analytics', () => {
+    it('should return plan and usage data', async () => {
+      const res = await request(app)
+        .get('/api/analytics')
+        .set('Authorization', 'Bearer valid-doctor-token');
+
+      expect(res.status).toBe(200);
+      expect(res.body.provider).toBeDefined();
+      expect(res.body.provider.plan).toBe('free');
+      expect(res.body.provider.monthlyChatLimit).toBe(50);
+      expect(res.body.provider.monthlyChatCount).toBe(5);
+    });
+
+    it('should return satisfaction data', async () => {
+      const res = await request(app)
+        .get('/api/analytics')
+        .set('Authorization', 'Bearer valid-doctor-token');
+
+      expect(res.status).toBe(200);
+      expect(res.body.satisfaction).toBeDefined();
+      expect(res.body.satisfaction).toHaveProperty('average');
+      expect(res.body.satisfaction).toHaveProperty('count');
+    });
+
+    it('should return topTopics and topQuestions', async () => {
+      const res = await request(app)
+        .get('/api/analytics')
+        .set('Authorization', 'Bearer valid-doctor-token');
+
+      expect(res.status).toBe(200);
+      expect(res.body.topTopics).toBeDefined();
+      expect(Array.isArray(res.body.topTopics)).toBe(true);
+      expect(res.body.topQuestions).toBeDefined();
+      expect(Array.isArray(res.body.topQuestions)).toBe(true);
+    });
+
+    it('should return totalConversations count', async () => {
+      const res = await request(app)
+        .get('/api/analytics')
+        .set('Authorization', 'Bearer valid-doctor-token');
+
+      expect(res.status).toBe(200);
+      expect(res.body).toHaveProperty('totalConversations');
+      expect(typeof res.body.totalConversations).toBe('number');
+      expect(res.body).toHaveProperty('totalChatCount');
+      expect(res.body).toHaveProperty('totalEscalations');
+    });
+
+    it('should return uniquePatients count', async () => {
+      const res = await request(app)
+        .get('/api/analytics')
+        .set('Authorization', 'Bearer valid-doctor-token');
+
+      expect(res.status).toBe(200);
+      expect(res.body).toHaveProperty('uniquePatients');
+      expect(typeof res.body.uniquePatients).toBe('number');
+    });
+
+    it('should return escalationRate and resolutionRate', async () => {
+      admin.__seed('providers', 'doctor-uid-1', {
+        ownerUid: 'doctor-uid-1',
+        handle: 'drsmith',
+        displayName: 'Dr. Smith',
+        specialty: 'General',
+        status: 'published',
+        enabledTopics: ['general_health_info'],
+        plan: 'free',
+        monthlyChatLimit: 50,
+        monthlyChatCount: 5,
+        draftsAccepted: 8,
+        draftsEdited: 2,
+        draftsRejected: 0,
+        contactInfo: null,
+        businessHours: null
+      });
+
+      const res = await request(app)
+        .get('/api/analytics')
+        .set('Authorization', 'Bearer valid-doctor-token');
+
+      expect(res.status).toBe(200);
+      expect(res.body).toHaveProperty('escalationRate');
+      expect(typeof res.body.escalationRate).toBe('number');
+      expect(res.body).toHaveProperty('resolutionRate');
+      expect(res.body.resolutionRate).toBe(100);
+    });
+
+    it('should return draftMetrics in analytics', async () => {
+      admin.__seed('providers', 'doctor-uid-1', {
+        ownerUid: 'doctor-uid-1',
+        handle: 'drsmith',
+        displayName: 'Dr. Smith',
+        specialty: 'General',
+        status: 'published',
+        enabledTopics: ['general_health_info'],
+        plan: 'free',
+        monthlyChatLimit: 50,
+        monthlyChatCount: 5,
+        draftsAccepted: 10,
+        draftsEdited: 3,
+        draftsRejected: 2,
+        contactInfo: null,
+        businessHours: null
+      });
+
+      const res = await request(app)
+        .get('/api/analytics')
+        .set('Authorization', 'Bearer valid-doctor-token');
+
+      expect(res.status).toBe(200);
+      expect(res.body.draftMetrics).toBeDefined();
+      expect(res.body.draftMetrics.accepted).toBe(10);
+      expect(res.body.draftMetrics.edited).toBe(3);
+      expect(res.body.draftMetrics.rejected).toBe(2);
+    });
+
+    it('should reject unauthenticated requests', async () => {
+      const res = await request(app)
+        .get('/api/analytics');
+
+      expect(res.status).toBe(401);
+    });
+  });
+
+  describe('GET /api/conversations', () => {
+    it('should return hasMore pagination metadata', async () => {
+      const res = await request(app)
+        .get('/api/conversations')
+        .set('Authorization', 'Bearer valid-doctor-token');
+
+      expect(res.status).toBe(200);
+      expect(res.body).toHaveProperty('hasMore');
+      expect(res.body).toHaveProperty('conversations');
+      expect(Array.isArray(res.body.conversations)).toBe(true);
+    });
+
+    it('should filter by satisfaction=high', async () => {
+      admin.__seed('conversations', 'conv-high', {
+        providerId: 'doctor-uid-1',
+        satisfactionRating: 5,
+        topic: 'general',
+        updatedAt: new Date()
+      });
+      admin.__seed('conversations', 'conv-low', {
+        providerId: 'doctor-uid-1',
+        satisfactionRating: 1,
+        topic: 'general',
+        updatedAt: new Date()
+      });
+
+      const res = await request(app)
+        .get('/api/conversations?satisfaction=high')
+        .set('Authorization', 'Bearer valid-doctor-token');
+
+      expect(res.status).toBe(200);
+      const ratings = res.body.conversations.map(c => c.satisfactionRating);
+      expect(ratings.every(r => r >= 4)).toBe(true);
+    });
+
+    it('should filter by satisfaction=none for unrated', async () => {
+      admin.__seed('conversations', 'conv-unrated', {
+        providerId: 'doctor-uid-1',
+        topic: 'general',
+        updatedAt: new Date()
+      });
+
+      const res = await request(app)
+        .get('/api/conversations?satisfaction=none')
+        .set('Authorization', 'Bearer valid-doctor-token');
+
+      expect(res.status).toBe(200);
+      const ratings = res.body.conversations.map(c => c.satisfactionRating);
+      expect(ratings.every(r => !r)).toBe(true);
+    });
+  });
+
+  describe('GET /api/safety-events', () => {
+    it('should return safety events for provider', async () => {
+      admin.__seed('safetyEvents', 'ev-1', {
+        providerId: 'doctor-uid-1',
+        eventType: 'blocked_input',
+        details: { reason: 'PII detected', pattern: 'email' },
+        createdAt: { _seconds: 1719100000 }
+      });
+
+      const res = await request(app)
+        .get('/api/safety-events')
+        .set('Authorization', 'Bearer valid-doctor-token');
+
+      expect(res.status).toBe(200);
+      expect(res.body.events).toBeDefined();
+      expect(Array.isArray(res.body.events)).toBe(true);
+    });
+
+    it('should return empty array when no events', async () => {
+      const res = await request(app)
+        .get('/api/safety-events')
+        .set('Authorization', 'Bearer valid-doctor-token');
+
+      expect(res.status).toBe(200);
+      expect(res.body.events).toBeDefined();
+    });
+
+    it('should reject unauthenticated requests', async () => {
+      const res = await request(app)
+        .get('/api/safety-events');
+
+      expect(res.status).toBe(401);
+    });
+  });
+
+  describe('DELETE /api/conversations/:threadId', () => {
+    it('should delete a conversation owned by the provider', async () => {
+      admin.__seed('threads', 'thread_test_1', {
+        doctorId: 'doctor-uid-1',
+        patientId: 'anon_sess1',
+        createdAt: new Date()
+      });
+
+      const res = await request(app)
+        .delete('/api/conversations/thread_test_1')
+        .set('Authorization', 'Bearer valid-doctor-token');
+
+      expect(res.status).toBe(200);
+      expect(res.body.success).toBe(true);
+    });
+
+    it('should reject deletion of another providers conversation', async () => {
+      admin.__seed('threads', 'thread_other', {
+        doctorId: 'other-doctor-uid',
+        patientId: 'anon_sess2',
+        createdAt: new Date()
+      });
+
+      const res = await request(app)
+        .delete('/api/conversations/thread_other')
+        .set('Authorization', 'Bearer valid-doctor-token');
+
+      expect(res.status).toBe(403);
+    });
+
+    it('should return 404 for nonexistent conversation', async () => {
+      const res = await request(app)
+        .delete('/api/conversations/nonexistent_thread')
+        .set('Authorization', 'Bearer valid-doctor-token');
+
+      expect(res.status).toBe(404);
+    });
+
+    it('should reject unauthenticated requests', async () => {
+      const res = await request(app)
+        .delete('/api/conversations/thread_test_1');
+
+      expect(res.status).toBe(401);
+    });
+  });
+
+  describe('POST /api/provider (creation validation)', () => {
+    it('should reject creation without displayName', async () => {
+      // Remove existing provider so creation is allowed
+      admin.__reset();
+
+      const res = await request(app)
+        .post('/api/provider')
+        .set('Authorization', 'Bearer valid-doctor-token')
+        .send({
+          handle: 'newdoc',
+          specialty: 'Cardiology'
+        });
+
+      expect(res.status).toBe(400);
+      expect(res.body.error).toMatch(/display name/i);
+    });
+
+    it('should reject creation without specialty', async () => {
+      admin.__reset();
+
+      const res = await request(app)
+        .post('/api/provider')
+        .set('Authorization', 'Bearer valid-doctor-token')
+        .send({
+          handle: 'newdoc',
+          displayName: 'Dr. New'
+        });
+
+      expect(res.status).toBe(400);
+      expect(res.body.error).toMatch(/specialty/i);
+    });
+  });
+});

package/tests/integration/api-qr.test.js

@@ -0,0 +1,121 @@
+process.env.NODE_ENV = 'test';
+
+jest.mock('firebase-admin', () => require('../mocks/firebase-admin'));
+jest.mock('stripe', () => jest.fn().mockReturnValue({}));
+jest.mock('openai', () => jest.fn().mockImplementation(() => ({
+  chat: { completions: { create: jest.fn().mockResolvedValue({ choices: [{ message: { content: 'mock' } }] }) } }
+})));
+jest.mock('@google/generative-ai', () => ({
+  GoogleGenerativeAI: jest.fn().mockImplementation(() => ({
+    getGenerativeModel: () => ({
+      generateContent: jest.fn().mockResolvedValue({ response: { text: () => 'mock' } })
+    })
+  }))
+}));
+jest.mock('../../functions/src/stripe-config', () => ({ stripe: {} }));
+jest.mock('../../functions/src/payment', () => ({
+  createConnectAccount: jest.fn(),
+  createAccountLink: jest.fn(),
+  refreshAccountStatus: jest.fn(),
+  setProviderPricing: jest.fn(),
+  createCheckoutSession: jest.fn(),
+  createPaymentIntent: jest.fn(),
+  createSubscription: jest.fn(),
+  cancelSubscription: jest.fn(),
+  checkPaymentAccess: jest.fn(),
+  getRevenueAnalytics: jest.fn(),
+  handleStripeWebhook: jest.fn()
+}));
+
+process.env.DEEPSEEK_API_KEY = 'test-key';
+process.env.GEMINI_API_KEY = 'test-key';
+
+const request = require('supertest');
+const admin = require('firebase-admin');
+
+const app = require('../../server');
+
+describe('GET /api/qr/:handle', () => {
+  beforeEach(() => {
+    admin.__reset();
+    admin.__seed('providers', 'doctor-uid-1', {
+      ownerUid: 'doctor-uid-1',
+      handle: 'drsmith',
+      displayName: 'Dr. Smith',
+      specialty: 'General',
+      status: 'published',
+      enabledTopics: ['general_health_info'],
+      plan: 'free',
+      monthlyChatLimit: 50,
+      monthlyChatCount: 5,
+      contactInfo: null,
+      businessHours: null
+    });
+    admin.__seed('handles', 'drsmith', { providerId: 'doctor-uid-1' });
+  });
+
+  it('should return a PNG QR code for a published provider', async () => {
+    const res = await request(app).get('/api/qr/drsmith');
+
+    expect(res.status).toBe(200);
+    expect(res.headers['content-type']).toMatch(/image\/png/);
+    expect(res.headers['cache-control']).toMatch(/public/);
+    // PNG files start with the PNG magic bytes (0x89504E47)
+    expect(res.body[0]).toBe(0x89);
+    expect(res.body[1]).toBe(0x50);
+    expect(res.body[2]).toBe(0x4e);
+    expect(res.body[3]).toBe(0x47);
+  });
+
+  it('should return 404 for a non-existent provider', async () => {
+    const res = await request(app).get('/api/qr/nonexistent');
+
+    expect(res.status).toBe(404);
+    expect(res.body.error).toBe('Provider not found');
+  });
+
+  it('should return 403 for an unpublished provider', async () => {
+    admin.__seed('providers', 'doctor-uid-2', {
+      ownerUid: 'doctor-uid-2',
+      handle: 'drunpublished',
+      displayName: 'Dr. Unpublished',
+      specialty: 'General',
+      status: 'draft',
+      enabledTopics: ['general_health_info'],
+      plan: 'free',
+      contactInfo: null,
+      businessHours: null
+    });
+    admin.__seed('handles', 'drunpublished', { providerId: 'doctor-uid-2' });
+
+    const res = await request(app).get('/api/qr/drunpublished');
+
+    expect(res.status).toBe(403);
+    expect(res.body.error).toBe('Provider is not available');
+  });
+
+  it('should return 404 for a non-existent handle', async () => {
+    const res = await request(app).get('/api/qr/nonexistenthandle');
+
+    expect(res.status).toBe(404);
+    expect(res.body.error).toBe('Provider not found');
+  });
+
+  it('should not require authentication', async () => {
+    // No Authorization header needed - should still succeed
+    const res = await request(app)
+      .get('/api/qr/drsmith')
+      .set('Authorization', ''); // explicitly no auth
+
+    expect(res.status).toBe(200);
+    expect(res.headers['content-type']).toMatch(/image\/png/);
+  });
+
+  it('should return a valid PNG with non-zero size', async () => {
+    const res = await request(app).get('/api/qr/drsmith');
+
+    expect(res.status).toBe(200);
+    // QR code PNG should have a reasonable size (at least a few hundred bytes)
+    expect(res.body.length).toBeGreaterThan(100);
+  });
+});