evaldoc 1.0.0

package/tests/integration/api-security.test.js

@@ -0,0 +1,241 @@
+process.env.NODE_ENV = 'test';
+
+jest.mock('firebase-admin', () => require('../mocks/firebase-admin'));
+jest.mock('stripe', () => jest.fn().mockReturnValue({}));
+jest.mock('openai', () => jest.fn().mockImplementation(() => ({
+  chat: { completions: { create: jest.fn().mockResolvedValue({ choices: [{ message: { content: 'This is general health information. *This is not medical advice.*' } }] }) } }
+})));
+jest.mock('@google/generative-ai', () => ({
+  GoogleGenerativeAI: jest.fn().mockImplementation(() => ({
+    getGenerativeModel: () => ({
+      generateContent: jest.fn().mockResolvedValue({ response: { text: () => 'mock' } })
+    })
+  }))
+}));
+jest.mock('../../functions/src/stripe-config', () => ({ stripe: {} }));
+jest.mock('../../functions/src/payment', () => ({
+  createConnectAccount: jest.fn(),
+  createAccountLink: jest.fn(),
+  refreshAccountStatus: jest.fn(),
+  setProviderPricing: jest.fn(),
+  createCheckoutSession: jest.fn(),
+  createPaymentIntent: jest.fn(),
+  createSubscription: jest.fn(),
+  cancelSubscription: jest.fn(),
+  checkPaymentAccess: jest.fn(),
+  getRevenueAnalytics: jest.fn(),
+  handleStripeWebhook: jest.fn()
+}));
+
+process.env.DEEPSEEK_API_KEY = 'test-key';
+process.env.GEMINI_API_KEY = 'test-key';
+
+const request = require('supertest');
+const admin = require('firebase-admin');
+
+admin.auth().verifyIdToken = jest.fn(async (token) => {
+  if (token === 'valid-doctor-token') return { uid: 'doctor-uid-1', email: 'doc@test.com' };
+  throw new Error('Invalid token');
+});
+
+const app = require('../../server');
+
+describe('Security & Input Validation', () => {
+  beforeEach(() => {
+    admin.__reset();
+    admin.__seed('providers', 'doctor-uid-1', {
+      ownerUid: 'doctor-uid-1',
+      handle: 'drsmith',
+      displayName: 'Dr. Smith',
+      specialty: 'General',
+      status: 'published',
+      enabledTopics: ['general_health_info'],
+      plan: 'free',
+      monthlyChatLimit: 50,
+      monthlyChatCount: 5,
+      contactInfo: null,
+      businessHours: null
+    });
+  });
+
+  describe('Message length validation', () => {
+    it('should reject messages exceeding 5000 characters', async () => {
+      const longMessage = 'a'.repeat(5001);
+
+      const res = await request(app)
+        .post('/api/chat')
+        .send({
+          handle: 'drsmith',
+          sessionId: 'test-session-1',
+          message: longMessage
+        });
+
+      expect(res.status).toBe(400);
+      expect(res.body.error).toMatch(/too long/i);
+    });
+
+    it('should accept messages at exactly 5000 characters', async () => {
+      const maxMessage = 'a'.repeat(5000);
+
+      const res = await request(app)
+        .post('/api/chat')
+        .send({
+          handle: 'drsmith',
+          sessionId: 'test-session-2',
+          message: maxMessage
+        });
+
+      // Should not be rejected for length (may be 200 or other status but not 400 for length)
+      expect(res.status).not.toBe(400);
+    });
+
+    it('should still require handle, sessionId, and message', async () => {
+      const res = await request(app)
+        .post('/api/chat')
+        .send({ handle: 'drsmith' });
+
+      expect(res.status).toBe(400);
+      expect(res.body.error).toMatch(/required/i);
+    });
+  });
+
+  describe('JSON body size limit', () => {
+    it('should reject excessively large payloads', async () => {
+      const hugePayload = { data: 'x'.repeat(200000) };
+
+      const res = await request(app)
+        .post('/api/chat')
+        .send(hugePayload);
+
+      expect(res.status).toBeGreaterThanOrEqual(400);
+    });
+  });
+
+  describe('Rate limiting headers', () => {
+    it('should include rate limit headers on chat endpoint', async () => {
+      const res = await request(app)
+        .post('/api/chat')
+        .send({
+          handle: 'drsmith',
+          sessionId: 'test-session-3',
+          message: 'Hello'
+        });
+
+      expect(res.headers['x-ratelimit-limit']).toBeDefined();
+      expect(res.headers['x-ratelimit-remaining']).toBeDefined();
+    });
+
+    it('should include rate limit headers on search endpoint', async () => {
+      const res = await request(app)
+        .get('/api/search-providers?q=test');
+
+      expect(res.headers['x-ratelimit-limit']).toBeDefined();
+      expect(res.headers['x-ratelimit-remaining']).toBeDefined();
+    });
+  });
+
+  describe('Security headers', () => {
+    it('should set security headers on all responses', async () => {
+      const res = await request(app).get('/api/launch-status');
+
+      expect(res.headers['strict-transport-security']).toBeDefined();
+      expect(res.headers['x-content-type-options']).toBe('nosniff');
+      expect(res.headers['x-frame-options']).toBe('DENY');
+      expect(res.headers['referrer-policy']).toBe('strict-origin-when-cross-origin');
+      expect(res.headers['x-xss-protection']).toBe('1; mode=block');
+    });
+  });
+
+  describe('Input sanitization', () => {
+    it('should handle empty message gracefully', async () => {
+      const res = await request(app)
+        .post('/api/chat')
+        .send({
+          handle: 'drsmith',
+          sessionId: 'test-session-4',
+          message: '   '
+        });
+
+      expect(res.status).toBe(400);
+    });
+
+    it('should normalize handle input', async () => {
+      const res = await request(app)
+        .post('/api/chat')
+        .send({
+          handle: 'DrSmith',
+          sessionId: 'test-session-5',
+          message: 'Hello'
+        });
+
+      // Should normalize to lowercase and find provider
+      expect(res.status).not.toBe(400);
+    });
+  });
+
+  describe('Chat response metadata', () => {
+    it('should return topic field in chat response', async () => {
+      const res = await request(app)
+        .post('/api/chat')
+        .send({
+          handle: 'drsmith',
+          sessionId: 'test-session-topic',
+          message: 'What are your clinic hours?'
+        });
+
+      if (res.status === 200) {
+        expect(res.body.topic).toBeDefined();
+        expect(typeof res.body.topic).toBe('string');
+      }
+    });
+  });
+
+  describe('404 handling', () => {
+    it('should return 404 HTML for invalid handle routes', async () => {
+      const res = await request(app)
+        .get('/nonexistent-handle')
+        .set('Accept', 'text/html');
+
+      expect(res.status).toBe(404);
+      expect(res.headers['content-type']).toMatch(/html/);
+    });
+
+    it('should return 404 JSON for API routes', async () => {
+      const res = await request(app)
+        .get('/api/nonexistent')
+        .set('Accept', 'application/json');
+
+      expect(res.status).toBe(404);
+    });
+
+    it('should serve chat page for valid handle', async () => {
+      // Seed handle mapping
+      admin.__seed('handles', 'drsmith', { providerId: 'doctor-uid-1' });
+
+      const res = await request(app)
+        .get('/drsmith')
+        .set('Accept', 'text/html');
+
+      expect(res.status).toBe(200);
+      expect(res.headers['content-type']).toMatch(/html/);
+    });
+  });
+
+  describe('Health endpoint', () => {
+    it('should return basic health info', async () => {
+      const res = await request(app).get('/health');
+
+      expect(res.status).toBe(200);
+      expect(res.body.ok).toBe(true);
+      expect(res.body.uptime).toBeDefined();
+      expect(typeof res.body.memory).toBe('number');
+    });
+
+    it('should support deep health check', async () => {
+      const res = await request(app).get('/health?deep=true');
+
+      expect(res.status).toBe(200);
+      expect(res.body.database).toBe('connected');
+    });
+  });
+});

package/tests/integration/api-stripe-search.test.js

@@ -0,0 +1,303 @@
+process.env.NODE_ENV = 'test';
+
+jest.mock('firebase-admin', () => require('../mocks/firebase-admin'));
+jest.mock('stripe', () => jest.fn().mockReturnValue({}));
+jest.mock('openai', () => jest.fn().mockImplementation(() => ({
+  chat: { completions: { create: jest.fn().mockResolvedValue({ choices: [{ message: { content: '{"response":"Draft reply"}' } }] }) } }
+})));
+jest.mock('@google/generative-ai', () => ({
+  GoogleGenerativeAI: jest.fn().mockImplementation(() => ({
+    getGenerativeModel: () => ({
+      generateContent: jest.fn().mockResolvedValue({ response: { text: () => 'mock' } })
+    })
+  }))
+}));
+jest.mock('../../functions/src/stripe-config', () => ({ stripe: {} }));
+jest.mock('../../functions/src/payment', () => ({
+  createConnectAccount: jest.fn().mockResolvedValue({ accountId: 'acct_test', onboardingStatus: 'PENDING' }),
+  createAccountLink: jest.fn(),
+  refreshAccountStatus: jest.fn().mockResolvedValue({ chargesEnabled: true }),
+  setProviderPricing: jest.fn(),
+  createCheckoutSession: jest.fn(),
+  createPaymentIntent: jest.fn(),
+  createSubscription: jest.fn(),
+  cancelSubscription: jest.fn(),
+  checkPaymentAccess: jest.fn(),
+  getRevenueAnalytics: jest.fn(),
+  handleStripeWebhook: jest.fn()
+}));
+
+process.env.DEEPSEEK_API_KEY = 'test-key';
+process.env.GEMINI_API_KEY = 'test-key';
+
+const request = require('supertest');
+const admin = require('firebase-admin');
+const { createConnectAccount, refreshAccountStatus } = require('../../functions/src/payment');
+
+admin.auth().verifyIdToken = jest.fn(async (token) => {
+  if (token === 'valid-doctor-token') return { uid: 'doctor-uid-1', email: 'doc@test.com' };
+  throw new Error('Invalid token');
+});
+
+const app = require('../../server');
+
+describe('Stripe Connect & Search Providers & Conversation Reply API', () => {
+  beforeEach(() => {
+    admin.__reset();
+    createConnectAccount.mockClear();
+    refreshAccountStatus.mockClear();
+
+    admin.__seed('providers', 'doctor-uid-1', {
+      ownerUid: 'doctor-uid-1',
+      handle: 'drsmith',
+      displayName: 'Dr. Smith',
+      specialty: 'General',
+      status: 'published',
+      plan: 'free'
+    });
+  });
+
+  // ──────────────────────────────────────────────────────────────────────
+  // POST /api/stripe/create-connect-account
+  // ──────────────────────────────────────────────────────────────────────
+  describe('POST /api/stripe/create-connect-account', () => {
+    it('should return existing account if stripeAccountId already set', async () => {
+      admin.__seed('providers', 'doctor-uid-1', {
+        ownerUid: 'doctor-uid-1',
+        handle: 'drsmith',
+        displayName: 'Dr. Smith',
+        specialty: 'General',
+        status: 'published',
+        plan: 'free',
+        stripeAccountId: 'acct_existing',
+        stripeOnboardingStatus: 'COMPLETE'
+      });
+
+      const res = await request(app)
+        .post('/api/stripe/create-connect-account')
+        .set('Authorization', 'Bearer valid-doctor-token')
+        .send();
+
+      expect(res.status).toBe(200);
+      expect(res.body.accountId).toBe('acct_existing');
+      expect(res.body.onboardingStatus).toBe('COMPLETE');
+      expect(createConnectAccount).not.toHaveBeenCalled();
+    });
+
+    it('should call createConnectAccount when no existing account', async () => {
+      const res = await request(app)
+        .post('/api/stripe/create-connect-account')
+        .set('Authorization', 'Bearer valid-doctor-token')
+        .send();
+
+      expect(res.status).toBe(200);
+      expect(res.body.accountId).toBe('acct_test');
+      expect(res.body.onboardingStatus).toBe('PENDING');
+      expect(createConnectAccount).toHaveBeenCalledWith({
+        providerId: 'doctor-uid-1',
+        email: 'doc@test.com',
+        displayName: 'Dr. Smith',
+        country: 'US'
+      });
+    });
+
+    it('should reject unauthenticated requests (401)', async () => {
+      const res = await request(app)
+        .post('/api/stripe/create-connect-account')
+        .send();
+
+      expect(res.status).toBe(401);
+    });
+
+    it('should reject when provider not found (404)', async () => {
+      admin.__reset();
+
+      const res = await request(app)
+        .post('/api/stripe/create-connect-account')
+        .set('Authorization', 'Bearer valid-doctor-token')
+        .send();
+
+      expect(res.status).toBe(404);
+      expect(res.body.error).toMatch(/Provider not found/);
+    });
+  });
+
+  // ──────────────────────────────────────────────────────────────────────
+  // POST /api/stripe/refresh-account-status
+  // ──────────────────────────────────────────────────────────────────────
+  describe('POST /api/stripe/refresh-account-status', () => {
+    it('should call refreshAccountStatus for valid provider', async () => {
+      admin.__seed('providers', 'doctor-uid-1', {
+        ownerUid: 'doctor-uid-1',
+        handle: 'drsmith',
+        displayName: 'Dr. Smith',
+        specialty: 'General',
+        status: 'published',
+        plan: 'free',
+        stripeAccountId: 'acct_existing'
+      });
+
+      const res = await request(app)
+        .post('/api/stripe/refresh-account-status')
+        .set('Authorization', 'Bearer valid-doctor-token')
+        .send();
+
+      expect(res.status).toBe(200);
+      expect(res.body.chargesEnabled).toBe(true);
+      expect(refreshAccountStatus).toHaveBeenCalledWith({
+        providerId: 'doctor-uid-1',
+        stripeAccountId: 'acct_existing'
+      });
+    });
+
+    it('should reject when no stripeAccountId set (400)', async () => {
+      const res = await request(app)
+        .post('/api/stripe/refresh-account-status')
+        .set('Authorization', 'Bearer valid-doctor-token')
+        .send();
+
+      expect(res.status).toBe(400);
+      expect(res.body.error).toMatch(/No Stripe Connect account/);
+    });
+
+    it('should reject unauthenticated (401)', async () => {
+      const res = await request(app)
+        .post('/api/stripe/refresh-account-status')
+        .send();
+
+      expect(res.status).toBe(401);
+    });
+  });
+
+  // ──────────────────────────────────────────────────────────────────────
+  // GET /api/search-providers
+  // ──────────────────────────────────────────────────────────────────────
+  describe('GET /api/search-providers', () => {
+    it('should return published providers matching query', async () => {
+      admin.__seed('providers', 'provider-a', {
+        handle: 'drjones',
+        displayName: 'Dr. Jones',
+        specialty: 'Cardiology',
+        status: 'published'
+      });
+      admin.__seed('providers', 'provider-b', {
+        handle: 'drbrown',
+        displayName: 'Dr. Brown',
+        specialty: 'Dermatology',
+        status: 'published'
+      });
+      admin.__seed('providers', 'provider-unpub', {
+        handle: 'drhidden',
+        displayName: 'Dr. Hidden',
+        specialty: 'Cardiology',
+        status: 'draft'
+      });
+
+      const res = await request(app)
+        .get('/api/search-providers')
+        .query({ q: 'jones' });
+
+      expect(res.status).toBe(200);
+      expect(res.body.providers).toHaveLength(1);
+      expect(res.body.providers[0].displayName).toBe('Dr. Jones');
+    });
+
+    it('should return empty array for no matches', async () => {
+      const res = await request(app)
+        .get('/api/search-providers')
+        .query({ q: 'zzzznonexistent' });
+
+      expect(res.status).toBe(200);
+      expect(res.body.providers).toEqual([]);
+    });
+
+    it('should reject missing query param', async () => {
+      const res = await request(app)
+        .get('/api/search-providers');
+
+      expect(res.status).toBe(400);
+      expect(res.body.error).toMatch(/Query must be at least 2 characters/);
+    });
+  });
+
+  // ──────────────────────────────────────────────────────────────────────
+  // POST /api/conversation/:id/reply
+  // ──────────────────────────────────────────────────────────────────────
+  describe('POST /api/conversation/:id/reply', () => {
+    beforeEach(() => {
+      admin.__seed('conversations', 'convo-1', {
+        providerId: 'doctor-uid-1',
+        sessionId: 'session-1',
+        lastAssistantMessage: 'Hello'
+      });
+    });
+
+    it('should add doctor reply to conversation', async () => {
+      const res = await request(app)
+        .post('/api/conversation/convo-1/reply')
+        .set('Authorization', 'Bearer valid-doctor-token')
+        .send({ message: 'Here is my medical advice.' });
+
+      expect(res.status).toBe(200);
+      expect(res.body.success).toBe(true);
+
+      // Verify message was added to subcollection
+      const messages = admin.__getAll('conversations/convo-1/messages');
+      const messageKeys = Object.keys(messages);
+      expect(messageKeys.length).toBe(1);
+      const msg = messages[messageKeys[0]];
+      expect(msg.role).toBe('doctor');
+      expect(msg.content).toBe('Here is my medical advice.');
+      expect(msg.isDoctorManual).toBe(true);
+
+      // Verify conversation metadata was updated
+      const convo = admin.__getAll('conversations')['convo-1'];
+      expect(convo.lastAssistantMessage).toBe('Here is my medical advice.');
+    });
+
+    it('should reject empty message', async () => {
+      const res = await request(app)
+        .post('/api/conversation/convo-1/reply')
+        .set('Authorization', 'Bearer valid-doctor-token')
+        .send({ message: '' });
+
+      expect(res.status).toBe(400);
+      expect(res.body.error).toMatch(/message is required/);
+    });
+
+    it('should reject message over 10000 chars', async () => {
+      const longMessage = 'x'.repeat(10001);
+
+      const res = await request(app)
+        .post('/api/conversation/convo-1/reply')
+        .set('Authorization', 'Bearer valid-doctor-token')
+        .send({ message: longMessage });
+
+      expect(res.status).toBe(400);
+      expect(res.body.error).toMatch(/exceeds maximum length/);
+    });
+
+    it('should reject access to conversations owned by other providers', async () => {
+      admin.__seed('conversations', 'convo-other', {
+        providerId: 'other-doctor-uid',
+        sessionId: 'session-other'
+      });
+
+      const res = await request(app)
+        .post('/api/conversation/convo-other/reply')
+        .set('Authorization', 'Bearer valid-doctor-token')
+        .send({ message: 'Should not work' });
+
+      expect(res.status).toBe(404);
+      expect(res.body.error).toMatch(/Conversation not found/);
+    });
+
+    it('should reject unauthenticated (401)', async () => {
+      const res = await request(app)
+        .post('/api/conversation/convo-1/reply')
+        .send({ message: 'test' });
+
+      expect(res.status).toBe(401);
+    });
+  });
+});