evaldoc 1.0.0

package/tests/unit/server-helpers.test.js

@@ -0,0 +1,774 @@
+/**
+ * Server helper function unit tests
+ *
+ * Tests pure functions from server.js (inlined for isolation):
+ * - normalizeHandle: handle normalization and sanitization
+ * - sanitizeTopics: topic array validation
+ * - HEX_COLOR_REGEX: hex color validation
+ * - stripHtml: HTML tag stripping
+ * - sanitizeContactInfo: contact info sanitization
+ * - rateLimit: rate limiting logic (middleware)
+ * - Pagination parameter parsing
+ * - HANDLE_REGEX: handle format validation
+ * - sanitizeProviderUpdate: compound sanitization
+ */
+
+// Inline copies of pure functions from server.js (same pattern as chat-ui-logic.test.js)
+
+function normalizeHandle(handle) {
+  return String(handle || '')
+    .trim()
+    .toLowerCase()
+    .replace(/\s+/g, '-')
+    .replace(/[^a-z0-9-]/g, '');
+}
+
+const TOPIC_KEYS = [
+  'medication_info_safety',
+  'appointments_preparation',
+  'general_health_info',
+  'clinic_services_hours',
+  'insurance_billing_faq',
+  'post_procedure_guidance'
+];
+
+function sanitizeTopics(topics) {
+  if (!Array.isArray(topics)) return null;
+  const filtered = topics.filter((topic) => TOPIC_KEYS.includes(topic));
+  return filtered.length ? filtered : null;
+}
+
+const HEX_COLOR_REGEX = /^#[0-9a-fA-F]{6}$/;
+
+function stripHtml(str) {
+  return String(str).replace(/<[^>]*>/g, '').trim();
+}
+
+function sanitizeContactInfo(ci) {
+  if (!ci || typeof ci !== 'object') return null;
+  const clean = {};
+  if (ci.phone) clean.phone = stripHtml(String(ci.phone)).replace(/[^0-9+\-() .ext]/gi, '').substring(0, 30);
+  if (ci.email) {
+    const email = String(ci.email).trim().toLowerCase();
+    if (/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) clean.email = email;
+  }
+  if (ci.address) clean.address = stripHtml(ci.address).substring(0, 200);
+  return Object.keys(clean).length ? clean : null;
+}
+
+const HANDLE_REGEX = /^[a-z0-9][a-z0-9-]{2,29}$/;
+const RESERVED_HANDLES = new Set(['app', 'api', 'admin', 'static', 'public', 'functions', 'health']);
+
+function sanitizeProviderUpdate(body) {
+  const update = {};
+  if (body.displayName !== undefined) {
+    const name = stripHtml(body.displayName).substring(0, 100);
+    if (name) update.displayName = name;
+  }
+  if (body.specialty !== undefined) {
+    update.specialty = stripHtml(body.specialty).substring(0, 100);
+  }
+  if (body.country !== undefined) update.country = stripHtml(body.country).substring(0, 60);
+  if (body.locale !== undefined) update.locale = String(body.locale).trim().substring(0, 10);
+  if (body.photoUrl !== undefined) update.photoUrl = body.photoUrl ? String(body.photoUrl).trim() : null;
+  if (body.logoUrl !== undefined) update.logoUrl = body.logoUrl ? String(body.logoUrl).trim() : null;
+  if (body.brandPrimaryColor !== undefined) {
+    const c = String(body.brandPrimaryColor).trim();
+    if (HEX_COLOR_REGEX.test(c)) update.brandPrimaryColor = c;
+  }
+  if (body.brandSecondaryColor !== undefined) {
+    const c = String(body.brandSecondaryColor).trim();
+    if (HEX_COLOR_REGEX.test(c)) update.brandSecondaryColor = c;
+  }
+  if (body.welcomeMessage !== undefined) update.welcomeMessage = stripHtml(body.welcomeMessage).substring(0, 500);
+  if (body.contactInfo !== undefined) {
+    update.contactInfo = body.contactInfo === null ? null : sanitizeContactInfo(body.contactInfo);
+  }
+  if (body.businessHours !== undefined && (body.businessHours === null || typeof body.businessHours === 'object')) {
+    update.businessHours = body.businessHours;
+  }
+
+  const topics = sanitizeTopics(body.enabledTopics);
+  if (topics) update.enabledTopics = topics;
+
+  if (body.status && ['draft', 'preview', 'published', 'suspended'].includes(body.status)) {
+    update.status = body.status;
+  }
+
+  return update;
+}
+
+// Rate limit factory (inlined from server.js, adapted for unit testing)
+function createRateLimiter({ maxRequests = 30, windowMs = 60000 } = {}) {
+  const store = new Map();
+  return {
+    store,
+    middleware: (req, res, next) => {
+      const ip = req.ip || req.connection.remoteAddress || 'unknown';
+      const key = `${ip}:${req.path}`;
+      const now = Date.now();
+      let entry = store.get(key);
+
+      if (!entry || now - entry.windowStart > windowMs) {
+        entry = { windowStart: now, count: 0 };
+      }
+
+      entry.count++;
+      store.set(key, entry);
+
+      if (entry.count > maxRequests) {
+        return res.status(429).json({ error: 'Too many requests. Please wait and try again.' });
+      }
+
+      res.setHeader('X-RateLimit-Limit', String(maxRequests));
+      res.setHeader('X-RateLimit-Remaining', String(Math.max(0, maxRequests - entry.count)));
+      next();
+    }
+  };
+}
+
+// Pagination parameter parsing (inlined from server.js endpoint logic)
+function parsePaginationParams(query, { defaultLimit = 30, maxLimit = 50 } = {}) {
+  const limit = Math.min(parseInt(query.limit, 10) || defaultLimit, maxLimit);
+  const offset = Math.max(parseInt(query.offset, 10) || 0, 0);
+  return { limit, offset };
+}
+
+
+describe('Server Helpers', () => {
+
+  // ─── normalizeHandle ───────────────────────────────────────────
+  describe('normalizeHandle', () => {
+    it('should lowercase uppercase input', () => {
+      expect(normalizeHandle('DrSmith')).toBe('drsmith');
+    });
+
+    it('should replace spaces with hyphens', () => {
+      expect(normalizeHandle('dr smith clinic')).toBe('dr-smith-clinic');
+    });
+
+    it('should collapse multiple spaces into one hyphen', () => {
+      expect(normalizeHandle('dr   smith')).toBe('dr-smith');
+    });
+
+    it('should remove special characters', () => {
+      expect(normalizeHandle('dr.smith@clinic!')).toBe('drsmithclinic');
+    });
+
+    it('should handle empty string', () => {
+      expect(normalizeHandle('')).toBe('');
+    });
+
+    it('should handle null', () => {
+      expect(normalizeHandle(null)).toBe('');
+    });
+
+    it('should handle undefined', () => {
+      expect(normalizeHandle(undefined)).toBe('');
+    });
+
+    it('should trim leading and trailing whitespace', () => {
+      expect(normalizeHandle('  drsmith  ')).toBe('drsmith');
+    });
+
+    it('should handle numeric input', () => {
+      expect(normalizeHandle(12345)).toBe('12345');
+    });
+
+    it('should strip unicode characters', () => {
+      expect(normalizeHandle('dr-müller')).toBe('dr-mller');
+    });
+
+    it('should handle string with only special characters', () => {
+      expect(normalizeHandle('!@#$%^&*()')).toBe('');
+    });
+
+    it('should preserve hyphens', () => {
+      expect(normalizeHandle('my-clinic')).toBe('my-clinic');
+    });
+  });
+
+  // ─── sanitizeTopics ────────────────────────────────────────────
+  describe('sanitizeTopics', () => {
+    it('should return valid topics unchanged', () => {
+      const input = ['medication_info_safety', 'general_health_info'];
+      expect(sanitizeTopics(input)).toEqual(input);
+    });
+
+    it('should filter out invalid topics', () => {
+      const input = ['medication_info_safety', 'fake_topic', 'general_health_info'];
+      expect(sanitizeTopics(input)).toEqual(['medication_info_safety', 'general_health_info']);
+    });
+
+    it('should return null for empty array', () => {
+      expect(sanitizeTopics([])).toBeNull();
+    });
+
+    it('should return null for non-array input (string)', () => {
+      expect(sanitizeTopics('medication_info_safety')).toBeNull();
+    });
+
+    it('should return null for non-array input (number)', () => {
+      expect(sanitizeTopics(42)).toBeNull();
+    });
+
+    it('should return null for null input', () => {
+      expect(sanitizeTopics(null)).toBeNull();
+    });
+
+    it('should return null for undefined input', () => {
+      expect(sanitizeTopics(undefined)).toBeNull();
+    });
+
+    it('should return null when all topics are invalid', () => {
+      expect(sanitizeTopics(['bogus', 'invalid', 'nope'])).toBeNull();
+    });
+
+    it('should accept all six valid topics', () => {
+      const result = sanitizeTopics(TOPIC_KEYS.slice());
+      expect(result).toEqual(TOPIC_KEYS);
+    });
+
+    it('should return null for object input', () => {
+      expect(sanitizeTopics({ topic: 'medication_info_safety' })).toBeNull();
+    });
+  });
+
+  // ─── HEX_COLOR_REGEX ──────────────────────────────────────────
+  describe('HEX_COLOR_REGEX', () => {
+    it('should match valid 6-digit hex color (lowercase)', () => {
+      expect(HEX_COLOR_REGEX.test('#aabbcc')).toBe(true);
+    });
+
+    it('should match valid 6-digit hex color (uppercase)', () => {
+      expect(HEX_COLOR_REGEX.test('#AABBCC')).toBe(true);
+    });
+
+    it('should match valid 6-digit hex color (mixed case)', () => {
+      expect(HEX_COLOR_REGEX.test('#aAbBcC')).toBe(true);
+    });
+
+    it('should match valid black color', () => {
+      expect(HEX_COLOR_REGEX.test('#000000')).toBe(true);
+    });
+
+    it('should match valid white color', () => {
+      expect(HEX_COLOR_REGEX.test('#ffffff')).toBe(true);
+    });
+
+    it('should reject 3-digit hex shorthand', () => {
+      expect(HEX_COLOR_REGEX.test('#abc')).toBe(false);
+    });
+
+    it('should reject 8-digit hex (alpha channel)', () => {
+      expect(HEX_COLOR_REGEX.test('#aabbccdd')).toBe(false);
+    });
+
+    it('should reject missing hash prefix', () => {
+      expect(HEX_COLOR_REGEX.test('aabbcc')).toBe(false);
+    });
+
+    it('should reject invalid hex characters', () => {
+      expect(HEX_COLOR_REGEX.test('#gghhii')).toBe(false);
+    });
+
+    it('should reject empty string', () => {
+      expect(HEX_COLOR_REGEX.test('')).toBe(false);
+    });
+
+    it('should reject color name', () => {
+      expect(HEX_COLOR_REGEX.test('red')).toBe(false);
+    });
+
+    it('should reject rgb notation', () => {
+      expect(HEX_COLOR_REGEX.test('rgb(0,0,0)')).toBe(false);
+    });
+  });
+
+  // ─── stripHtml ─────────────────────────────────────────────────
+  describe('stripHtml', () => {
+    it('should remove simple HTML tags', () => {
+      expect(stripHtml('<b>bold</b>')).toBe('bold');
+    });
+
+    it('should remove nested HTML tags', () => {
+      expect(stripHtml('<div><span>text</span></div>')).toBe('text');
+    });
+
+    it('should handle self-closing tags', () => {
+      expect(stripHtml('before<br/>after')).toBe('beforeafter');
+    });
+
+    it('should remove script tags and content markers', () => {
+      expect(stripHtml('<script>alert("xss")</script>')).toBe('alert("xss")');
+    });
+
+    it('should remove tags with attributes', () => {
+      expect(stripHtml('<a href="http://evil.com">click</a>')).toBe('click');
+    });
+
+    it('should handle empty string', () => {
+      expect(stripHtml('')).toBe('');
+    });
+
+    it('should handle string with no HTML', () => {
+      expect(stripHtml('plain text')).toBe('plain text');
+    });
+
+    it('should trim whitespace from result', () => {
+      expect(stripHtml('  <b>text</b>  ')).toBe('text');
+    });
+
+    it('should handle non-string input (number)', () => {
+      expect(stripHtml(42)).toBe('42');
+    });
+
+    it('should handle img tag with onerror XSS payload', () => {
+      expect(stripHtml('<img src=x onerror=alert(1)>')).toBe('');
+    });
+
+    it('should strip event handler attributes in tags', () => {
+      expect(stripHtml('<div onmouseover="steal()">safe</div>')).toBe('safe');
+    });
+
+    it('should handle multiple tags in sequence', () => {
+      expect(stripHtml('<b>a</b><i>b</i><u>c</u>')).toBe('abc');
+    });
+  });
+
+  // ─── sanitizeContactInfo ───────────────────────────────────────
+  describe('sanitizeContactInfo', () => {
+    it('should sanitize valid phone number', () => {
+      const result = sanitizeContactInfo({ phone: '+1 (555) 123-4567' });
+      expect(result.phone).toBe('+1 (555) 123-4567');
+    });
+
+    it('should strip HTML from phone number', () => {
+      const result = sanitizeContactInfo({ phone: '<script>alert(1)</script>555-1234' });
+      expect(result.phone).not.toContain('<script>');
+      expect(result.phone).toContain('555-1234');
+    });
+
+    it('should strip non-phone characters from phone', () => {
+      const result = sanitizeContactInfo({ phone: 'CALL: 555-1234; DROP TABLE' });
+      expect(result.phone).not.toContain(';');
+      expect(result.phone).not.toContain('DROP');
+    });
+
+    it('should truncate phone to 30 characters', () => {
+      const result = sanitizeContactInfo({ phone: '1'.repeat(50) });
+      expect(result.phone.length).toBeLessThanOrEqual(30);
+    });
+
+    it('should validate and lowercase email', () => {
+      const result = sanitizeContactInfo({ email: 'Doctor@Hospital.COM' });
+      expect(result.email).toBe('doctor@hospital.com');
+    });
+
+    it('should reject invalid email (no @)', () => {
+      const result = sanitizeContactInfo({ email: 'not-an-email' });
+      expect(result).toBeNull();
+    });
+
+    it('should reject email with spaces', () => {
+      const result = sanitizeContactInfo({ email: 'user @domain.com' });
+      expect(result).toBeNull();
+    });
+
+    it('should sanitize address by stripping HTML', () => {
+      const result = sanitizeContactInfo({ address: '<b>123 Main St</b>' });
+      expect(result.address).toBe('123 Main St');
+    });
+
+    it('should truncate address to 200 characters', () => {
+      const result = sanitizeContactInfo({ address: 'A'.repeat(300) });
+      expect(result.address.length).toBeLessThanOrEqual(200);
+    });
+
+    it('should return null for null input', () => {
+      expect(sanitizeContactInfo(null)).toBeNull();
+    });
+
+    it('should return null for non-object input', () => {
+      expect(sanitizeContactInfo('string')).toBeNull();
+    });
+
+    it('should return null for empty object', () => {
+      expect(sanitizeContactInfo({})).toBeNull();
+    });
+
+    it('should return null for object with only invalid email', () => {
+      expect(sanitizeContactInfo({ email: 'bad' })).toBeNull();
+    });
+
+    it('should handle all three fields together', () => {
+      const result = sanitizeContactInfo({
+        phone: '555-0100',
+        email: 'doc@clinic.com',
+        address: '456 Oak Ave'
+      });
+      expect(result.phone).toBe('555-0100');
+      expect(result.email).toBe('doc@clinic.com');
+      expect(result.address).toBe('456 Oak Ave');
+    });
+
+    it('should allow phone number with ext', () => {
+      const result = sanitizeContactInfo({ phone: '555-0100 ext 42' });
+      expect(result.phone).toContain('ext');
+    });
+  });
+
+  // ─── HANDLE_REGEX ──────────────────────────────────────────────
+  describe('HANDLE_REGEX', () => {
+    it('should accept valid lowercase alphanumeric handle', () => {
+      expect(HANDLE_REGEX.test('drsmith')).toBe(true);
+    });
+
+    it('should accept handle with hyphens', () => {
+      expect(HANDLE_REGEX.test('dr-smith-clinic')).toBe(true);
+    });
+
+    it('should accept handle starting with a digit', () => {
+      expect(HANDLE_REGEX.test('1clinic')).toBe(true);
+    });
+
+    it('should require minimum 3 characters', () => {
+      expect(HANDLE_REGEX.test('ab')).toBe(false);
+    });
+
+    it('should accept exactly 3 characters', () => {
+      expect(HANDLE_REGEX.test('abc')).toBe(true);
+    });
+
+    it('should accept exactly 30 characters', () => {
+      expect(HANDLE_REGEX.test('a' + 'b'.repeat(29))).toBe(true);
+    });
+
+    it('should reject more than 30 characters', () => {
+      expect(HANDLE_REGEX.test('a' + 'b'.repeat(30))).toBe(false);
+    });
+
+    it('should reject handle starting with a hyphen', () => {
+      expect(HANDLE_REGEX.test('-drsmith')).toBe(false);
+    });
+
+    it('should reject uppercase characters', () => {
+      expect(HANDLE_REGEX.test('DrSmith')).toBe(false);
+    });
+
+    it('should reject special characters', () => {
+      expect(HANDLE_REGEX.test('dr_smith')).toBe(false);
+    });
+
+    it('should reject empty string', () => {
+      expect(HANDLE_REGEX.test('')).toBe(false);
+    });
+  });
+
+  // ─── RESERVED_HANDLES ─────────────────────────────────────────
+  describe('RESERVED_HANDLES', () => {
+    it('should include "api"', () => {
+      expect(RESERVED_HANDLES.has('api')).toBe(true);
+    });
+
+    it('should include "admin"', () => {
+      expect(RESERVED_HANDLES.has('admin')).toBe(true);
+    });
+
+    it('should include "health"', () => {
+      expect(RESERVED_HANDLES.has('health')).toBe(true);
+    });
+
+    it('should not include arbitrary strings', () => {
+      expect(RESERVED_HANDLES.has('drsmith')).toBe(false);
+    });
+
+    it('should have 7 reserved handles', () => {
+      expect(RESERVED_HANDLES.size).toBe(7);
+    });
+  });
+
+  // ─── Rate Limiting ────────────────────────────────────────────
+  describe('rateLimit', () => {
+    function makeMockReqRes(ip, path) {
+      const headers = {};
+      return {
+        req: { ip, path, connection: { remoteAddress: ip } },
+        res: {
+          statusCode: null,
+          headers,
+          status(code) { this.statusCode = code; return this; },
+          json(data) { this.body = data; return this; },
+          setHeader(k, v) { headers[k] = v; }
+        }
+      };
+    }
+
+    it('should allow requests under the limit', () => {
+      const { middleware } = createRateLimiter({ maxRequests: 5, windowMs: 60000 });
+      const { req, res } = makeMockReqRes('1.2.3.4', '/api/test');
+      let nextCalled = false;
+      middleware(req, res, () => { nextCalled = true; });
+      expect(nextCalled).toBe(true);
+    });
+
+    it('should set rate limit headers', () => {
+      const { middleware } = createRateLimiter({ maxRequests: 10, windowMs: 60000 });
+      const { req, res } = makeMockReqRes('1.2.3.4', '/api/test');
+      middleware(req, res, () => {});
+      expect(res.headers['X-RateLimit-Limit']).toBe('10');
+      expect(res.headers['X-RateLimit-Remaining']).toBe('9');
+    });
+
+    it('should block requests over the limit', () => {
+      const { middleware } = createRateLimiter({ maxRequests: 3, windowMs: 60000 });
+      const { req, res } = makeMockReqRes('5.6.7.8', '/api/chat');
+      const noop = () => {};
+      middleware(req, res, noop);
+      middleware(req, res, noop);
+      middleware(req, res, noop);
+      // 4th request exceeds limit of 3
+      let nextCalled = false;
+      middleware(req, res, () => { nextCalled = true; });
+      expect(nextCalled).toBe(false);
+      expect(res.statusCode).toBe(429);
+      expect(res.body.error).toContain('Too many requests');
+    });
+
+    it('should track different IPs separately', () => {
+      const { middleware } = createRateLimiter({ maxRequests: 2, windowMs: 60000 });
+      const { req: req1, res: res1 } = makeMockReqRes('10.0.0.1', '/api/test');
+      const { req: req2, res: res2 } = makeMockReqRes('10.0.0.2', '/api/test');
+      const noop = () => {};
+      middleware(req1, res1, noop);
+      middleware(req1, res1, noop);
+      // IP1 is at limit, IP2 should still be fine
+      let nextCalled = false;
+      middleware(req2, res2, () => { nextCalled = true; });
+      expect(nextCalled).toBe(true);
+    });
+
+    it('should track different paths separately', () => {
+      const { middleware } = createRateLimiter({ maxRequests: 1, windowMs: 60000 });
+      const { req: req1, res: res1 } = makeMockReqRes('10.0.0.1', '/api/chat');
+      const { req: req2, res: res2 } = makeMockReqRes('10.0.0.1', '/api/provider');
+      const noop = () => {};
+      middleware(req1, res1, noop);
+      // Same IP, different path should still work
+      let nextCalled = false;
+      middleware(req2, res2, () => { nextCalled = true; });
+      expect(nextCalled).toBe(true);
+    });
+
+    it('should reset count after window expires', () => {
+      const { middleware, store } = createRateLimiter({ maxRequests: 2, windowMs: 1000 });
+      const { req, res } = makeMockReqRes('10.0.0.3', '/api/test');
+      const noop = () => {};
+      middleware(req, res, noop);
+      middleware(req, res, noop);
+      // Manually expire the window
+      const key = '10.0.0.3:/api/test';
+      const entry = store.get(key);
+      entry.windowStart = Date.now() - 2000; // expired
+      store.set(key, entry);
+      let nextCalled = false;
+      middleware(req, res, () => { nextCalled = true; });
+      expect(nextCalled).toBe(true);
+    });
+
+    it('should show remaining count decreasing', () => {
+      const { middleware } = createRateLimiter({ maxRequests: 5, windowMs: 60000 });
+      const { req, res } = makeMockReqRes('10.0.0.4', '/api/test');
+      middleware(req, res, () => {});
+      expect(res.headers['X-RateLimit-Remaining']).toBe('4');
+      middleware(req, res, () => {});
+      expect(res.headers['X-RateLimit-Remaining']).toBe('3');
+      middleware(req, res, () => {});
+      expect(res.headers['X-RateLimit-Remaining']).toBe('2');
+    });
+
+    it('should use default maxRequests of 30 when no options given', () => {
+      const { middleware } = createRateLimiter();
+      const { req, res } = makeMockReqRes('10.0.0.5', '/default');
+      middleware(req, res, () => {});
+      expect(res.headers['X-RateLimit-Limit']).toBe('30');
+    });
+
+    it('should fallback to "unknown" when no IP available', () => {
+      const { middleware, store } = createRateLimiter({ maxRequests: 5, windowMs: 60000 });
+      const req = { ip: undefined, path: '/test', connection: { remoteAddress: undefined } };
+      const headers = {};
+      const res = {
+        setHeader(k, v) { headers[k] = v; },
+        status() { return this; },
+        json() { return this; }
+      };
+      middleware(req, res, () => {});
+      expect(store.has('unknown:/test')).toBe(true);
+    });
+  });
+
+  // ─── Pagination Parameter Parsing ─────────────────────────────
+  describe('Pagination parameter parsing', () => {
+    it('should use default limit when not provided', () => {
+      const { limit } = parsePaginationParams({});
+      expect(limit).toBe(30);
+    });
+
+    it('should use default offset of 0 when not provided', () => {
+      const { offset } = parsePaginationParams({});
+      expect(offset).toBe(0);
+    });
+
+    it('should parse valid limit', () => {
+      const { limit } = parsePaginationParams({ limit: '25' });
+      expect(limit).toBe(25);
+    });
+
+    it('should cap limit at maxLimit', () => {
+      const { limit } = parsePaginationParams({ limit: '200' });
+      expect(limit).toBe(50);
+    });
+
+    it('should clamp negative offset to 0', () => {
+      const { offset } = parsePaginationParams({ offset: '-5' });
+      expect(offset).toBe(0);
+    });
+
+    it('should handle NaN limit gracefully', () => {
+      const { limit } = parsePaginationParams({ limit: 'abc' });
+      expect(limit).toBe(30);
+    });
+
+    it('should handle NaN offset gracefully', () => {
+      const { offset } = parsePaginationParams({ offset: 'xyz' });
+      expect(offset).toBe(0);
+    });
+
+    it('should respect custom defaultLimit', () => {
+      const { limit } = parsePaginationParams({}, { defaultLimit: 50, maxLimit: 100 });
+      expect(limit).toBe(50);
+    });
+
+    it('should respect custom maxLimit', () => {
+      const { limit } = parsePaginationParams({ limit: '200' }, { defaultLimit: 50, maxLimit: 100 });
+      expect(limit).toBe(100);
+    });
+
+    it('should accept limit=0 as falsy and use default', () => {
+      const { limit } = parsePaginationParams({ limit: '0' });
+      expect(limit).toBe(30);
+    });
+  });
+
+  // ─── sanitizeProviderUpdate ────────────────────────────────────
+  describe('sanitizeProviderUpdate', () => {
+    it('should strip HTML from displayName', () => {
+      const result = sanitizeProviderUpdate({ displayName: '<b>Dr Evil</b>' });
+      expect(result.displayName).toBe('Dr Evil');
+    });
+
+    it('should truncate displayName to 100 characters', () => {
+      const result = sanitizeProviderUpdate({ displayName: 'A'.repeat(200) });
+      expect(result.displayName.length).toBeLessThanOrEqual(100);
+    });
+
+    it('should not set displayName if it becomes empty after stripping', () => {
+      const result = sanitizeProviderUpdate({ displayName: '<script></script>' });
+      expect(result.displayName).toBeUndefined();
+    });
+
+    it('should strip HTML from specialty', () => {
+      const result = sanitizeProviderUpdate({ specialty: '<img src=x>Cardiology' });
+      expect(result.specialty).toBe('Cardiology');
+    });
+
+    it('should accept valid hex brand color', () => {
+      const result = sanitizeProviderUpdate({ brandPrimaryColor: '#ff5500' });
+      expect(result.brandPrimaryColor).toBe('#ff5500');
+    });
+
+    it('should reject invalid hex brand color', () => {
+      const result = sanitizeProviderUpdate({ brandPrimaryColor: 'red' });
+      expect(result.brandPrimaryColor).toBeUndefined();
+    });
+
+    it('should accept valid status values', () => {
+      expect(sanitizeProviderUpdate({ status: 'draft' }).status).toBe('draft');
+      expect(sanitizeProviderUpdate({ status: 'preview' }).status).toBe('preview');
+      expect(sanitizeProviderUpdate({ status: 'published' }).status).toBe('published');
+      expect(sanitizeProviderUpdate({ status: 'suspended' }).status).toBe('suspended');
+    });
+
+    it('should reject invalid status values', () => {
+      const result = sanitizeProviderUpdate({ status: 'hacked' });
+      expect(result.status).toBeUndefined();
+    });
+
+    it('should set contactInfo to null when explicitly null', () => {
+      const result = sanitizeProviderUpdate({ contactInfo: null });
+      expect(result.contactInfo).toBeNull();
+    });
+
+    it('should sanitize contactInfo object', () => {
+      const result = sanitizeProviderUpdate({
+        contactInfo: { email: 'Doc@Test.COM', phone: '<b>555</b>' }
+      });
+      expect(result.contactInfo.email).toBe('doc@test.com');
+      expect(result.contactInfo.phone).toBe('555');
+    });
+
+    it('should sanitize enabledTopics', () => {
+      const result = sanitizeProviderUpdate({
+        enabledTopics: ['medication_info_safety', 'bogus']
+      });
+      expect(result.enabledTopics).toEqual(['medication_info_safety']);
+    });
+
+    it('should truncate welcomeMessage to 500 characters', () => {
+      const result = sanitizeProviderUpdate({ welcomeMessage: 'W'.repeat(600) });
+      expect(result.welcomeMessage.length).toBeLessThanOrEqual(500);
+    });
+
+    it('should strip HTML from welcomeMessage', () => {
+      const result = sanitizeProviderUpdate({ welcomeMessage: '<h1>Welcome</h1>' });
+      expect(result.welcomeMessage).toBe('Welcome');
+    });
+
+    it('should truncate country to 60 characters', () => {
+      const result = sanitizeProviderUpdate({ country: 'C'.repeat(100) });
+      expect(result.country.length).toBeLessThanOrEqual(60);
+    });
+
+    it('should truncate locale to 10 characters', () => {
+      const result = sanitizeProviderUpdate({ locale: 'en-US-extra-long' });
+      expect(result.locale.length).toBeLessThanOrEqual(10);
+    });
+
+    it('should set photoUrl to null when empty', () => {
+      const result = sanitizeProviderUpdate({ photoUrl: '' });
+      expect(result.photoUrl).toBeNull();
+    });
+
+    it('should accept businessHours as object', () => {
+      const hours = { mon: '9-5', tue: '9-5' };
+      const result = sanitizeProviderUpdate({ businessHours: hours });
+      expect(result.businessHours).toEqual(hours);
+    });
+
+    it('should accept businessHours as null', () => {
+      const result = sanitizeProviderUpdate({ businessHours: null });
+      expect(result.businessHours).toBeNull();
+    });
+
+    it('should reject businessHours that is a string', () => {
+      const result = sanitizeProviderUpdate({ businessHours: '9-5' });
+      expect(result.businessHours).toBeUndefined();
+    });
+
+    it('should return empty object when body has no recognized fields', () => {
+      const result = sanitizeProviderUpdate({ unknownField: 'anything' });
+      expect(Object.keys(result).length).toBe(0);
+    });
+  });
+});