whale-code 6.5.6 → 6.5.8

package/dist/server/handlers/__tests__/e2e/auth-cross-platform-tokens.e2e.test.js

@@ -0,0 +1,264 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { randomUUID } from "node:crypto";
+import { HAS_TEST_DB, getTestClient, seedTracked, cleanup, RUN_PREFIX } from "../../__test-utils__/test-db.js";
+const sb = getTestClient();
+
+// In-memory stores
+
+let inMemorySessions = [];
+let inMemoryApiCalls = [];
+let inMemoryStoreMemberships = [];
+let jwtCounter = 0;
+function generateJwt(userId, storeId, expiresInMs = 3600000) {
+  const header = {
+    alg: "HS256",
+    typ: "JWT"
+  };
+  const payload = {
+    sub: userId,
+    store_id: storeId,
+    iat: Date.now(),
+    exp: Date.now() + expiresInMs,
+    jti: `${Date.now()}_${++jwtCounter}`
+  };
+  const b64 = obj => Buffer.from(JSON.stringify(obj)).toString("base64url");
+  return `${b64(header)}.${b64(payload)}.mock_signature`;
+}
+function parseJwt(token) {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) return null;
+    const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString());
+    return payload;
+  } catch {
+    return null;
+  }
+}
+async function login(email, password) {
+  const {
+    data: userLookup
+  } = await sb.from("platform_users").select().eq("email", email);
+  if (!userLookup || userLookup.length === 0) {
+    return {
+      token: null,
+      error: "Invalid credentials"
+    };
+  }
+  const user = userLookup[0];
+  const prefs = user.preferences ?? {};
+  if (prefs._test_password_hash !== `hashed_${password}`) {
+    return {
+      token: null,
+      error: "Invalid credentials"
+    };
+  }
+  const membership = inMemoryStoreMemberships.find(m => m.user_id === user.id);
+  if (!membership) {
+    return {
+      token: null,
+      error: "No store assigned"
+    };
+  }
+  const storeId = membership.store_id;
+  const token = generateJwt(user.id, storeId);
+  inMemorySessions.push({
+    id: randomUUID(),
+    user_id: user.id,
+    store_id: storeId,
+    token_hash: `hash_${token.slice(-10)}`,
+    expires_at: new Date(Date.now() + 3600000).toISOString(),
+    active: true
+  });
+  return {
+    token,
+    error: null
+  };
+}
+async function authenticateRequest(token) {
+  const payload = parseJwt(token);
+  if (!payload) {
+    return {
+      userId: null,
+      storeId: null,
+      error: "Invalid token"
+    };
+  }
+  if (payload.exp < Date.now()) {
+    return {
+      userId: null,
+      storeId: null,
+      error: "Token expired"
+    };
+  }
+  const {
+    data: user
+  } = await sb.from("platform_users").select().eq("id", payload.sub);
+  if (!user || user.length === 0) {
+    return {
+      userId: null,
+      storeId: null,
+      error: "User not found"
+    };
+  }
+  return {
+    userId: payload.sub,
+    storeId: payload.store_id,
+    error: null
+  };
+}
+async function makeAuthenticatedApiCall(token, endpoint, targetStoreId) {
+  const auth = await authenticateRequest(token);
+  if (auth.error) {
+    return {
+      data: null,
+      error: auth.error,
+      statusCode: 401
+    };
+  }
+  if (auth.storeId !== targetStoreId) {
+    inMemoryApiCalls.push({
+      id: randomUUID(),
+      user_id: auth.userId,
+      endpoint,
+      target_store_id: targetStoreId,
+      authorized: false,
+      reason: "store_mismatch"
+    });
+    return {
+      data: null,
+      error: "Forbidden: store access denied",
+      statusCode: 403
+    };
+  }
+  inMemoryApiCalls.push({
+    id: randomUUID(),
+    user_id: auth.userId,
+    endpoint,
+    target_store_id: targetStoreId,
+    authorized: true
+  });
+  return {
+    data: {
+      store_id: targetStoreId,
+      endpoint,
+      result: "ok"
+    },
+    error: null,
+    statusCode: 200
+  };
+}
+async function refreshSession(userId, storeId) {
+  for (const session of inMemorySessions) {
+    if (session.user_id === userId) {
+      session.active = false;
+    }
+  }
+  const newToken = generateJwt(userId, storeId);
+  inMemorySessions.push({
+    id: randomUUID(),
+    user_id: userId,
+    store_id: storeId,
+    token_hash: `hash_${newToken.slice(-10)}`,
+    expires_at: new Date(Date.now() + 3600000).toISOString(),
+    active: true
+  });
+  return {
+    token: newToken,
+    error: null
+  };
+}
+describe.skipIf(!HAS_TEST_DB)("Auth Cross-Platform E2E — tokens & refresh", () => {
+  let storeAId;
+  let storeBId;
+  let user1Id;
+  let user2Id;
+  beforeEach(async () => {
+    storeAId = randomUUID();
+    storeBId = randomUUID();
+    user1Id = randomUUID();
+    user2Id = randomUUID();
+    inMemorySessions = [];
+    inMemoryApiCalls = [];
+    inMemoryStoreMemberships = [];
+    await seedTracked("stores", [{
+      id: storeAId,
+      store_name: `${RUN_PREFIX}_Store Alpha`,
+      slug: `${RUN_PREFIX}-store-alpha`,
+      email: `${RUN_PREFIX}_alpha@example.com`
+    }, {
+      id: storeBId,
+      store_name: `${RUN_PREFIX}_Store Beta`,
+      slug: `${RUN_PREFIX}-store-beta`,
+      email: `${RUN_PREFIX}_beta@example.com`
+    }]);
+    await seedTracked("platform_users", [{
+      id: user1Id,
+      email: `${RUN_PREFIX}_alice@example.com`,
+      first_name: "Alice",
+      last_name: "Test",
+      preferences: {
+        _test_password_hash: "hashed_secret123"
+      }
+    }, {
+      id: user2Id,
+      email: `${RUN_PREFIX}_bob@example.com`,
+      first_name: "Bob",
+      last_name: "Test",
+      preferences: {
+        _test_password_hash: "hashed_password456"
+      }
+    }]);
+    inMemoryStoreMemberships = [{
+      id: randomUUID(),
+      user_id: user1Id,
+      store_id: storeAId,
+      role: "owner"
+    }, {
+      id: randomUUID(),
+      user_id: user2Id,
+      store_id: storeBId,
+      role: "member"
+    }];
+  });
+  afterEach(async () => {
+    await cleanup();
+  });
+  it("rejects requests with invalid or expired tokens", async () => {
+    const expiredToken = generateJwt(user1Id, storeAId, -1000);
+    const expiredResult = await makeAuthenticatedApiCall(expiredToken, "/api/data", storeAId);
+    expect(expiredResult.statusCode).toBe(401);
+    expect(expiredResult.error).toBe("Token expired");
+    const malformedResult = await makeAuthenticatedApiCall("not.a.valid.token", "/api/data", storeAId);
+    expect(malformedResult.statusCode).toBe(401);
+    expect(malformedResult.error).toBe("Invalid token");
+    const {
+      token,
+      error
+    } = await login(`${RUN_PREFIX}_alice@example.com`, "wrongpassword");
+    expect(token).toBeNull();
+    expect(error).toBe("Invalid credentials");
+  });
+  it("refreshes session and invalidates old tokens", async () => {
+    const {
+      token: originalToken
+    } = await login(`${RUN_PREFIX}_bob@example.com`, "password456");
+    expect(originalToken).not.toBeNull();
+    const originalSessions = inMemorySessions.filter(s => s.user_id === user2Id);
+    const activeOrig = originalSessions.find(s => s.active === true);
+    expect(activeOrig).toBeDefined();
+    const {
+      token: newToken,
+      error
+    } = await refreshSession(user2Id, storeBId);
+    expect(error).toBeNull();
+    expect(newToken).toBeDefined();
+    expect(newToken).not.toBe(originalToken);
+    const allSessions = inMemorySessions.filter(s => s.user_id === user2Id);
+    const activeSessions = allSessions.filter(s => s.active === true);
+    const inactiveSessions = allSessions.filter(s => s.active === false);
+    expect(activeSessions).toHaveLength(1);
+    expect(inactiveSessions.length).toBeGreaterThanOrEqual(1);
+    const result = await makeAuthenticatedApiCall(newToken, "/api/inventory", storeBId);
+    expect(result.statusCode).toBe(200);
+  });
+});

package/dist/server/handlers/__tests__/e2e/email-pipeline-send.e2e.test.js

@@ -0,0 +1,214 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { randomUUID } from "node:crypto";
+import { HAS_TEST_DB, RUN_PREFIX } from "../../__test-utils__/test-db.js";
+
+// ============================================================================
+// In-memory stores for email pipeline
+// ============================================================================
+
+let emailRecords = [];
+let emailThreads = [];
+let emailSettings = [];
+const mockResendApi = {
+  send: vi.fn()
+};
+
+// ============================================================================
+// Email Pipeline Helpers
+// ============================================================================
+
+function detectThread(recipient, subject, storeId) {
+  const baseSubject = subject.replace(/^(Re:|Fwd:)\s*/gi, "").trim();
+  const thread = emailThreads.find(t => t.store_id === storeId && t.recipient === recipient && t.base_subject === baseSubject);
+  return thread ? thread.id : null;
+}
+function sendEmail(params) {
+  const storeSettings = emailSettings.find(s => s.store_id === params.store_id) ?? {};
+  const isTestMode = storeSettings.test_mode === true;
+  const testRedirectAddress = storeSettings.test_redirect_email;
+  const effectiveTo = isTestMode && testRedirectAddress ? testRedirectAddress : params.to;
+  const providerId = `msg_${RUN_PREFIX}_${Date.now()}_${Math.random().toString(36).slice(2, 6)}`;
+  mockResendApi.send.mockReturnValueOnce({
+    id: providerId,
+    status: "sent"
+  });
+  mockResendApi.send({
+    from: params.from_address,
+    to: effectiveTo,
+    subject: params.subject,
+    html: params.html_body
+  });
+  const baseSubject = params.subject.replace(/^(Re:|Fwd:)\s*/gi, "").trim();
+  let threadId = detectThread(params.to, params.subject, params.store_id);
+  if (!threadId) {
+    threadId = randomUUID();
+    emailThreads.push({
+      id: threadId,
+      store_id: params.store_id,
+      recipient: params.to,
+      base_subject: baseSubject,
+      message_count: 0
+    });
+  }
+  const thread = emailThreads.find(t => t.id === threadId);
+  if (thread) {
+    thread.message_count += 1;
+  }
+  const emailId = randomUUID();
+  emailRecords.push({
+    id: emailId,
+    store_id: params.store_id,
+    recipient: params.to,
+    effective_recipient: effectiveTo,
+    from_address: params.from_address,
+    subject: params.subject,
+    status: "sent",
+    provider_id: providerId,
+    thread_id: threadId,
+    tags: params.tags ? JSON.stringify(params.tags) : null,
+    is_test_mode: isTestMode
+  });
+  return {
+    emailId,
+    providerId
+  };
+}
+function processResendWebhook(event) {
+  const statusMap = {
+    "email.delivered": "delivered",
+    "email.bounced": "bounced",
+    "email.complained": "complained"
+  };
+  const newStatus = statusMap[event.type];
+  if (!newStatus) {
+    return {
+      updated: false
+    };
+  }
+  const record = emailRecords.find(r => r.provider_id === event.data.email_id);
+  if (!record) {
+    return {
+      updated: false
+    };
+  }
+  record.status = newStatus;
+  record.status_updated_at = event.data.created_at;
+  if (event.type === "email.bounced") {
+    record.bounce_type = event.data.bounce_type ?? "hard";
+  }
+  return {
+    updated: true
+  };
+}
+
+// ============================================================================
+// E2E Tests: Email Pipeline — send & webhooks
+// ============================================================================
+
+describe.skipIf(!HAS_TEST_DB)("Email Pipeline E2E — send & webhooks", () => {
+  const emailStoreId = `${RUN_PREFIX}_store_email`;
+  beforeEach(() => {
+    vi.clearAllMocks();
+    emailRecords = [];
+    emailThreads = [];
+    emailSettings = [];
+    emailSettings.push({
+      id: randomUUID(),
+      store_id: emailStoreId,
+      test_mode: false,
+      test_redirect_email: "dev@internal.example.com",
+      domain: "mail.example.com",
+      from_name: "Test Store",
+      from_email: "noreply@mail.example.com"
+    });
+  });
+  afterEach(() => {});
+  it("sends an email via edge function and creates email_records entry", () => {
+    const {
+      emailId,
+      providerId
+    } = sendEmail({
+      to: `${RUN_PREFIX}_customer@example.com`,
+      subject: `${RUN_PREFIX}_Your order is ready`,
+      html_body: "<p>Order #123 is ready for pickup.</p>",
+      store_id: emailStoreId,
+      from_address: "noreply@mail.example.com"
+    });
+    expect(emailId).toBeDefined();
+    expect(providerId).toBeDefined();
+    expect(mockResendApi.send).toHaveBeenCalledWith(expect.objectContaining({
+      to: `${RUN_PREFIX}_customer@example.com`,
+      subject: `${RUN_PREFIX}_Your order is ready`
+    }));
+    const records = emailRecords.filter(r => r.id === emailId);
+    expect(records).toHaveLength(1);
+    expect(records[0].status).toBe("sent");
+    expect(records[0].recipient).toBe(`${RUN_PREFIX}_customer@example.com`);
+    expect(records[0].provider_id).toBe(providerId);
+  });
+  it("updates status to delivered when Resend webhook fires", () => {
+    const {
+      providerId
+    } = sendEmail({
+      to: `${RUN_PREFIX}_user@example.com`,
+      subject: `${RUN_PREFIX}_Welcome`,
+      html_body: "<p>Welcome!</p>",
+      store_id: emailStoreId,
+      from_address: "noreply@mail.example.com"
+    });
+    const result = processResendWebhook({
+      type: "email.delivered",
+      data: {
+        email_id: providerId,
+        to: `${RUN_PREFIX}_user@example.com`,
+        created_at: new Date().toISOString()
+      }
+    });
+    expect(result.updated).toBe(true);
+    const records = emailRecords.filter(r => r.provider_id === providerId);
+    expect(records[0].status).toBe("delivered");
+    expect(records[0].status_updated_at).toBeDefined();
+  });
+  it("handles bounce and complaint webhooks correctly", () => {
+    const {
+      providerId: bouncedId
+    } = sendEmail({
+      to: `${RUN_PREFIX}_invalid@example.com`,
+      subject: `${RUN_PREFIX}_Test bounce`,
+      html_body: "<p>Test</p>",
+      store_id: emailStoreId,
+      from_address: "noreply@mail.example.com"
+    });
+    const {
+      providerId: complainedId
+    } = sendEmail({
+      to: `${RUN_PREFIX}_annoyed@example.com`,
+      subject: `${RUN_PREFIX}_Test complaint`,
+      html_body: "<p>Spam?</p>",
+      store_id: emailStoreId,
+      from_address: "noreply@mail.example.com"
+    });
+    processResendWebhook({
+      type: "email.bounced",
+      data: {
+        email_id: bouncedId,
+        to: `${RUN_PREFIX}_invalid@example.com`,
+        created_at: new Date().toISOString(),
+        bounce_type: "hard"
+      }
+    });
+    processResendWebhook({
+      type: "email.complained",
+      data: {
+        email_id: complainedId,
+        to: `${RUN_PREFIX}_annoyed@example.com`,
+        created_at: new Date().toISOString()
+      }
+    });
+    const bouncedRecord = emailRecords.find(r => r.provider_id === bouncedId);
+    expect(bouncedRecord.status).toBe("bounced");
+    expect(bouncedRecord.bounce_type).toBe("hard");
+    const complainedRecord = emailRecords.find(r => r.provider_id === complainedId);
+    expect(complainedRecord.status).toBe("complained");
+  });
+});

package/dist/server/handlers/__tests__/e2e/email-pipeline-threads.e2e.test.js

@@ -0,0 +1,168 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { randomUUID } from "node:crypto";
+import { HAS_TEST_DB, RUN_PREFIX } from "../../__test-utils__/test-db.js";
+
+// ============================================================================
+// In-memory stores for email pipeline
+// ============================================================================
+
+let emailRecords = [];
+let emailThreads = [];
+let emailSettings = [];
+const mockResendApi = {
+  send: vi.fn()
+};
+
+// ============================================================================
+// Email Pipeline Helpers
+// ============================================================================
+
+function detectThread(recipient, subject, storeId) {
+  const baseSubject = subject.replace(/^(Re:|Fwd:)\s*/gi, "").trim();
+  const thread = emailThreads.find(t => t.store_id === storeId && t.recipient === recipient && t.base_subject === baseSubject);
+  return thread ? thread.id : null;
+}
+function sendEmail(params) {
+  const storeSettings = emailSettings.find(s => s.store_id === params.store_id) ?? {};
+  const isTestMode = storeSettings.test_mode === true;
+  const testRedirectAddress = storeSettings.test_redirect_email;
+  const effectiveTo = isTestMode && testRedirectAddress ? testRedirectAddress : params.to;
+  const providerId = `msg_${RUN_PREFIX}_${Date.now()}_${Math.random().toString(36).slice(2, 6)}`;
+  mockResendApi.send.mockReturnValueOnce({
+    id: providerId,
+    status: "sent"
+  });
+  mockResendApi.send({
+    from: params.from_address,
+    to: effectiveTo,
+    subject: params.subject,
+    html: params.html_body
+  });
+  const baseSubject = params.subject.replace(/^(Re:|Fwd:)\s*/gi, "").trim();
+  let threadId = detectThread(params.to, params.subject, params.store_id);
+  if (!threadId) {
+    threadId = randomUUID();
+    emailThreads.push({
+      id: threadId,
+      store_id: params.store_id,
+      recipient: params.to,
+      base_subject: baseSubject,
+      message_count: 0
+    });
+  }
+  const thread = emailThreads.find(t => t.id === threadId);
+  if (thread) {
+    thread.message_count += 1;
+  }
+  const emailId = randomUUID();
+  emailRecords.push({
+    id: emailId,
+    store_id: params.store_id,
+    recipient: params.to,
+    effective_recipient: effectiveTo,
+    from_address: params.from_address,
+    subject: params.subject,
+    status: "sent",
+    provider_id: providerId,
+    thread_id: threadId,
+    tags: params.tags ? JSON.stringify(params.tags) : null,
+    is_test_mode: isTestMode
+  });
+  return {
+    emailId,
+    providerId
+  };
+}
+
+// ============================================================================
+// E2E Tests: Email Pipeline — test mode & threading
+// ============================================================================
+
+describe.skipIf(!HAS_TEST_DB)("Email Pipeline E2E — test mode & threads", () => {
+  const emailStoreId = `${RUN_PREFIX}_store_email`;
+  beforeEach(() => {
+    vi.clearAllMocks();
+    emailRecords = [];
+    emailThreads = [];
+    emailSettings = [];
+    emailSettings.push({
+      id: randomUUID(),
+      store_id: emailStoreId,
+      test_mode: false,
+      test_redirect_email: "dev@internal.example.com",
+      domain: "mail.example.com",
+      from_name: "Test Store",
+      from_email: "noreply@mail.example.com"
+    });
+  });
+  afterEach(() => {});
+  it("redirects emails to test address when test mode is enabled", () => {
+    const settings = emailSettings.find(s => s.store_id === emailStoreId);
+    if (settings) settings.test_mode = true;
+    const {
+      emailId
+    } = sendEmail({
+      to: `${RUN_PREFIX}_real-customer@example.com`,
+      subject: `${RUN_PREFIX}_Order confirmation`,
+      html_body: "<p>Your order is confirmed.</p>",
+      store_id: emailStoreId,
+      from_address: "noreply@mail.example.com"
+    });
+    expect(mockResendApi.send).toHaveBeenCalledWith(expect.objectContaining({
+      to: "dev@internal.example.com"
+    }));
+    const record = emailRecords.find(r => r.id === emailId);
+    expect(record.recipient).toBe(`${RUN_PREFIX}_real-customer@example.com`);
+    expect(record.effective_recipient).toBe("dev@internal.example.com");
+    expect(record.is_test_mode).toBe(true);
+  });
+  it("detects email threads by base subject and recipient", () => {
+    const recipient = `${RUN_PREFIX}_support@customer.com`;
+    const {
+      emailId: firstId
+    } = sendEmail({
+      to: recipient,
+      subject: `${RUN_PREFIX}_Order question`,
+      html_body: "<p>I have a question about my order.</p>",
+      store_id: emailStoreId,
+      from_address: "noreply@mail.example.com"
+    });
+    const {
+      emailId: replyId
+    } = sendEmail({
+      to: recipient,
+      subject: `Re: ${RUN_PREFIX}_Order question`,
+      html_body: "<p>Thanks for your response.</p>",
+      store_id: emailStoreId,
+      from_address: "noreply@mail.example.com"
+    });
+    const firstRecord = emailRecords.find(r => r.id === firstId);
+    const replyRecord = emailRecords.find(r => r.id === replyId);
+    expect(firstRecord.thread_id).toBe(replyRecord.thread_id);
+    const thread = emailThreads.find(t => t.id === firstRecord.thread_id);
+    expect(thread.message_count).toBe(2);
+    expect(thread.base_subject).toBe(`${RUN_PREFIX}_Order question`);
+  });
+  it("creates separate threads for different recipients with same subject", () => {
+    const aliceEmail = `${RUN_PREFIX}_alice@example.com`;
+    const bobEmail = `${RUN_PREFIX}_bob@example.com`;
+    const subject = `${RUN_PREFIX}_Welcome`;
+    sendEmail({
+      to: aliceEmail,
+      subject,
+      html_body: "<p>Welcome Alice!</p>",
+      store_id: emailStoreId,
+      from_address: "noreply@mail.example.com"
+    });
+    sendEmail({
+      to: bobEmail,
+      subject,
+      html_body: "<p>Welcome Bob!</p>",
+      store_id: emailStoreId,
+      from_address: "noreply@mail.example.com"
+    });
+    const threads = emailThreads.filter(t => t.store_id === emailStoreId && t.base_subject === `${RUN_PREFIX}_Welcome`);
+    expect(threads).toHaveLength(2);
+    expect(threads[0].recipient).not.toBe(threads[1].recipient);
+  });
+});