TASK22057: phase19 endpoint consistency hardening slice

tests/phase19/service-behaviour.test.cjs

@@ -0,0 +1,203 @@
+const fs = require("fs");
+const path = require("path");
+const vm = require("vm");
+const assert = require("assert");
+
+const rootDir = path.resolve(__dirname, "..", "..");
+
+const loadModule = (relativePath, injected = {}) => {
+    const filePath = path.join(rootDir, relativePath);
+    let source = fs.readFileSync(filePath, "utf8");
+
+    source = source.replace(/import[\s\S]*?from\s+"[^"]+";\n?/g, "");
+    source = source.replace(
+        /export default async function\s+(\w+)\s*\(/g,
+        "async function $1("
+    );
+    source = source.replace(/export const\s+/g, "const ");
+    source = source.replace(
+        /export default\s+(\w+);/g,
+        "module.exports.default = $1;"
+    );
+
+    source +=
+        '\nif (typeof ApiProxy !== "undefined" && !module.exports.default) module.exports.default = ApiProxy;\n';
+
+    const context = {
+        module: { exports: {} },
+        exports: {},
+        require,
+        process,
+        CryptoJS: {
+            HmacSHA256: () => ({ toString: () => "hashed" }),
+            enc: { Hex: { parse: () => "" } }
+        },
+        console: {
+            log: () => {},
+            info: () => {},
+            warn: () => {},
+            error: () => {}
+        },
+        ...injected
+    };
+
+    vm.runInNewContext(source, context, { filename: filePath });
+    return context.module.exports;
+};
+
+const createRes = () => {
+    const state = {
+        statusCode: null,
+        jsonBody: undefined
+    };
+
+    return {
+        state,
+        status(code) {
+            state.statusCode = code;
+            return this;
+        },
+        json(payload) {
+            state.jsonBody = payload;
+            return payload;
+        }
+    };
+};
+
+const tests = [];
+const test = (name, fn) => tests.push({ name, fn });
+
+test("createwatchedcases_api rejects missing required @odata binds with 400", async () => {
+    let axiosCalls = 0;
+    const axiosMock = async () => {
+        axiosCalls += 1;
+        return { data: {} };
+    };
+    axiosMock.get = async () => ({ data: { value: [] } });
+
+    const mod = loadModule("pages/api/endpoint/createwatchedcases_api.js", {
+        axios: axiosMock,
+        getToken: async () => ({ access_token: "token" })
+    });
+
+    const req = { body: {} };
+    const res = createRes();
+    await mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 400);
+    assert.strictEqual(axiosCalls, 0);
+});
+
+test("createwatchedcases_api rejects malformed @odata bind values with 400", async () => {
+    let axiosCalls = 0;
+    const axiosMock = async () => {
+        axiosCalls += 1;
+        return { data: {} };
+    };
+    axiosMock.get = async () => ({ data: { value: [] } });
+
+    const mod = loadModule("pages/api/endpoint/createwatchedcases_api.js", {
+        axios: axiosMock,
+        getToken: async () => ({ access_token: "token" })
+    });
+
+    const req = {
+        body: {
+            "pinswg_WatchedCase@odata.bind": "/incidents/no-brackets",
+            "pinswg_Contact@odata.bind": "/contacts/no-brackets"
+        }
+    };
+    const res = createRes();
+    await mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 400);
+    assert.strictEqual(axiosCalls, 0);
+});
+
+test("createwatchedcases_api valid body still returns 200", async () => {
+    const axiosConfigCalls = [];
+    const axiosMock = async (config) => {
+        axiosConfigCalls.push(config);
+        return { data: { ok: true } };
+    };
+    axiosMock.get = async () => ({ data: { value: [] } });
+
+    const mod = loadModule("pages/api/endpoint/createwatchedcases_api.js", {
+        axios: axiosMock,
+        getToken: async () => ({ access_token: "token" })
+    });
+
+    const req = {
+        body: {
+            "pinswg_WatchedCase@odata.bind": "/incidents(inc-1)",
+            "pinswg_Contact@odata.bind": "/contacts(con-1)"
+        }
+    };
+    const res = createRes();
+    await mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 200);
+    assert.strictEqual(axiosConfigCalls.length, 1);
+});
+
+test("getappealtypes_api still returns 200 on successful relay call", async () => {
+    const mod = loadModule("pages/api/endpoint/getappealtypes_api.js", {
+        axios: { get: async () => ({ data: { value: [{ id: 1 }] } }) },
+        getToken: async () => ({ access_token: "token" }),
+        azureHeaders: () => ({})
+    });
+
+    const req = { query: {} };
+    const res = createRes();
+    await mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 200);
+    assert.deepStrictEqual(JSON.parse(JSON.stringify(res.state.jsonBody)), {
+        value: [{ id: 1 }]
+    });
+});
+
+test("getdnslist_api still returns 200 and preserves nextLink transform", async () => {
+    const mod = loadModule("pages/api/endpoint/getdnslist_api.js", {
+        axios: {
+            get: async () => ({
+                data: {
+                    value: [{ id: 1 }],
+                    "@odata.nextLink":
+                        "https://example.test/v8.2/incidents?$skiptoken=abc"
+                }
+            })
+        },
+        getToken: async () => ({ access_token: "token" }),
+        azureHeaders: () => ({}),
+        _: { has: (obj, key) => Object.prototype.hasOwnProperty.call(obj, key) }
+    });
+
+    const req = { query: {} };
+    const res = createRes();
+    await mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 200);
+    assert.strictEqual(
+        res.state.jsonBody["@odata.nextLink"],
+        'incidents?$skiptoken=abc"'
+    );
+});
+
+const run = async () => {
+    let passed = 0;
+
+    for (const currentTest of tests) {
+        await currentTest.fn();
+        passed += 1;
+    }
+
+    console.log(
+        `Phase 19 behavioural tests passed (${passed}/${tests.length}).`
+    );
+};
+
+run().catch((error) => {
+    console.error(error);
+    process.exit(1);
+});