626 lines
20 KiB
JavaScript
626 lines
20 KiB
JavaScript
const assert = require("assert");
|
|
const fs = require("fs");
|
|
const path = require("path");
|
|
const {
|
|
createAxiosMock,
|
|
createLoggerMock,
|
|
createAxiosError,
|
|
loadServiceModule,
|
|
normalize
|
|
} = require("../serviceHarness.cjs");
|
|
|
|
const tests = [];
|
|
|
|
const test = (name, fn) => {
|
|
tests.push({ name, fn });
|
|
};
|
|
|
|
test("document/getAwaitingSubmissionFromBlob includes hash token and returns data", async () => {
|
|
const axios = createAxiosMock();
|
|
const logger = createLoggerMock();
|
|
const hashCalls = [];
|
|
const hashAPIPath = (queryPath) => {
|
|
hashCalls.push(queryPath);
|
|
return "&hash=abc123";
|
|
};
|
|
|
|
axios.getHandler = async () => ({ data: { value: ["blob-item"] } });
|
|
|
|
const document = loadServiceModule("documentDirectService.js", {
|
|
axios,
|
|
BASE_URL: "http://example.local",
|
|
consoleLogger: logger.consoleLogger,
|
|
hashAPIPath
|
|
});
|
|
|
|
const result = await document.getAwaitingSubmissionFromBlob("container-1");
|
|
|
|
assert.deepStrictEqual(normalize(result), { value: ["blob-item"] });
|
|
assert.strictEqual(hashCalls.length, 1);
|
|
assert.strictEqual(
|
|
hashCalls[0],
|
|
"/api/file/getawaitingsubmissionfromblob?container=container-1"
|
|
);
|
|
assert.strictEqual(
|
|
axios.calls[0].url,
|
|
"http://example.local/api/file/getawaitingsubmissionfromblob?container=container-1&hash=abc123"
|
|
);
|
|
});
|
|
|
|
test("document/getAwaitingSubmissionFromBlob logs and returns undefined on failure", async () => {
|
|
const axios = createAxiosMock();
|
|
const logger = createLoggerMock();
|
|
|
|
axios.getHandler = async () =>
|
|
Promise.reject(createAxiosError(403, "Forbidden"));
|
|
|
|
const document = loadServiceModule("documentDirectService.js", {
|
|
axios,
|
|
BASE_URL: "",
|
|
consoleLogger: logger.consoleLogger,
|
|
hashAPIPath: () => "&hash=xyz"
|
|
});
|
|
|
|
const result = await document.getAwaitingSubmissionFromBlob("container-2");
|
|
|
|
assert.strictEqual(result, undefined);
|
|
assert.strictEqual(logger.calls.length, 1);
|
|
});
|
|
|
|
test("document/getRepsFromBlob forwards cookies only to trusted origin without redirects", async () => {
|
|
const axios = createAxiosMock();
|
|
const logger = createLoggerMock();
|
|
|
|
axios.getHandler = async () => ({
|
|
data: { value: ["representation"] }
|
|
});
|
|
|
|
const document = loadServiceModule("documentDirectService.js", {
|
|
axios,
|
|
BASE_URL: "http://example.local",
|
|
consoleLogger: logger.consoleLogger,
|
|
hashAPIPath: () => "&hash=abc123"
|
|
});
|
|
|
|
const result = await document.getRepsFromBlob("container-1", {
|
|
headers: {
|
|
Cookie: "next-auth.session-token=test-session"
|
|
}
|
|
});
|
|
|
|
assert.deepStrictEqual(normalize(result), {
|
|
value: ["representation"]
|
|
});
|
|
|
|
assert.strictEqual(axios.calls.length, 1);
|
|
assert.strictEqual(
|
|
axios.calls[0].url,
|
|
"http://example.local/api/file/getrepsblob?container=container-1&hash=abc123"
|
|
);
|
|
assert.strictEqual(
|
|
axios.calls[0].config.headers.Cookie,
|
|
"next-auth.session-token=test-session"
|
|
);
|
|
assert.strictEqual(axios.calls[0].config.maxRedirects, 0);
|
|
assert.strictEqual(logger.calls.length, 0);
|
|
});
|
|
|
|
test("document/getRepsFromBlob rejects untrusted origin before HTTP request", async () => {
|
|
const axios = createAxiosMock();
|
|
const logger = createLoggerMock();
|
|
|
|
const document = loadServiceModule("documentDirectService.js", {
|
|
axios,
|
|
BASE_URL: "https://untrusted.example",
|
|
consoleLogger: logger.consoleLogger,
|
|
hashAPIPath: () => "&hash=abc123"
|
|
});
|
|
|
|
await assert.rejects(
|
|
document.getRepsFromBlob("container-1", {
|
|
headers: {
|
|
Cookie: "next-auth.session-token=test-session"
|
|
}
|
|
}),
|
|
/Untrusted representation request destination/
|
|
);
|
|
|
|
assert.strictEqual(axios.calls.length, 0);
|
|
assert.strictEqual(logger.calls.length, 0);
|
|
});
|
|
|
|
test("document/getRepsFromBlob preserves requests without forwarded cookies", async () => {
|
|
const axios = createAxiosMock();
|
|
const logger = createLoggerMock();
|
|
|
|
axios.getHandler = async () => ({
|
|
data: { value: ["representation"] }
|
|
});
|
|
|
|
const document = loadServiceModule("documentDirectService.js", {
|
|
axios,
|
|
BASE_URL: "http://example.local",
|
|
consoleLogger: logger.consoleLogger,
|
|
hashAPIPath: () => "&hash=abc123"
|
|
});
|
|
|
|
const result = await document.getRepsFromBlob("container-1");
|
|
|
|
assert.deepStrictEqual(normalize(result), {
|
|
value: ["representation"]
|
|
});
|
|
assert.strictEqual(axios.calls.length, 1);
|
|
assert.strictEqual(axios.calls[0].config, undefined);
|
|
assert.strictEqual(logger.calls.length, 0);
|
|
});
|
|
|
|
test("portal/deleteWatchedCases uses signer hash and returns data", async () => {
|
|
const axios = createAxiosMock();
|
|
const logger = createLoggerMock();
|
|
const signCalls = [];
|
|
|
|
axios.getHandler = async (url) => {
|
|
if (url.startsWith("/api/endpoint/gethash_api?path=")) {
|
|
signCalls.push(url);
|
|
return { data: { hash: "&hash=watch123" } };
|
|
}
|
|
|
|
throw new Error("Unexpected get url: " + url);
|
|
};
|
|
|
|
axios.requestHandler = async () => ({ data: { removed: true } });
|
|
|
|
const portal = loadServiceModule("portalDirectService.js", {
|
|
axios,
|
|
BASE_URL: "",
|
|
consoleLogger: logger.consoleLogger,
|
|
hashAPIPath: () => "&hash=fallback"
|
|
});
|
|
|
|
const result = await portal.deleteWatchedCases("watch-1");
|
|
|
|
assert.deepStrictEqual(normalize(result), { removed: true });
|
|
assert.strictEqual(
|
|
signCalls[0],
|
|
"/api/endpoint/gethash_api?path=%2Fapi%2Fsubscriptions%2Fdelete-watched-case%3FwatchedCaseID%3Dwatch-1"
|
|
);
|
|
assert.strictEqual(
|
|
axios.calls[1].config.url,
|
|
"/api/subscriptions/delete-watched-case?watchedCaseID=watch-1&hash=watch123"
|
|
);
|
|
});
|
|
|
|
test("document delete blob flows use signer hash", async () => {
|
|
const axios = createAxiosMock();
|
|
const logger = createLoggerMock();
|
|
const signCalls = [];
|
|
|
|
axios.getHandler = async (url) => {
|
|
if (url.startsWith("/api/endpoint/gethash_api?path=")) {
|
|
signCalls.push(url);
|
|
return { data: { hash: "&hash=doc123" } };
|
|
}
|
|
|
|
throw new Error("Unexpected get url: " + url);
|
|
};
|
|
|
|
axios.requestHandler = async () => ({ data: { ok: true } });
|
|
|
|
const document = loadServiceModule("documentDirectService.js", {
|
|
axios,
|
|
BASE_URL: "",
|
|
consoleLogger: logger.consoleLogger,
|
|
hashAPIPath: () => "&hash=fallback",
|
|
postSignedFileJson: async (queryUrl, data, config = {}) => {
|
|
const hashResponse = await axios.get(
|
|
"/api/endpoint/gethash_api?path=" + encodeURIComponent(queryUrl)
|
|
);
|
|
|
|
const response = await axios({
|
|
method: "post",
|
|
url: queryUrl + hashResponse.data.hash,
|
|
data,
|
|
...config
|
|
});
|
|
|
|
return response.data;
|
|
}
|
|
});
|
|
|
|
const one = await document.deleteAwaitingSubmissionsFromBlob(
|
|
"c1",
|
|
"case-1"
|
|
);
|
|
const two = await document.deleteMyRepresentationsFromBlob(
|
|
"c1",
|
|
"case-1",
|
|
"rep-a"
|
|
);
|
|
|
|
assert.deepStrictEqual(normalize(one), { ok: true });
|
|
assert.deepStrictEqual(normalize(two), { ok: true });
|
|
assert.strictEqual(
|
|
signCalls[0],
|
|
"/api/endpoint/gethash_api?path=%2Fapi%2Ffile%2Fdeleteblobcase%3Fcontainer%3Dc1%26casefolderID%3Dcase-1"
|
|
);
|
|
assert.strictEqual(
|
|
signCalls[1],
|
|
"/api/endpoint/gethash_api?path=%2Fapi%2Ffile%2Fdeleteblobrep%3Fcontainer%3Dc1%26casefolderID%3Dcase-1%26repfile%3Drep-a"
|
|
);
|
|
});
|
|
|
|
test("document/downloadBlob delegates blob request config via file client helper", async () => {
|
|
const axios = createAxiosMock();
|
|
const logger = createLoggerMock();
|
|
|
|
axios.requestHandler = async (config) => {
|
|
return { data: { type: "blob", url: config.url } };
|
|
};
|
|
|
|
const document = loadServiceModule("documentDirectService.js", {
|
|
axios,
|
|
BASE_URL: "http://example.local",
|
|
consoleLogger: logger.consoleLogger,
|
|
hashAPIPath: () => ""
|
|
});
|
|
|
|
const result = await document.downloadBlob(
|
|
"MyContainer",
|
|
"folder/file.pdf"
|
|
);
|
|
|
|
assert.deepStrictEqual(normalize(result), {
|
|
type: "blob",
|
|
url: "http://example.local/api/file/downloadblob?container=mycontainer&blobname=folder/file.pdf"
|
|
});
|
|
assert.strictEqual(axios.calls.length, 1);
|
|
assert.strictEqual(axios.calls[0].type, "request");
|
|
assert.strictEqual(axios.calls[0].config.method, "get");
|
|
assert.strictEqual(axios.calls[0].config.responseType, "blob");
|
|
});
|
|
|
|
test("account/getPortalLogin appends hash and returns res.data", async () => {
|
|
const axios = createAxiosMock();
|
|
const logger = createLoggerMock();
|
|
const signCalls = [];
|
|
|
|
axios.getHandler = async (url) => {
|
|
if (url.startsWith("/api/endpoint/gethash_api?path=")) {
|
|
signCalls.push(url);
|
|
return { data: { hash: "&hash=login123" } };
|
|
}
|
|
|
|
throw new Error("Unexpected get url: " + url);
|
|
};
|
|
|
|
axios.requestHandler = async () => ({
|
|
data: { value: [{ id: "user-1" }] }
|
|
});
|
|
|
|
const account = loadServiceModule("accountDirectService.js", {
|
|
axios,
|
|
BASE_URL: "http://example.local",
|
|
consoleLogger: logger.consoleLogger,
|
|
hashAPIPath: () => "&hash=fallback"
|
|
});
|
|
|
|
const result = await account.getPortalLogin("person@example.com");
|
|
|
|
assert.deepStrictEqual(normalize(result), { value: [{ id: "user-1" }] });
|
|
assert.strictEqual(signCalls.length, 1);
|
|
assert.strictEqual(
|
|
signCalls[0],
|
|
"/api/endpoint/gethash_api?path=%2Fapi%2Fendpoint%2Fgetportallogin_api%3FemailAddress%3Dperson%40example.com"
|
|
);
|
|
assert.strictEqual(axios.calls[1].config.method, "get");
|
|
assert.strictEqual(
|
|
axios.calls[1].config.url,
|
|
"http://example.local/api/endpoint/getportallogin_api?emailAddress=person@example.com&hash=login123"
|
|
);
|
|
});
|
|
|
|
test("account/getPortalLogin returns JSON stringified error on failure", async () => {
|
|
const axios = createAxiosMock();
|
|
const logger = createLoggerMock();
|
|
const error = createAxiosError(500, "Broken");
|
|
|
|
axios.getHandler = async (url) => {
|
|
if (url.startsWith("/api/endpoint/gethash_api?path=")) {
|
|
return { data: { hash: "&hash=err" } };
|
|
}
|
|
|
|
throw new Error("Unexpected get url: " + url);
|
|
};
|
|
|
|
axios.requestHandler = async () => Promise.reject(error);
|
|
|
|
const account = loadServiceModule("accountDirectService.js", {
|
|
axios,
|
|
BASE_URL: "",
|
|
consoleLogger: logger.consoleLogger,
|
|
hashAPIPath: () => "&hash=err"
|
|
});
|
|
|
|
const result = await account.getPortalLogin("person@example.com");
|
|
|
|
assert.strictEqual(result, JSON.stringify(error));
|
|
assert.strictEqual(logger.calls.length, 1);
|
|
});
|
|
|
|
test("notify/sendEmail posts payload and returns response data", async () => {
|
|
const axios = createAxiosMock();
|
|
const logger = createLoggerMock();
|
|
|
|
axios.requestHandler = async () => ({ data: { id: "msg-1" } });
|
|
|
|
const notify = loadServiceModule("notifyDirectService.js", {
|
|
axios,
|
|
consoleLogger: logger.consoleLogger
|
|
});
|
|
|
|
const result = await notify.sendEmail(
|
|
"template-1",
|
|
"person@example.com",
|
|
{ name: "Person" },
|
|
"ref-123"
|
|
);
|
|
|
|
assert.deepStrictEqual(normalize(result), { id: "msg-1" });
|
|
assert.strictEqual(axios.calls[0].config.url, "/api/email/notify");
|
|
assert.strictEqual(axios.calls[0].config.method, "post");
|
|
assert.deepStrictEqual(normalize(axios.calls[0].config.data), {
|
|
templateId: "template-1",
|
|
emailAddress: "person@example.com",
|
|
reference: "ref-123",
|
|
personalisation: { name: "Person" }
|
|
});
|
|
});
|
|
|
|
test("notify/sendEmail logs and rethrows on failure", async () => {
|
|
const axios = createAxiosMock();
|
|
const logger = createLoggerMock();
|
|
const error = createAxiosError(429, "Too Many Requests");
|
|
|
|
axios.requestHandler = async () => Promise.reject(error);
|
|
|
|
const notify = loadServiceModule("notifyDirectService.js", {
|
|
axios,
|
|
consoleLogger: logger.consoleLogger
|
|
});
|
|
|
|
let thrown;
|
|
|
|
try {
|
|
await notify.sendEmail("template-1", "person@example.com", {}, "ref");
|
|
} catch (err) {
|
|
thrown = err;
|
|
}
|
|
|
|
assert.strictEqual(thrown, error);
|
|
assert.strictEqual(logger.calls.length, 1);
|
|
});
|
|
|
|
test("notify/sendContactUsConfirmation posts only the dedicated payload", async () => {
|
|
const axios = createAxiosMock();
|
|
const logger = createLoggerMock();
|
|
|
|
axios.requestHandler = async () => ({ data: { sent: true } });
|
|
|
|
const notify = loadServiceModule("notifyDirectService.js", {
|
|
axios,
|
|
consoleLogger: logger.consoleLogger
|
|
});
|
|
const formValues = {
|
|
contactEmail: "person@example.com",
|
|
contactSubject: "Questions about Planning legislation or policy",
|
|
contactbody: "Please review https://example.invalid",
|
|
typeOfContact: "plq",
|
|
ignored: "not sent"
|
|
};
|
|
|
|
const result = await notify.sendContactUsConfirmation(formValues, "cy");
|
|
|
|
assert.deepStrictEqual(normalize(result), { sent: true });
|
|
assert.strictEqual(
|
|
axios.calls[0].config.url,
|
|
"/api/email/contactus-confirmation"
|
|
);
|
|
assert.strictEqual(axios.calls[0].config.method, "post");
|
|
assert.deepStrictEqual(normalize(axios.calls[0].config.data), {
|
|
contactEmail: "person@example.com",
|
|
contactSubject: "Questions about Planning legislation or policy",
|
|
contactbody: "Please review https://example.invalid",
|
|
typeOfContact: "plq",
|
|
language: "cy"
|
|
});
|
|
});
|
|
|
|
test("notify/sendContactUsConfirmation logs and rethrows on failure", async () => {
|
|
const axios = createAxiosMock();
|
|
const logger = createLoggerMock();
|
|
const error = createAxiosError(400, "Bad Request");
|
|
|
|
axios.requestHandler = async () => Promise.reject(error);
|
|
|
|
const notify = loadServiceModule("notifyDirectService.js", {
|
|
axios,
|
|
consoleLogger: logger.consoleLogger
|
|
});
|
|
|
|
await assert.rejects(
|
|
notify.sendContactUsConfirmation(
|
|
{
|
|
contactEmail: "person@example.com",
|
|
contactSubject: "Other enquiry for PEDW",
|
|
contactbody: "Message",
|
|
typeOfContact: "other"
|
|
},
|
|
"en"
|
|
),
|
|
(thrown) => thrown === error
|
|
);
|
|
assert.strictEqual(logger.calls.length, 1);
|
|
});
|
|
|
|
test("notify/sendContactUsPETNotification posts only the dedicated PET payload", async () => {
|
|
const axios = createAxiosMock();
|
|
const logger = createLoggerMock();
|
|
|
|
axios.requestHandler = async () => ({ data: { sent: true } });
|
|
|
|
const notify = loadServiceModule("notifyDirectService.js", {
|
|
axios,
|
|
consoleLogger: logger.consoleLogger
|
|
});
|
|
const formValues = {
|
|
contactEmail: "person@example.com",
|
|
contactSubject: "Questions about Planning legislation or policy",
|
|
contactbody: "Please review https://example.invalid",
|
|
typeOfContact: "plq",
|
|
ignored: "not sent"
|
|
};
|
|
|
|
const result = await notify.sendContactUsPETNotification(
|
|
formValues,
|
|
"pet@example.com"
|
|
);
|
|
|
|
assert.deepStrictEqual(normalize(result), { sent: true });
|
|
assert.strictEqual(
|
|
axios.calls[0].config.url,
|
|
"/api/email/contactus-pet-notification"
|
|
);
|
|
assert.strictEqual(axios.calls[0].config.method, "post");
|
|
assert.deepStrictEqual(normalize(axios.calls[0].config.data), {
|
|
petEmail: "pet@example.com",
|
|
contactEmail: "person@example.com",
|
|
contactSubject: "Questions about Planning legislation or policy",
|
|
contactbody: "Please review https://example.invalid",
|
|
typeOfContact: "plq"
|
|
});
|
|
});
|
|
|
|
test("notify/sendContactUsPETNotification logs and rethrows on failure", async () => {
|
|
const axios = createAxiosMock();
|
|
const logger = createLoggerMock();
|
|
const error = createAxiosError(400, "Bad Request");
|
|
|
|
axios.requestHandler = async () => Promise.reject(error);
|
|
|
|
const notify = loadServiceModule("notifyDirectService.js", {
|
|
axios,
|
|
consoleLogger: logger.consoleLogger
|
|
});
|
|
|
|
await assert.rejects(
|
|
notify.sendContactUsPETNotification(
|
|
{
|
|
contactEmail: "person@example.com",
|
|
contactSubject: "Questions about Planning legislation or policy",
|
|
contactbody: "Message",
|
|
typeOfContact: "plq"
|
|
},
|
|
"pet@example.com"
|
|
),
|
|
(thrown) => thrown === error
|
|
);
|
|
assert.strictEqual(logger.calls.length, 1);
|
|
});
|
|
|
|
test("public and portal Contact Us pages preserve PET gating and submission ordering", async () => {
|
|
const rootDir = path.resolve(__dirname, "..", "..");
|
|
|
|
for (const relativePath of ["pages/contactus.js", "pages/myportal/contactus.js"]) {
|
|
const source = fs.readFileSync(path.join(rootDir, relativePath), "utf8");
|
|
const confirmationCall = source.indexOf("sendContactEmail(formValues);");
|
|
const crmCall = source.indexOf("createCRMTask(formValues);");
|
|
const petCondition = source.indexOf(
|
|
'formValues.typeOfContact == "plq" &&'
|
|
);
|
|
const petCall = source.indexOf(
|
|
"sendPETEmail(formValues, props.petEmail);"
|
|
);
|
|
|
|
assert.notStrictEqual(confirmationCall, -1);
|
|
assert.notStrictEqual(crmCall, -1);
|
|
assert.notStrictEqual(petCondition, -1);
|
|
assert.notStrictEqual(petCall, -1);
|
|
assert.strictEqual(
|
|
confirmationCall < crmCall &&
|
|
crmCall < petCondition &&
|
|
petCondition < petCall,
|
|
true
|
|
);
|
|
assert.strictEqual(
|
|
source.includes(
|
|
"sendContactUsPETNotification(formValues, petEmail)"
|
|
),
|
|
true
|
|
);
|
|
assert.strictEqual(
|
|
source.includes("sendContactUsConfirmation("),
|
|
true
|
|
);
|
|
assert.strictEqual(source.includes("sendEmail(templateId,"), false);
|
|
}
|
|
});
|
|
|
|
test("integration/createCRMTask posts payload and returns data", async () => {
|
|
const axios = createAxiosMock();
|
|
const logger = createLoggerMock();
|
|
|
|
axios.requestHandler = async () => ({ data: { taskId: "crm-1" } });
|
|
|
|
const integration = loadServiceModule("integrationDirectService.js", {
|
|
axios,
|
|
consoleLogger: logger.consoleLogger
|
|
});
|
|
|
|
const payload = { subject: "hello" };
|
|
const result = await integration.createCRMTask(payload);
|
|
|
|
assert.deepStrictEqual(normalize(result), { taskId: "crm-1" });
|
|
assert.strictEqual(
|
|
axios.calls[0].config.url,
|
|
"/api/endpoint/createcrmtask_api"
|
|
);
|
|
assert.strictEqual(axios.calls[0].config.method, "post");
|
|
assert.deepStrictEqual(normalize(axios.calls[0].config.data), payload);
|
|
});
|
|
|
|
test("integration/createCRMTask logs and returns undefined on failure", async () => {
|
|
const axios = createAxiosMock();
|
|
const logger = createLoggerMock();
|
|
|
|
axios.requestHandler = async () =>
|
|
Promise.reject(createAxiosError(400, "Bad Request"));
|
|
|
|
const integration = loadServiceModule("integrationDirectService.js", {
|
|
axios,
|
|
consoleLogger: logger.consoleLogger
|
|
});
|
|
|
|
const result = await integration.createCRMTask({ subject: "x" });
|
|
|
|
assert.strictEqual(result, undefined);
|
|
assert.strictEqual(logger.calls.length, 1);
|
|
});
|
|
|
|
const run = async () => {
|
|
let passed = 0;
|
|
|
|
for (const currentTest of tests) {
|
|
await currentTest.fn();
|
|
passed += 1;
|
|
}
|
|
|
|
console.log(
|
|
`Phase 7 behavioural tests passed (${passed}/${tests.length}).`
|
|
);
|
|
};
|
|
|
|
run().catch((error) => {
|
|
console.error(error);
|
|
process.exit(1);
|
|
});
|