trihub-ernaehrung-backseatDevs/src/tests/bookings.test.js

622 lines
22 KiB
JavaScript

import test from "node:test";
import assert from "node:assert/strict";
import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { randomUUID } from "node:crypto";
import { createApp } from "../server/index.js";
import { createCsvStorage } from "../server/services/csv-storage.js";
import { createBookingService } from "../server/services/booking-service.js";
import { createEmailService } from "../server/services/email-service.js";
import { packages } from "../shared/packages.js";
const input = {
packageId: packages[0].id,
name: 'Test, "Person"',
email: "person@example.test",
};
async function setup(t, options = {}) {
const directory = await mkdtemp(join(tmpdir(), "trihub-booking-"));
const file = join(directory, "bookings.csv");
const storage = createCsvStorage(file);
const sent = [];
const sendConfirmation =
options.sendConfirmation ??
(async (booking) => {
sent.push({ ...booking });
});
const dependencies = {
catalog: packages,
storage,
sendConfirmation,
...options,
};
const app = createApp(dependencies);
await new Promise((resolve) => app.listen(0, "127.0.0.1", resolve));
t.after(async () => {
app.closeAllConnections();
await new Promise((resolve) => app.close(resolve));
await rm(directory, { recursive: true, force: true });
});
const url = `http://127.0.0.1:${app.address().port}`;
async function post(body = input, key = randomUUID()) {
const response = await fetch(`${url}/api/bookings`, {
method: "POST",
headers: {
"Content-Type": "application/json",
"Idempotency-Key": key,
},
body: JSON.stringify(body),
});
return { status: response.status, body: await response.json() };
}
return { post, url, file, storage, sent, dependencies };
}
test("Buchung steht vor Versand in CSV; Paketname kommt vom Server", async (t) => {
const fixture = await setup(t);
const result = await fixture.post({
...input,
packageName: "Manipuliert",
price: 0,
});
assert.equal(result.status, 201);
assert.equal(result.body.emailStatus, "accepted");
assert.equal(result.body.packageName, packages[0].name);
assert.equal(result.body.bookingId, "TH-000001");
assert.ok(!Number.isNaN(Date.parse(result.body.createdAt)));
const records = await fixture.storage.readAll();
assert.equal(records.length, 1);
assert.equal(records[0].name, input.name);
assert.equal(records[0].emailStatus, "accepted");
assert.equal(fixture.sent.length, 1);
assert.equal(fixture.sent[0].emailStatus, "sending");
assert.ok(!("email" in result.body));
});
test("Pflichtfelder, Typen, Längen, E-Mail und unbekannte IDs werden abgelehnt", async (t) => {
const { post, storage, sent } = await setup(t);
for (const body of [
null,
[],
{},
{ ...input, name: " " },
{ ...input, name: 42 },
{ ...input, name: "a".repeat(121) },
{ ...input, name: "Test\nBcc: fremd" },
{ ...input, email: "keine-adresse" },
{ ...input, email: "a..b@example.test" },
{ ...input, email: ".person@example.test" },
{ ...input, email: "person.@example.test" },
{ ...input, email: "person@example..test" },
{ ...input, email: "person@-example.test" },
{ ...input, email: `person@${"a".repeat(64)}.test` },
{ ...input, email: "a\r\nb@example.test" },
{ ...input, email: false },
{ ...input, email: "a".repeat(255) },
{ ...input, packageId: "unknown" },
{ ...input, packageId: "../demo" },
{ ...input, packageId: 1 },
{ ...input, packageId: "a".repeat(81) },
]) {
const result = await post(body);
assert.equal(result.status, 400, JSON.stringify(body));
}
assert.equal((await post(input, "invalid")).status, 400);
assert.deepEqual(await storage.readAll(), []);
assert.equal(sent.length, 0);
});
test("Parallele Wiederholungen und Neustart erzeugen nur eine Buchung und Mail", async (t) => {
const { post, storage, sent, dependencies } = await setup(t);
const key = randomUUID();
const results = await Promise.all(
Array.from({ length: 8 }, () => post(input, key)),
);
assert.equal(new Set(results.map((r) => r.body.bookingId)).size, 1);
assert.equal(results.filter((r) => r.status === 201).length, 1);
assert.equal(sent.length, 1);
assert.equal((await storage.readAll()).length, 1);
// Neue Serviceinstanz liest ausschließlich den persistenten CSV-Zustand.
const restarted = createBookingService({ ...dependencies, packages: [] });
const replay = await restarted.book(input, key);
assert.equal(replay.status, 200);
assert.equal(replay.body.bookingId, results[0].body.bookingId);
assert.equal(sent.length, 1);
const conflict = await post({ ...input, name: "Andere Person" }, key);
assert.equal(conflict.status, 409);
});
test("Verschiedene gleichzeitige Buchungen behalten alle CSV-Zeilen", async (t) => {
const { post, storage } = await setup(t);
const results = await Promise.all(
Array.from({ length: 12 }, (_, i) =>
post({ ...input, name: `Person ${i}` }),
),
);
assert.ok(results.every((r) => r.status === 201));
const records = await storage.readAll();
assert.equal(records.length, 12);
assert.deepEqual(
records.map((record) => record.bookingId),
Array.from(
{ length: 12 },
(_, i) => `TH-${String(i + 1).padStart(6, "0")}`,
),
);
});
test("CSV schützt Formeln und erhält Kommas, Anführungszeichen, Apostrophe und Zeilenumbrüche", async (t) => {
const { storage, file } = await setup(t);
const values = [
'=HYPERLINK("evil")',
"+1",
"-1",
"@SUM(A1)",
"\t=1",
"\r=1",
"\n=1",
" =1",
"'Original",
'Test, "Name"\nzweite Zeile',
];
const rows = values.map((name) => ({ name, packageName: name }));
await storage.writeAll(rows);
assert.deepEqual(
(await storage.readAll()).map((r) => r.name),
values,
);
const text = await readFile(file, "utf8");
assert.ok(text.includes("'=HYPERLINK"));
assert.ok(text.includes("''Original"));
assert.ok(text.includes('"Test, ""Name""\nzweite Zeile"'));
await storage.writeAll(await storage.readAll());
assert.deepEqual(
(await storage.readAll()).map((r) => r.name),
values,
);
});
test("Fehlgeschlagenes erstes Schreiben verhindert Versand", async (t) => {
let sent = 0;
const { post } = await setup(t, {
storage: {
readAll: async () => [],
writeAll: async () => {
throw new Error("Disk full");
},
},
sendConfirmation: async () => {
sent++;
},
});
const result = await post();
assert.equal(result.status, 503);
assert.equal(result.body.error.code, "BOOKING_NOT_SAVED");
assert.equal(sent, 0);
});
test("Beschädigte CSV wird nicht überschrieben", async (t) => {
const { post, file, sent } = await setup(t);
await writeFile(file, "falscher,header\n1,2\n");
const result = await post();
assert.equal(result.status, 503);
assert.equal(result.body.error.code, "STORAGE_UNAVAILABLE");
assert.equal(await readFile(file, "utf8"), "falscher,header\n1,2\n");
assert.equal(sent.length, 0);
});
test("Mailfehler speichert Buchung; Wiederholung sendet nicht erneut", async (t) => {
let calls = 0;
const { post, storage } = await setup(t, {
sendConfirmation: async () => {
calls++;
throw new Error("SMTP rejected");
},
});
const key = randomUUID();
const first = await post(input, key);
assert.equal(first.status, 202);
assert.equal(first.body.saved, true);
assert.equal(first.body.emailStatus, "failed");
assert.equal((await storage.readAll())[0].emailStatus, "failed");
assert.equal((await post(input, key)).body.bookingId, first.body.bookingId);
assert.equal(calls, 1);
});
test("Ausstehender Versand kann nach Schreibfehler sicher fortgesetzt werden", async (t) => {
const { storage } = await setup(t);
let writes = 0;
let sends = 0;
const service = createBookingService({
packages: packages,
storage: {
readAll: () => storage.readAll(),
writeAll: async (rows) => {
if (++writes === 2) throw new Error("Disk full");
return storage.writeAll(rows);
},
},
sendConfirmation: async () => {
sends++;
},
});
const key = randomUUID();
const first = await service.book(input, key);
assert.equal(first.body.emailStatus, "pending");
assert.equal(sends, 0);
const retry = await service.book(input, key);
assert.equal(retry.body.emailStatus, "accepted");
assert.equal(retry.body.bookingId, first.body.bookingId);
assert.equal(sends, 1);
});
test("Status-Schreibfehler nach SMTP bleibt unklar und löst keinen Doppelversand aus", async (t) => {
const { storage } = await setup(t);
let writes = 0;
let sends = 0;
const service = createBookingService({
packages: packages,
storage: {
readAll: () => storage.readAll(),
writeAll: async (rows) => {
if (++writes === 3) throw new Error("Disk full");
return storage.writeAll(rows);
},
},
sendConfirmation: async () => {
sends++;
},
});
const key = randomUUID();
assert.equal((await service.book(input, key)).body.emailStatus, "unknown");
assert.equal((await storage.readAll())[0].emailStatus, "sending");
const restarted = createBookingService({
storage,
packages: packages,
sendConfirmation: async () => {
sends++;
},
});
assert.equal(
(await restarted.book(input, key)).body.emailStatus,
"unknown",
);
assert.equal(sends, 1);
});
test("SMTP-Nachricht enthält Buchungsnummer und Paket; externe Hosts sind standardmäßig gesperrt", async () => {
let message;
const send = createEmailService({}, () => ({
sendMail: async (mail) => {
message = mail;
return { accepted: [input.email] };
},
}));
await send({
...input,
bookingId: "TH-000001",
packageName: packages[0].name,
});
assert.ok(message.text.includes("TH-000001"));
assert.ok(message.text.includes(packages[0].name));
assert.equal(message.to.address, input.email);
assert.ok(message.text.includes("Zahlungsvorgang wird übersprungen"));
assert.ok(message.text.includes("keine Abbuchung"));
assert.throws(
() => createEmailService({ SMTP_HOST: "smtp.example.org" }),
/gesperrt/,
);
const rejected = createEmailService({}, () => ({
sendMail: async () => ({ accepted: [] }),
}));
await assert.rejects(() => rejected(input));
});
test("SMTP-Verbindungsabbruch unterscheidet sich von expliziter Ablehnung", async () => {
for (const [code, expected] of [
["ETIMEDOUT", true],
["EAUTH", false],
]) {
const send = createEmailService({}, () => ({
sendMail: async () => {
throw Object.assign(new Error("SMTP"), { code });
},
}));
await assert.rejects(
() => send(input),
(error) => error.deliveryUnknown === expected,
);
}
});
test("HTTP-Vertrag: JSON, Größenlimit, Methoden und private Dateien", async (t) => {
const { url } = await setup(t);
const response = await fetch(`${url}/api/bookings`);
assert.equal(response.status, 405);
for (const path of [
"/src/server/data/bookings.csv",
"/.env",
"/data/bookings.csv",
]) {
assert.equal((await fetch(`${url}${path}`)).status, 404);
}
assert.equal(
(await fetch(`${url}/api/bookings`, { method: "POST", body: "{}" }))
.status,
415,
);
assert.equal(
(
await fetch(`${url}/api/bookings`, {
method: "POST",
headers: { "Content-Type": "application/json" },
body: "{",
})
).status,
400,
);
assert.equal(
(
await fetch(`${url}/api/bookings`, {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ name: "a".repeat(9000) }),
})
).status,
413,
);
const catalog = await (await fetch(`${url}/api/angebote`)).json();
assert.deepEqual(
catalog.packages,
packages.map(({ id, name, summary }) => ({ id, name, summary })),
);
assert.equal((await fetch(`${url}/api/packages`)).status, 200);
});
test("Paketvertrag lehnt fehlende, numerische und doppelte IDs ab", () => {
for (const catalog of [
[null],
[{ ...packages[0], id: 123 }],
[{ ...packages[0], id: undefined }],
[packages[0], packages[0]],
]) {
assert.throws(
() => createApp({ catalog, sendConfirmation: async () => {} }),
/Paketdaten erfüllen/,
);
}
});
test("Fortlaufende Nummern bleiben nach Neustart erhalten und Wiederholungen verbrauchen keine Nummer", async (t) => {
const { storage, post } = await setup(t);
const key = randomUUID();
assert.equal((await post(input, key)).body.bookingId, "TH-000001");
assert.equal((await post(input, key)).body.bookingId, "TH-000001");
const restarted = createBookingService({
storage,
packages: packages,
sendConfirmation: async () => {},
});
assert.equal(
(await restarted.book(input, randomUUID())).body.bookingId,
"TH-000002",
);
assert.equal((await storage.readAll()).length, 2);
});
test("Bestehende UUID-Buchungen bleiben unverändert und weiterhin abrufbar", async (t) => {
const { storage, post } = await setup(t);
const key = randomUUID();
await post(input, key);
const records = await storage.readAll();
const legacyId = randomUUID();
records[0].bookingId = legacyId;
await storage.writeAll(records);
assert.equal((await post(input, key)).body.bookingId, legacyId);
assert.equal((await post()).body.bookingId, "TH-000001");
assert.equal((await storage.readAll())[0].bookingId, legacyId);
});
test("Nummernvergabe verwendet den höchsten CSV-Wert und wächst über sechs Stellen hinaus", async (t) => {
const { storage, post } = await setup(t);
await post();
await post();
const records = await storage.readAll();
records[0].bookingId = "TH-999999";
await storage.writeAll(records);
assert.equal((await post()).body.bookingId, "TH-1000000");
});
test("Detail-API und Vorschau liefern die gewählte Variante mit centgenauen Preisen", async (t) => {
const { url, storage, sent } = await setup(t, { catalog: packages });
const details = await (
await fetch(`${url}/api/packages/ernaehrung-premium`)
).json();
assert.equal(details.variants.length, 2);
assert.ok(details.includedFeatures.length > 0);
assert.equal((await fetch(`${url}/api/packages/unbekannt`)).status, 404);
const response = await fetch(`${url}/api/bookings/preview`, {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({
packageId: details.id,
variantId: "ernaehrung-premium-52",
price: 1,
}),
});
assert.equal(response.status, 200);
const preview = await response.json();
assert.equal(preview.durationWeeks, 52);
assert.equal(preview.grossPrice, 1399);
assert.equal(preview.netPrice, 1175.63);
assert.equal(preview.taxAmount, 223.37);
assert.equal(preview.taxRate, 19);
assert.equal(preview.currency, "EUR");
assert.deepEqual(preview.includedFeatures, details.includedFeatures);
assert.deepEqual(await storage.readAll(), []);
assert.equal(sent.length, 0);
});
test("Bestelldaten bleiben nach Katalogänderung und Neustart unverändert", async (t) => {
const fixture = await setup(t, { catalog: packages });
const key = randomUUID();
const data = {
...input,
packageId: "ernaehrung-premium",
variantId: "ernaehrung-premium-52",
price: 1,
includedFeatures: ["Manipuliert"],
};
const result = await fixture.post(data, key);
assert.equal(result.status, 201);
const order = result.body.bookedPackage;
assert.equal(order.grossPrice, 1399);
assert.equal(order.durationWeeks, 52);
assert.equal(order.variantId, data.variantId);
assert.ok(!order.includedFeatures.includes("Manipuliert"));
assert.deepEqual((await fixture.storage.readAll())[0].bookedPackage, order);
assert.deepEqual(fixture.sent[0].bookedPackage, order);
const restarted = createBookingService({
storage: fixture.storage,
packages: [],
details: [],
sendConfirmation: async () => assert.fail("Doppelversand"),
});
assert.deepEqual(
(await restarted.book(data, key)).body.bookedPackage,
order,
);
assert.equal(
(
await fixture.post(
{ ...data, variantId: "ernaehrung-premium-24" },
key,
)
).status,
409,
);
});
test("Unbekannte und paketfremde Varianten werden vor dem Speichern abgelehnt", async (t) => {
const { post, storage, sent, url } = await setup(t, { catalog: packages });
for (const data of [
{ packageId: "ernaehrung-premium", variantId: "unbekannt" },
{ packageId: "ernaehrung-starter", variantId: "ernaehrung-premium-52" },
{ packageId: "ernaehrung-premium", variantId: 52 },
]) {
assert.equal((await post({ ...input, ...data })).status, 400);
assert.equal(
(
await fetch(`${url}/api/bookings/preview`, {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify(data),
})
).status,
400,
);
}
assert.deepEqual(await storage.readAll(), []);
assert.equal(sent.length, 0);
});
test("Bestehende CSV ohne Bestelldaten bleibt lesbar und wird verlustfrei erweitert", async (t) => {
const { post, file, storage } = await setup(t);
const key = randomUUID();
await post(input, key);
const [record] = await storage.readAll();
await writeFile(
file,
`bookingId,createdAt,packageId,packageName,name,email,emailStatus,idempotencyKey,requestHash\nTH-000001,${record.createdAt},ernaehrung-starter,Altes Paket,Alte Person,person@example.test,accepted,alter-key,alter-hash\n`,
);
assert.equal((await post()).status, 201);
const records = await storage.readAll();
assert.equal(records.length, 2);
assert.equal(records[0].packageName, "Altes Paket");
assert.equal(records[0].bookedPackage, null);
assert.equal(records[1].bookedPackage.packageId, "ernaehrung-starter");
});
test("Bestätigungsmail enthält gespeicherte Leistungen, Variante, Preise und maskiertes HTML", async (t) => {
const { post } = await setup(t, { catalog: packages });
const result = await post({
...input,
packageId: "ernaehrung-premium",
variantId: "ernaehrung-premium-52",
});
let message;
const send = createEmailService({}, () => ({
sendMail: async (mail) => {
message = mail;
return { accepted: [input.email] };
},
}));
await send({ ...input, name: "<img src=x>", ...result.body });
assert.match(message.subject, /Bestellbestätigung TH-/);
for (const text of [
"52-Wochen-Variante",
"52 Wochen",
"1.399,00",
"1.175,63",
"223,37",
"19 %",
"einmalig",
"Bestelldatum:",
...result.body.bookedPackage.includedFeatures,
]) {
assert.ok(message.text.includes(text), text);
}
assert.ok(message.html.includes("&lt;img src=x&gt;"));
assert.ok(!message.html.includes("<img src=x>"));
});
test("Swagger-Kundendaten und Zustimmung werden validiert und dauerhaft gespeichert", async (t) => {
const { post, storage, sent } = await setup(t, { catalog: packages });
const customer = {
firstName: "Thomas",
lastName: "Müller",
email: "thomas@example.test",
phone: "+49 170 1234567",
ageGroup: "50-59",
notes: "Vorbereitung auf die Mitteldistanz.",
};
const request = {
packageId: "ernaehrung-standard",
customer,
acceptedTerms: true,
};
for (const body of [
{ ...request, acceptedTerms: false },
{ ...request, acceptedTerms: "true" },
{ ...request, customer: [] },
{ ...request, customer: { ...customer, firstName: "" } },
{ ...request, customer: { ...customer, email: "ungültig" } },
{ ...request, customer: { ...customer, phone: 123 } },
])
assert.equal((await post(body)).status, 400);
const key = randomUUID();
const result = await post(request, key);
assert.equal(result.status, 201);
assert.equal(result.body.customerEmail, customer.email);
const [record] = await storage.readAll();
assert.equal(record.name, "Thomas Müller");
assert.deepEqual(record.customer, customer);
assert.equal(record.acceptedTerms, true);
assert.deepEqual(sent[0].customer, customer);
assert.equal((await post(request, key)).status, 200);
assert.equal(
(
await post(
{
...request,
customer: { ...customer, notes: "Anderer Auftrag" },
},
key,
)
).status,
409,
);
});