Source identity
| Field | Recorded value |
|---|---|
| Source type | GitHub source |
| Original record | Janady13/thatdeveloperguy-website / tests/api/inquiries.test.ts |
| Date | Not specified in source |
| Repository | Janady13/thatdeveloperguy-website |
| Revision | 2bea2ebdff0e34494bff597d4fa9c8422a0c3a94 |
| Branch | main |
| Path or archive member | tests/api/inquiries.test.ts |
| Original SHA-256 | 9141de5e1f7c69d43d01a9e68589a1490dc1b5232576e4fd62a624a8840a5cf4 |
| Git blob SHA | 13a63b385304787d8fac6844d6920e3d511c9608 |
| Reading-copy SHA-256 | 9141de5e1f7c69d43d01a9e68589a1490dc1b5232576e4fd62a624a8840a5cf4 |
Recovered source transcript
Download complete source text ↓99 lines · 8.0 KB
import { test, describe } from 'node:test';
import assert from 'node:assert/strict';
import { buildApp } from '../../server/app.ts';
import { loadConfig } from '../../server/config.ts';
import type { Provider, ProviderResult } from '../../server/email/provider.ts';
const ENV = { PUBLIC_ORIGIN: 'https://tdg.test', SMTP_HOST: 'smtp.test', SMTP_PORT: '587', SMTP_USER: 'u', SMTP_PASS: 'p', SMTP_FROM: 'u@tdg.test', SMTP_TO: 'inbox@tdg.test', DELIVERY_TIMEOUT_MS: '150', RATE_LIMIT_MAX: '3', RATE_LIMIT_WINDOW_MS: '60000' };
const contact = { path: '/contact', receivedPath: '/contact/received', telephone: '+10000000000', email: 'inbox@tdg.test' };
const good = { name: 'Pat Example', email: 'pat@example.org', organization: 'Example County', service: 'security', message: 'We need a security review of two offices and a small data center.', from: 'capability.cybersecurity', website: '' };
function fakeProvider(behaviour: 'accept' | 'reject' | 'hang' | 'throw5xx' | 'throwNet'): Provider & { sent: number } {
const provider = { sent: 0, close() {}, async send(): Promise<ProviderResult> {
provider.sent++;
if (behaviour === 'accept') return { accepted: ['inbox@tdg.test'], rejected: [] };
if (behaviour === 'reject') return { accepted: [], rejected: ['inbox@tdg.test'] };
if (behaviour === 'throw5xx') throw Object.assign(new Error('Message rejected'), { responseCode: 550 });
if (behaviour === 'throwNet') throw Object.assign(new Error('socket closed'), { code: 'ECONNRESET' });
return new Promise(() => {}); // hang
} };
return provider;
}
async function appWith(behaviour: Parameters<typeof fakeProvider>[0], env: Record<string, string> = {}) { const provider = fakeProvider(behaviour); const app = await buildApp({ config: loadConfig({ ...ENV, ...env }), provider, contact, logger: false }); return { app, provider }; }
const json = (app: any, body: unknown, headers: Record<string, string> = {}) => app.inject({ method: 'POST', url: '/api/inquiries', headers: { 'content-type': 'application/json', accept: 'application/json', origin: 'https://tdg.test', ...headers }, payload: body });
const form = (app: any, body: Record<string, string>, headers: Record<string, string> = {}) => app.inject({ method: 'POST', url: '/api/inquiries', headers: { 'content-type': 'application/x-www-form-urlencoded', origin: 'https://tdg.test', ...headers }, payload: new URLSearchParams(body).toString() });
describe('inquiry outcomes', () => {
test('provider acceptance of the fixed recipient → provider_accepted (JSON) and 303 to the generic receipt (form)', async () => {
const { app, provider } = await appWith('accept');
const r = await json(app, good); assert.equal(r.statusCode, 200); assert.equal(r.json().outcome, 'provider_accepted'); assert.ok(r.headers['x-request-id']);
const f = await form(app, { ...good, message: 'A different message so it is not a duplicate of the first.' }); assert.equal(f.statusCode, 303); assert.equal(f.headers.location, '/contact/received'); assert.equal(f.body, '');
assert.equal(provider.sent, 2); await app.close();
});
test('provider rejection is never shown as success', async () => {
const { app } = await appWith('reject');
const r = await json(app, good); assert.equal(r.statusCode, 502); assert.equal(r.json().outcome, 'provider_rejected');
const f = await form(app, { ...good, message: 'Second distinct message for the HTML path check here.' }); assert.equal(f.statusCode, 502); assert.match(f.body, /<h1>Message not sent<\/h1>/); assert.doesNotMatch(f.body, /Pat Example|pat@example/);
await app.close();
});
test('a 5xx provider error is a rejection; a transport error is delivery_unknown', async () => {
const a = await appWith('throw5xx'); assert.equal((await json(a.app, good)).json().outcome, 'provider_rejected'); await a.app.close();
const b = await appWith('throwNet'); const r = await json(b.app, good); assert.equal(r.statusCode, 504); assert.equal(r.json().outcome, 'delivery_unknown'); await b.app.close();
});
test('a provider timeout is delivery_unknown and is not retried', async () => {
const { app, provider } = await appWith('hang');
const t = Date.now(); const r = await json(app, good);
assert.equal(r.json().outcome, 'delivery_unknown'); assert.ok(Date.now() - t < 2000); assert.equal(provider.sent, 1);
const again = await json(app, good); assert.equal(again.json().outcome, 'delivery_unknown'); assert.equal(again.json().duplicate, true); assert.equal(provider.sent, 1, 'identical resend is answered from the record, not sent again');
await app.close();
});
test('duplicate submissions inside the window are not sent twice', async () => {
const { app, provider } = await appWith('accept');
await json(app, good); const r = await json(app, good);
assert.equal(r.json().outcome, 'provider_accepted'); assert.equal(r.json().duplicate, true); assert.equal(provider.sent, 1); await app.close();
});
});
describe('refusals', () => {
test('validation failures name the fields and send nothing', async () => {
const { app, provider } = await appWith('accept');
const r = await json(app, { ...good, email: 'not-an-address', message: 'short' });
assert.equal(r.statusCode, 422); assert.equal(r.json().outcome, 'validation_failed'); assert.deepEqual(Object.keys(r.json().fields).sort(), ['email', 'message']);
const f = await form(app, { ...good, name: 'X' }); assert.equal(f.statusCode, 422); assert.match(f.body, /<strong>name<\/strong>/);
assert.equal(provider.sent, 0); await app.close();
});
test('honeypot, unknown fields and header-injection attempts are refused before delivery', async () => {
const { app, provider } = await appWith('accept', { RATE_LIMIT_MAX: '20' });
assert.equal((await json(app, { ...good, website: 'http://spam' })).json().outcome, 'validation_failed');
assert.equal((await json(app, { ...good, extra: 'x' })).json().outcome, 'validation_failed');
assert.equal((await json(app, { ...good, name: 'Pat\r\nBcc: victim@example.org' })).json().outcome, 'validation_failed');
assert.equal((await json(app, { ...good, email: 'a@b.co,victim@example.org' })).json().outcome, 'validation_failed');
assert.equal(provider.sent, 0); await app.close();
});
test('link-stuffed messages are refused as abuse', async () => {
const { app, provider } = await appWith('accept');
const r = await json(app, { ...good, message: 'see http://a.x http://b.x http://c.x http://d.x http://e.x now' });
assert.equal(r.json().outcome, 'abuse_refused'); assert.equal(provider.sent, 0); await app.close();
});
test('cross-origin submissions are refused', async () => {
const { app, provider } = await appWith('accept');
assert.equal((await json(app, good, { origin: 'https://evil.example' })).json().outcome, 'validation_failed');
assert.equal((await json(app, good, { 'sec-fetch-site': 'cross-site' })).json().outcome, 'validation_failed');
assert.equal(provider.sent, 0); await app.close();
});
test('rate limiting answers with rate_limited after the allowance', async () => {
const { app } = await appWith('accept');
const outcomes = []; for (let i = 0; i < 5; i++) outcomes.push((await json(app, { ...good, message: `Distinct message number ${i} to avoid the duplicate policy.` })).json().outcome);
assert.deepEqual(outcomes, ['provider_accepted', 'provider_accepted', 'provider_accepted', 'rate_limited', 'rate_limited']); await app.close();
});
test('oversized bodies are refused', async () => {
const { app } = await appWith('accept');
const r = await json(app, { ...good, message: 'x'.repeat(20_000) }); assert.equal(r.statusCode, 422); await app.close();
});
test('visiting the receipt path is not an API success and health exposes nothing', async () => {
const { app } = await appWith('accept');
assert.equal((await app.inject({ method: 'GET', url: '/contact/received' })).statusCode, 404);
const h = await app.inject({ method: 'GET', url: '/api/health' }); assert.deepEqual(h.json(), { ok: true }); await app.close();
});
});