feat(release): prepare 1.1.0 candidate

server/supabase/functions/_shared/team-contract.test.ts

@@ -0,0 +1,103 @@
+import {
+  buildInviteEmailHtml,
+  buildInviteUrl,
+  mapTeamRpcError,
+  normalizeSiteOrigin,
+  parseTeamAcceptInput,
+  parseTeamInviteInput,
+  TeamContractError,
+} from './team-contract.ts'
+
+function assert(condition: boolean, message: string): asserts condition {
+  if (!condition) throw new Error(message)
+}
+
+function assertContractError(action: () => unknown, code: string, status: number): void {
+  let actual: unknown
+  try {
+    action()
+  } catch (error) {
+    actual = error
+  }
+  assert(actual instanceof TeamContractError, `expected TeamContractError for ${code}`)
+  assert(actual.code === code, `expected ${code}, received ${actual.code}`)
+  assert(actual.status === status, `expected status ${status}, received ${actual.status}`)
+}
+
+Deno.test('team invite parser normalizes the only accepted request fields', () => {
+  const parsed = parseTeamInviteInput({
+    team_id: '11111111-2222-4333-8444-555555555555',
+    email: '  MEMBER@Example.COM ',
+  })
+  assert(parsed.teamId === '11111111-2222-4333-8444-555555555555', 'team id must be preserved')
+  assert(parsed.email === 'member@example.com', 'email must be normalized')
+  assert(parsed.role === 'member', 'role must default to member')
+
+  assertContractError(
+    () => parseTeamInviteInput({
+      team_id: parsed.teamId,
+      email: parsed.email,
+      role: 'member',
+      html: '<script>alert(1)</script>',
+    }),
+    'invalid_invite_request',
+    400,
+  )
+})
+
+Deno.test('team accept parser permits only a URL-safe bounded bearer token', () => {
+  const parsed = parseTeamAcceptInput({ token: 'abcdefghijklmnopqrstuvwx_123456' })
+  assert(parsed.token === 'abcdefghijklmnopqrstuvwx_123456', 'token must be preserved')
+  assertContractError(
+    () => parseTeamAcceptInput({ token: 'short' }),
+    'invalid_invite_token',
+    400,
+  )
+  assertContractError(
+    () => parseTeamAcceptInput({ token: parsed.token, team_id: crypto.randomUUID() }),
+    'invalid_invite_token',
+    400,
+  )
+})
+
+Deno.test('site URL is fail-closed to the canonical deployed HTTPS origin', () => {
+  assert(
+    normalizeSiteOrigin('https://d3ro.chanpaca.net/app/') === 'https://d3ro.chanpaca.net',
+    'canonical HTTPS origin must normalize',
+  )
+  assertContractError(() => normalizeSiteOrigin(undefined), 'site_url_not_configured', 503)
+  assertContractError(() => normalizeSiteOrigin('http://localhost:5173'), 'site_url_invalid', 503)
+  assertContractError(() => normalizeSiteOrigin('https://voice.chanpaca.net'), 'site_url_invalid', 503)
+  assertContractError(() => normalizeSiteOrigin('https://d3ro.dev'), 'site_url_invalid', 503)
+  assertContractError(() => normalizeSiteOrigin('http://attacker.example'), 'site_url_invalid', 503)
+  assertContractError(() => normalizeSiteOrigin('https://user:pass@d3ro.chanpaca.net'), 'site_url_invalid', 503)
+  assertContractError(() => normalizeSiteOrigin('javascript:alert(1)'), 'site_url_invalid', 503)
+})
+
+Deno.test('invite URL encodes the token and email HTML escapes every dynamic field', () => {
+  const token = 'abcdefghijklmnopqrstuvwx_123456'
+  const url = buildInviteUrl('https://d3ro.chanpaca.net', token)
+  assert(
+    url === `https://d3ro.chanpaca.net/accept-invite/?token=${token}`,
+    'canonical invite URL required',
+  )
+  const html = buildInviteEmailHtml({
+    inviteUrl: `${url}&x=<bad>`,
+    inviterEmail: 'owner<script>@example.com',
+    teamName: '<img src=x onerror=alert(1)>',
+    role: 'admin',
+  })
+  assert(!html.includes('<script>'), 'inviter email must be escaped')
+  assert(!html.includes('<img'), 'team name must be escaped')
+  assert(html.includes('&lt;bad&gt;'), 'URL text must be escaped')
+  assert(html.includes('&amp;x='), 'URL ampersands must be escaped')
+})
+
+Deno.test('team RPC failures are mapped to stable public codes without provider detail', () => {
+  const limited = mapTeamRpcError('invite', { code: '54000', message: 'private database detail' })
+  assert(limited.code === 'invite_rate_limited' && limited.status === 429, 'rate limit must be stable')
+  const mismatch = mapTeamRpcError('accept', { code: '42501', message: 'invite_email_mismatch' })
+  assert(mismatch.code === 'invite_email_mismatch' && mismatch.status === 403, 'mismatch must be stable')
+  const unknown = mapTeamRpcError('accept', { code: 'XX000', message: 'secret stack text' })
+  assert(unknown.code === 'team_accept_failed' && unknown.status === 500, 'unknown errors must be sanitized')
+})