d3ro-voice/server/supabase/functions/_shared/team-contract.test.ts

import {
  buildInviteEmailHtml,
  buildInviteUrl,
  mapTeamRpcError,
  normalizeSiteOrigin,
  parseTeamAcceptInput,
  parseTeamInviteInput,
  TeamContractError,
} from './team-contract.ts'
import { PUBLIC_SITE_ORIGIN } from './core-contract.generated.ts'

function assert(condition: boolean, message: string): asserts condition {
  if (!condition) throw new Error(message)
}

function assertContractError(action: () => unknown, code: string, status: number): void {
  let actual: unknown
  try {
    action()
  } catch (error) {
    actual = error
  }
  assert(actual instanceof TeamContractError, `expected TeamContractError for ${code}`)
  assert(actual.code === code, `expected ${code}, received ${actual.code}`)
  assert(actual.status === status, `expected status ${status}, received ${actual.status}`)
}

Deno.test('team invite parser normalizes the only accepted request fields', () => {
  const parsed = parseTeamInviteInput({
    team_id: '11111111-2222-4333-8444-555555555555',
    email: '  MEMBER@Example.COM ',
  })
  assert(parsed.teamId === '11111111-2222-4333-8444-555555555555', 'team id must be preserved')
  assert(parsed.email === 'member@example.com', 'email must be normalized')
  assert(parsed.role === 'member', 'role must default to member')

  assertContractError(
    () => parseTeamInviteInput({
      team_id: parsed.teamId,
      email: parsed.email,
      role: 'member',
      html: '<script>alert(1)</script>',
    }),
    'invalid_invite_request',
    400,
  )
})

Deno.test('team accept parser permits only a URL-safe bounded bearer token', () => {
  const parsed = parseTeamAcceptInput({ token: 'abcdefghijklmnopqrstuvwx_123456' })
  assert(parsed.token === 'abcdefghijklmnopqrstuvwx_123456', 'token must be preserved')
  assertContractError(
    () => parseTeamAcceptInput({ token: 'short' }),
    'invalid_invite_token',
    400,
  )
  assertContractError(
    () => parseTeamAcceptInput({ token: parsed.token, team_id: crypto.randomUUID() }),
    'invalid_invite_token',
    400,
  )
})

Deno.test('site URL is fail-closed to the canonical deployed HTTPS origin', () => {
  assert(
    normalizeSiteOrigin(`${PUBLIC_SITE_ORIGIN}/app/`) === PUBLIC_SITE_ORIGIN,
    'canonical HTTPS origin must normalize',
  )
  assertContractError(() => normalizeSiteOrigin(undefined), 'site_url_not_configured', 503)
  assertContractError(() => normalizeSiteOrigin('http://localhost:5173'), 'site_url_invalid', 503)
  assertContractError(() => normalizeSiteOrigin('https://voice.chanpaca.net'), 'site_url_invalid', 503)
  assertContractError(() => normalizeSiteOrigin('https://d3ro.dev'), 'site_url_invalid', 503)
  assertContractError(() => normalizeSiteOrigin('http://attacker.example'), 'site_url_invalid', 503)
  assertContractError(() => normalizeSiteOrigin(PUBLIC_SITE_ORIGIN.replace('https://', 'https://user:pass@')), 'site_url_invalid', 503)
  assertContractError(() => normalizeSiteOrigin('javascript:alert(1)'), 'site_url_invalid', 503)
})

Deno.test('invite URL encodes the token and email HTML escapes every dynamic field', () => {
  const token = 'abcdefghijklmnopqrstuvwx_123456'
  const url = buildInviteUrl(PUBLIC_SITE_ORIGIN, token)
  assert(
    url === `${PUBLIC_SITE_ORIGIN}/accept-invite/?token=${token}`,
    'canonical invite URL required',
  )
  const html = buildInviteEmailHtml({
    inviteUrl: `${url}&x=<bad>`,
    inviterEmail: 'owner<script>@example.com',
    teamName: '<img src=x onerror=alert(1)>',
    role: 'admin',
  })
  assert(!html.includes('<script>'), 'inviter email must be escaped')
  assert(!html.includes('<img'), 'team name must be escaped')
  assert(html.includes('&lt;bad&gt;'), 'URL text must be escaped')
  assert(html.includes('&amp;x='), 'URL ampersands must be escaped')
})

Deno.test('team RPC failures are mapped to stable public codes without provider detail', () => {
  const limited = mapTeamRpcError('invite', { code: '54000', message: 'private database detail' })
  assert(limited.code === 'invite_rate_limited' && limited.status === 429, 'rate limit must be stable')
  const mismatch = mapTeamRpcError('accept', { code: '42501', message: 'invite_email_mismatch' })
  assert(mismatch.code === 'invite_email_mismatch' && mismatch.status === 403, 'mismatch must be stable')
  const unknown = mapTeamRpcError('accept', { code: 'XX000', message: 'secret stack text' })
  assert(unknown.code === 'team_accept_failed' && unknown.status === 500, 'unknown errors must be sanitized')
})