add tests and registry

2026-05-22 02:58:59 -04:00
parent 99c429d69c
commit b9197bcb5d
10 changed files with 480 additions and 16 deletions
@@ -0,0 +1,139 @@
+import request from 'supertest'
+import { prisma } from '../../lib/prisma'
+import { createApp } from '../../app'
+import {
+  authHeader,
+  createCompanyWithEmployee,
+  signEmployeeToken,
+} from '../helpers/fixtures'
+
+const app = createApp()
+
+describe('Companies API — brand credential exposure (VF-01)', () => {
+  let companyId: string
+  let ownerToken: string
+  let agentToken: string
+
+  beforeAll(async () => {
+    const { company, employee } = await createCompanyWithEmployee({ role: 'OWNER' })
+    companyId = company.id
+    ownerToken = signEmployeeToken(employee.id, companyId, 'OWNER')
+
+    const agent = await prisma.employee.create({
+      data: {
+        companyId,
+        clerkUserId: `clerk_brand_${Date.now()}`,
+        firstName: 'Agent',
+        lastName:  'Brand',
+        email:     `agent-brand-${Date.now()}@test.com`,
+        role:      'AGENT',
+      },
+    })
+    agentToken = signEmployeeToken(agent.id, companyId, 'AGENT')
+
+    // Seed brand with real-looking payment credentials
+    await prisma.brandSettings.create({
+      data: {
+        companyId,
+        displayName:       company.name,
+        subdomain:         `brand-test-${Date.now()}`,
+        amanpayMerchantId: 'merchant-secret-id',
+        amanpaySecretKey:  'aman-super-secret-key',
+        paypalEmail:       'payments@example.com',
+        paypalMerchantId:  'paypal-merchant-secret',
+      } as any,
+    })
+  })
+
+  describe('GET /api/v1/companies/me/brand', () => {
+    it('returns 401 without auth', async () => {
+      const res = await request(app).get('/api/v1/companies/me/brand')
+      expect(res.status).toBe(401)
+    })
+
+    it('does not expose amanpaySecretKey in the response', async () => {
+      const res = await request(app)
+        .get('/api/v1/companies/me/brand')
+        .set(authHeader(ownerToken))
+
+      expect(res.status).toBe(200)
+      expect(res.body.data).not.toHaveProperty('amanpaySecretKey')
+    })
+
+    it('does not expose amanpayMerchantId in the response', async () => {
+      const res = await request(app)
+        .get('/api/v1/companies/me/brand')
+        .set(authHeader(ownerToken))
+
+      expect(res.status).toBe(200)
+      expect(res.body.data).not.toHaveProperty('amanpayMerchantId')
+    })
+
+    it('does not expose paypalEmail in the response', async () => {
+      const res = await request(app)
+        .get('/api/v1/companies/me/brand')
+        .set(authHeader(ownerToken))
+
+      expect(res.status).toBe(200)
+      expect(res.body.data).not.toHaveProperty('paypalEmail')
+    })
+
+    it('does not expose paypalMerchantId in the response', async () => {
+      const res = await request(app)
+        .get('/api/v1/companies/me/brand')
+        .set(authHeader(ownerToken))
+
+      expect(res.status).toBe(200)
+      expect(res.body.data).not.toHaveProperty('paypalMerchantId')
+    })
+
+    it('returns amanpayConfigured=true when credentials are set', async () => {
+      const res = await request(app)
+        .get('/api/v1/companies/me/brand')
+        .set(authHeader(ownerToken))
+
+      expect(res.status).toBe(200)
+      expect(res.body.data.amanpayConfigured).toBe(true)
+    })
+
+    it('returns paypalConfigured=true when credentials are set', async () => {
+      const res = await request(app)
+        .get('/api/v1/companies/me/brand')
+        .set(authHeader(ownerToken))
+
+      expect(res.status).toBe(200)
+      expect(res.body.data.paypalConfigured).toBe(true)
+    })
+
+    it('is accessible to AGENT role (no role gate on this endpoint)', async () => {
+      const res = await request(app)
+        .get('/api/v1/companies/me/brand')
+        .set(authHeader(agentToken))
+
+      expect(res.status).toBe(200)
+      expect(res.body.data).not.toHaveProperty('amanpaySecretKey')
+      expect(res.body.data).not.toHaveProperty('amanpayMerchantId')
+    })
+
+    it('returns amanpayConfigured=false when credentials are absent', async () => {
+      const { company: c2, employee: e2 } = await createCompanyWithEmployee({ role: 'OWNER' })
+      const t2 = signEmployeeToken(e2.id, c2.id, 'OWNER')
+
+      await prisma.brandSettings.create({
+        data: {
+          companyId:   c2.id,
+          displayName: c2.name,
+          subdomain:   `no-creds-${Date.now()}`,
+        } as any,
+      })
+
+      const res = await request(app)
+        .get('/api/v1/companies/me/brand')
+        .set(authHeader(t2))
+
+      expect(res.status).toBe(200)
+      expect(res.body.data.amanpayConfigured).toBe(false)
+      expect(res.body.data.paypalConfigured).toBe(false)
+    })
+  })
+})
@@ -11,12 +11,62 @@ import {
  signEmployeeToken,
 } from '../helpers/fixtures'

+
 const app = createApp()

 function uniqueEmail(prefix: string) {
  return `${prefix}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}@test.com`
 }

+describe('Payment webhooks — signature bypass fix (VF-02)', () => {
+  describe('POST /api/v1/payments/webhooks/amanpay', () => {
+    it('returns 401 when AmanPay is not configured (env vars absent)', async () => {
+      // In the test environment AMANPAY_MERCHANT_ID and AMANPAY_SECRET_KEY are not set,
+      // so isConfigured() returns false. The fix ensures this returns 401, not 200.
+      const res = await request(app)
+        .post('/api/v1/payments/webhooks/amanpay')
+        .send({ transaction_id: 'txn_fake', status: 'PAID' })
+
+      expect(res.status).toBe(401)
+      expect(res.body.error).toBe('invalid_signature')
+    })
+
+    it('does not process the webhook payload when provider is not configured', async () => {
+      const { company, employee } = await createCompanyWithEmployee({ role: 'OWNER' })
+      const vehicle   = await createVehicle(company.id)
+      const customer  = await createCustomer(company.id)
+      const reservation = await createReservation(company.id, vehicle.id, customer.id, {
+        totalAmount: 1000, paidAmount: 0,
+      })
+      const payment = await createRentalPayment(company.id, reservation.id, {
+        status: 'PENDING',
+        amanpayTransactionId: `txn-webhook-${Date.now()}`,
+      })
+
+      const res = await request(app)
+        .post('/api/v1/payments/webhooks/amanpay')
+        .send({ transaction_id: payment.amanpayTransactionId, status: 'PAID' })
+
+      expect(res.status).toBe(401)
+
+      // Reservation must remain unpaid — the handler was not invoked
+      const unchanged = await prisma.reservation.findUniqueOrThrow({ where: { id: reservation.id } })
+      expect(unchanged.paymentStatus).toBe('UNPAID')
+    })
+  })
+
+  describe('POST /api/v1/payments/webhooks/paypal', () => {
+    it('returns 401 when PayPal is not configured (env vars absent)', async () => {
+      const res = await request(app)
+        .post('/api/v1/payments/webhooks/paypal')
+        .send({ event_type: 'PAYMENT.CAPTURE.COMPLETED', resource: { id: 'pp-fake' } })
+
+      expect(res.status).toBe(401)
+      expect(res.body.error).toBe('invalid_signature')
+    })
+  })
+})
+
 describe('Payments API', () => {
  let companyId: string
  let ownerToken: string
@@ -14,6 +14,51 @@ function uniqueEmail(prefix: string) {
  return `${prefix}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}@test.com`
 }

+describe('Subscription webhooks — signature bypass fix (VF-02)', () => {
+  describe('POST /api/v1/subscriptions/webhooks/amanpay', () => {
+    it('returns 401 when AmanPay is not configured (env vars absent)', async () => {
+      // In the test environment AMANPAY_MERCHANT_ID / SECRET_KEY are not set,
+      // so isConfigured() returns false. The fix ensures this returns 401, not 200.
+      const res = await request(app)
+        .post('/api/v1/subscriptions/webhooks/amanpay')
+        .send({ transaction_id: 'txn_fake_sub', status: 'PAID' })
+
+      expect(res.status).toBe(401)
+      expect(res.body.error).toBe('invalid_signature')
+    })
+
+    it('does not activate a subscription for an unconfigured-provider request', async () => {
+      const { company } = await createCompanyWithEmployee({ role: 'OWNER' })
+      const sub = await prisma.subscription.findUniqueOrThrow({ where: { companyId: company.id } })
+      const invoice = await createSubscriptionInvoice(company.id, sub.id, {
+        status: 'PENDING',
+        amanpayTransactionId: `sub-txn-bypass-${Date.now()}`,
+      })
+
+      const res = await request(app)
+        .post('/api/v1/subscriptions/webhooks/amanpay')
+        .send({ transaction_id: (invoice as any).amanpayTransactionId, status: 'PAID' })
+
+      expect(res.status).toBe(401)
+
+      // Invoice must remain PENDING — the handler was not invoked
+      const unchanged = await prisma.subscriptionInvoice.findUniqueOrThrow({ where: { id: invoice.id } })
+      expect(unchanged.status).toBe('PENDING')
+    })
+  })
+
+  describe('POST /api/v1/subscriptions/webhooks/paypal', () => {
+    it('returns 401 when PayPal is not configured (env vars absent)', async () => {
+      const res = await request(app)
+        .post('/api/v1/subscriptions/webhooks/paypal')
+        .send({ event_type: 'BILLING.SUBSCRIPTION.ACTIVATED', resource: { id: 'sub-fake' } })
+
+      expect(res.status).toBe(401)
+      expect(res.body.error).toBe('invalid_signature')
+    })
+  })
+})
+
 describe('Subscriptions API', () => {
  let companyId: string
  let subscriptionId: string
@@ -1,4 +1,5 @@
 import request from 'supertest'
+import { prisma } from '../../lib/prisma'
 import { createApp } from '../../app'
 import {
  createCompanyWithEmployee,
@@ -143,4 +144,64 @@ describe('Vehicles API', () => {
      expect(res.body.data.available).toBe(true)
    })
  })
+
+  describe('GET /api/v1/vehicles/:id/maintenance — tenant isolation (VF-03)', () => {
+    it('returns 401 without auth', async () => {
+      const vehicle = await createVehicle(companyId)
+      const res = await request(app).get(`/api/v1/vehicles/${vehicle.id}/maintenance`)
+      expect(res.status).toBe(401)
+    })
+
+    it('returns maintenance logs for own company vehicle', async () => {
+      const vehicle = await createVehicle(companyId)
+      await prisma.maintenanceLog.create({
+        data: {
+          vehicleId:   vehicle.id,
+          type:        'OIL_CHANGE',
+          description: 'Routine oil change',
+          cost:        250,
+          performedAt: new Date(),
+        } as any,
+      })
+
+      const res = await request(app)
+        .get(`/api/v1/vehicles/${vehicle.id}/maintenance`)
+        .set(authHeader(token))
+
+      expect(res.status).toBe(200)
+      expect(Array.isArray(res.body.data)).toBe(true)
+      expect(res.body.data.length).toBeGreaterThanOrEqual(1)
+    })
+
+    it('returns 404 when accessing maintenance logs for a vehicle belonging to another company', async () => {
+      const { company: otherCompany } = await createCompanyWithEmployee({ role: 'OWNER' })
+      const foreignVehicle = await createVehicle(otherCompany.id, { make: 'BMW', model: 'X5' })
+
+      const res = await request(app)
+        .get(`/api/v1/vehicles/${foreignVehicle.id}/maintenance`)
+        .set(authHeader(token))
+
+      expect(res.status).toBe(404)
+    })
+
+    it('does not leak maintenance logs across companies even when vehicle id is known', async () => {
+      const { company: otherCompany } = await createCompanyWithEmployee({ role: 'OWNER' })
+      const foreignVehicle = await createVehicle(otherCompany.id)
+      await prisma.maintenanceLog.create({
+        data: {
+          vehicleId:   foreignVehicle.id,
+          type:        'TIRE_ROTATION',
+          description: 'Other company private data',
+          cost:        100,
+          performedAt: new Date(),
+        } as any,
+      })
+
+      const res = await request(app)
+        .get(`/api/v1/vehicles/${foreignVehicle.id}/maintenance`)
+        .set(authHeader(token))
+
+      expect(res.status).toBe(404)
+    })
+  })
 })