eks_relay/tests/integration/tools.test.ts

import { after, before, test } from 'node:test';
import assert from 'node:assert/strict';
import { prepareTestDatabase, startServer, type RunningServer } from '../helpers/testServer.js';
import { applyTestConfig } from '../helpers/testConfig.js';

const dbUrl = prepareTestDatabase('test-tools');

const { createApp } = await import('../../src/http/app.js');
const { disconnectDb } = await import('../../src/store/db.js');

let running: RunningServer;

const TOOL_PATHS = [
  '/tools/get_order_data',
  '/tools/get_product_data',
  '/tools/get_shipping_data',
  '/tools/check_shipping_eligibility',
  '/tools/get_payment_methods',
  '/tools/get_product_compatibility',
  '/tools/get_car_data',
  '/tools/new_ticket',
];

before(async () => {
  applyTestConfig({ DATABASE_URL: dbUrl });
  running = await startServer(createApp());
});

after(async () => {
  await running.close();
  await disconnectDb();
});

async function post(path: string, body: unknown, auth?: string) {
  const headers: Record<string, string> = { 'Content-Type': 'application/json' };
  if (auth !== undefined) headers.Authorization = auth;
  const res = await fetch(`${running.baseUrl}${path}`, {
    method: 'POST',
    headers,
    body: JSON.stringify(body),
  });
  return { status: res.status, body: (await res.json()) as Record<string, unknown> };
}

test('every tool endpoint exists and rejects an unauthenticated call', async () => {
  for (const path of TOOL_PATHS) {
    const res = await post(path, {});
    assert.equal(res.status, 401, `${path} must require auth`);
    assert.equal(res.body.code, 'UNAUTHORIZED');
  }
});

test('a wrong bearer token is rejected', async () => {
  for (const path of TOOL_PATHS) {
    const res = await post(path, {}, 'Bearer wrong-secret');
    assert.equal(res.status, 401, `${path} must reject a wrong secret`);
  }
});

test('a token of the same length but different value is still rejected', async () => {
  const res = await post('/tools/new_ticket', { conversationId: 1 }, 'Bearer test-shared-secreT');
  assert.equal(res.status, 401);
});

test('an authenticated call with missing parameters returns 400, not 401', async () => {
  const res = await post('/tools/new_ticket', {}, 'Bearer test-shared-secret');
  assert.equal(res.status, 400);
  assert.equal(res.body.code, 'MISSING_PARAMS');
});

test('get_order_data requires an e-mail for ownership verification', async () => {
  const res = await post('/tools/get_order_data', { orderNumber: '123' }, 'Bearer test-shared-secret');
  assert.equal(res.status, 400);
  assert.equal(res.body.code, 'INVALID_PARAMS');
});

test('get_product_data requires at least one selector', async () => {
  const res = await post('/tools/get_product_data', {}, 'Bearer test-shared-secret');
  assert.equal(res.status, 400);
  assert.equal(res.body.code, 'MISSING_PARAMS');
});

test('admin endpoints require the admin token, not the tool secret', async () => {
  const noAuth = await fetch(`${running.baseUrl}/admin/events`);
  assert.equal(noAuth.status, 401);

  const toolSecret = await fetch(`${running.baseUrl}/admin/events`, {
    headers: { Authorization: 'Bearer test-shared-secret' },
  });
  assert.equal(toolSecret.status, 401);

  const admin = await fetch(`${running.baseUrl}/admin/events`, {
    headers: { Authorization: 'Bearer test-admin-token' },
  });
  assert.equal(admin.status, 200);
  const body = (await admin.json()) as Record<string, unknown>;
  assert.equal(body.ok, true);
  assert.ok(Array.isArray(body.events));
});

test('an unknown route returns a JSON 404', async () => {
  const res = await fetch(`${running.baseUrl}/tools/does_not_exist`, {
    method: 'POST',
    headers: { 'Content-Type': 'application/json', Authorization: 'Bearer test-shared-secret' },
    body: '{}',
  });
  assert.equal(res.status, 404);
  const body = (await res.json()) as Record<string, unknown>;
  assert.equal(body.code, 'NOT_FOUND');
});