alpenwerk-hr/tests/unit/security.test.ts

import { NextRequest } from "next/server";
import { afterEach, describe, expect, it, vi } from "vitest";
import { sanitizeForSpreadsheetCell, toCsv } from "@/lib/export";
import { sanitizeIlikeTerm } from "@/lib/supabase/query";

// The route under test imports lib/supabase/admin.ts, which is guarded by
// `import "server-only"` — that throws when loaded outside Next's own
// server compilation (e.g. here, under plain Vitest/Node). Mock it out:
// these tests only exercise the auth guard, which returns before the real
// admin client is ever created.
vi.mock("@/lib/supabase/admin", () => ({ createAdminClient: vi.fn() }));

describe("sanitizeForSpreadsheetCell", () => {
  it("prefixes values that would be read as a formula by Excel/Sheets", () => {
    expect(sanitizeForSpreadsheetCell("=SUM(A1:A2)")).toBe("'=SUM(A1:A2)");
    expect(sanitizeForSpreadsheetCell("+1234")).toBe("'+1234");
    expect(sanitizeForSpreadsheetCell("-1234")).toBe("'-1234");
    expect(sanitizeForSpreadsheetCell("@cmd")).toBe("'@cmd");
  });

  it("leaves ordinary text untouched", () => {
    expect(sanitizeForSpreadsheetCell("Gruber")).toBe("Gruber");
    expect(sanitizeForSpreadsheetCell("Hauptstraße 1, 1200 Wien")).toBe("Hauptstraße 1, 1200 Wien");
  });

  it("toCsv escapes a formula-injection payload in a row value", () => {
    const csv = toCsv([{ name: "=cmd|'/c calc'!A1" }], [{ header: "Name", get: (r: { name: string }) => r.name }]);
    expect(csv).toContain("'=cmd");
  });
});

describe("sanitizeIlikeTerm", () => {
  it("strips PostgREST or-filter delimiter characters", () => {
    expect(sanitizeIlikeTerm("a,b")).toBe("ab");
    expect(sanitizeIlikeTerm("a(b)c")).toBe("abc");
    // An attempt to close the current ilike condition and append another
    // column filter is neutralized by removing the delimiters, not escaped
    // into a differently-structured (but still injected) query.
    expect(sanitizeIlikeTerm("x),sv_nummer.ilike.%")).toBe("xsv_nummer.ilike.%");
  });

  it("leaves a normal search term untouched", () => {
    expect(sanitizeIlikeTerm("Gruber")).toBe("Gruber");
  });
});

describe("cron auth guard (/api/cron/apply-pending-changes)", () => {
  afterEach(() => {
    vi.unstubAllEnvs();
  });

  async function callCronRoute(authorization?: string) {
    // The route reads process.env.CRON_SECRET inside the handler on every
    // request (not at module load time), so importing it once and reusing
    // it across the stubbed-env cases below is safe.
    const { GET } = await import("@/app/api/cron/apply-pending-changes/route");
    const headers = new Headers();
    if (authorization !== undefined) headers.set("authorization", authorization);
    const request = new NextRequest("http://localhost/api/cron/apply-pending-changes", { headers });
    return GET(request);
  }

  it("rejects the request when CRON_SECRET is not configured, even with a matching-looking header", async () => {
    vi.stubEnv("CRON_SECRET", "");
    const res = await callCronRoute("Bearer ");
    expect(res.status).toBe(401);
  });

  it("rejects a request with no Authorization header", async () => {
    vi.stubEnv("CRON_SECRET", "test-secret");
    const res = await callCronRoute(undefined);
    expect(res.status).toBe(401);
  });

  it("rejects a request with the wrong bearer token", async () => {
    vi.stubEnv("CRON_SECRET", "test-secret");
    const res = await callCronRoute("Bearer wrong-value");
    expect(res.status).toBe(401);
  });
});

describe("protected export route without a session (/api/export/employees)", () => {
  it("returns 401 instead of running the query when there is no authenticated user", async () => {
    vi.doMock("@/lib/supabase/server", () => ({
      createClient: async () => ({
        auth: { getUser: async () => ({ data: { user: null } }) },
      }),
    }));
    const { GET } = await import("@/app/api/export/employees/route");
    const request = new NextRequest("http://localhost/api/export/employees");
    const res = await GET(request);
    expect(res.status).toBe(401);
    vi.doUnmock("@/lib/supabase/server");
  });
});