managarten/services/mana-notify/internal/handler/notifications_test.go
Till JS 8e8b6ac65f fix(mana-auth) + chore: rewrite /api/v1/auth/login JWT mint, remove Matrix stack
This commit bundles two unrelated changes that were swept together by an
accidental `git add -A` in another working session. Documented here so the
history reflects what's actually inside.

═══════════════════════════════════════════════════════════════════════
1. fix(mana-auth): /api/v1/auth/login mints JWT via auth.handler instead
   of api.signInEmail
═══════════════════════════════════════════════════════════════════════

Previous attempt (commit 55cc75e7d) tried to fix the broken JWT mint in
/api/v1/auth/login by switching the cookie name from `mana.session_token`
to `__Secure-mana.session_token` for production. That was necessary but
not sufficient: Better Auth's session cookie value isn't just the raw
session token, it's `<token>.<HMAC>` where the HMAC is derived from the
better-auth secret. Reconstructing the cookie from auth.api.signInEmail's
JSON response only gave us the raw token, so /api/auth/token's
get-session middleware still couldn't validate it and the JWT mint kept
silently failing.

Real fix: do the sign-in via auth.handler (the HTTP path) rather than
auth.api.signInEmail (the SDK path). The handler returns a real fetch
Response with a Set-Cookie header containing the fully signed cookie
envelope. We capture that header verbatim and forward it as the cookie
on the /api/auth/token request, which now passes validation and mints
the JWT correctly.

Verified end-to-end on auth.mana.how:

  $ curl -X POST https://auth.mana.how/api/v1/auth/login \
      -d '{"email":"...","password":"..."}'
  {
    "user": {...},
    "token": "<session token>",
    "accessToken": "eyJhbGciOiJFZERTQSI...",   ← real JWT now
    "refreshToken": "<session token>"
  }

Side benefits:
- Email-not-verified path is now handled by checking
  signInResponse.status === 403 directly, no more catching APIError
  with the comment-noted async-stream footgun.
- X-Forwarded-For is forwarded explicitly so Better Auth's rate limiter
  and our security log see the real client IP.
- The leftover catch block now only handles unexpected exceptions
  (network errors etc); the FORBIDDEN-checking logic in it is dead but
  harmless and left in for defense in depth.

═══════════════════════════════════════════════════════════════════════
2. chore: remove the entire self-hosted Matrix stack (Synapse, Element,
   Manalink, mana-matrix-bot)
═══════════════════════════════════════════════════════════════════════

The Matrix subsystem ran parallel to the main Mana product without any
load-bearing integration: the unified web app never imported matrix-js-sdk,
the chat module uses mana-sync (local-first), and mana-matrix-bot's
plugins duplicated features the unified app already ships natively.
Keeping it alive cost a Synapse + Element + matrix-web + bot container
quartet, three Cloudflare routes, an OIDC provider plugin in mana-auth,
and a steady drip of devlog/dependency churn.

Removed:
- apps/matrix (Manalink web + mobile, ~150 files)
- services/mana-matrix-bot (Go bot with ~20 plugins)
- docker/matrix configs (Synapse + Element)
- synapse/element-web/matrix-web/mana-matrix-bot services in
  docker-compose.macmini.yml
- matrix.mana.how/element.mana.how/link.mana.how Cloudflare tunnel routes
- OIDC provider plugin + matrix-synapse trustedClient + matrixUserLinks
  table from mana-auth (oauth_* schema definitions also removed)
- MatrixService import path in mana-media (importFromMatrix endpoint)
- Matrix notification channel in mana-notify (worker, metrics, config,
  channel_type enum, MatrixOptions handler)
- Matrix entries from shared-branding (mana-apps + app-icons),
  notify-client, the i18n bundle, the observatory map, the credits
  app-label list, the landing footer/apps page, the prometheus + alerts
  + promtail tier mappings, and the matrix-related deploy paths in
  cd-macmini.yml + ci.yml

Devlog/manascore/blueprint entries that mention Matrix are left intact
as historical record. The oauth_* + matrix_user_links Postgres tables
stay on existing prod databases — code can no longer write to them, drop
them in a follow-up migration if you want them gone for real.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-08 16:32:13 +02:00

196 lines
4.6 KiB
Go

package handler
import (
"encoding/json"
"testing"
)
func TestValidateSendRequest(t *testing.T) {
tests := []struct {
name string
req SendRequest
wantErr string
}{
{
name: "missing channel",
req: SendRequest{AppID: "app1", Recipient: "user@test.com", Body: "hello"},
wantErr: "channel is required",
},
{
name: "invalid channel",
req: SendRequest{Channel: "sms", AppID: "app1", Recipient: "user@test.com", Body: "hello"},
wantErr: "channel must be email, push, or webhook",
},
{
name: "missing appId",
req: SendRequest{Channel: "email", Recipient: "user@test.com", Body: "hello"},
wantErr: "appId is required",
},
{
name: "missing recipient and userId",
req: SendRequest{Channel: "email", AppID: "app1", Body: "hello"},
wantErr: "recipient, recipients, or userId is required",
},
{
name: "missing template and body",
req: SendRequest{Channel: "email", AppID: "app1", Recipient: "user@test.com"},
wantErr: "template or body is required",
},
{
name: "valid with recipient and body",
req: SendRequest{Channel: "email", AppID: "app1", Recipient: "user@test.com", Body: "hello"},
},
{
name: "valid with userId and template",
req: SendRequest{Channel: "push", AppID: "app1", UserID: "u1", Template: "welcome"},
},
{
name: "valid with recipients",
req: SendRequest{Channel: "webhook", AppID: "app1", Recipients: []string{"url1"}, Body: "data"},
},
{
name: "valid email channel",
req: SendRequest{Channel: "email", AppID: "app1", Recipient: "a@b.com", Body: "hi"},
},
{
name: "valid push channel",
req: SendRequest{Channel: "push", AppID: "app1", Recipient: "token", Body: "hi"},
},
{
name: "valid webhook channel",
req: SendRequest{Channel: "webhook", AppID: "app1", Recipient: "https://hook.example.com", Body: "{}"},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
err := validateSendRequest(&tt.req)
if tt.wantErr != "" {
if err == nil {
t.Fatalf("expected error %q, got nil", tt.wantErr)
}
if err.Error() != tt.wantErr {
t.Fatalf("expected error %q, got %q", tt.wantErr, err.Error())
}
} else {
if err != nil {
t.Fatalf("expected no error, got %q", err.Error())
}
}
})
}
}
func TestParseTime(t *testing.T) {
tests := []struct {
input string
wantH int
wantM int
}{
{"22:00", 22, 0},
{"08:30", 8, 30},
{"0:00", 0, 0},
{"23:59", 23, 59},
{"invalid", 0, 0},
{"", 0, 0},
}
for _, tt := range tests {
t.Run(tt.input, func(t *testing.T) {
h, m := parseTime(tt.input)
if h != tt.wantH || m != tt.wantM {
t.Fatalf("parseTime(%q) = (%d, %d), want (%d, %d)", tt.input, h, m, tt.wantH, tt.wantM)
}
})
}
}
func TestNilIfEmpty(t *testing.T) {
tests := []struct {
name string
input string
isNil bool
}{
{"empty string returns nil", "", true},
{"non-empty returns pointer", "hello", false},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
result := nilIfEmpty(tt.input)
if tt.isNil {
if result != nil {
t.Fatal("expected nil, got non-nil")
}
} else {
if result == nil {
t.Fatal("expected non-nil, got nil")
}
if *result != tt.input {
t.Fatalf("expected %q, got %q", tt.input, *result)
}
}
})
}
}
func TestJsonOrNil(t *testing.T) {
tests := []struct {
name string
input map[string]any
isNil bool
verify func(t *testing.T, b []byte)
}{
{
name: "nil map returns nil",
input: nil,
isNil: true,
},
{
name: "empty map returns valid JSON",
input: map[string]any{},
isNil: false,
verify: func(t *testing.T, b []byte) {
var m map[string]any
if err := json.Unmarshal(b, &m); err != nil {
t.Fatalf("invalid JSON: %v", err)
}
if len(m) != 0 {
t.Fatalf("expected empty map, got %v", m)
}
},
},
{
name: "map with data returns valid JSON",
input: map[string]any{"key": "value", "num": float64(42)},
isNil: false,
verify: func(t *testing.T, b []byte) {
var m map[string]any
if err := json.Unmarshal(b, &m); err != nil {
t.Fatalf("invalid JSON: %v", err)
}
if m["key"] != "value" {
t.Fatalf("expected key=value, got %v", m["key"])
}
},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
result := jsonOrNil(tt.input)
if tt.isNil {
if result != nil {
t.Fatal("expected nil, got non-nil")
}
} else {
if result == nil {
t.Fatal("expected non-nil, got nil")
}
if tt.verify != nil {
tt.verify(t, result)
}
}
})
}
}