import { describe, it, expect } from 'vitest' import { ensureHtmlDocument, buildEmailBodyHtmlDocument, EMAIL_ALLOWED_MIME_TYPES, UPLOAD_ALLOWED_MIME_TYPES, } from '@/extensions/general/invoice-inbox/lib/upload-and-extract' import { htmlToText } from '@/extensions/general/invoice-inbox/lib/extract-invoice-fields' import { validateDocumentMagicBytes } from '@/lib/core/documents/document-service' const decode = (buf: ArrayBuffer) => new TextDecoder().decode(new Uint8Array(buf)) describe('EMAIL_ALLOWED_MIME_TYPES', () => { it('is the upload set plus text/html, and only reachable from the email pipeline', () => { for (const type of UPLOAD_ALLOWED_MIME_TYPES) { expect(EMAIL_ALLOWED_MIME_TYPES.has(type)).toBe(true) } expect(EMAIL_ALLOWED_MIME_TYPES.has('text/html')).toBe(true) // The manual upload surface must stay strict. expect(UPLOAD_ALLOWED_MIME_TYPES.has('text/html')).toBe(false) }) }) describe('ensureHtmlDocument', () => { it('wraps a fragment-shaped mail body into a full document', () => { const out = decode(ensureHtmlDocument('
Belopp: 100 kr
', 'plain fallback')!) expect(out).toContain('Belopp: 100 kr
') expect(out).not.toContain('plain fallback') }) it('escapes a plain-text-only body into a', () => {
const out = decode(
buildEmailBodyHtmlDocument(null, 'Total & 100 kr')!,
)
expect(out).toContain('')
expect(out).toContain('Total <script>alert(1)</script> & 100 kr')
expect(out).not.toContain('Faktura 42