Files
accounted/extensions/general/whatsapp-inbox/__tests__/graph-api.test.ts
T
398c734b93 feat(whatsapp-inbox): intake extension with webhook, phone linking and receipt ack (#1338)
Webhook lifecycle: GET hub.challenge handshake (constant-time verify-token
compare); POST verifies X-Hub-Signature-256 over the RAW body before any
parse, Zod-parses the envelope, persists inbound rows (partial-unique wamid
= dedupe against Meta's up-to-7-day redelivery), acks 200 fast and defers
media processing via the after() idiom. Rejected and rate-limited content
always acks 200 and lands as skipped/error rows, never a retryable status.

Linking: the settings panel (Installningar -> WhatsApp) mints AC- one-time
codes (sha256 stored, 10 min TTL, single use, ambiguity-free alphabet); the
webhook consumes the code, binds phone to user (HMAC-peppered hash + AES-256-
GCM at rest) and confirms with M3. Keyword commands stopp/start/hjalp;
unknown senders get one throttled M1 greeting (1/h, 3/day) behind the
sender-quota RPC, with no media download and no content persistence.

Intake worker: atomic claim on the message row (the durable job record),
company resolution (default -> sole membership -> M6 fallback, no item),
per-company inbox quota (ack-and-drop, M17 once per 10 min per sender),
MIME allowlist, 10 MB stream-checked media download, exact sha256 duplicate
check, then the shared uploadAndExtract funnel (source 'whatsapp',
channel_context caption, whatsapp_message_id) and the M4 ack with extracted
merchant/total/date. Failures wrap to 'error' + error_message + one M18.

uploadAndExtract widened: source 'whatsapp', optional channelMeta + actorId;
email/upload paths behaviorally unchanged.

Deferred to PR4: burst debounce + combined ack (M5), in-chat company choice
(M6 buttons + 8h pin), clarifying questions M7-M10, interpret-answer LLM
call, sweep cron, retention cron.

Co-authored-by: Jakob Wennberg <jakob.wennberg@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-08-05 14:47:08 +02:00

202 lines
7.5 KiB
TypeScript

import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
import { createQueuedMockSupabase } from '@/tests/helpers'
import { TimeoutError } from '@/lib/http/fetch-with-timeout'
import {
sendText,
downloadMedia,
getDisplayPhoneNumber,
resetDisplayNumberCacheForTests,
GraphApiError,
MAX_MEDIA_BYTES,
} from '@/extensions/general/whatsapp-inbox/lib/graph-api'
import { TEMPLATE } from '@/extensions/general/whatsapp-inbox/lib/messages'
import type { SupabaseClient } from '@supabase/supabase-js'
const fetchMock = vi.fn()
describe('graph-api', () => {
const originalEnv = { ...process.env }
beforeEach(() => {
vi.clearAllMocks()
vi.stubGlobal('fetch', fetchMock)
resetDisplayNumberCacheForTests()
process.env.WHATSAPP_ACCESS_TOKEN = 'token-1'
process.env.WHATSAPP_PHONE_NUMBER_ID = '111222333'
})
afterEach(() => {
vi.unstubAllGlobals()
process.env = { ...originalEnv }
})
describe('sendText', () => {
it('sends and persists an outbound row with the response wamid', async () => {
fetchMock.mockResolvedValueOnce(
new Response(JSON.stringify({ messages: [{ id: 'wamid.OUT1' }] }), { status: 200 }),
)
const { supabase, enqueue, findCall } = createQueuedMockSupabase()
enqueue({ data: null, error: null })
const result = await sendText(supabase as unknown as SupabaseClient, {
to: '46701234567',
body: 'Hej!',
template: TEMPLATE.m16Fallback,
senderPhoneHash: 'hash-1',
})
expect(result).toEqual({ ok: true, wamid: 'wamid.OUT1' })
const [row] = findCall('whatsapp_messages', 'insert') as [Record<string, unknown>]
expect(row.direction).toBe('outbound')
expect(row.wamid).toBe('wamid.OUT1')
expect(row.delivery_status).toBe('sent')
expect(row.processing_status).toBe('done')
expect(row.raw_payload).toEqual({ template: TEMPLATE.m16Fallback })
expect(row.sender_phone_hash).toBe('hash-1')
// The Graph call itself
const [url, init] = fetchMock.mock.calls[0] as [string, RequestInit]
expect(url).toContain('/111222333/messages')
expect((init.headers as Record<string, string>).Authorization).toBe('Bearer token-1')
expect(JSON.parse(init.body as string).text.body).toBe('Hej!')
})
it('never throws on non-2xx and records a failed row', async () => {
fetchMock.mockResolvedValueOnce(new Response('{"error":{}}', { status: 500 }))
const { supabase, enqueue, findCall } = createQueuedMockSupabase()
enqueue({ data: null, error: null })
const result = await sendText(supabase as unknown as SupabaseClient, {
to: '46701234567',
body: 'Hej!',
template: TEMPLATE.m18Error,
})
expect(result).toEqual({ ok: false, wamid: null })
const [row] = findCall('whatsapp_messages', 'insert') as [Record<string, unknown>]
expect(row.delivery_status).toBe('failed')
expect(row.wamid).toBeNull()
})
it('never throws on a network error', async () => {
fetchMock.mockRejectedValueOnce(new Error('ECONNRESET'))
const { supabase, enqueue } = createQueuedMockSupabase()
enqueue({ data: null, error: null })
const result = await sendText(supabase as unknown as SupabaseClient, {
to: '46701234567',
body: 'Hej!',
template: TEMPLATE.m18Error,
})
expect(result.ok).toBe(false)
})
})
describe('downloadMedia', () => {
it('resolves the media id, downloads with Bearer auth, and returns the bytes', async () => {
const bytes = new Uint8Array([1, 2, 3, 4])
fetchMock
.mockResolvedValueOnce(
new Response(
JSON.stringify({ url: 'https://lookaside.example/m1', mime_type: 'image/jpeg' }),
{ status: 200 },
),
)
.mockResolvedValueOnce(new Response(bytes, { status: 200 }))
const media = await downloadMedia('media-1')
expect(media.mime).toBe('image/jpeg')
expect(media.fileSize).toBe(4)
expect(new Uint8Array(media.buffer)).toEqual(bytes)
const [downloadUrl, downloadInit] = fetchMock.mock.calls[1] as [string, RequestInit]
expect(downloadUrl).toBe('https://lookaside.example/m1')
expect((downloadInit.headers as Record<string, string>).Authorization).toBe('Bearer token-1')
})
it('rejects a non-2xx lookup', async () => {
fetchMock.mockResolvedValueOnce(new Response('{}', { status: 404 }))
await expect(downloadMedia('media-1')).rejects.toThrow(GraphApiError)
})
it('rejects a non-2xx download', async () => {
fetchMock
.mockResolvedValueOnce(
new Response(JSON.stringify({ url: 'https://lookaside.example/m1' }), { status: 200 }),
)
.mockResolvedValueOnce(new Response('gone', { status: 410 }))
await expect(downloadMedia('media-1')).rejects.toThrow(/download failed/)
})
it('rejects when the declared file size exceeds the cap', async () => {
fetchMock.mockResolvedValueOnce(
new Response(
JSON.stringify({ url: 'https://x/m1', file_size: MAX_MEDIA_BYTES + 1 }),
{ status: 200 },
),
)
await expect(downloadMedia('media-1')).rejects.toThrow(/size limit/)
expect(fetchMock).toHaveBeenCalledTimes(1)
})
it('rejects via the content-length header before reading the body', async () => {
fetchMock
.mockResolvedValueOnce(
new Response(JSON.stringify({ url: 'https://x/m1' }), { status: 200 }),
)
.mockResolvedValueOnce(
new Response('x', {
status: 200,
headers: { 'content-length': String(MAX_MEDIA_BYTES + 1) },
}),
)
await expect(downloadMedia('media-1')).rejects.toThrow(/size limit/)
})
it('rejects an oversized stream even without a content-length header', async () => {
const chunk = new Uint8Array(6 * 1024 * 1024)
const stream = new ReadableStream<Uint8Array>({
start(controller) {
controller.enqueue(chunk)
controller.enqueue(chunk) // 12 MB total > 10 MB cap
controller.close()
},
})
fetchMock
.mockResolvedValueOnce(
new Response(JSON.stringify({ url: 'https://x/m1' }), { status: 200 }),
)
.mockResolvedValueOnce(new Response(stream, { status: 200 }))
await expect(downloadMedia('media-1')).rejects.toThrow(/size limit/)
})
it('propagates timeouts as TimeoutError', async () => {
fetchMock.mockRejectedValueOnce(new TimeoutError('WhatsApp media lookup timed out'))
await expect(downloadMedia('media-1')).rejects.toThrow(TimeoutError)
})
it('throws when the access token is missing', async () => {
delete process.env.WHATSAPP_ACCESS_TOKEN
await expect(downloadMedia('media-1')).rejects.toThrow(/WHATSAPP_ACCESS_TOKEN/)
})
})
describe('getDisplayPhoneNumber', () => {
it('resolves and caches the display number as digits', async () => {
fetchMock.mockResolvedValueOnce(
new Response(JSON.stringify({ display_phone_number: '+46 10 123 45 67' }), { status: 200 }),
)
expect(await getDisplayPhoneNumber()).toBe('46101234567')
// Cached: second call issues no fetch.
expect(await getDisplayPhoneNumber()).toBe('46101234567')
expect(fetchMock).toHaveBeenCalledTimes(1)
})
it('returns null on failure instead of throwing', async () => {
fetchMock.mockResolvedValueOnce(new Response('{}', { status: 500 }))
expect(await getDisplayPhoneNumber()).toBeNull()
})
})
})