accounted/app/api/auth/email-hook/__tests__/route.test.ts

/**
 * Tests for POST /api/auth/email-hook (Supabase Send Email hook).
 *
 * Unauthenticated by design: the guard is the Standard Webhooks signature.
 * Signature material is computed with node:crypto exactly like Supabase does.
 */
import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
import { createHmac, randomBytes } from 'node:crypto'
import type { Brand } from '@/lib/branding/resolve'

vi.mock('@/lib/init', () => ({ ensureInitialized: vi.fn() }))

const resolveBrandResultByHostMock = vi.hoisted(() => vi.fn())
vi.mock('@/lib/branding/resolve', () => ({
  resolveBrandByHost: vi.fn(),
  // The one registry read: the trusted-origin resolver classifies the
  // redirect_to host through it, and the hook reads the sender brand from it.
  resolveBrandResultByHost: (...args: unknown[]) => resolveBrandResultByHostMock(...args),
  // Imported by lib/email/brand-sender (not called on the hook path).
  resolveBrandForCompany: vi.fn(),
}))

const CANONICAL = 'https://app.gnubok.se'
/** The one registered brand host in these tests; everything else is unknown. */
const BRAND_HOST = 'app.siffra.se'

vi.mock('@/lib/branding/service', () => ({
  getBranding: () => ({ appName: 'Accounted', appUrl: 'https://app.gnubok.se' }),
}))

const sendEmailMock = vi.hoisted(() => vi.fn())
vi.mock('@/lib/email/service', () => ({
  getEmailService: () => ({ sendEmail: sendEmailMock, isConfigured: () => true }),
}))

import { POST } from '../route'

const KEY = randomBytes(24)
const SECRET = `v1,whsec_${KEY.toString('base64')}`

function makeBrand(overrides: Partial<Brand> = {}): Brand {
  return {
    id: 'brand-1',
    teamId: 'team-1',
    domain: 'app.siffra.se',
    appName: 'Siffra',
    logoUrl: null,
    brandColor: '#123456',
    chromeColor: null,
    fontKey: 'default',
    supportEmail: 'support@siffra.se',
    authEmailFrom: 'noreply@post.siffra.se',
    senderDomain: 'post.siffra.se',
    senderDomainStatus: 'verified',
    resendDomainId: 'rd-1',
    signupMode: 'open',
    ...overrides,
  }
}

function signedRequest(rawBody: string, opts?: { badSignature?: boolean; headers?: Record<string, string> }): Request {
  const id = 'msg_1'
  const timestamp = String(Math.floor(Date.now() / 1000))
  const signature = createHmac('sha256', KEY)
    .update(`${id}.${timestamp}.${rawBody}`)
    .digest('base64')
  return new Request('http://localhost:3000/api/auth/email-hook', {
    method: 'POST',
    body: rawBody,
    headers: {
      'content-type': 'application/json',
      'webhook-id': id,
      'webhook-timestamp': timestamp,
      'webhook-signature': opts?.badSignature ? 'v1,AAAA' : `v1,${signature}`,
      ...opts?.headers,
    },
  })
}

function hookPayload(overrides?: {
  user?: Record<string, unknown>
  email_data?: Record<string, unknown>
}): string {
  return JSON.stringify({
    user: { email: 'user@example.se', ...overrides?.user },
    email_data: {
      token: '123456',
      token_hash: 'hash-1',
      redirect_to: 'https://app.gnubok.se/auth/callback?next=/reset-password',
      email_action_type: 'recovery',
      site_url: 'https://app.gnubok.se',
      ...overrides?.email_data,
    },
  })
}

const ORIGINAL_APP_URL = process.env.NEXT_PUBLIC_APP_URL

beforeEach(() => {
  vi.clearAllMocks()
  process.env.SUPABASE_SEND_EMAIL_HOOK_SECRET = SECRET
  process.env.NEXT_PUBLIC_APP_URL = CANONICAL
  resolveBrandResultByHostMock.mockImplementation(async (host: string) => ({
    brand: host === BRAND_HOST ? makeBrand() : null,
    lookupFailed: false,
  }))
  sendEmailMock.mockResolvedValue({ success: true, messageId: 'msg-1' })
})

afterEach(() => {
  delete process.env.SUPABASE_SEND_EMAIL_HOOK_SECRET
  if (ORIGINAL_APP_URL === undefined) delete process.env.NEXT_PUBLIC_APP_URL
  else process.env.NEXT_PUBLIC_APP_URL = ORIGINAL_APP_URL
})

describe('POST /api/auth/email-hook', () => {
  it('returns 500 when the hook secret is not configured', async () => {
    delete process.env.SUPABASE_SEND_EMAIL_HOOK_SECRET
    const res = await POST(signedRequest(hookPayload()))
    expect(res.status).toBe(500)
    expect(sendEmailMock).not.toHaveBeenCalled()
  })

  it('returns 401 for an invalid signature', async () => {
    const res = await POST(signedRequest(hookPayload(), { badSignature: true }))
    expect(res.status).toBe(401)
    expect(sendEmailMock).not.toHaveBeenCalled()
  })

  it('returns 400 for a signed but malformed payload', async () => {
    const res = await POST(signedRequest('not-json'))
    expect(res.status).toBe(400)
    expect(sendEmailMock).not.toHaveBeenCalled()
  })

  it('sends canonical recovery mail linking to the originating host (no brand)', async () => {
    const res = await POST(signedRequest(hookPayload()))
    expect(res.status).toBe(200)
    await expect(res.json()).resolves.toEqual({})

    expect(sendEmailMock).toHaveBeenCalledTimes(1)
    const options = sendEmailMock.mock.calls[0][0]
    expect(options.to).toBe('user@example.se')
    expect(options.subject).toBe('Återställ ditt lösenord')
    expect(options.fromName).toBeUndefined()
    expect(options.fromAddress).toBeUndefined()
    expect(options.replyTo).toBeUndefined()
    // token_hash + verifyOtp pattern on the originating host, preserving the
    // existing next=/reset-password query.
    expect(options.text).toContain('https://app.gnubok.se/auth/callback?next=%2Freset-password')
    expect(options.text).toContain('token_hash=hash-1')
    expect(options.text).toContain('type=recovery')
  })

  it('brands the mail from the redirect_to host and rides the verified brand sender', async () => {
    const res = await POST(
      signedRequest(
        hookPayload({
          email_data: {
            email_action_type: 'signup',
            redirect_to: 'https://app.siffra.se/auth/callback',
          },
        }),
      ),
    )
    expect(res.status).toBe(200)
    expect(resolveBrandResultByHostMock).toHaveBeenCalledWith('app.siffra.se')

    const options = sendEmailMock.mock.calls[0][0]
    expect(options.fromName).toBe('Siffra')
    expect(options.fromAddress).toBe('noreply@post.siffra.se')
    expect(options.replyTo).toBe('support@siffra.se')
    expect(options.html).toContain('Siffra')
    expect(options.html).not.toMatch(/accounted/i)
    expect(options.text).toContain('https://app.siffra.se/auth/callback?token_hash=hash-1')
    expect(options.text).toContain('type=signup')
  })

  it('uses the via-fallback for a brand without a verified sender domain', async () => {
    resolveBrandResultByHostMock.mockResolvedValue({
      brand: makeBrand({ senderDomainStatus: 'pending' }),
      lookupFailed: false,
    })
    await POST(
      signedRequest(
        hookPayload({
          email_data: {
            email_action_type: 'magiclink',
            redirect_to: 'https://app.siffra.se/auth/callback',
          },
        }),
      ),
    )
    const options = sendEmailMock.mock.calls[0][0]
    expect(options.fromName).toBe('Siffra')
    expect(options.fromAddress).toBeUndefined()
  })

  it('sends two mails for a secure email change', async () => {
    await POST(
      signedRequest(
        hookPayload({
          user: { email: 'current@example.se', new_email: 'new@example.se' },
          email_data: {
            email_action_type: 'email_change',
            token_hash: 'hash-new-address',
            token_hash_new: 'hash-current-address',
            redirect_to: 'https://app.gnubok.se/auth/callback',
          },
        }),
      ),
    )
    expect(sendEmailMock).toHaveBeenCalledTimes(2)
    const first = sendEmailMock.mock.calls[0][0]
    const second = sendEmailMock.mock.calls[1][0]
    // token_hash confirms at the NEW address, token_hash_new at the current.
    expect(first.to).toBe('new@example.se')
    expect(first.text).toContain('token_hash=hash-new-address')
    expect(second.to).toBe('current@example.se')
    expect(second.text).toContain('token_hash=hash-current-address')
  })

  it('sends the OTP code for reauthentication without a link', async () => {
    await POST(
      signedRequest(
        hookPayload({
          email_data: { email_action_type: 'reauthentication', token: '424242' },
        }),
      ),
    )
    const options = sendEmailMock.mock.calls[0][0]
    expect(options.subject).toBe('Din verifieringskod')
    expect(options.text).toContain('424242')
    expect(options.text).not.toContain('token_hash=')
  })

  it('builds the callback URL when redirect_to points at a plain path', async () => {
    await POST(
      signedRequest(
        hookPayload({
          email_data: {
            email_action_type: 'magiclink',
            redirect_to: 'https://app.gnubok.se/settings/account',
          },
        }),
      ),
    )
    const options = sendEmailMock.mock.calls[0][0]
    expect(options.text).toContain('https://app.gnubok.se/auth/callback?next=%2Fsettings%2Faccount')
    expect(options.text).toContain('type=magiclink')
  })

  it('returns 500 when the email provider fails, so Supabase retries', async () => {
    sendEmailMock.mockResolvedValue({ success: false, error: 'provider down' })
    const res = await POST(signedRequest(hookPayload()))
    expect(res.status).toBe(500)
  })

  describe('redirect_to destinations (signature proves the sender, not the destination)', () => {
    it.each([
      ['an unknown host', 'https://evil.example/auth/callback?next=/reset-password'],
      ['a lookalike of a registered host', 'https://app.siffra.se.evil.example/auth/callback'],
      ['a registered host on a non-default port', 'https://app.siffra.se:8443/auth/callback'],
      ['a credential-bearing URL', 'https://app.siffra.se@evil.example/auth/callback'],
      // URL.origin drops userinfo: the host alone would pass as trusted.
      ['credentials on a registered host', 'https://evil.example@app.siffra.se/auth/callback?next=/x'],
      ['credentials on the canonical host', 'https://user:pw@app.gnubok.se/auth/callback?next=/x'],
      ['a malformed value', 'not a url'],
    ])('links %s to the canonical callback without the requested path', async (_label, redirectTo) => {
      const res = await POST(
        signedRequest(hookPayload({ email_data: { redirect_to: redirectTo } })),
      )
      expect(res.status).toBe(200)

      const options = sendEmailMock.mock.calls[0][0]
      expect(options.text).toContain(
        'https://app.gnubok.se/auth/callback?token_hash=hash-1&type=recovery',
      )
      expect(options.text).not.toContain('evil.example')
      expect(options.text).not.toContain(':8443')
      expect(options.text).not.toContain('next=')
      // Canonical link means canonical sender: brand and destination agree.
      expect(options.fromName).toBeUndefined()
      expect(options.fromAddress).toBeUndefined()
    })

    it('upgrades http on a registered brand host to https and drops the requested path', async () => {
      await POST(
        signedRequest(
          hookPayload({
            email_data: { redirect_to: 'http://app.siffra.se/auth/callback?next=/settings' },
          }),
        ),
      )
      const options = sendEmailMock.mock.calls[0][0]
      expect(options.text).toContain(
        'https://app.siffra.se/auth/callback?token_hash=hash-1&type=recovery',
      )
      expect(options.text).not.toContain('http://')
      expect(options.text).not.toContain('next=')
      expect(options.fromName).toBe('Siffra')
    })

    it('keeps the requested path on a registered brand host', async () => {
      await POST(
        signedRequest(
          hookPayload({
            email_data: { redirect_to: 'https://app.siffra.se/auth/callback?next=%2Freset-password' },
          }),
        ),
      )
      const options = sendEmailMock.mock.calls[0][0]
      expect(options.text).toContain(
        'https://app.siffra.se/auth/callback?next=%2Freset-password&token_hash=hash-1',
      )
      expect(options.fromName).toBe('Siffra')
    })

    it('falls back to the canonical callback when redirect_to is missing', async () => {
      await POST(signedRequest(hookPayload({ email_data: { redirect_to: undefined } })))
      const options = sendEmailMock.mock.calls[0][0]
      expect(options.text).toContain('https://app.gnubok.se/auth/callback?token_hash=hash-1')
    })

    it('returns 500 without sending when the brand read fails after the origin resolved', async () => {
      // First read (origin classification) succeeds, second (sender) fails:
      // never platform-branded mail carrying a brand link.
      resolveBrandResultByHostMock
        .mockResolvedValueOnce({ brand: makeBrand(), lookupFailed: false })
        .mockResolvedValueOnce({ brand: null, lookupFailed: true })
      const res = await POST(
        signedRequest(
          hookPayload({ email_data: { redirect_to: 'https://app.siffra.se/auth/callback' } }),
        ),
      )
      expect(res.status).toBe(500)
      expect(sendEmailMock).not.toHaveBeenCalled()
    })

    it('still sends canonical mail when the brand read fails on the canonical origin', async () => {
      resolveBrandResultByHostMock.mockResolvedValue({ brand: null, lookupFailed: true })
      const res = await POST(signedRequest(hookPayload()))
      expect(res.status).toBe(200)
      const options = sendEmailMock.mock.calls[0][0]
      expect(options.text).toContain('https://app.gnubok.se/auth/callback?next=%2Freset-password')
      expect(options.fromName).toBeUndefined()
    })

    it('returns 500 without sending when the brand registry cannot be read', async () => {
      resolveBrandResultByHostMock.mockResolvedValue({ brand: null, lookupFailed: true })
      const res = await POST(
        signedRequest(
          hookPayload({ email_data: { redirect_to: 'https://app.siffra.se/auth/callback' } }),
        ),
      )
      expect(res.status).toBe(500)
      expect(sendEmailMock).not.toHaveBeenCalled()
    })
  })
})