metis-desk/apps/server/src/company-logos.integration.ts

import assert from "node:assert/strict";

import {
  CompaniesResponseSchema,
  CompanyLogoResponseSchema,
  CompanyResponseSchema,
} from "@metis/companies/common";

export async function verifyCompanyLogos(
  baseUrl: string,
  companyId: string,
  cookie: string,
  csrfToken: string,
  origin: string
) {
  const path = `/companies/${companyId}/logo`;
  const headers = {
    cookie,
    origin,
    "x-csrf-token": csrfToken,
    "content-type": "application/octet-stream",
  };
  const png = Buffer.from(
    "iVBORw0KGgoAAAANSUhEUgAAAQAAAACACAIAAABr1yBdAAAACXBIWXMAAAPoAAAD6AG1e1JrAAACrElEQVR4nO3cwQ3EIBAEQVLpBAmIaB2B3/vYkgjg1G5kw87c6T4LgbZqcMZ/gYVANgAJEMgbgAQI5BOIBAjkDEACBHIIJgECuQUiAQK5BiUBApkDkACBDMJIgEAmwSRAIFEIEiCQLBAJEEgYjgQIJA1KAgQShyYBAukDkACBFGJIgEAaYSRAIJVIEiCQTjAJUshWiidBu7eBf4WYfwZWNgAJEMgbgAQI5BOIBAjkDEACBHIIJgECuQUiAQK5BiUBApkDkACBDMJIgEAmwSRAIFEIEiCQLBAJEEgYjgQIJA1KAgQShyYBAukDkACBFGJIgEAaYSRAIJVIEiCQTjAJUkdWiidBu7eBf4WYfwZWNgAJEMgbgAQI5BOIBAjkDEACBHIIJgECuQUiAQK5BiUBApkDkACBDMJIgEAmwSRAIFEIEiCQLBAJEEgYjgQIJA1KAgQShyYBAukDkACBFGJIgEAaYSRAIJVIEiCQTjAJUkdWiidBu7eBf4WYfwZWNgAJEMgbgAQI5BOIBAjkDEACBHIIJgECuQUiAQK5BiUBApkDkACBDMJIgEAmwSRAIFEIEiCQLBAJEEgYjgQIJA1KAgQShyYBAukDkACBFGJIgIBGGAkQeCqRJEDg6QSTAAGleBLc7dvAv0LMPwMrG4AECOQNQAIE8glEAgRyBiABAjkEkwCB3AKRAIFcg5IAgcwBSIBABmEkQCCTYBIgkCgECRBIFogECCQMRwIEkgYlAQKJQ5MAgfQBSIBACjEkQCCNMBIgkEokCRBIJ5gEqSMrxZOg3dvAv0LMPwMrG4AECOQNQAIE8glEAgRyBiABAjkEkwCB3AKRAIFcg5IAgcwBSIBABmEkQCCTYBIgkCgECRBIFogECCQMRwIEkgYlAQKJQ5MAgfQBSIBA/9vgAyvyiK2z3NTsAAAAAElFTkSuQmCC",
    "base64"
  );

  assert.equal((await fetch(`${baseUrl}${path}?version=${"a".repeat(64)}`)).status, 401);
  assert.equal(
    (
      await fetch(`${baseUrl}${path}`, {
        method: "POST",
        headers: { ...headers, "x-csrf-token": "invalid" },
        body: png,
      })
    ).status,
    403
  );
  assert.equal(
    (
      await fetch(`${baseUrl}${path}`, {
        method: "POST",
        headers,
        body: Buffer.from("invalid image"),
      })
    ).status,
    400
  );
  assert.equal(
    (
      await fetch(`${baseUrl}${path}`, {
        method: "POST",
        headers,
        body: Buffer.alloc(2 * 1024 * 1024 + 1),
      })
    ).status,
    413
  );
  const upload = await fetch(`${baseUrl}${path}`, { method: "POST", headers, body: png });

  assert.equal(upload.status, 200);
  const logo = CompanyLogoResponseSchema.parse(await upload.json());

  assert.ok(logo.logoVersion);
  const url = `${baseUrl}${path}?version=${logo.logoVersion}`;
  const image = await fetch(url, { headers: { cookie } });

  assert.equal(image.status, 200);
  assert.equal(image.headers.get("content-type"), "image/webp");
  assert.match(image.headers.get("cache-control") ?? "", /private/);
  const bytes = Buffer.from(await image.arrayBuffer());

  assert.ok(bytes.length <= 64 * 1024);
  assert.equal(bytes.subarray(8, 12).toString(), "WEBP");
  assert.equal(
    (await fetch(url, { headers: { cookie, "if-none-match": image.headers.get("etag") ?? "" } }))
      .status,
    304
  );
  assert.equal(
    (await fetch(`${baseUrl}${path}?version=${"b".repeat(64)}`, { headers: { cookie } })).status,
    404
  );
  const repeated = await fetch(`${baseUrl}${path}`, { method: "POST", headers, body: png });

  assert.deepEqual(CompanyLogoResponseSchema.parse(await repeated.json()), logo);
  const detail = await fetch(`${baseUrl}/companies/${companyId}`, { headers: { cookie } });

  assert.equal(
    CompanyResponseSchema.parse(await detail.json()).company.logoVersion,
    logo.logoVersion
  );
  const list = await fetch(`${baseUrl}/companies`, { headers: { cookie } });

  assert.equal(
    CompaniesResponseSchema.parse(await list.json()).companies.find((item) => item.id === companyId)
      ?.logoVersion,
    logo.logoVersion
  );
  const replacement = await fetch(`${baseUrl}${path}`, {
    method: "POST",
    headers,
    body: Buffer.from(
      "iVBORw0KGgoAAAANSUhEUgAAAQAAAACACAIAAABr1yBdAAAACXBIWXMAAAPoAAAD6AG1e1JrAAACrElEQVR4nO3cwQ3EIBAEQVIgSYLrKB2B3/vYkgjg1G5kw87c6V0LgbZqcMZ/gYVANgAJEMgbgAQI5BOIBAjkDEACBHIIJgECuQUiAQK5BiUBApkDkACBDMJIgEAmwSRAIFEIEiCQLBAJEEgYjgQIJA1KAgQShyYBAukDkACBFGJIgEAaYSRAIJVIEiCQTjAJUshWiidBu7eBf4WYfwZWNgAJEMgbgAQI5BOIBAjkDEACBHIIJgECuQUiAQK5BiUBApkDkACBDMJIgEAmwSRAIFEIEiCQLBAJEEgYjgQIJA1KAgQShyYBAukDkACBFGJIgEAaYSRAIJVIEiCQTjAJUkdWiidBu7eBf4WYfwZWNgAJEMgbgAQI5BOIBAjkDEACBHIIJgECuQUiAQK5BiUBApkDkACBDMJIgEAmwSRAIFEIEiCQLBAJEEgYjgQIJA1KAgQShyYBAukDkACBFGJIgEAaYSRAIJVIEiCQTjAJUkdWiidBu7eBf4WYfwZWNgAJEMgbgAQI5BOIBAjkDEACBHIIJgECuQUiAQK5BiUBApkDkACBDMJIgEAmwSRAIFEIEiCQLBAJEEgYjgQIJA1KAgQShyYBAukDkACBFGJIgIBGGAkQuCqRJEDg6gSTAAGleBK87dvAv0LMPwMrG4AECOQNQAIE8glEAgRyBiABAjkEkwCB3AKRAIFcg5IAgcwBSIBABmEkQCCTYBIgkCgECRBIFogECCQMRwIEkgYlAQKJQ5MAgfQBSIBACjEkQCCNMBIgkEokCRBIJ5gEqSMrxZOg3dvAv0LMPwMrG4AECOQNQAIE8glEAgRyBiABAjkEkwCB3AKRAIFcg5IAgcwBSIBABmEkQCCTYBIgkCgECRBIFogECCQMRwIEkgYlAQKJQ5MAgfQBSIBA/9vgAyJWiHFIq0dWAAAAAElFTkSuQmCC",
      "base64"
    ),
  });

  assert.equal(replacement.status, 200);
  const replaced = CompanyLogoResponseSchema.parse(await replacement.json());

  assert.notEqual(replaced.logoVersion, logo.logoVersion);
  assert.equal((await fetch(url, { headers: { cookie } })).status, 404);
  const updatedUrl = `${baseUrl}${path}?version=${replaced.logoVersion}`;

  assert.equal((await fetch(updatedUrl, { headers: { cookie } })).status, 200);
  const current = await fetch(`${baseUrl}/companies/${companyId}`, { headers: { cookie } });
  const company = CompanyResponseSchema.parse(await current.json()).company;
  const update = await fetch(`${baseUrl}/companies/${companyId}/update`, {
    method: "POST",
    headers: { ...headers, "content-type": "application/json" },
    body: JSON.stringify({ name: company.name, active: company.active }),
  });

  assert.equal(update.status, 200);
  assert.equal(
    CompanyResponseSchema.parse(await update.json()).company.logoVersion,
    replaced.logoVersion
  );
  for (let repeat = 0; repeat < 2; repeat++) {
    const removed = await fetch(`${baseUrl}${path}/remove`, {
      method: "POST",
      headers: { ...headers, "content-type": "application/json" },
      body: "{}",
    });

    assert.equal(removed.status, 200);
    assert.equal(CompanyLogoResponseSchema.parse(await removed.json()).logoVersion, null);
  }
  assert.equal((await fetch(url, { headers: { cookie } })).status, 404);
  assert.equal((await fetch(updatedUrl, { headers: { cookie } })).status, 404);
  const cleared = await fetch(`${baseUrl}/companies/${companyId}`, { headers: { cookie } });

  assert.equal(CompanyResponseSchema.parse(await cleared.json()).company.logoVersion, null);
}