Track HiveGrid Cloud planning reference

hivegrid-cloud/apps/web/app/utils/services/adminSettingsValidation.server.test.ts

@@ -0,0 +1,96 @@
+import { describe, expect, it } from "vitest";
+import { parseAdminSettingsForm, redactSettingsAuditDetails } from "./adminSettingsValidation.server";
+
+const sensitiveHeadScript = `<script>window.token="secret-token";fetch("https://tracker.example/pixel?apiKey=raw-key")</script>`;
+
+function createForm(values: Record<string, string | boolean | undefined>) {
+  const form = new FormData();
+  Object.entries(values).forEach(([key, value]) => {
+    if (value !== undefined) {
+      form.set(key, typeof value === "boolean" ? String(value) : value);
+    }
+  });
+  return form;
+}
+
+describe("adminSettingsValidation.server", () => {
+  it("normalizes valid general settings and rejects missing required names", () => {
+    const valid = parseAdminSettingsForm(
+      "general",
+      createForm({ action: "update", name: "  Acme Portal  ", theme: "zinc", headScripts: sensitiveHeadScript, bodyScripts: "" })
+    );
+
+    expect(valid).toMatchObject({ ok: true, section: "general" });
+    expect(valid.ok && valid.data).toMatchObject({ name: "Acme Portal", theme: "zinc", headScripts: sensitiveHeadScript, bodyScripts: "" });
+
+    const invalid = parseAdminSettingsForm("general", createForm({ action: "update", name: "   " }));
+
+    expect(invalid).toEqual({ ok: false, status: 400, errors: { name: ["This field is required."] } });
+  });
+
+  it("normalizes authentication booleans", () => {
+    const result = parseAdminSettingsForm(
+      "authentication",
+      createForm({ action: "update", requireEmailVerification: "on", requireOrganization: "true" })
+    );
+
+    expect(result).toMatchObject({
+      ok: true,
+      section: "authentication",
+      data: {
+        authRequireEmailVerification: true,
+        authRequireOrganization: true,
+        authRequireName: false,
+      },
+    });
+  });
+
+  it("normalizes analytics settings (EU-sterilisiert, ohne Google Analytics)", () => {
+    const valid = parseAdminSettingsForm("analytics", createForm({ action: "update", enabled: "true", simpleAnalytics: "on" }));
+
+    expect(valid).toMatchObject({
+      ok: true,
+      section: "analytics",
+      data: {
+        analyticsEnabled: true,
+        analyticsSimpleAnalytics: true,
+        analyticsPlausibleAnalytics: false,
+      },
+    });
+
+    // EU-Sterilisation (R-P1a): ein mitgesendetes googleAnalyticsTrackingId wird ignoriert, nicht persistiert.
+    const ignored = parseAdminSettingsForm("analytics", createForm({ action: "update", googleAnalyticsTrackingId: "G-ABC12345" }));
+    expect(ignored.ok).toBe(true);
+    expect(JSON.stringify(ignored)).not.toContain("G-ABC12345");
+  });
+
+  it("normalizes cookie settings and rejects malformed actions or booleans", () => {
+    const valid = parseAdminSettingsForm("cookies", createForm({ action: "update", enabled: "true" }));
+
+    expect(valid).toEqual({ ok: true, section: "cookies", data: { cookiesEnabled: true } });
+
+    const invalid = parseAdminSettingsForm("cookies", createForm({ action: "delete", enabled: "true" }));
+
+    expect(invalid).toEqual({ ok: false, status: 400, errors: { action: ["Invalid action."] } });
+
+    const tampered = parseAdminSettingsForm("cookies", createForm({ action: "update", enabled: "definitely" }));
+
+    expect(tampered).toEqual({ ok: false, status: 400, errors: { enabled: ["Boolean value is invalid."] } });
+  });
+
+  it("redacts scripts, tokens and query strings from audit details", () => {
+    const audit = redactSettingsAuditDetails("general", {
+      headScripts: sensitiveHeadScript,
+      bodyScripts: `<script src="https://cdn.example/app.js?token=raw-token"></script>`,
+      brandingLogo: "https://assets.example/logo.png?token=raw-token",
+      cookiesEnabled: true,
+    });
+
+    expect(audit).toContain("headScripts");
+    expect(audit).toContain("cookiesEnabled");
+    expect(audit).toContain("true");
+    expect(audit).not.toContain(sensitiveHeadScript);
+    expect(audit).not.toContain("raw-token");
+    expect(audit).not.toContain("?token=");
+  });
+});