refactor(server): replace node-fetch with native fetch + undici, fix photo integrations
Replace node-fetch v2 with Node 22's built-in fetch API across the entire server.
Add undici as an explicit dependency to provide the dispatcher API needed for
DNS pinning (SSRF rebinding prevention) in ssrfGuard.ts. All seven service files
that used a plain `import fetch from 'node-fetch'` are updated to use the global.
The ssrfGuard safeFetch/createPinnedAgent is rewritten as createPinnedDispatcher
using an undici Agent, with correct handling of the `all: true` lookup callback
required by Node 18+. The collabService dynamic require() and notifications agent
option are updated to use the dispatcher pattern. Test mocks are migrated from
vi.mock('node-fetch') to vi.stubGlobal('fetch'), and streaming test fixtures are
updated to use Web ReadableStream instead of Node Readable.
Fix several bugs in the Synology and Immich photo integrations:
- pipeAsset: guard against setting headers after stream has already started
- _getSynologySession: clear stale SID and re-login when decrypt_api_key returns null
instead of propagating success(null) downstream
- _requestSynologyApi: return retrySession error (not stale session) on retry failure;
also retry on error codes 106 (timeout) and 107 (duplicate login), not only 119
- searchSynologyPhotos: fix incorrect total field type (Synology list_item returns no
total); hasMore correctly uses allItems.length === limit
- _splitPackedSynologyId: validate cache_key format before use; callers return 400
- getImmichCredentials / _getSynologyCredentials: treat null from decrypt_api_key as
a missing-credentials condition rather than casting null to string
- Synology size param: enforce allowlist ['sm', 'm', 'xl'] per API documentation
This commit is contained in:
jubnl
@@ -1,6 +1,6 @@
|
||||
/**
|
||||
* Immich integration tests.
|
||||
* Covers IMMICH-001 to IMMICH-015 (settings, SSRF protection, connection test).
|
||||
* Covers IMMICH-001 to IMMICH-024 (settings, SSRF protection, album links).
|
||||
*
|
||||
* External Immich API calls are not made — tests focus on settings persistence
|
||||
* and input validation.
|
||||
@@ -60,6 +60,7 @@ vi.mock('../../src/utils/ssrfGuard', async () => {
|
||||
return { allowed: false, isPrivate: false, error: 'Invalid URL' };
|
||||
}
|
||||
}),
|
||||
safeFetch: vi.fn().mockRejectedValue(new Error('safeFetch should not be called in unit tests')),
|
||||
};
|
||||
});
|
||||
|
||||
@@ -89,43 +90,43 @@ afterAll(() => {
|
||||
});
|
||||
|
||||
describe('Immich settings', () => {
|
||||
it('IMMICH-001 — GET /api/immich/settings returns current settings', async () => {
|
||||
it('IMMICH-001 — GET /api/integrations/memories/immich/settings returns current settings', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
|
||||
const res = await request(app)
|
||||
.get('/api/integrations/immich/settings')
|
||||
.get('/api/integrations/memories/immich/settings')
|
||||
.set('Cookie', authCookie(user.id));
|
||||
expect(res.status).toBe(200);
|
||||
// Settings may be empty initially
|
||||
expect(res.body).toBeDefined();
|
||||
});
|
||||
|
||||
it('IMMICH-001 — PUT /api/immich/settings saves Immich URL and API key', async () => {
|
||||
it('IMMICH-001 — PUT /api/integrations/memories/immich/settings saves Immich URL and API key', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
|
||||
const res = await request(app)
|
||||
.put('/api/integrations/immich/settings')
|
||||
.put('/api/integrations/memories/immich/settings')
|
||||
.set('Cookie', authCookie(user.id))
|
||||
.send({ immich_url: 'https://immich.example.com', immich_api_key: 'test-api-key' });
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body.success).toBe(true);
|
||||
});
|
||||
|
||||
it('IMMICH-002 — PUT /api/immich/settings with private IP is blocked by SSRF guard', async () => {
|
||||
it('IMMICH-002 — PUT /api/integrations/memories/immich/settings with private IP is blocked by SSRF guard', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
|
||||
const res = await request(app)
|
||||
.put('/api/integrations/immich/settings')
|
||||
.put('/api/integrations/memories/immich/settings')
|
||||
.set('Cookie', authCookie(user.id))
|
||||
.send({ immich_url: 'http://192.168.1.100', immich_api_key: 'test-key' });
|
||||
expect(res.status).toBe(400);
|
||||
});
|
||||
|
||||
it('IMMICH-002 — PUT /api/immich/settings with loopback is blocked', async () => {
|
||||
it('IMMICH-002 — PUT /api/integrations/memories/immich/settings with loopback is blocked', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
|
||||
const res = await request(app)
|
||||
.put('/api/integrations/immich/settings')
|
||||
.put('/api/integrations/memories/immich/settings')
|
||||
.set('Cookie', authCookie(user.id))
|
||||
.send({ immich_url: 'http://127.0.0.1:2283', immich_api_key: 'test-key' });
|
||||
expect(res.status).toBe(400);
|
||||
@@ -133,14 +134,14 @@ describe('Immich settings', () => {
|
||||
});
|
||||
|
||||
describe('Immich authentication', () => {
|
||||
it('GET /api/immich/settings without auth returns 401', async () => {
|
||||
const res = await request(app).get('/api/integrations/immich/settings');
|
||||
it('GET /api/integrations/memories/immich/settings without auth returns 401', async () => {
|
||||
const res = await request(app).get('/api/integrations/memories/immich/settings');
|
||||
expect(res.status).toBe(401);
|
||||
});
|
||||
|
||||
it('PUT /api/immich/settings without auth returns 401', async () => {
|
||||
it('PUT /api/integrations/memories/immich/settings without auth returns 401', async () => {
|
||||
const res = await request(app)
|
||||
.put('/api/integrations/immich/settings')
|
||||
.put('/api/integrations/memories/immich/settings')
|
||||
.send({ url: 'https://example.com', api_key: 'key' });
|
||||
expect(res.status).toBe(401);
|
||||
});
|
||||
@@ -152,9 +153,9 @@ describe('Immich album links', () => {
|
||||
const trip = testDb.prepare('INSERT INTO trips (user_id, title) VALUES (?, ?) RETURNING *').get(user.id, 'Test Trip') as any;
|
||||
|
||||
const res = await request(app)
|
||||
.post(`/api/integrations/immich/trips/${trip.id}/album-links`)
|
||||
.post(`/api/integrations/memories/unified/trips/${trip.id}/album-links`)
|
||||
.set('Cookie', authCookie(user.id))
|
||||
.send({ album_id: 'album-uuid-123', album_name: 'Vacation 2024' });
|
||||
.send({ album_id: 'album-uuid-123', album_name: 'Vacation 2024', provider: 'immich' });
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body.success).toBe(true);
|
||||
@@ -171,7 +172,7 @@ describe('Immich album links', () => {
|
||||
testDb.prepare('INSERT INTO trip_album_links (trip_id, user_id, album_id, album_name, provider) VALUES (?, ?, ?, ?, ?)').run(trip.id, user.id, 'album-abc', 'My Album', 'immich');
|
||||
|
||||
const res = await request(app)
|
||||
.get(`/api/integrations/immich/trips/${trip.id}/album-links`)
|
||||
.get(`/api/integrations/memories/unified/trips/${trip.id}/album-links`)
|
||||
.set('Cookie', authCookie(user.id));
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
@@ -196,7 +197,7 @@ describe('Immich album links', () => {
|
||||
testDb.prepare('INSERT INTO trip_photos (trip_id, user_id, asset_id, provider, shared) VALUES (?, ?, ?, ?, 1)').run(trip.id, user.id, 'asset-manual', 'immich');
|
||||
|
||||
const res = await request(app)
|
||||
.delete(`/api/integrations/immich/trips/${trip.id}/album-links/${linkResult.id}`)
|
||||
.delete(`/api/integrations/memories/unified/trips/${trip.id}/album-links/${linkResult.id}`)
|
||||
.set('Cookie', authCookie(user.id));
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
@@ -212,7 +213,7 @@ describe('Immich album links', () => {
|
||||
expect(link).toBeUndefined();
|
||||
});
|
||||
|
||||
it('IMMICH-023 — DELETE album-link by non-owner is a no-op', async () => {
|
||||
it('IMMICH-023 — DELETE album-link by non-member returns 404', async () => {
|
||||
const { user: owner } = createUser(testDb);
|
||||
const { user: other } = createUser(testDb);
|
||||
const trip = testDb.prepare('INSERT INTO trips (user_id, title) VALUES (?, ?) RETURNING *').get(owner.id, 'Test Trip') as any;
|
||||
@@ -221,12 +222,12 @@ describe('Immich album links', () => {
|
||||
.get(trip.id, owner.id, 'album-secret', 'Secret Album', 'immich') as any;
|
||||
testDb.prepare('INSERT INTO trip_photos (trip_id, user_id, asset_id, provider, shared, album_link_id) VALUES (?, ?, ?, ?, 1, ?)').run(trip.id, owner.id, 'asset-owned', 'immich', linkResult.id);
|
||||
|
||||
// Other user tries to delete owner's album link
|
||||
// Non-member tries to delete owner's album link — should be denied
|
||||
const res = await request(app)
|
||||
.delete(`/api/integrations/immich/trips/${trip.id}/album-links/${linkResult.id}`)
|
||||
.delete(`/api/integrations/memories/unified/trips/${trip.id}/album-links/${linkResult.id}`)
|
||||
.set('Cookie', authCookie(other.id));
|
||||
|
||||
expect(res.status).toBe(200); // endpoint returns 200 even when no row matched
|
||||
expect(res.status).toBe(404);
|
||||
|
||||
// Link and photos should still exist
|
||||
const link = testDb.prepare('SELECT * FROM trip_album_links WHERE id = ?').get(linkResult.id);
|
||||
@@ -236,7 +237,7 @@ describe('Immich album links', () => {
|
||||
});
|
||||
|
||||
it('IMMICH-024 — DELETE album-link without auth returns 401', async () => {
|
||||
const res = await request(app).delete('/api/integrations/immich/trips/1/album-links/1');
|
||||
const res = await request(app).delete('/api/integrations/memories/unified/trips/1/album-links/1');
|
||||
expect(res.status).toBe(401);
|
||||
});
|
||||
});
|
||||
|
||||
513
server/tests/integration/memories-immich.test.ts
Normal file
513
server/tests/integration/memories-immich.test.ts
Normal file
@@ -0,0 +1,513 @@
|
||||
/**
|
||||
* Immich-specific integration tests (IMMICH-030 – IMMICH-070).
|
||||
* Covers status, test-connection, browse, search, asset proxy, access control,
|
||||
* and albums — everything NOT covered by the existing immich.test.ts.
|
||||
*
|
||||
* safeFetch is mocked to return fake Immich API responses based on URL patterns.
|
||||
* No real HTTP calls are made.
|
||||
*/
|
||||
import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
|
||||
import request from 'supertest';
|
||||
import type { Application } from 'express';
|
||||
|
||||
// ── Hoisted DB mock ──────────────────────────────────────────────────────────
|
||||
|
||||
const { testDb, dbMock } = vi.hoisted(() => {
|
||||
const Database = require('better-sqlite3');
|
||||
const db = new Database(':memory:');
|
||||
db.exec('PRAGMA journal_mode = WAL');
|
||||
db.exec('PRAGMA foreign_keys = ON');
|
||||
db.exec('PRAGMA busy_timeout = 5000');
|
||||
const mock = {
|
||||
db,
|
||||
closeDb: () => {},
|
||||
reinitialize: () => {},
|
||||
getPlaceWithTags: () => null,
|
||||
canAccessTrip: (tripId: any, userId: number) =>
|
||||
db.prepare(`SELECT t.id, t.user_id FROM trips t LEFT JOIN trip_members m ON m.trip_id = t.id AND m.user_id = ? WHERE t.id = ? AND (t.user_id = ? OR m.user_id IS NOT NULL)`).get(userId, tripId, userId),
|
||||
isOwner: (tripId: any, userId: number) =>
|
||||
!!db.prepare('SELECT id FROM trips WHERE id = ? AND user_id = ?').get(tripId, userId),
|
||||
};
|
||||
return { testDb: db, dbMock: mock };
|
||||
});
|
||||
|
||||
vi.mock('../../src/db/database', () => dbMock);
|
||||
vi.mock('../../src/config', () => ({
|
||||
JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
|
||||
ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
|
||||
updateJwtSecret: () => {},
|
||||
}));
|
||||
vi.mock('../../src/websocket', () => ({ broadcast: vi.fn() }));
|
||||
|
||||
// ── SSRF guard mock — routes all Immich API calls to fake responses ───────────
|
||||
vi.mock('../../src/utils/ssrfGuard', async () => {
|
||||
const actual = await vi.importActual<typeof import('../../src/utils/ssrfGuard')>('../../src/utils/ssrfGuard');
|
||||
|
||||
function makeFakeImmichFetch(url: string, init?: any) {
|
||||
const u = typeof url === 'string' ? url : String(url);
|
||||
|
||||
// /api/users/me — used by status + test-connection
|
||||
if (u.includes('/api/users/me')) {
|
||||
return Promise.resolve({
|
||||
ok: true, status: 200,
|
||||
headers: { get: (h: string) => h === 'content-type' ? 'application/json' : null },
|
||||
json: () => Promise.resolve({ name: 'Test User', email: 'test@immich.local' }),
|
||||
body: null,
|
||||
});
|
||||
}
|
||||
// /api/timeline/buckets — browse
|
||||
if (u.includes('/api/timeline/buckets')) {
|
||||
return Promise.resolve({
|
||||
ok: true, status: 200,
|
||||
headers: { get: () => null },
|
||||
json: () => Promise.resolve([{ timeBucket: '2024-01-01T00:00:00.000Z', count: 3 }]),
|
||||
body: null,
|
||||
});
|
||||
}
|
||||
// /api/search/metadata — search
|
||||
if (u.includes('/api/search/metadata')) {
|
||||
return Promise.resolve({
|
||||
ok: true, status: 200,
|
||||
headers: { get: () => null },
|
||||
json: () => Promise.resolve({
|
||||
assets: {
|
||||
items: [
|
||||
{ id: 'asset-search-1', fileCreatedAt: '2024-06-01T10:00:00.000Z', exifInfo: { city: 'Paris', country: 'France' } },
|
||||
],
|
||||
},
|
||||
}),
|
||||
body: null,
|
||||
});
|
||||
}
|
||||
// /api/assets/:id/thumbnail — thumbnail proxy
|
||||
if (u.includes('/thumbnail')) {
|
||||
const imageBytes = Buffer.from('fake-thumbnail-data');
|
||||
return Promise.resolve({
|
||||
ok: true, status: 200,
|
||||
headers: { get: (h: string) => h === 'content-type' ? 'image/webp' : null },
|
||||
body: new ReadableStream({ start(c) { c.enqueue(imageBytes); c.close(); } }),
|
||||
});
|
||||
}
|
||||
// /api/assets/:id/original — original proxy
|
||||
if (u.includes('/original')) {
|
||||
const imageBytes = Buffer.from('fake-original-data');
|
||||
return Promise.resolve({
|
||||
ok: true, status: 200,
|
||||
headers: { get: (h: string) => h === 'content-type' ? 'image/jpeg' : null },
|
||||
body: new ReadableStream({ start(c) { c.enqueue(imageBytes); c.close(); } }),
|
||||
});
|
||||
}
|
||||
// /api/assets/:id — asset info
|
||||
if (/\/api\/assets\/[^/]+$/.test(u)) {
|
||||
return Promise.resolve({
|
||||
ok: true, status: 200,
|
||||
headers: { get: () => null },
|
||||
json: () => Promise.resolve({
|
||||
id: 'asset-info-1',
|
||||
fileCreatedAt: '2024-06-01T10:00:00.000Z',
|
||||
originalFileName: 'photo.jpg',
|
||||
exifInfo: {
|
||||
exifImageWidth: 4032, exifImageHeight: 3024,
|
||||
make: 'Apple', model: 'iPhone 15',
|
||||
lensModel: null, focalLength: 5.1, fNumber: 1.8,
|
||||
exposureTime: '1/500', iso: 100,
|
||||
city: 'Paris', state: 'Île-de-France', country: 'France',
|
||||
latitude: 48.8566, longitude: 2.3522,
|
||||
fileSizeInByte: 2048000,
|
||||
},
|
||||
}),
|
||||
body: null,
|
||||
});
|
||||
}
|
||||
// /api/albums — list albums
|
||||
if (/\/api\/albums$/.test(u)) {
|
||||
return Promise.resolve({
|
||||
ok: true, status: 200,
|
||||
headers: { get: () => null },
|
||||
json: () => Promise.resolve([
|
||||
{ id: 'album-uuid-1', albumName: 'Vacation 2024', assetCount: 42, startDate: '2024-06-01', endDate: '2024-06-14', albumThumbnailAssetId: null },
|
||||
]),
|
||||
body: null,
|
||||
});
|
||||
}
|
||||
// /api/albums/:id — album detail (for sync)
|
||||
if (/\/api\/albums\//.test(u)) {
|
||||
return Promise.resolve({
|
||||
ok: true, status: 200,
|
||||
headers: { get: () => null },
|
||||
json: () => Promise.resolve({ assets: [{ id: 'asset-sync-1', type: 'IMAGE' }] }),
|
||||
body: null,
|
||||
});
|
||||
}
|
||||
// fallback — unexpected call
|
||||
return Promise.reject(new Error(`Unexpected safeFetch call: ${u}`));
|
||||
}
|
||||
|
||||
return {
|
||||
...actual,
|
||||
checkSsrf: vi.fn().mockImplementation(async (rawUrl: string) => {
|
||||
try {
|
||||
const url = new URL(rawUrl);
|
||||
const h = url.hostname;
|
||||
if (h === '127.0.0.1' || h === '::1' || h === 'localhost') {
|
||||
return { allowed: false, isPrivate: true, error: 'Loopback not allowed' };
|
||||
}
|
||||
if (/^(10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.)/.test(h)) {
|
||||
return { allowed: false, isPrivate: true, error: 'Private IP not allowed' };
|
||||
}
|
||||
return { allowed: true, isPrivate: false, resolvedIp: '93.184.216.34' };
|
||||
} catch {
|
||||
return { allowed: false, isPrivate: false, error: 'Invalid URL' };
|
||||
}
|
||||
}),
|
||||
safeFetch: vi.fn().mockImplementation(makeFakeImmichFetch),
|
||||
};
|
||||
});
|
||||
|
||||
import { createApp } from '../../src/app';
|
||||
import { createTables } from '../../src/db/schema';
|
||||
import { runMigrations } from '../../src/db/migrations';
|
||||
import { resetTestDb } from '../helpers/test-db';
|
||||
import { createUser, createTrip, addTripMember, addTripPhoto, addAlbumLink, setImmichCredentials } from '../helpers/factories';
|
||||
import { authCookie } from '../helpers/auth';
|
||||
import { loginAttempts, mfaAttempts } from '../../src/routes/auth';
|
||||
import { safeFetch } from '../../src/utils/ssrfGuard';
|
||||
|
||||
const app: Application = createApp();
|
||||
|
||||
const IMMICH = '/api/integrations/memories/immich';
|
||||
|
||||
beforeAll(() => {
|
||||
createTables(testDb);
|
||||
runMigrations(testDb);
|
||||
});
|
||||
|
||||
beforeEach(() => {
|
||||
resetTestDb(testDb);
|
||||
loginAttempts.clear();
|
||||
mfaAttempts.clear();
|
||||
});
|
||||
|
||||
afterAll(() => testDb.close());
|
||||
|
||||
// ── Connection status ─────────────────────────────────────────────────────────
|
||||
|
||||
describe('Immich connection status', () => {
|
||||
it('IMMICH-030 — GET /status when not configured returns { connected: false }', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
|
||||
const res = await request(app)
|
||||
.get(`${IMMICH}/status`)
|
||||
.set('Cookie', authCookie(user.id));
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body.connected).toBe(false);
|
||||
});
|
||||
|
||||
it('IMMICH-031 — GET /status when configured returns connected + user info', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
setImmichCredentials(testDb, user.id, 'https://immich.example.com', 'test-api-key');
|
||||
|
||||
const res = await request(app)
|
||||
.get(`${IMMICH}/status`)
|
||||
.set('Cookie', authCookie(user.id));
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body.connected).toBe(true);
|
||||
expect(res.body.user).toMatchObject({ name: 'Test User', email: 'test@immich.local' });
|
||||
});
|
||||
});
|
||||
|
||||
// ── Test connection ───────────────────────────────────────────────────────────
|
||||
|
||||
describe('Immich test connection', () => {
|
||||
it('IMMICH-032 — POST /test with missing fields returns { connected: false }', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
|
||||
const res = await request(app)
|
||||
.post(`${IMMICH}/test`)
|
||||
.set('Cookie', authCookie(user.id))
|
||||
.send({ immich_url: 'https://immich.example.com' }); // missing api_key
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body.connected).toBe(false);
|
||||
});
|
||||
|
||||
it('IMMICH-033 — POST /test with valid credentials returns { connected: true }', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
|
||||
const res = await request(app)
|
||||
.post(`${IMMICH}/test`)
|
||||
.set('Cookie', authCookie(user.id))
|
||||
.send({ immich_url: 'https://immich.example.com', immich_api_key: 'valid-key' });
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body.connected).toBe(true);
|
||||
expect(res.body.user).toBeDefined();
|
||||
});
|
||||
});
|
||||
|
||||
// ── Browse & Search ───────────────────────────────────────────────────────────
|
||||
|
||||
describe('Immich browse and search', () => {
|
||||
it('IMMICH-040 — GET /browse when not configured returns 400', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
|
||||
const res = await request(app)
|
||||
.get(`${IMMICH}/browse`)
|
||||
.set('Cookie', authCookie(user.id));
|
||||
|
||||
expect(res.status).toBe(400);
|
||||
});
|
||||
|
||||
it('IMMICH-041 — GET /browse returns timeline buckets', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
setImmichCredentials(testDb, user.id, 'https://immich.example.com', 'test-api-key');
|
||||
|
||||
const res = await request(app)
|
||||
.get(`${IMMICH}/browse`)
|
||||
.set('Cookie', authCookie(user.id));
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(Array.isArray(res.body.buckets)).toBe(true);
|
||||
expect(res.body.buckets.length).toBeGreaterThan(0);
|
||||
});
|
||||
|
||||
it('IMMICH-042 — POST /search returns mapped assets', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
setImmichCredentials(testDb, user.id, 'https://immich.example.com', 'test-api-key');
|
||||
|
||||
const res = await request(app)
|
||||
.post(`${IMMICH}/search`)
|
||||
.set('Cookie', authCookie(user.id))
|
||||
.send({});
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(Array.isArray(res.body.assets)).toBe(true);
|
||||
expect(res.body.assets[0]).toMatchObject({ id: 'asset-search-1', city: 'Paris', country: 'France' });
|
||||
});
|
||||
|
||||
it('IMMICH-043 — POST /search when upstream throws returns 502', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
setImmichCredentials(testDb, user.id, 'https://immich.example.com', 'test-api-key');
|
||||
|
||||
vi.mocked(safeFetch).mockRejectedValueOnce(new Error('upstream unreachable'));
|
||||
|
||||
const res = await request(app)
|
||||
.post(`${IMMICH}/search`)
|
||||
.set('Cookie', authCookie(user.id))
|
||||
.send({});
|
||||
|
||||
expect(res.status).toBe(502);
|
||||
expect(res.body.error).toBeDefined();
|
||||
});
|
||||
});
|
||||
|
||||
// ── Asset proxy ───────────────────────────────────────────────────────────────
|
||||
|
||||
describe('Immich asset proxy', () => {
|
||||
it('IMMICH-050 — GET /assets/info returns asset metadata for own photo', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
const trip = createTrip(testDb, user.id);
|
||||
setImmichCredentials(testDb, user.id, 'https://immich.example.com', 'test-api-key');
|
||||
addTripPhoto(testDb, trip.id, user.id, 'asset-info-1', 'immich', { shared: false });
|
||||
|
||||
const res = await request(app)
|
||||
.get(`${IMMICH}/assets/${trip.id}/asset-info-1/${user.id}/info`)
|
||||
.set('Cookie', authCookie(user.id));
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body).toMatchObject({ id: 'asset-info-1', city: 'Paris', country: 'France' });
|
||||
});
|
||||
|
||||
it('IMMICH-051 — GET /assets/info with invalid assetId (special chars) returns 400', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
const trip = createTrip(testDb, user.id);
|
||||
// ID contains characters outside [a-zA-Z0-9_-] → fails isValidAssetId()
|
||||
const invalidId = 'asset!@#$%';
|
||||
|
||||
const res = await request(app)
|
||||
.get(`${IMMICH}/assets/${trip.id}/${encodeURIComponent(invalidId)}/${user.id}/info`)
|
||||
.set('Cookie', authCookie(user.id));
|
||||
|
||||
expect(res.status).toBe(400);
|
||||
});
|
||||
|
||||
it('IMMICH-052 — GET /assets/info by non-owner of unshared photo returns 403', async () => {
|
||||
const { user: owner } = createUser(testDb);
|
||||
const { user: member } = createUser(testDb);
|
||||
const trip = createTrip(testDb, owner.id);
|
||||
addTripMember(testDb, trip.id, member.id);
|
||||
setImmichCredentials(testDb, owner.id, 'https://immich.example.com', 'test-api-key');
|
||||
// private photo — shared = false
|
||||
addTripPhoto(testDb, trip.id, owner.id, 'asset-private', 'immich', { shared: false });
|
||||
|
||||
const res = await request(app)
|
||||
.get(`${IMMICH}/assets/${trip.id}/asset-private/${owner.id}/info`)
|
||||
.set('Cookie', authCookie(member.id));
|
||||
|
||||
expect(res.status).toBe(403);
|
||||
});
|
||||
|
||||
it('IMMICH-053 — GET /assets/info by trip member for shared photo returns 200', async () => {
|
||||
const { user: owner } = createUser(testDb);
|
||||
const { user: member } = createUser(testDb);
|
||||
const trip = createTrip(testDb, owner.id);
|
||||
addTripMember(testDb, trip.id, member.id);
|
||||
setImmichCredentials(testDb, owner.id, 'https://immich.example.com', 'test-api-key');
|
||||
// shared photo
|
||||
addTripPhoto(testDb, trip.id, owner.id, 'asset-shared', 'immich', { shared: true });
|
||||
|
||||
const res = await request(app)
|
||||
.get(`${IMMICH}/assets/${trip.id}/asset-shared/${owner.id}/info`)
|
||||
.set('Cookie', authCookie(member.id));
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
});
|
||||
|
||||
it('IMMICH-054 — GET /assets/thumbnail for own photo streams image data', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
const trip = createTrip(testDb, user.id);
|
||||
setImmichCredentials(testDb, user.id, 'https://immich.example.com', 'test-api-key');
|
||||
addTripPhoto(testDb, trip.id, user.id, 'asset-thumb', 'immich', { shared: false });
|
||||
|
||||
const res = await request(app)
|
||||
.get(`${IMMICH}/assets/${trip.id}/asset-thumb/${user.id}/thumbnail`)
|
||||
.set('Cookie', authCookie(user.id));
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.headers['content-type']).toContain('image/webp');
|
||||
expect(res.body).toBeDefined();
|
||||
});
|
||||
|
||||
it('IMMICH-055 — GET /assets/thumbnail for other\'s unshared photo returns 403', async () => {
|
||||
const { user: owner } = createUser(testDb);
|
||||
const { user: member } = createUser(testDb);
|
||||
const trip = createTrip(testDb, owner.id);
|
||||
addTripMember(testDb, trip.id, member.id);
|
||||
addTripPhoto(testDb, trip.id, owner.id, 'asset-noshare', 'immich', { shared: false });
|
||||
|
||||
const res = await request(app)
|
||||
.get(`${IMMICH}/assets/${trip.id}/asset-noshare/${owner.id}/thumbnail`)
|
||||
.set('Cookie', authCookie(member.id));
|
||||
|
||||
expect(res.status).toBe(403);
|
||||
});
|
||||
|
||||
it('IMMICH-056 — GET /assets/original for shared photo streams image data', async () => {
|
||||
const { user: owner } = createUser(testDb);
|
||||
const { user: member } = createUser(testDb);
|
||||
const trip = createTrip(testDb, owner.id);
|
||||
addTripMember(testDb, trip.id, member.id);
|
||||
setImmichCredentials(testDb, owner.id, 'https://immich.example.com', 'test-api-key');
|
||||
addTripPhoto(testDb, trip.id, owner.id, 'asset-orig', 'immich', { shared: true });
|
||||
|
||||
const res = await request(app)
|
||||
.get(`${IMMICH}/assets/${trip.id}/asset-orig/${owner.id}/original`)
|
||||
.set('Cookie', authCookie(member.id));
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.headers['content-type']).toContain('image/jpeg');
|
||||
});
|
||||
|
||||
it('IMMICH-057 — GET /assets/info where trip does not exist returns 403', async () => {
|
||||
const { user: owner } = createUser(testDb);
|
||||
const { user: member } = createUser(testDb);
|
||||
// Insert a shared photo referencing a trip that doesn't exist (FK disabled temporarily)
|
||||
testDb.exec('PRAGMA foreign_keys = OFF');
|
||||
testDb.prepare(
|
||||
'INSERT INTO trip_photos (trip_id, user_id, asset_id, provider, shared) VALUES (?, ?, ?, ?, ?)'
|
||||
).run(9999, owner.id, 'asset-notrip', 'immich', 1);
|
||||
testDb.exec('PRAGMA foreign_keys = ON');
|
||||
|
||||
const res = await request(app)
|
||||
.get(`${IMMICH}/assets/9999/asset-notrip/${owner.id}/info`)
|
||||
.set('Cookie', authCookie(member.id));
|
||||
|
||||
// canAccessUserPhoto: shared photo found, but canAccessTrip(9999) → null → false → 403
|
||||
expect(res.status).toBe(403);
|
||||
});
|
||||
|
||||
it('IMMICH-058 — GET /assets/info when upstream returns error propagates status', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
const trip = createTrip(testDb, user.id);
|
||||
setImmichCredentials(testDb, user.id, 'https://immich.example.com', 'test-api-key');
|
||||
addTripPhoto(testDb, trip.id, user.id, 'asset-upstream-err', 'immich', { shared: false });
|
||||
|
||||
vi.mocked(safeFetch).mockResolvedValueOnce({
|
||||
ok: false, status: 503,
|
||||
headers: { get: () => null } as any,
|
||||
json: async () => ({}),
|
||||
} as any);
|
||||
|
||||
const res = await request(app)
|
||||
.get(`${IMMICH}/assets/${trip.id}/asset-upstream-err/${user.id}/info`)
|
||||
.set('Cookie', authCookie(user.id));
|
||||
|
||||
expect(res.status).toBe(503);
|
||||
expect(res.body.error).toBeDefined();
|
||||
});
|
||||
});
|
||||
|
||||
// ── Albums ────────────────────────────────────────────────────────────────────
|
||||
|
||||
describe('Immich albums', () => {
|
||||
it('IMMICH-060 — GET /albums when not configured returns 400', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
|
||||
const res = await request(app)
|
||||
.get(`${IMMICH}/albums`)
|
||||
.set('Cookie', authCookie(user.id));
|
||||
|
||||
expect(res.status).toBe(400);
|
||||
});
|
||||
|
||||
it('IMMICH-061 — GET /albums returns album list', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
setImmichCredentials(testDb, user.id, 'https://immich.example.com', 'test-api-key');
|
||||
|
||||
const res = await request(app)
|
||||
.get(`${IMMICH}/albums`)
|
||||
.set('Cookie', authCookie(user.id));
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(Array.isArray(res.body.albums)).toBe(true);
|
||||
expect(res.body.albums[0]).toMatchObject({ id: 'album-uuid-1', albumName: 'Vacation 2024' });
|
||||
});
|
||||
});
|
||||
|
||||
// ── Auth checks ───────────────────────────────────────────────────────────────
|
||||
|
||||
describe('Immich auth checks', () => {
|
||||
it('IMMICH-070 — GET /status without auth returns 401', async () => {
|
||||
expect((await request(app).get(`${IMMICH}/status`)).status).toBe(401);
|
||||
});
|
||||
|
||||
it('IMMICH-070 — POST /test without auth returns 401', async () => {
|
||||
expect((await request(app).post(`${IMMICH}/test`)).status).toBe(401);
|
||||
});
|
||||
|
||||
it('IMMICH-070 — GET /browse without auth returns 401', async () => {
|
||||
expect((await request(app).get(`${IMMICH}/browse`)).status).toBe(401);
|
||||
});
|
||||
|
||||
it('IMMICH-070 — POST /search without auth returns 401', async () => {
|
||||
expect((await request(app).post(`${IMMICH}/search`)).status).toBe(401);
|
||||
});
|
||||
|
||||
it('IMMICH-070 — GET /albums without auth returns 401', async () => {
|
||||
expect((await request(app).get(`${IMMICH}/albums`)).status).toBe(401);
|
||||
});
|
||||
|
||||
it('IMMICH-070 — GET /assets/info without auth returns 401', async () => {
|
||||
expect((await request(app).get(`${IMMICH}/assets/1/asset-x/1/info`)).status).toBe(401);
|
||||
});
|
||||
|
||||
it('IMMICH-070 — GET /assets/thumbnail without auth returns 401', async () => {
|
||||
expect((await request(app).get(`${IMMICH}/assets/1/asset-x/1/thumbnail`)).status).toBe(401);
|
||||
});
|
||||
|
||||
it('IMMICH-070 — GET /assets/original without auth returns 401', async () => {
|
||||
expect((await request(app).get(`${IMMICH}/assets/1/asset-x/1/original`)).status).toBe(401);
|
||||
});
|
||||
});
|
||||
545
server/tests/integration/memories-synology.test.ts
Normal file
545
server/tests/integration/memories-synology.test.ts
Normal file
@@ -0,0 +1,545 @@
|
||||
/**
|
||||
* Synology Photos integration tests (SYNO-001 – SYNO-040).
|
||||
* Covers settings, connection test, search, albums, asset streaming, and access control.
|
||||
*
|
||||
* safeFetch is mocked to return fake Synology API JSON responses based on the `api`
|
||||
* query/body parameter. The Synology service uses POST form-body requests so the mock
|
||||
* inspects URLSearchParams to dispatch the right fake response.
|
||||
*
|
||||
* No real HTTP calls are made.
|
||||
*/
|
||||
import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
|
||||
import request from 'supertest';
|
||||
import type { Application } from 'express';
|
||||
|
||||
// ── Hoisted DB mock ──────────────────────────────────────────────────────────
|
||||
|
||||
const { testDb, dbMock } = vi.hoisted(() => {
|
||||
const Database = require('better-sqlite3');
|
||||
const db = new Database(':memory:');
|
||||
db.exec('PRAGMA journal_mode = WAL');
|
||||
db.exec('PRAGMA foreign_keys = ON');
|
||||
db.exec('PRAGMA busy_timeout = 5000');
|
||||
const mock = {
|
||||
db,
|
||||
closeDb: () => {},
|
||||
reinitialize: () => {},
|
||||
getPlaceWithTags: () => null,
|
||||
canAccessTrip: (tripId: any, userId: number) =>
|
||||
db.prepare(`SELECT t.id, t.user_id FROM trips t LEFT JOIN trip_members m ON m.trip_id = t.id AND m.user_id = ? WHERE t.id = ? AND (t.user_id = ? OR m.user_id IS NOT NULL)`).get(userId, tripId, userId),
|
||||
isOwner: (tripId: any, userId: number) =>
|
||||
!!db.prepare('SELECT id FROM trips WHERE id = ? AND user_id = ?').get(tripId, userId),
|
||||
};
|
||||
return { testDb: db, dbMock: mock };
|
||||
});
|
||||
|
||||
vi.mock('../../src/db/database', () => dbMock);
|
||||
vi.mock('../../src/config', () => ({
|
||||
JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
|
||||
ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
|
||||
updateJwtSecret: () => {},
|
||||
}));
|
||||
vi.mock('../../src/websocket', () => ({ broadcast: vi.fn() }));
|
||||
|
||||
// ── SSRF guard mock — routes all Synology API calls to fake responses ─────────
|
||||
vi.mock('../../src/utils/ssrfGuard', async () => {
|
||||
const actual = await vi.importActual<typeof import('../../src/utils/ssrfGuard')>('../../src/utils/ssrfGuard');
|
||||
|
||||
function makeFakeSynologyFetch(url: string, init?: any) {
|
||||
const u = String(url);
|
||||
|
||||
// Determine which API was called from the URL query param (e.g. ?api=SYNO.API.Auth)
|
||||
// or from the body for POST requests.
|
||||
let apiName = '';
|
||||
try {
|
||||
apiName = new URL(u).searchParams.get('api') || '';
|
||||
} catch {}
|
||||
if (!apiName && init?.body) {
|
||||
const body = init.body instanceof URLSearchParams
|
||||
? init.body
|
||||
: new URLSearchParams(String(init.body));
|
||||
apiName = body.get('api') || '';
|
||||
}
|
||||
|
||||
// Auth login — used by settings save, status, test-connection
|
||||
if (apiName === 'SYNO.API.Auth') {
|
||||
return Promise.resolve({
|
||||
ok: true, status: 200,
|
||||
headers: { get: () => 'application/json' },
|
||||
json: () => Promise.resolve({ success: true, data: { sid: 'fake-session-id-abc' } }),
|
||||
body: null,
|
||||
});
|
||||
}
|
||||
|
||||
// Album list
|
||||
if (apiName === 'SYNO.Foto.Browse.Album') {
|
||||
return Promise.resolve({
|
||||
ok: true, status: 200,
|
||||
headers: { get: () => 'application/json' },
|
||||
json: () => Promise.resolve({
|
||||
success: true,
|
||||
data: {
|
||||
list: [
|
||||
{ id: 1, name: 'Summer Trip', item_count: 15 },
|
||||
{ id: 2, name: 'Winter Holiday', item_count: 8 },
|
||||
],
|
||||
},
|
||||
}),
|
||||
body: null,
|
||||
});
|
||||
}
|
||||
|
||||
// Search photos
|
||||
if (apiName === 'SYNO.Foto.Search.Search') {
|
||||
return Promise.resolve({
|
||||
ok: true, status: 200,
|
||||
headers: { get: () => 'application/json' },
|
||||
json: () => Promise.resolve({
|
||||
success: true,
|
||||
data: {
|
||||
list: [
|
||||
{
|
||||
id: 101,
|
||||
filename: 'photo1.jpg',
|
||||
filesize: 1024000,
|
||||
time: 1717228800, // 2024-06-01 in Unix timestamp
|
||||
additional: {
|
||||
thumbnail: { cache_key: '101_cachekey' },
|
||||
address: { city: 'Tokyo', country: 'Japan', state: 'Tokyo' },
|
||||
exif: { camera: 'Sony A7IV', focal_length: '50', aperture: '1.8', exposure_time: '1/250', iso: 400 },
|
||||
gps: { latitude: 35.6762, longitude: 139.6503 },
|
||||
resolution: { width: 6000, height: 4000 },
|
||||
orientation: 1,
|
||||
description: 'Tokyo street',
|
||||
},
|
||||
},
|
||||
],
|
||||
total: 1,
|
||||
},
|
||||
}),
|
||||
body: null,
|
||||
});
|
||||
}
|
||||
|
||||
// Browse items (for album sync or asset info)
|
||||
if (apiName === 'SYNO.Foto.Browse.Item') {
|
||||
return Promise.resolve({
|
||||
ok: true, status: 200,
|
||||
headers: { get: () => 'application/json' },
|
||||
json: () => Promise.resolve({
|
||||
success: true,
|
||||
data: {
|
||||
list: [
|
||||
{
|
||||
id: 101,
|
||||
filename: 'photo1.jpg',
|
||||
filesize: 1024000,
|
||||
time: 1717228800,
|
||||
additional: {
|
||||
thumbnail: { cache_key: '101_cachekey' },
|
||||
address: { city: 'Tokyo', country: 'Japan', state: 'Tokyo' },
|
||||
exif: { camera: 'Sony A7IV' },
|
||||
gps: { latitude: 35.6762, longitude: 139.6503 },
|
||||
resolution: { width: 6000, height: 4000 },
|
||||
orientation: 1,
|
||||
description: null,
|
||||
},
|
||||
},
|
||||
],
|
||||
},
|
||||
}),
|
||||
body: null,
|
||||
});
|
||||
}
|
||||
|
||||
// Thumbnail stream
|
||||
if (apiName === 'SYNO.Foto.Thumbnail') {
|
||||
const imageBytes = Buffer.from('fake-synology-thumbnail');
|
||||
return Promise.resolve({
|
||||
ok: true, status: 200,
|
||||
headers: { get: (h: string) => h === 'content-type' ? 'image/jpeg' : null },
|
||||
body: new ReadableStream({ start(c) { c.enqueue(imageBytes); c.close(); } }),
|
||||
});
|
||||
}
|
||||
|
||||
// Original download
|
||||
if (apiName === 'SYNO.Foto.Download') {
|
||||
const imageBytes = Buffer.from('fake-synology-original');
|
||||
return Promise.resolve({
|
||||
ok: true, status: 200,
|
||||
headers: { get: (h: string) => h === 'content-type' ? 'image/jpeg' : null },
|
||||
body: new ReadableStream({ start(c) { c.enqueue(imageBytes); c.close(); } }),
|
||||
});
|
||||
}
|
||||
|
||||
return Promise.reject(new Error(`Unexpected safeFetch call to Synology: ${u}, api=${apiName}`));
|
||||
}
|
||||
|
||||
return {
|
||||
...actual,
|
||||
checkSsrf: vi.fn().mockImplementation(async (rawUrl: string) => {
|
||||
try {
|
||||
const url = new URL(rawUrl);
|
||||
const h = url.hostname;
|
||||
if (h === '127.0.0.1' || h === '::1' || h === 'localhost') {
|
||||
return { allowed: false, isPrivate: true, error: 'Loopback not allowed' };
|
||||
}
|
||||
if (/^(10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.)/.test(h)) {
|
||||
return { allowed: false, isPrivate: true, error: 'Private IP not allowed' };
|
||||
}
|
||||
return { allowed: true, isPrivate: false, resolvedIp: '93.184.216.34' };
|
||||
} catch {
|
||||
return { allowed: false, isPrivate: false, error: 'Invalid URL' };
|
||||
}
|
||||
}),
|
||||
safeFetch: vi.fn().mockImplementation(makeFakeSynologyFetch),
|
||||
};
|
||||
});
|
||||
|
||||
import { createApp } from '../../src/app';
|
||||
import { createTables } from '../../src/db/schema';
|
||||
import { runMigrations } from '../../src/db/migrations';
|
||||
import { resetTestDb } from '../helpers/test-db';
|
||||
import { createUser, createTrip, addTripMember, addTripPhoto, setSynologyCredentials } from '../helpers/factories';
|
||||
import { authCookie } from '../helpers/auth';
|
||||
import { loginAttempts, mfaAttempts } from '../../src/routes/auth';
|
||||
import { safeFetch } from '../../src/utils/ssrfGuard';
|
||||
|
||||
const app: Application = createApp();
|
||||
|
||||
const SYNO = '/api/integrations/memories/synologyphotos';
|
||||
|
||||
beforeAll(() => {
|
||||
createTables(testDb);
|
||||
runMigrations(testDb);
|
||||
});
|
||||
|
||||
beforeEach(() => {
|
||||
resetTestDb(testDb);
|
||||
loginAttempts.clear();
|
||||
mfaAttempts.clear();
|
||||
});
|
||||
|
||||
afterAll(() => testDb.close());
|
||||
|
||||
// ── Settings ──────────────────────────────────────────────────────────────────
|
||||
|
||||
describe('Synology settings', () => {
|
||||
it('SYNO-001 — GET /settings when not configured returns 400', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
|
||||
const res = await request(app)
|
||||
.get(`${SYNO}/settings`)
|
||||
.set('Cookie', authCookie(user.id));
|
||||
|
||||
expect(res.status).toBe(400);
|
||||
});
|
||||
|
||||
it('SYNO-002 — PUT /settings saves credentials and returns success', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
|
||||
const res = await request(app)
|
||||
.put(`${SYNO}/settings`)
|
||||
.set('Cookie', authCookie(user.id))
|
||||
.send({
|
||||
synology_url: 'https://synology.example.com',
|
||||
synology_username: 'admin',
|
||||
synology_password: 'secure-password',
|
||||
});
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
|
||||
const row = testDb.prepare('SELECT synology_url, synology_username FROM users WHERE id = ?').get(user.id) as any;
|
||||
expect(row.synology_url).toBe('https://synology.example.com');
|
||||
expect(row.synology_username).toBe('admin');
|
||||
});
|
||||
|
||||
it('SYNO-003 — PUT /settings with SSRF-blocked URL returns 400', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
|
||||
const res = await request(app)
|
||||
.put(`${SYNO}/settings`)
|
||||
.set('Cookie', authCookie(user.id))
|
||||
.send({
|
||||
synology_url: 'http://192.168.1.100',
|
||||
synology_username: 'admin',
|
||||
synology_password: 'pass',
|
||||
});
|
||||
|
||||
expect(res.status).toBe(400);
|
||||
});
|
||||
|
||||
it('SYNO-004 — PUT /settings without URL returns 400', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
|
||||
const res = await request(app)
|
||||
.put(`${SYNO}/settings`)
|
||||
.set('Cookie', authCookie(user.id))
|
||||
.send({ synology_username: 'admin', synology_password: 'pass' }); // no url
|
||||
|
||||
expect(res.status).toBe(400);
|
||||
});
|
||||
});
|
||||
|
||||
// ── Connection ────────────────────────────────────────────────────────────────
|
||||
|
||||
describe('Synology connection', () => {
|
||||
it('SYNO-010 — GET /status when not configured returns { connected: false }', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
|
||||
const res = await request(app)
|
||||
.get(`${SYNO}/status`)
|
||||
.set('Cookie', authCookie(user.id));
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body.connected).toBe(false);
|
||||
});
|
||||
|
||||
it('SYNO-011 — GET /status when configured returns { connected: true }', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
setSynologyCredentials(testDb, user.id, 'https://synology.example.com', 'admin', 'pass');
|
||||
|
||||
const res = await request(app)
|
||||
.get(`${SYNO}/status`)
|
||||
.set('Cookie', authCookie(user.id));
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body.connected).toBe(true);
|
||||
});
|
||||
|
||||
it('SYNO-012 — POST /test with valid credentials returns { connected: true }', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
|
||||
const res = await request(app)
|
||||
.post(`${SYNO}/test`)
|
||||
.set('Cookie', authCookie(user.id))
|
||||
.send({
|
||||
synology_url: 'https://synology.example.com',
|
||||
synology_username: 'admin',
|
||||
synology_password: 'secure-password',
|
||||
});
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body.connected).toBe(true);
|
||||
});
|
||||
|
||||
it('SYNO-013 — POST /test with missing fields returns error', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
|
||||
const res = await request(app)
|
||||
.post(`${SYNO}/test`)
|
||||
.set('Cookie', authCookie(user.id))
|
||||
.send({ synology_url: 'https://synology.example.com' }); // missing username+password
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body.connected).toBe(false);
|
||||
expect(res.body.error).toBeDefined();
|
||||
});
|
||||
});
|
||||
|
||||
// ── Search & Albums ───────────────────────────────────────────────────────────
|
||||
|
||||
describe('Synology search and albums', () => {
|
||||
it('SYNO-020 — POST /search returns mapped assets', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
setSynologyCredentials(testDb, user.id, 'https://synology.example.com', 'admin', 'pass');
|
||||
|
||||
const res = await request(app)
|
||||
.post(`${SYNO}/search`)
|
||||
.set('Cookie', authCookie(user.id))
|
||||
.send({});
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(Array.isArray(res.body.assets)).toBe(true);
|
||||
expect(res.body.assets[0]).toMatchObject({ city: 'Tokyo', country: 'Japan' });
|
||||
});
|
||||
|
||||
it('SYNO-021 — POST /search when upstream throws propagates 500', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
setSynologyCredentials(testDb, user.id, 'https://synology.example.com', 'admin', 'pass');
|
||||
|
||||
// Auth call succeeds, search call throws a network error
|
||||
vi.mocked(safeFetch)
|
||||
.mockResolvedValueOnce({
|
||||
ok: true, status: 200,
|
||||
headers: { get: () => 'application/json' },
|
||||
json: async () => ({ success: true, data: { sid: 'fake-sid' } }),
|
||||
body: null,
|
||||
} as any)
|
||||
.mockRejectedValueOnce(new Error('Synology unreachable'));
|
||||
|
||||
const res = await request(app)
|
||||
.post(`${SYNO}/search`)
|
||||
.set('Cookie', authCookie(user.id))
|
||||
.send({});
|
||||
|
||||
expect(res.status).toBe(500);
|
||||
expect(res.body.error).toBeDefined();
|
||||
});
|
||||
|
||||
it('SYNO-022 — GET /albums returns album list', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
setSynologyCredentials(testDb, user.id, 'https://synology.example.com', 'admin', 'pass');
|
||||
|
||||
const res = await request(app)
|
||||
.get(`${SYNO}/albums`)
|
||||
.set('Cookie', authCookie(user.id));
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(Array.isArray(res.body.albums)).toBe(true);
|
||||
expect(res.body.albums).toHaveLength(2);
|
||||
expect(res.body.albums[0]).toMatchObject({ albumName: 'Summer Trip', assetCount: 15 });
|
||||
});
|
||||
});
|
||||
|
||||
// ── Asset access ──────────────────────────────────────────────────────────────
|
||||
|
||||
describe('Synology asset access', () => {
|
||||
it('SYNO-030 — GET /assets/info returns metadata for own photo', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
const trip = createTrip(testDb, user.id);
|
||||
setSynologyCredentials(testDb, user.id, 'https://synology.example.com', 'admin', 'pass');
|
||||
addTripPhoto(testDb, trip.id, user.id, '101_cachekey', 'synologyphotos', { shared: false });
|
||||
|
||||
const res = await request(app)
|
||||
.get(`${SYNO}/assets/${trip.id}/101_cachekey/${user.id}/info`)
|
||||
.set('Cookie', authCookie(user.id));
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body).toMatchObject({ city: 'Tokyo', country: 'Japan' });
|
||||
});
|
||||
|
||||
it('SYNO-031 — GET /assets/info by non-owner of unshared photo returns 403', async () => {
|
||||
const { user: owner } = createUser(testDb);
|
||||
const { user: member } = createUser(testDb);
|
||||
const trip = createTrip(testDb, owner.id);
|
||||
addTripMember(testDb, trip.id, member.id);
|
||||
addTripPhoto(testDb, trip.id, owner.id, '101_cachekey', 'synologyphotos', { shared: false });
|
||||
|
||||
const res = await request(app)
|
||||
.get(`${SYNO}/assets/${trip.id}/101_cachekey/${owner.id}/info`)
|
||||
.set('Cookie', authCookie(member.id));
|
||||
|
||||
expect(res.status).toBe(403);
|
||||
});
|
||||
|
||||
it('SYNO-032 — GET /assets/thumbnail streams image data for own photo', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
const trip = createTrip(testDb, user.id);
|
||||
setSynologyCredentials(testDb, user.id, 'https://synology.example.com', 'admin', 'pass');
|
||||
addTripPhoto(testDb, trip.id, user.id, '101_cachekey', 'synologyphotos', { shared: false });
|
||||
|
||||
const res = await request(app)
|
||||
.get(`${SYNO}/assets/${trip.id}/101_cachekey/${user.id}/thumbnail`)
|
||||
.set('Cookie', authCookie(user.id));
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.headers['content-type']).toContain('image/jpeg');
|
||||
});
|
||||
|
||||
it('SYNO-033 — GET /assets/original streams image data for shared photo', async () => {
|
||||
const { user: owner } = createUser(testDb);
|
||||
const { user: member } = createUser(testDb);
|
||||
const trip = createTrip(testDb, owner.id);
|
||||
addTripMember(testDb, trip.id, member.id);
|
||||
setSynologyCredentials(testDb, owner.id, 'https://synology.example.com', 'admin', 'pass');
|
||||
addTripPhoto(testDb, trip.id, owner.id, '101_cachekey', 'synologyphotos', { shared: true });
|
||||
|
||||
const res = await request(app)
|
||||
.get(`${SYNO}/assets/${trip.id}/101_cachekey/${owner.id}/original`)
|
||||
.set('Cookie', authCookie(member.id));
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.headers['content-type']).toContain('image/jpeg');
|
||||
});
|
||||
|
||||
it('SYNO-034 — GET /assets with invalid kind returns 400', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
const trip = createTrip(testDb, user.id);
|
||||
addTripPhoto(testDb, trip.id, user.id, '101_cachekey', 'synologyphotos', { shared: false });
|
||||
|
||||
const res = await request(app)
|
||||
.get(`${SYNO}/assets/${trip.id}/101_cachekey/${user.id}/badkind`)
|
||||
.set('Cookie', authCookie(user.id));
|
||||
|
||||
expect(res.status).toBe(400);
|
||||
});
|
||||
|
||||
it('SYNO-035 — GET /assets/info where trip does not exist returns 403', async () => {
|
||||
const { user: owner } = createUser(testDb);
|
||||
const { user: member } = createUser(testDb);
|
||||
// Insert a shared photo referencing a trip that doesn't exist (FK disabled temporarily)
|
||||
testDb.exec('PRAGMA foreign_keys = OFF');
|
||||
testDb.prepare(
|
||||
'INSERT INTO trip_photos (trip_id, user_id, asset_id, provider, shared) VALUES (?, ?, ?, ?, ?)'
|
||||
).run(9999, owner.id, '101_cachekey', 'synologyphotos', 1);
|
||||
testDb.exec('PRAGMA foreign_keys = ON');
|
||||
|
||||
const res = await request(app)
|
||||
.get(`${SYNO}/assets/9999/101_cachekey/${owner.id}/info`)
|
||||
.set('Cookie', authCookie(member.id));
|
||||
|
||||
// canAccessUserPhoto: shared photo found, but canAccessTrip(9999) → null → false → 403
|
||||
expect(res.status).toBe(403);
|
||||
});
|
||||
|
||||
it('SYNO-036 — GET /assets/info when upstream throws propagates 500', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
const trip = createTrip(testDb, user.id);
|
||||
setSynologyCredentials(testDb, user.id, 'https://synology.example.com', 'admin', 'pass');
|
||||
addTripPhoto(testDb, trip.id, user.id, '101_cachekey', 'synologyphotos', { shared: false });
|
||||
|
||||
// Auth call succeeds, Browse.Item call throws a network error
|
||||
vi.mocked(safeFetch)
|
||||
.mockResolvedValueOnce({
|
||||
ok: true, status: 200,
|
||||
headers: { get: () => 'application/json' },
|
||||
json: async () => ({ success: true, data: { sid: 'fake-sid' } }),
|
||||
body: null,
|
||||
} as any)
|
||||
.mockRejectedValueOnce(new Error('network failure'));
|
||||
|
||||
const res = await request(app)
|
||||
.get(`${SYNO}/assets/${trip.id}/101_cachekey/${user.id}/info`)
|
||||
.set('Cookie', authCookie(user.id));
|
||||
|
||||
expect(res.status).toBe(500);
|
||||
expect(res.body.error).toBeDefined();
|
||||
});
|
||||
});
|
||||
|
||||
// ── Auth checks ───────────────────────────────────────────────────────────────
|
||||
|
||||
describe('Synology auth checks', () => {
|
||||
it('SYNO-040 — GET /settings without auth returns 401', async () => {
|
||||
expect((await request(app).get(`${SYNO}/settings`)).status).toBe(401);
|
||||
});
|
||||
|
||||
it('SYNO-040 — PUT /settings without auth returns 401', async () => {
|
||||
expect((await request(app).put(`${SYNO}/settings`)).status).toBe(401);
|
||||
});
|
||||
|
||||
it('SYNO-040 — GET /status without auth returns 401', async () => {
|
||||
expect((await request(app).get(`${SYNO}/status`)).status).toBe(401);
|
||||
});
|
||||
|
||||
it('SYNO-040 — POST /test without auth returns 401', async () => {
|
||||
expect((await request(app).post(`${SYNO}/test`)).status).toBe(401);
|
||||
});
|
||||
|
||||
it('SYNO-040 — GET /albums without auth returns 401', async () => {
|
||||
expect((await request(app).get(`${SYNO}/albums`)).status).toBe(401);
|
||||
});
|
||||
|
||||
it('SYNO-040 — POST /search without auth returns 401', async () => {
|
||||
expect((await request(app).post(`${SYNO}/search`)).status).toBe(401);
|
||||
});
|
||||
|
||||
it('SYNO-040 — GET /assets/info without auth returns 401', async () => {
|
||||
expect((await request(app).get(`${SYNO}/assets/1/photo-x/1/info`)).status).toBe(401);
|
||||
});
|
||||
|
||||
it('SYNO-040 — GET /assets/thumbnail without auth returns 401', async () => {
|
||||
expect((await request(app).get(`${SYNO}/assets/1/photo-x/1/thumbnail`)).status).toBe(401);
|
||||
});
|
||||
});
|
||||
334
server/tests/integration/memories-unified.test.ts
Normal file
334
server/tests/integration/memories-unified.test.ts
Normal file
@@ -0,0 +1,334 @@
|
||||
/**
|
||||
* Unified Memories integration tests (UNIFIED-001 – UNIFIED-020).
|
||||
* Covers the provider-agnostic /unified/trips/:tripId/photos and
|
||||
* /unified/trips/:tripId/album-links routes.
|
||||
*
|
||||
* No real HTTP is made — safeFetch is mocked to never be called.
|
||||
* The broadcast WebSocket call is no-op mocked.
|
||||
*/
|
||||
import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
|
||||
import request from 'supertest';
|
||||
import type { Application } from 'express';
|
||||
|
||||
// ── Hoisted DB mock ──────────────────────────────────────────────────────────
|
||||
|
||||
const { testDb, dbMock } = vi.hoisted(() => {
|
||||
const Database = require('better-sqlite3');
|
||||
const db = new Database(':memory:');
|
||||
db.exec('PRAGMA journal_mode = WAL');
|
||||
db.exec('PRAGMA foreign_keys = ON');
|
||||
db.exec('PRAGMA busy_timeout = 5000');
|
||||
const mock = {
|
||||
db,
|
||||
closeDb: () => {},
|
||||
reinitialize: () => {},
|
||||
getPlaceWithTags: () => null,
|
||||
canAccessTrip: (tripId: any, userId: number) =>
|
||||
db.prepare(`SELECT t.id, t.user_id FROM trips t LEFT JOIN trip_members m ON m.trip_id = t.id AND m.user_id = ? WHERE t.id = ? AND (t.user_id = ? OR m.user_id IS NOT NULL)`).get(userId, tripId, userId),
|
||||
isOwner: (tripId: any, userId: number) =>
|
||||
!!db.prepare('SELECT id FROM trips WHERE id = ? AND user_id = ?').get(tripId, userId),
|
||||
};
|
||||
return { testDb: db, dbMock: mock };
|
||||
});
|
||||
|
||||
vi.mock('../../src/db/database', () => dbMock);
|
||||
vi.mock('../../src/config', () => ({
|
||||
JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
|
||||
ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
|
||||
updateJwtSecret: () => {},
|
||||
}));
|
||||
vi.mock('../../src/websocket', () => ({ broadcast: vi.fn() }));
|
||||
vi.mock('../../src/utils/ssrfGuard', async () => {
|
||||
const actual = await vi.importActual<typeof import('../../src/utils/ssrfGuard')>('../../src/utils/ssrfGuard');
|
||||
return {
|
||||
...actual,
|
||||
checkSsrf: vi.fn().mockResolvedValue({ allowed: true, isPrivate: false, resolvedIp: '93.184.216.34' }),
|
||||
safeFetch: vi.fn().mockRejectedValue(new Error('safeFetch should not be called in unified tests')),
|
||||
};
|
||||
});
|
||||
|
||||
import { createApp } from '../../src/app';
|
||||
import { createTables } from '../../src/db/schema';
|
||||
import { runMigrations } from '../../src/db/migrations';
|
||||
import { resetTestDb } from '../helpers/test-db';
|
||||
import { createUser, createTrip, addTripMember, addTripPhoto, addAlbumLink } from '../helpers/factories';
|
||||
import { authCookie } from '../helpers/auth';
|
||||
import { loginAttempts, mfaAttempts } from '../../src/routes/auth';
|
||||
|
||||
const app: Application = createApp();
|
||||
|
||||
const BASE = '/api/integrations/memories/unified';
|
||||
|
||||
beforeAll(() => {
|
||||
createTables(testDb);
|
||||
runMigrations(testDb);
|
||||
});
|
||||
|
||||
beforeEach(() => {
|
||||
resetTestDb(testDb);
|
||||
loginAttempts.clear();
|
||||
mfaAttempts.clear();
|
||||
});
|
||||
|
||||
afterAll(() => testDb.close());
|
||||
|
||||
// ── Helpers ──────────────────────────────────────────────────────────────────
|
||||
|
||||
function photosUrl(tripId: number) { return `${BASE}/trips/${tripId}/photos`; }
|
||||
function albumLinksUrl(tripId: number, linkId?: number) {
|
||||
return linkId ? `${BASE}/trips/${tripId}/album-links/${linkId}` : `${BASE}/trips/${tripId}/album-links`;
|
||||
}
|
||||
|
||||
// ── Unified Photo Management ─────────────────────────────────────────────────
|
||||
|
||||
describe('Unified photo management', () => {
|
||||
it('UNIFIED-001 — GET photos lists own + shared photos from other members', async () => {
|
||||
const { user: owner } = createUser(testDb);
|
||||
const { user: member } = createUser(testDb);
|
||||
const trip = createTrip(testDb, owner.id);
|
||||
addTripMember(testDb, trip.id, member.id);
|
||||
|
||||
// owner has a private photo; member has a shared photo
|
||||
addTripPhoto(testDb, trip.id, owner.id, 'asset-own', 'immich', { shared: false });
|
||||
addTripPhoto(testDb, trip.id, member.id, 'asset-shared', 'immich', { shared: true });
|
||||
|
||||
const res = await request(app)
|
||||
.get(photosUrl(trip.id))
|
||||
.set('Cookie', authCookie(owner.id));
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
const ids = (res.body.photos as any[]).map((p: any) => p.asset_id);
|
||||
expect(ids).toContain('asset-own');
|
||||
expect(ids).toContain('asset-shared');
|
||||
});
|
||||
|
||||
it('UNIFIED-002 — GET photos excludes other members\' private photos', async () => {
|
||||
const { user: owner } = createUser(testDb);
|
||||
const { user: member } = createUser(testDb);
|
||||
const trip = createTrip(testDb, owner.id);
|
||||
addTripMember(testDb, trip.id, member.id);
|
||||
|
||||
addTripPhoto(testDb, trip.id, member.id, 'asset-private', 'immich', { shared: false });
|
||||
|
||||
const res = await request(app)
|
||||
.get(photosUrl(trip.id))
|
||||
.set('Cookie', authCookie(owner.id));
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
const ids = (res.body.photos as any[]).map((p: any) => p.asset_id);
|
||||
expect(ids).not.toContain('asset-private');
|
||||
});
|
||||
|
||||
it('UNIFIED-003 — GET photos returns 404 for non-member', async () => {
|
||||
const { user: owner } = createUser(testDb);
|
||||
const { user: stranger } = createUser(testDb);
|
||||
const trip = createTrip(testDb, owner.id);
|
||||
|
||||
const res = await request(app)
|
||||
.get(photosUrl(trip.id))
|
||||
.set('Cookie', authCookie(stranger.id));
|
||||
|
||||
expect(res.status).toBe(404);
|
||||
});
|
||||
|
||||
it('UNIFIED-004 — POST photos adds photos from selections', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
const trip = createTrip(testDb, user.id);
|
||||
|
||||
const res = await request(app)
|
||||
.post(photosUrl(trip.id))
|
||||
.set('Cookie', authCookie(user.id))
|
||||
.send({
|
||||
shared: true,
|
||||
selections: [{ provider: 'immich', asset_ids: ['asset-a', 'asset-b'] }],
|
||||
});
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body.added).toBe(2);
|
||||
|
||||
const rows = testDb.prepare('SELECT asset_id FROM trip_photos WHERE trip_id = ?').all(trip.id) as any[];
|
||||
expect(rows.map((r: any) => r.asset_id)).toEqual(expect.arrayContaining(['asset-a', 'asset-b']));
|
||||
});
|
||||
|
||||
it('UNIFIED-005 — POST photos with empty selections returns 400', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
const trip = createTrip(testDb, user.id);
|
||||
|
||||
const res = await request(app)
|
||||
.post(photosUrl(trip.id))
|
||||
.set('Cookie', authCookie(user.id))
|
||||
.send({ selections: [] });
|
||||
|
||||
expect(res.status).toBe(400);
|
||||
});
|
||||
|
||||
it('UNIFIED-006 — POST photos with invalid provider returns 400', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
const trip = createTrip(testDb, user.id);
|
||||
|
||||
const res = await request(app)
|
||||
.post(photosUrl(trip.id))
|
||||
.set('Cookie', authCookie(user.id))
|
||||
.send({ selections: [{ provider: 'nonexistent', asset_ids: ['asset-x'] }] });
|
||||
|
||||
expect(res.status).toBe(400);
|
||||
});
|
||||
|
||||
it('UNIFIED-007 — PUT photos/sharing toggles shared flag', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
const trip = createTrip(testDb, user.id);
|
||||
addTripPhoto(testDb, trip.id, user.id, 'asset-tog', 'immich', { shared: false });
|
||||
|
||||
const res = await request(app)
|
||||
.put(`${photosUrl(trip.id)}/sharing`)
|
||||
.set('Cookie', authCookie(user.id))
|
||||
.send({ provider: 'immich', asset_id: 'asset-tog', shared: true });
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
const row = testDb.prepare('SELECT shared FROM trip_photos WHERE asset_id = ?').get('asset-tog') as any;
|
||||
expect(row.shared).toBe(1);
|
||||
});
|
||||
|
||||
it('UNIFIED-008 — PUT photos/sharing on non-member trip returns 404', async () => {
|
||||
const { user: owner } = createUser(testDb);
|
||||
const { user: stranger } = createUser(testDb);
|
||||
const trip = createTrip(testDb, owner.id);
|
||||
|
||||
const res = await request(app)
|
||||
.put(`${photosUrl(trip.id)}/sharing`)
|
||||
.set('Cookie', authCookie(stranger.id))
|
||||
.send({ provider: 'immich', asset_id: 'any', shared: true });
|
||||
|
||||
expect(res.status).toBe(404);
|
||||
});
|
||||
|
||||
it('UNIFIED-009 — DELETE photos removes own photo', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
const trip = createTrip(testDb, user.id);
|
||||
addTripPhoto(testDb, trip.id, user.id, 'asset-del', 'immich');
|
||||
|
||||
const res = await request(app)
|
||||
.delete(photosUrl(trip.id))
|
||||
.set('Cookie', authCookie(user.id))
|
||||
.send({ provider: 'immich', asset_id: 'asset-del' });
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
const row = testDb.prepare('SELECT * FROM trip_photos WHERE asset_id = ?').get('asset-del');
|
||||
expect(row).toBeUndefined();
|
||||
});
|
||||
|
||||
it('UNIFIED-010 — DELETE photos on non-member trip returns 404', async () => {
|
||||
const { user: owner } = createUser(testDb);
|
||||
const { user: stranger } = createUser(testDb);
|
||||
const trip = createTrip(testDb, owner.id);
|
||||
|
||||
const res = await request(app)
|
||||
.delete(photosUrl(trip.id))
|
||||
.set('Cookie', authCookie(stranger.id))
|
||||
.send({ provider: 'immich', asset_id: 'any' });
|
||||
|
||||
expect(res.status).toBe(404);
|
||||
});
|
||||
});
|
||||
|
||||
// ── Unified Album-Link Management ────────────────────────────────────────────
|
||||
|
||||
describe('Unified album-link management', () => {
|
||||
it('UNIFIED-011 — POST album-links with missing provider returns 400', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
const trip = createTrip(testDb, user.id);
|
||||
|
||||
const res = await request(app)
|
||||
.post(albumLinksUrl(trip.id))
|
||||
.set('Cookie', authCookie(user.id))
|
||||
.send({ album_id: 'album-abc', album_name: 'Test' }); // no provider
|
||||
|
||||
expect(res.status).toBe(400);
|
||||
});
|
||||
|
||||
it('UNIFIED-012 — POST album-links with missing album_id returns 400', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
const trip = createTrip(testDb, user.id);
|
||||
|
||||
const res = await request(app)
|
||||
.post(albumLinksUrl(trip.id))
|
||||
.set('Cookie', authCookie(user.id))
|
||||
.send({ provider: 'immich', album_name: 'Test' }); // no album_id
|
||||
|
||||
expect(res.status).toBe(400);
|
||||
});
|
||||
|
||||
it('UNIFIED-013 — POST album-links duplicate link returns 409', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
const trip = createTrip(testDb, user.id);
|
||||
|
||||
await request(app)
|
||||
.post(albumLinksUrl(trip.id))
|
||||
.set('Cookie', authCookie(user.id))
|
||||
.send({ provider: 'immich', album_id: 'album-dup', album_name: 'Dup' });
|
||||
|
||||
const res = await request(app)
|
||||
.post(albumLinksUrl(trip.id))
|
||||
.set('Cookie', authCookie(user.id))
|
||||
.send({ provider: 'immich', album_id: 'album-dup', album_name: 'Dup' });
|
||||
|
||||
expect(res.status).toBe(409);
|
||||
});
|
||||
|
||||
it('UNIFIED-014 — GET album-links only returns links for enabled providers', async () => {
|
||||
const { user } = createUser(testDb);
|
||||
const trip = createTrip(testDb, user.id);
|
||||
addAlbumLink(testDb, trip.id, user.id, 'immich', 'album-enabled');
|
||||
|
||||
// Disable the immich provider
|
||||
testDb.prepare('UPDATE photo_providers SET enabled = 0 WHERE id = ?').run('immich');
|
||||
|
||||
const res = await request(app)
|
||||
.get(albumLinksUrl(trip.id))
|
||||
.set('Cookie', authCookie(user.id));
|
||||
|
||||
// Re-enable for future tests
|
||||
testDb.prepare('UPDATE photo_providers SET enabled = 1 WHERE id = ?').run('immich');
|
||||
|
||||
expect(res.status).toBe(400); // no providers enabled → error
|
||||
});
|
||||
});
|
||||
|
||||
// ── Auth checks ───────────────────────────────────────────────────────────────
|
||||
|
||||
describe('Unified auth checks', () => {
|
||||
it('UNIFIED-020 — GET photos without auth returns 401', async () => {
|
||||
const res = await request(app).get(`${BASE}/trips/1/photos`);
|
||||
expect(res.status).toBe(401);
|
||||
});
|
||||
|
||||
it('UNIFIED-020 — POST photos without auth returns 401', async () => {
|
||||
const res = await request(app).post(`${BASE}/trips/1/photos`);
|
||||
expect(res.status).toBe(401);
|
||||
});
|
||||
|
||||
it('UNIFIED-020 — PUT photos/sharing without auth returns 401', async () => {
|
||||
const res = await request(app).put(`${BASE}/trips/1/photos/sharing`);
|
||||
expect(res.status).toBe(401);
|
||||
});
|
||||
|
||||
it('UNIFIED-020 — DELETE photos without auth returns 401', async () => {
|
||||
const res = await request(app).delete(`${BASE}/trips/1/photos`);
|
||||
expect(res.status).toBe(401);
|
||||
});
|
||||
|
||||
it('UNIFIED-020 — GET album-links without auth returns 401', async () => {
|
||||
const res = await request(app).get(`${BASE}/trips/1/album-links`);
|
||||
expect(res.status).toBe(401);
|
||||
});
|
||||
|
||||
it('UNIFIED-020 — POST album-links without auth returns 401', async () => {
|
||||
const res = await request(app).post(`${BASE}/trips/1/album-links`);
|
||||
expect(res.status).toBe(401);
|
||||
});
|
||||
|
||||
it('UNIFIED-020 — DELETE album-links without auth returns 401', async () => {
|
||||
const res = await request(app).delete(`${BASE}/trips/1/album-links/1`);
|
||||
expect(res.status).toBe(401);
|
||||
});
|
||||
});
|
||||
@@ -37,14 +37,12 @@ vi.mock('../../src/config', () => ({
|
||||
updateJwtSecret: () => {},
|
||||
}));
|
||||
|
||||
// Mock external holiday API (node-fetch used by some service paths)
|
||||
vi.mock('node-fetch', () => ({
|
||||
default: vi.fn().mockResolvedValue({
|
||||
ok: true,
|
||||
json: () => Promise.resolve([
|
||||
{ date: '2025-01-01', name: 'New Year\'s Day', countryCode: 'DE' },
|
||||
]),
|
||||
}),
|
||||
// Prevent real HTTP calls (holiday API etc.)
|
||||
vi.stubGlobal('fetch', vi.fn().mockResolvedValue({
|
||||
ok: true,
|
||||
json: () => Promise.resolve([
|
||||
{ date: '2025-01-01', name: 'New Year\'s Day', countryCode: 'DE' },
|
||||
]),
|
||||
}));
|
||||
|
||||
// Mock vacayService.getCountries to avoid real HTTP call to nager.at
|
||||
@@ -81,6 +79,7 @@ beforeEach(() => {
|
||||
|
||||
afterAll(() => {
|
||||
testDb.close();
|
||||
vi.unstubAllGlobals();
|
||||
});
|
||||
|
||||
describe('Vacay plan', () => {
|
||||
|
||||
@@ -39,23 +39,21 @@ vi.mock('../../src/config', () => ({
|
||||
updateJwtSecret: () => {},
|
||||
}));
|
||||
|
||||
// Mock node-fetch / global fetch so no real HTTP calls are made
|
||||
vi.mock('node-fetch', () => ({
|
||||
default: vi.fn().mockResolvedValue({
|
||||
ok: true,
|
||||
json: () => Promise.resolve({
|
||||
current: { temperature_2m: 22, weathercode: 1, windspeed_10m: 10, relativehumidity_2m: 60, precipitation: 0 },
|
||||
daily: {
|
||||
time: ['2025-06-01'],
|
||||
temperature_2m_max: [25],
|
||||
temperature_2m_min: [18],
|
||||
weathercode: [1],
|
||||
precipitation_sum: [0],
|
||||
windspeed_10m_max: [15],
|
||||
sunrise: ['2025-06-01T06:00'],
|
||||
sunset: ['2025-06-01T21:00'],
|
||||
},
|
||||
}),
|
||||
// Prevent real HTTP calls to Open-Meteo
|
||||
vi.stubGlobal('fetch', vi.fn().mockResolvedValue({
|
||||
ok: true,
|
||||
json: () => Promise.resolve({
|
||||
current: { temperature_2m: 22, weathercode: 1, windspeed_10m: 10, relativehumidity_2m: 60, precipitation: 0 },
|
||||
daily: {
|
||||
time: ['2025-06-01'],
|
||||
temperature_2m_max: [25],
|
||||
temperature_2m_min: [18],
|
||||
weathercode: [1],
|
||||
precipitation_sum: [0],
|
||||
windspeed_10m_max: [15],
|
||||
sunrise: ['2025-06-01T06:00'],
|
||||
sunset: ['2025-06-01T21:00'],
|
||||
},
|
||||
}),
|
||||
}));
|
||||
|
||||
@@ -82,6 +80,7 @@ beforeEach(() => {
|
||||
|
||||
afterAll(() => {
|
||||
testDb.close();
|
||||
vi.unstubAllGlobals();
|
||||
});
|
||||
|
||||
describe('Weather validation', () => {
|
||||
|
||||
Reference in New Issue
Block a user