nexarch/web/dms-browser/lib/http.test.ts

import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
import { resetSessionForTests, downloadFile, currentUserId, statusMessage } from "./http";
import { fetchChildren, fetchDocuments } from "./api";
import { fetchAllTags, assignTag } from "./tagApi";
import { fetchFields, saveValues } from "./metadataApi";
import { fetchSearch, parseSearchState } from "./searchApi";
import { fetchTrash, restoreSelection } from "./trashApi";
import { fetchSavedSearches, createSavedSearch } from "./savedSearchApi";
import { fetchRevisions, restoreRevision, revisionContentUrl } from "./versionsApi";
import { fetchDiff } from "./diffApi";
import { fetchAuditLog, auditExportUrl } from "./auditApi";
import { applyBulkEdit } from "./bulkEditApi";

function b64(o: unknown): string {
  return btoa(String.fromCharCode(...new TextEncoder().encode(JSON.stringify(o)))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
}
const TOKEN = `${b64({ alg: "EdDSA" })}.${b64({ sub: "u-42", tenant: "acme" })}.sig`;

type Call = { url: string; init: RequestInit };
let calls: Call[];
let handler: (url: string, init: RequestInit) => Response;

const json = (body: unknown, status = 200) => new Response(JSON.stringify(body), { status, headers: { "Content-Type": "application/json" } });

beforeEach(() => {
  calls = [];
  handler = (url) => {
    if (url.endsWith("/auth/module-token")) return json({ token: TOKEN, token_type: "Bearer", expires_in: 600, tenant: "acme", role: "user" });
    return json([]);
  };
  vi.stubGlobal(
    "fetch",
    vi.fn(async (input: RequestInfo | URL, init: RequestInit = {}) => {
      calls.push({ url: String(input), init });
      return handler(String(input), init);
    })
  );
  vi.stubEnv("NEXT_PUBLIC_AUTH_MODE", "token");
  vi.stubEnv("NEXT_PUBLIC_CORE_API_BASE", "/api/core/v1");
  vi.stubEnv("NEXT_PUBLIC_USER_ID", "");
  for (const k of ["FOLDER", "TAG", "METADATA", "SEARCH", "TRASH", "SAVED_SEARCH", "VERSIONING", "AUDIT", "BULK_EDIT"]) {
    vi.stubEnv(`NEXT_PUBLIC_${k}_API_URL`, `http://dms.test/api/dms/v1`);
  }
  resetSessionForTests();
});
afterEach(() => {
  vi.unstubAllEnvs();
  vi.unstubAllGlobals();
});

function dmsCalls(): Call[] {
  return calls.filter((c) => !c.url.includes("/auth/"));
}

describe("UX-10 AK1: alle DMS-Aufrufe im Token-Modus (Standard)", () => {
  it("senden Authorization: Bearer und nie caller/X-User-Id/actor", async () => {
    handler = (url) => (url.endsWith("/auth/module-token") ? json({ token: TOKEN, token_type: "Bearer", expires_in: 600, tenant: "acme", role: "user" }) : json({ hits: [], total: 0, limit: 20, offset: 0, took_ms: 1, facets: {} }));
    const attempts: Array<() => Promise<unknown>> = [
      () => fetchChildren(null),
      () => fetchDocuments("f-1"),
      () => fetchAllTags(),
      () => assignTag("d-1", "t-1"),
      () => fetchFields(),
      () => saveValues("d-1", { a: "b" }),
      () => fetchSearch(parseSearchState(new URLSearchParams("q=test"))),
      () => fetchTrash(),
      () => restoreSelection(["d-1"], []),
      () => fetchSavedSearches(),
      () => createSavedSearch("n", "q=x", false),
      () => fetchRevisions("d-1"),
      () => restoreRevision("d-1", "r-1"),
      () => fetchDiff("d-1", "r-1", "r-2"),
      () => fetchAuditLog({}),
      () => applyBulkEdit({ documentIds: ["d-1"], addTagIds: ["t-1"] }),
    ];
    for (const a of attempts) await a().catch(() => undefined);

    const api = dmsCalls();
    expect(api.length).toBeGreaterThanOrEqual(attempts.length);
    for (const c of api) {
      expect(c.url, c.url).not.toMatch(/[?&]caller=/);
      const h = new Headers(c.init.headers);
      expect(h.get("Authorization"), c.url).toBe(`Bearer ${TOKEN}`);
      expect(h.get("X-User-Id"), c.url).toBeNull();
      expect(String(c.init.body ?? ""), c.url).not.toMatch(/"actor"|"caller"/);
      expect(c.url, c.url).not.toContain(TOKEN);
    }
  });

  it("URLs fuer Download und Export enthalten weder caller noch Token", () => {
    expect(revisionContentUrl("d-1", "r-1")).not.toMatch(/caller|Bearer|eyJ/);
    expect(auditExportUrl({ actor: "x" })).not.toMatch(/caller=/);
  });

  it("Download laedt Inhalte mit Bearer-Header und speichert lokal (kein Link mit Token)", async () => {
    handler = (url) => (url.includes("/auth/") ? json({ token: TOKEN, token_type: "Bearer", expires_in: 600, tenant: "acme" }) : new Response("inhalt", { status: 200, headers: { "Content-Disposition": 'attachment; filename="a.pdf"' } }));
    const created = vi.fn(() => "blob:x");
    vi.stubGlobal("URL", Object.assign(URL, { createObjectURL: created, revokeObjectURL: vi.fn() }));
    await downloadFile(revisionContentUrl("d-1", "r-1"), "fallback");
    const api = dmsCalls();
    expect(api).toHaveLength(1);
    expect(new Headers(api[0].init.headers).get("Authorization")).toBe(`Bearer ${TOKEN}`);
    expect(created).toHaveBeenCalled();
  });

  it("Nutzer-ID kommt aus dem Token, nicht aus NEXT_PUBLIC_USER_ID", async () => {
    vi.stubEnv("NEXT_PUBLIC_USER_ID", "vorgetaeuscht");
    expect(await currentUserId()).toBe("u-42");
  });
});

describe("UX-10 AK2: Fehlerbehandlung", () => {
  it("abgelaufenes/ungueltiges Token (401 vom DMS) fuehrt zur erneuten Anmeldung, nie zu Daten", async () => {
    vi.stubEnv("NEXT_PUBLIC_LOGIN_URL", "/anmelden");
    const assign = vi.fn();
    vi.stubGlobal("location", { pathname: "/", search: "", assign });
    handler = (url) => (url.endsWith("/auth/module-token") ? json({ token: TOKEN, token_type: "Bearer", expires_in: 600, tenant: "acme" }) : new Response("", { status: 401 }));
    await expect(fetchAllTags()).rejects.toMatchObject({ kind: "unauthenticated" });
    expect(assign).toHaveBeenCalledWith("/anmelden?return=%2F");
    expect(dmsCalls().every((c) => !/caller=/.test(c.url))).toBe(true);
  });

  it("Token fremden Mandanten wird vom DMS mit 401 abgewiesen und liefert keine Daten", async () => {
    handler = (url) => (url.endsWith("/auth/module-token") ? json({ token: TOKEN, token_type: "Bearer", expires_in: 600, tenant: "globex" }) : new Response(JSON.stringify({ error: { code: "unauthenticated" } }), { status: 401 }));
    await expect(fetchFields()).rejects.toMatchObject({ kind: "unauthenticated" });
  });

  it.each([
    [403, /Berechtigung/],
    [503, /nicht verfügbar/],
  ])("%i wird als verstaendliche Meldung ausgegeben", async (status, text) => {
    handler = (url) => (url.endsWith("/auth/module-token") ? json({ token: TOKEN, token_type: "Bearer", expires_in: 600, tenant: "acme" }) : new Response("", { status }));
    await expect(fetchAllTags()).rejects.toThrow(text);
  });

  it("statusMessage: 500 bleibt technisch, 401/403/503 verstaendlich", () => {
    expect(statusMessage({ status: 500 }, "Fehler")).toBe("Fehler (500)");
    expect(statusMessage({ status: 401 }, "Fehler")).toMatch(/anmelden/);
  });

  it("Kontodienst nicht erreichbar: Meldung, kein Rueckfall auf caller", async () => {
    vi.stubEnv("NEXT_PUBLIC_USER_ID", "u-legacy");
    handler = (url) => {
      if (url.includes("/auth/")) throw new TypeError("network");
      return json([]);
    };
    await expect(fetchAllTags()).rejects.toMatchObject({ kind: "unavailable" });
    expect(dmsCalls()).toHaveLength(0);
  });
});

describe("UX-10: Uebergangsmodus bleibt abschaltbar", () => {
  it("NEXT_PUBLIC_AUTH_MODE=caller sendet wie bisher caller und kein Bearer", async () => {
    vi.stubEnv("NEXT_PUBLIC_AUTH_MODE", "caller");
    vi.stubEnv("NEXT_PUBLIC_USER_ID", "u-legacy");
    await fetchRevisions("d-1");
    const c = dmsCalls()[0];
    expect(c.url).toContain("caller=u-legacy");
    expect(new Headers(c.init.headers).get("Authorization")).toBeNull();
    expect(calls.some((x) => x.url.includes("/auth/"))).toBe(false);
  });
});