websitedev/scripts/test-content-editor-versions.js

#!/usr/bin/env node

/**
 * Integration test for the CMS Versions panel (MITHOME-64):
 *   1. GET /versions lists the backups of the file (auth required)
 *   2. GET /versions?show=<backup> renders a diff vs the current content
 *   3. POST /restore restores an older backup; the pre-restore state gets a
 *      fresh backup too (restore is reversible)
 *   4. path traversal backup names are rejected (400)
 *   5. restore without CSRF is rejected (403)
 */
const assert = require('assert/strict');
const crypto = require('crypto');
const fs = require('fs');
const os = require('os');
const path = require('path');
const { spawn } = require('child_process');

const ROOT = path.join(__dirname, '..');
const PORT = 4131;
const BASE = `http://127.0.0.1:${PORT}`;
const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'cms-versions-'));
const auditFile = path.join(tmp, 'audit.jsonl');

const child = spawn('node', ['content-editor.js'], {
  cwd: ROOT,
  env: {
    ...process.env,
    CONTENT_EDITOR_PORT: String(PORT),
    CONTENT_EDITOR_AUDIT_FILE: auditFile,
    CMS_USER: 'versions-test-user',
    CMS_PASS: 'versions-test-pass',
    CMS_DEPLOY_ENV: 'staging',
  },
  stdio: 'ignore',
});

async function waitForServer(timeoutMs = 10000) {
  const deadline = Date.now() + timeoutMs;
  while (Date.now() < deadline) {
    try {
      await fetch(`${BASE}/version`);
      return;
    } catch {
      await new Promise(r => setTimeout(r, 200));
    }
  }
  throw new Error('server did not start');
}

async function session() {
  const login = await fetch(`${BASE}/login`, {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ user: 'versions-test-user', pass: 'versions-test-pass' }),
  });
  return (login.headers.get('set-cookie') || '').split(';')[0];
}

async function csrfOf(cookie) {
  const page = await (await fetch(`${BASE}/?file=contact`, { headers: { Cookie: cookie } })).text();
  return page.match(/CSRF_TOKEN = "([a-f0-9]+)"/)[1];
}

const hashOf = s => crypto.createHash('sha256').update(s.trim()).digest('hex');

async function main() {
  await waitForServer();
  const cookie = await session();
  const csrf = await csrfOf(cookie);
  const contentFile = path.join(ROOT, 'proto', 'src', 'content', 'pages', 'contact.json');
  const original = fs.readFileSync(contentFile, 'utf8');
  const backupDir = path.join(ROOT, '.content-backups');
  const testStartedAt = Date.now();

  try {
    // Create two saves → two backups of intermediate states
    const v1 = JSON.parse(original);
    v1.hero.subtitle = 'Verzió teszt #1';
    const v2 = JSON.parse(original);
    v2.hero.subtitle = 'Verzió teszt #2';

    for (const variant of [v1, v2]) {
      const res = await fetch(`${BASE}/save?file=contact`, {
        method: 'POST',
        headers: {
          Cookie: cookie,
          'Content-Type': 'application/json',
          'X-CSRF-Token': csrf,
          'X-Content-Hash': hashOf(fs.readFileSync(contentFile, 'utf8')),
        },
        body: JSON.stringify(variant, null, 2),
      });
      assert.equal(res.status, 200, 'seed save must succeed');
    }
    // restore the pristine original as the "current" state for the diff assertion
    const third = await fetch(`${BASE}/save?file=contact`, {
      method: 'POST',
      headers: {
        Cookie: cookie,
        'Content-Type': 'application/json',
        'X-CSRF-Token': csrf,
        'X-Content-Hash': hashOf(fs.readFileSync(contentFile, 'utf8')),
      },
      body: original,
    });
    assert.equal(third.status, 200);

    // 1. versions page lists backups (names appear in the show= comparison links)
    const versionsPage = await (await fetch(`${BASE}/versions?file=contact`, { headers: { Cookie: cookie } })).text();
    assert.match(versionsPage, /Verziók/);
    assert.match(versionsPage, /Visszaállítás/);
    const names = [...versionsPage.matchAll(/restore\('([^']+)'\)/g)].map(m => m[1]);
    assert.ok(names.length >= 3, `expected at least 3 backups, got ${names.length}`);
    // backups of v1 (the oldest seeded state) — pick the one that contains subtitle #1
    // (backups hold the state BEFORE each save: original, v1, v2)

    // 2. diff view: pick the backup that holds "Verzió teszt #1" (created during
    // this run) and compare it with the current (original) content
    const backupHoldingV1 = fs.readdirSync(backupDir)
      .filter(name => name.startsWith('contact.'))
      .filter(name => fs.statSync(path.join(backupDir, name)).mtimeMs >= testStartedAt)
      .find(name => fs.readFileSync(path.join(backupDir, name), 'utf8').includes('Verzió teszt #1'));
    assert.ok(backupHoldingV1, 'seeded backup holding v1 must exist');

    const diffPage = await (await fetch(`${BASE}/versions?file=contact&show=${backupHoldingV1}`, { headers: { Cookie: cookie } })).text();
    assert.match(diffPage, /diff-del/, 'diff must contain removed lines (backup side)');
    assert.match(diffPage, /diff-add/, 'diff must contain added lines (current side)');
    assert.match(diffPage, /Verzió teszt #1/);

    // 3. restore the v1 backup → file content becomes v1
    const restore = await fetch(`${BASE}/restore?file=contact&backup=${backupHoldingV1}`, {
      method: 'POST',
      headers: { Cookie: cookie, 'X-CSRF-Token': csrf },
    });
    assert.equal(restore.status, 200);
    assert.ok(fs.readFileSync(contentFile, 'utf8').includes('Verzió teszt #1'));

    // restore created a new backup of the pre-restore state (reversibility)
    const afterPage = await (await fetch(`${BASE}/versions?file=contact`, { headers: { Cookie: cookie } })).text();
    const namesAfter = [...afterPage.matchAll(/restore\('([^']+)'\)/g)].map(m => m[1]);
    assert.equal(namesAfter.length, names.length + 1, 'restore must back up the current state first');

    // 4. traversal is rejected
    const evil = await fetch(`${BASE}/restore?file=contact&backup=${encodeURIComponent('../../package.json')}`, {
      method: 'POST',
      headers: { Cookie: cookie, 'X-CSRF-Token': csrf },
    });
    assert.equal(evil.status, 400);

    // 5. no CSRF → 403
    const noCsrf = await fetch(`${BASE}/restore?file=contact&backup=${backupHoldingV1}`, {
      method: 'POST',
      headers: { Cookie: cookie },
    });
    assert.equal(noCsrf.status, 403);

    // unauthenticated listing is redirected for browsers / 401 otherwise
    const anon = await fetch(`${BASE}/versions?file=contact`);
    assert.equal(anon.status, 401);

    console.log('Content Editor versions panel test: OK');
  } finally {
    fs.writeFileSync(contentFile, original); // leave the repo pristine
  }
}

main()
  .catch(err => { console.error('❌', err.message); process.exitCode = 1; })
  .finally(() => {
    child.kill('SIGTERM');
    try { fs.rmSync(tmp, { recursive: true, force: true }); } catch { /* best effort */ }
  });