konnosDashboard
delivery-sms-honest.test.ts234 lines · main
1/**
2 * Offline SMS honesty + email branding HTML (no Doltgres).
3 * Full path: bun scripts/sms-polish-proof.mjs (needs local engine DB).
4 */
5import { describe, expect, test } from 'bun:test';
6
7import {
8 authEmailSubject,
9 buildBrivenEngineAuthEmailHtml,
10 sendBrivenEngineSms,
11 sendBrivenEngineSmsTest,
12} from './delivery.js';
13
14describe('briven-engine SMS honest delivery (offline)', () => {
15 test('test helper rejects non-E.164 phone without hitting provider', async () => {
16 const r = await sendBrivenEngineSmsTest({
17 projectId: 'p_any',
18 phoneNumber: '5551234',
19 });
20 expect(r.ok).toBe(false);
21 expect(r.mode).toBe('error');
22 expect(r.message?.toLowerCase()).toContain('e.164');
23 });
24
25 test('SMS without projectId is not a silent success', async () => {
26 const r = await sendBrivenEngineSms({
27 phoneNumber: '+15551234567',
28 userInputCode: '123456',
29 type: 'PASSWORDLESS_LOGIN',
30 });
31 expect(r.ok).toBe(false);
32 expect(r.mode).toBe('log');
33 expect(r.channel).toBe('sms');
34 expect(r.engine).toBe('briven-engine');
35 expect(r.message?.toLowerCase()).toMatch(/project/);
36 });
37});
38
39describe('briven-engine auth email branding HTML', () => {
40 test('includes sender name, custom footer, and structured OTP', () => {
41 const html = buildBrivenEngineAuthEmailHtml({
42 code: '123456',
43 expiryMinutes: 10,
44 branding: {
45 logoUrl: null,
46 primaryColor: '#FFFD74',
47 senderName: 'Konnos',
48 brandUrl: 'konnos.org',
49 footerNote: null,
50 footerLoveName: 'Flanders',
51 footerOrgName: 'flndrn',
52 footerTagline: '100% self-funded, sustainable & independent',
53 footerCity: 'Limassol',
54 footerCountry: 'Cyprus',
55 footerShowLove: true,
56 footerShowTagline: true,
57 footerShowAddress: true,
58 },
59 });
60 expect(html).toContain('Konnos');
61 expect(html).toContain('sign in to Konnos');
62 expect(html).toContain('123456');
63 expect(html).toContain('Flanders');
64 expect(html).toContain('Limassol');
65 expect(html).toContain('self-funded');
66 expect(html).toContain('konnos.org');
67 expect(html).not.toContain('<script>');
68 });
69
70 test('omits footer lines when toggles are off', () => {
71 const html = buildBrivenEngineAuthEmailHtml({
72 code: '1',
73 branding: {
74 logoUrl: null,
75 primaryColor: '#FFFD74',
76 senderName: 'Mavi',
77 brandUrl: null,
78 footerNote: null,
79 footerLoveName: 'Flanders',
80 footerOrgName: 'flndrn',
81 footerTagline: 'tagline',
82 footerCity: 'Limassol',
83 footerCountry: 'Cyprus',
84 footerShowLove: false,
85 footerShowTagline: false,
86 footerShowAddress: false,
87 },
88 });
89 expect(html).toContain('Mavi');
90 expect(html).not.toContain('Flanders');
91 expect(html).not.toContain('tagline');
92 expect(html).not.toContain('Limassol');
93 });
94
95 test('magic link renders CTA; unsafe logo URLs dropped', () => {
96 const html = buildBrivenEngineAuthEmailHtml({
97 url: 'https://app.example.com/verify?t=1',
98 branding: {
99 logoUrl: 'https://example.com/x.png" onerror="alert(1)',
100 primaryColor: '#112233',
101 senderName: 'App <x>',
102 brandUrl: null,
103 footerNote: null,
104 footerLoveName: null,
105 footerOrgName: null,
106 footerTagline: null,
107 footerCity: null,
108 footerCountry: null,
109 footerShowLove: false,
110 footerShowTagline: false,
111 footerShowAddress: false,
112 },
113 });
114 expect(html).toContain('https://app.example.com/verify?t=1');
115 expect(html).toContain('click the button below to sign in');
116 expect(html).toContain('App &lt;x&gt;');
117 expect(html).not.toContain('onerror');
118 // Unsafe logo rejected → colored circle, no img
119 expect(html).not.toContain('<img');
120 // No raw "Magic link:" dump — button only
121 expect(html).not.toContain('Magic link:');
122 });
123
124 test('OTP-only email has code and no magic-link CTA', () => {
125 const html = buildBrivenEngineAuthEmailHtml({
126 code: '847291',
127 branding: {
128 logoUrl: null,
129 primaryColor: '#0ea5e9',
130 senderName: 'mavi pay',
131 brandUrl: 'pay.mavifinans.sh',
132 footerNote: null,
133 footerLoveName: null,
134 footerOrgName: null,
135 footerTagline: null,
136 footerCity: null,
137 footerCountry: null,
138 footerShowLove: false,
139 footerShowTagline: false,
140 footerShowAddress: false,
141 },
142 });
143 expect(html).toContain('mavi pay');
144 expect(html).toContain('847291');
145 expect(html).toContain('enter this code');
146 expect(html).not.toContain('click the button below');
147 expect(html).not.toContain('Magic link');
148 });
149
150 test('authEmailSubject uses project name not Briven Auth', () => {
151 expect(authEmailSubject('mavi pay', 'sign-in')).toBe(
152 'Your mavi pay Auth sign-in',
153 );
154 expect(authEmailSubject('mavi pay', 'code', '123456')).toBe(
155 'Your mavi pay Auth code: 123456',
156 );
157 expect(authEmailSubject('mavi pay', 'code')).toBe(
158 'Your mavi pay Auth code',
159 );
160 });
161
162 test('request meta block is rendered on OTP and magic-link emails', () => {
163 const meta = {
164 platform: 'Brave browser on macOS device',
165 deviceLocation: 'Ghent, East Flanders, Belgium (109.128.54.152)',
166 time: 'July 25, 2026 at 10:48:35 AM GMT+2',
167 };
168 const brandingBase = {
169 logoUrl: null as string | null,
170 primaryColor: '#0ea5e9',
171 senderName: 'mavi pay',
172 senderDomain: null as string | null,
173 senderLocalPart: null as string | null,
174 senderEmail: null as string | null,
175 brandUrl: null as string | null,
176 footerNote: null as string | null,
177 footerLoveName: null as string | null,
178 footerOrgName: null as string | null,
179 footerTagline: null as string | null,
180 footerCity: null as string | null,
181 footerCountry: null as string | null,
182 footerShowLove: false,
183 footerShowTagline: false,
184 footerShowAddress: false,
185 };
186 const otp = buildBrivenEngineAuthEmailHtml({
187 code: '123456',
188 requestMeta: meta,
189 branding: brandingBase,
190 });
191 expect(otp).toContain('Platform');
192 expect(otp).toContain('Device location');
193 expect(otp).toContain('Time');
194 expect(otp).toContain('109.128.54.152');
195 expect(otp).toContain('GMT+2');
196 expect(otp).toContain('<svg');
197 expect(otp).not.toContain('💻');
198
199 const link = buildBrivenEngineAuthEmailHtml({
200 url: 'https://pay.mavifinans.sh/auth/verify?t=1',
201 requestMeta: meta,
202 branding: brandingBase,
203 });
204 expect(link).toContain('click the button below');
205 expect(link).toContain('Brave browser on macOS device');
206 expect(link).toContain('Device location');
207 });
208
209 test('escapes plain body fallback', () => {
210 const html = buildBrivenEngineAuthEmailHtml({
211 body: '<b>hi</b>',
212 branding: {
213 logoUrl: null,
214 primaryColor: '#112233',
215 senderName: 'App',
216 senderDomain: null,
217 senderLocalPart: null,
218 senderEmail: null,
219 brandUrl: null,
220 footerNote: null,
221 footerLoveName: null,
222 footerOrgName: null,
223 footerTagline: null,
224 footerCity: null,
225 footerCountry: null,
226 footerShowLove: false,
227 footerShowTagline: false,
228 footerShowAddress: false,
229 },
230 });
231 expect(html).toContain('&lt;b&gt;hi&lt;/b&gt;');
232 });
233});
234