Files
sass-mohfarawati/tests/integration/actions-site-settings.test.ts
T
moh dc21c33867 ADDED - Admin SEO page, robots/sitemap hardening and media/maintenance security fixes
SEO
- New Settings > SEO admin page (seo_settings in app_config): indexing switch,
  Google/Bing verification, X handle, JSON-LD identity (Person/Organization,
  sameAs), per-locale keywords, readiness checklist and open links for
  sitemap.xml / robots.txt / manifest.
- robots.txt is now dynamic: disallows admin, api, success and coming-soon
  paths; blocks everything while indexing is off or maintenance is on.
- sitemap.xml carries hreflang alternates per URL, lists only categories with
  published projects, and is empty while hidden.
- Metadata: robots + verification meta, og:locale in de_DE/en_US/ar_AR form,
  alternateLocale, twitter site/creator, project cover as OG image with
  article type, noindex on /success and /coming-soon.
- JSON-LD: WebSite + publisher graph on all public pages, CreativeWork per
  project (view-mode independent).

Security
- Maintenance bypass now requires a correctly signed admin cookie; the
  middleware previously only checked the cookie existed. Token helpers moved
  to lib/admin-session-token.ts (shared by proxy.ts and lib/admin-auth.ts).
- Media uploads: magic-byte validation against the declared type, SVG
  sanitization (script/handlers/foreignObject/javascript: rejected), upload
  folder sanitized, kind inferred from the real file.
- Media route: fixed prefix-based path check that accepted sibling
  directories, unknown extensions return 404, nosniff header, CSP sandbox on
  SVG, gif content type added.
- External media URLs: protocol-relative (//host) URLs rejected.

Portfolio
- Project and category slugs share /portfolio/[slug]; saving now rejects a
  slug already used on the other side instead of silently shadowing it.

Tooling/docs
- Lint: ignore scripts/legacy-prisma-seed.cjs, drop unused import.
- New docs/SEO.md; FEATURES, ARCHITECTURE (Drizzle instead of Prisma), admin
  spec and CLAUDE.md updated.
- Tests for all of the above (unit + integration); suite green.
2026-09-20 21:36:16 +02:00

154 lines
6.0 KiB
TypeScript

import { beforeEach, describe, expect, it, vi } from "vitest";
vi.mock("next/cache", async () => ({ revalidatePath: (await import("@/tests/helpers/next-mocks")).revalidatePath }));
vi.mock("next/navigation", async () => ({ redirect: (await import("@/tests/helpers/next-mocks")).redirect }));
vi.mock("next/dist/client/components/redirect-error", async () => ({
isRedirectError: (await import("@/tests/helpers/next-mocks")).isRedirectError,
}));
vi.mock("@/lib/admin-auth", async () => {
const m = await import("@/tests/helpers/next-mocks");
return { isAdminAuthenticated: m.isAdminAuthenticated, clearAdminSessionCookie: m.clearAdminSessionCookie };
});
import {
saveSeoSettingsAction,
saveSiteBrandSettingsAction,
saveSiteLocalizationSettingsAction,
} from "@/app/_admin/site-settings/actions";
import { getSeoSettings, getSiteSettings, getSiteSettingsMediaBindings } from "@/lib/app-config";
import { adminAuth, captureRedirect, formDataFrom, resetNextMocks } from "@/tests/helpers/next-mocks";
beforeEach(() => {
resetNextMocks();
});
describe("saveSiteBrandSettingsAction", () => {
it("saves a normalized primary color", async () => {
const url = await captureRedirect(() => saveSiteBrandSettingsAction(formDataFrom({ primaryColor: "#123456" })));
expect(url).toContain("success=");
expect((await getSiteSettings()).brand.primaryColor).toBe("#123456");
});
it("falls back to the default color for invalid input", async () => {
await captureRedirect(() => saveSiteBrandSettingsAction(formDataFrom({ primaryColor: "not-a-color" })));
expect((await getSiteSettings()).brand.primaryColor).toBe("#dc5a35");
});
it("wires an external favicon into media bindings", async () => {
const faviconMedia = JSON.stringify({ mode: "external", url: "https://cdn/f.svg", kind: "IMAGE", label: "F" });
const url = await captureRedirect(() =>
saveSiteBrandSettingsAction(formDataFrom({ primaryColor: "#222222", faviconMedia })),
);
expect(url).toContain("success=");
const bindings = await getSiteSettingsMediaBindings();
expect(bindings.favicon?.url).toBe("https://cdn/f.svg");
});
it("errors on an invalid media json payload", async () => {
const url = await captureRedirect(() =>
saveSiteBrandSettingsAction(formDataFrom({ primaryColor: "#222222", faviconMedia: "{not json" })),
);
expect(url).toContain("error=");
});
it("redirects unauthenticated callers to the admin root", async () => {
adminAuth.authenticated = false;
const url = await captureRedirect(() => saveSiteBrandSettingsAction(formDataFrom({ primaryColor: "#123456" })));
expect(url).toBe("/");
});
});
const localizationForm = {
defaultLocale: "en",
siteNameAr: "الموقع",
siteNameEn: "The Site",
siteNameDe: "Die Seite",
titleTemplateAr: "{pageTitle} | {siteName}",
titleTemplateEn: "{pageTitle} | {siteName}",
titleTemplateDe: "{pageTitle} | {siteName}",
siteDescriptionAr: "وصف",
siteDescriptionEn: "Description",
siteDescriptionDe: "Beschreibung",
subheadAr: "",
subheadEn: "",
subheadDe: "",
};
describe("saveSiteLocalizationSettingsAction", () => {
it("saves valid localization settings and the default locale", async () => {
const url = await captureRedirect(() => saveSiteLocalizationSettingsAction(formDataFrom(localizationForm)));
expect(url).toContain("success=");
const settings = await getSiteSettings();
expect(settings.defaultLocale).toBe("en");
expect(settings.locales.en.siteName).toBe("The Site");
});
it("requires a site name for every locale", async () => {
const url = await captureRedirect(() =>
saveSiteLocalizationSettingsAction(formDataFrom({ ...localizationForm, siteNameEn: "" })),
);
expect(url).toContain("error=");
});
it("requires the {pageTitle} token in every title template", async () => {
const url = await captureRedirect(() =>
saveSiteLocalizationSettingsAction(formDataFrom({ ...localizationForm, titleTemplateDe: "{siteName} only" })),
);
expect(url).toContain("error=");
});
it("redirects unauthenticated callers to the admin root", async () => {
adminAuth.authenticated = false;
const url = await captureRedirect(() => saveSiteLocalizationSettingsAction(formDataFrom(localizationForm)));
expect(url).toBe("/");
});
});
describe("saveSeoSettingsAction", () => {
it("persists normalized seo settings", async () => {
const url = await captureRedirect(() =>
saveSeoSettingsAction(
formDataFrom({
allowIndexing: "on",
googleSiteVerification: "g-1",
twitterHandle: "moh",
structuredDataType: "Organization",
structuredDataName: "Studio",
sameAs: "https://a.com\nhttps://b.com",
keywordsDe: "a, b",
}),
),
);
expect(url).toContain("success=");
const seo = await getSeoSettings();
expect(seo).toMatchObject({
allowIndexing: true,
googleSiteVerification: "g-1",
twitterHandle: "@moh",
structuredDataType: "Organization",
sameAs: ["https://a.com", "https://b.com"],
});
expect(seo.locales.de.keywords).toBe("a, b");
});
it("turns indexing off when the checkbox is missing", async () => {
await captureRedirect(() => saveSeoSettingsAction(formDataFrom({})));
expect((await getSeoSettings()).allowIndexing).toBe(false);
});
it("rejects an invalid verification token without saving", async () => {
await captureRedirect(() => saveSeoSettingsAction(formDataFrom({ allowIndexing: "on", googleSiteVerification: "ok" })));
const url = await captureRedirect(() =>
saveSeoSettingsAction(formDataFrom({ allowIndexing: "on", googleSiteVerification: "<bad>" })),
);
expect(url).toContain("error=");
expect((await getSeoSettings()).googleSiteVerification).toBe("ok");
});
it("redirects unauthenticated users", async () => {
adminAuth.authenticated = false;
const url = await captureRedirect(() => saveSeoSettingsAction(formDataFrom({})));
expect(url).not.toContain("success=");
});
});