SEO - New Settings > SEO admin page (seo_settings in app_config): indexing switch, Google/Bing verification, X handle, JSON-LD identity (Person/Organization, sameAs), per-locale keywords, readiness checklist and open links for sitemap.xml / robots.txt / manifest. - robots.txt is now dynamic: disallows admin, api, success and coming-soon paths; blocks everything while indexing is off or maintenance is on. - sitemap.xml carries hreflang alternates per URL, lists only categories with published projects, and is empty while hidden. - Metadata: robots + verification meta, og:locale in de_DE/en_US/ar_AR form, alternateLocale, twitter site/creator, project cover as OG image with article type, noindex on /success and /coming-soon. - JSON-LD: WebSite + publisher graph on all public pages, CreativeWork per project (view-mode independent). Security - Maintenance bypass now requires a correctly signed admin cookie; the middleware previously only checked the cookie existed. Token helpers moved to lib/admin-session-token.ts (shared by proxy.ts and lib/admin-auth.ts). - Media uploads: magic-byte validation against the declared type, SVG sanitization (script/handlers/foreignObject/javascript: rejected), upload folder sanitized, kind inferred from the real file. - Media route: fixed prefix-based path check that accepted sibling directories, unknown extensions return 404, nosniff header, CSP sandbox on SVG, gif content type added. - External media URLs: protocol-relative (//host) URLs rejected. Portfolio - Project and category slugs share /portfolio/[slug]; saving now rejects a slug already used on the other side instead of silently shadowing it. Tooling/docs - Lint: ignore scripts/legacy-prisma-seed.cjs, drop unused import. - New docs/SEO.md; FEATURES, ARCHITECTURE (Drizzle instead of Prisma), admin spec and CLAUDE.md updated. - Tests for all of the above (unit + integration); suite green.
154 lines
6.0 KiB
TypeScript
154 lines
6.0 KiB
TypeScript
import { beforeEach, describe, expect, it, vi } from "vitest";
|
|
|
|
vi.mock("next/cache", async () => ({ revalidatePath: (await import("@/tests/helpers/next-mocks")).revalidatePath }));
|
|
vi.mock("next/navigation", async () => ({ redirect: (await import("@/tests/helpers/next-mocks")).redirect }));
|
|
vi.mock("next/dist/client/components/redirect-error", async () => ({
|
|
isRedirectError: (await import("@/tests/helpers/next-mocks")).isRedirectError,
|
|
}));
|
|
vi.mock("@/lib/admin-auth", async () => {
|
|
const m = await import("@/tests/helpers/next-mocks");
|
|
return { isAdminAuthenticated: m.isAdminAuthenticated, clearAdminSessionCookie: m.clearAdminSessionCookie };
|
|
});
|
|
|
|
import {
|
|
saveSeoSettingsAction,
|
|
saveSiteBrandSettingsAction,
|
|
saveSiteLocalizationSettingsAction,
|
|
} from "@/app/_admin/site-settings/actions";
|
|
import { getSeoSettings, getSiteSettings, getSiteSettingsMediaBindings } from "@/lib/app-config";
|
|
import { adminAuth, captureRedirect, formDataFrom, resetNextMocks } from "@/tests/helpers/next-mocks";
|
|
|
|
beforeEach(() => {
|
|
resetNextMocks();
|
|
});
|
|
|
|
describe("saveSiteBrandSettingsAction", () => {
|
|
it("saves a normalized primary color", async () => {
|
|
const url = await captureRedirect(() => saveSiteBrandSettingsAction(formDataFrom({ primaryColor: "#123456" })));
|
|
expect(url).toContain("success=");
|
|
expect((await getSiteSettings()).brand.primaryColor).toBe("#123456");
|
|
});
|
|
|
|
it("falls back to the default color for invalid input", async () => {
|
|
await captureRedirect(() => saveSiteBrandSettingsAction(formDataFrom({ primaryColor: "not-a-color" })));
|
|
expect((await getSiteSettings()).brand.primaryColor).toBe("#dc5a35");
|
|
});
|
|
|
|
it("wires an external favicon into media bindings", async () => {
|
|
const faviconMedia = JSON.stringify({ mode: "external", url: "https://cdn/f.svg", kind: "IMAGE", label: "F" });
|
|
const url = await captureRedirect(() =>
|
|
saveSiteBrandSettingsAction(formDataFrom({ primaryColor: "#222222", faviconMedia })),
|
|
);
|
|
expect(url).toContain("success=");
|
|
const bindings = await getSiteSettingsMediaBindings();
|
|
expect(bindings.favicon?.url).toBe("https://cdn/f.svg");
|
|
});
|
|
|
|
it("errors on an invalid media json payload", async () => {
|
|
const url = await captureRedirect(() =>
|
|
saveSiteBrandSettingsAction(formDataFrom({ primaryColor: "#222222", faviconMedia: "{not json" })),
|
|
);
|
|
expect(url).toContain("error=");
|
|
});
|
|
|
|
it("redirects unauthenticated callers to the admin root", async () => {
|
|
adminAuth.authenticated = false;
|
|
const url = await captureRedirect(() => saveSiteBrandSettingsAction(formDataFrom({ primaryColor: "#123456" })));
|
|
expect(url).toBe("/");
|
|
});
|
|
});
|
|
|
|
const localizationForm = {
|
|
defaultLocale: "en",
|
|
siteNameAr: "الموقع",
|
|
siteNameEn: "The Site",
|
|
siteNameDe: "Die Seite",
|
|
titleTemplateAr: "{pageTitle} | {siteName}",
|
|
titleTemplateEn: "{pageTitle} | {siteName}",
|
|
titleTemplateDe: "{pageTitle} | {siteName}",
|
|
siteDescriptionAr: "وصف",
|
|
siteDescriptionEn: "Description",
|
|
siteDescriptionDe: "Beschreibung",
|
|
subheadAr: "",
|
|
subheadEn: "",
|
|
subheadDe: "",
|
|
};
|
|
|
|
describe("saveSiteLocalizationSettingsAction", () => {
|
|
it("saves valid localization settings and the default locale", async () => {
|
|
const url = await captureRedirect(() => saveSiteLocalizationSettingsAction(formDataFrom(localizationForm)));
|
|
expect(url).toContain("success=");
|
|
const settings = await getSiteSettings();
|
|
expect(settings.defaultLocale).toBe("en");
|
|
expect(settings.locales.en.siteName).toBe("The Site");
|
|
});
|
|
|
|
it("requires a site name for every locale", async () => {
|
|
const url = await captureRedirect(() =>
|
|
saveSiteLocalizationSettingsAction(formDataFrom({ ...localizationForm, siteNameEn: "" })),
|
|
);
|
|
expect(url).toContain("error=");
|
|
});
|
|
|
|
it("requires the {pageTitle} token in every title template", async () => {
|
|
const url = await captureRedirect(() =>
|
|
saveSiteLocalizationSettingsAction(formDataFrom({ ...localizationForm, titleTemplateDe: "{siteName} only" })),
|
|
);
|
|
expect(url).toContain("error=");
|
|
});
|
|
|
|
it("redirects unauthenticated callers to the admin root", async () => {
|
|
adminAuth.authenticated = false;
|
|
const url = await captureRedirect(() => saveSiteLocalizationSettingsAction(formDataFrom(localizationForm)));
|
|
expect(url).toBe("/");
|
|
});
|
|
});
|
|
|
|
describe("saveSeoSettingsAction", () => {
|
|
it("persists normalized seo settings", async () => {
|
|
const url = await captureRedirect(() =>
|
|
saveSeoSettingsAction(
|
|
formDataFrom({
|
|
allowIndexing: "on",
|
|
googleSiteVerification: "g-1",
|
|
twitterHandle: "moh",
|
|
structuredDataType: "Organization",
|
|
structuredDataName: "Studio",
|
|
sameAs: "https://a.com\nhttps://b.com",
|
|
keywordsDe: "a, b",
|
|
}),
|
|
),
|
|
);
|
|
expect(url).toContain("success=");
|
|
const seo = await getSeoSettings();
|
|
expect(seo).toMatchObject({
|
|
allowIndexing: true,
|
|
googleSiteVerification: "g-1",
|
|
twitterHandle: "@moh",
|
|
structuredDataType: "Organization",
|
|
sameAs: ["https://a.com", "https://b.com"],
|
|
});
|
|
expect(seo.locales.de.keywords).toBe("a, b");
|
|
});
|
|
|
|
it("turns indexing off when the checkbox is missing", async () => {
|
|
await captureRedirect(() => saveSeoSettingsAction(formDataFrom({})));
|
|
expect((await getSeoSettings()).allowIndexing).toBe(false);
|
|
});
|
|
|
|
it("rejects an invalid verification token without saving", async () => {
|
|
await captureRedirect(() => saveSeoSettingsAction(formDataFrom({ allowIndexing: "on", googleSiteVerification: "ok" })));
|
|
const url = await captureRedirect(() =>
|
|
saveSeoSettingsAction(formDataFrom({ allowIndexing: "on", googleSiteVerification: "<bad>" })),
|
|
);
|
|
expect(url).toContain("error=");
|
|
expect((await getSeoSettings()).googleSiteVerification).toBe("ok");
|
|
});
|
|
|
|
it("redirects unauthenticated users", async () => {
|
|
adminAuth.authenticated = false;
|
|
const url = await captureRedirect(() => saveSeoSettingsAction(formDataFrom({})));
|
|
expect(url).not.toContain("success=");
|
|
});
|
|
});
|