434 lines
19 KiB
JavaScript
434 lines
19 KiB
JavaScript
#!/usr/bin/env node
|
|
/*
|
|
* cari.test.mjs — the /cari payload-shape gates (D-01, D-02, D-10, D-11, D-13, D-15).
|
|
* ------------------------------------------------------------------------------------
|
|
* Two gate styles, per the repo's established conventions:
|
|
*
|
|
* Style 1 — fake-transport payload capture (webhook.test.mjs's seam):
|
|
* createBot(env, { baseFetch }) is driven with synthetic Telegram
|
|
* updates; the fake fetch records every outgoing Bot API request
|
|
* (method, url, JSON body). Assertions run on the RECORDED request
|
|
* bodies — exactly what Telegram would receive. The live API is never
|
|
* touched (bot.init()'s getMe also lands in the fake).
|
|
*
|
|
* Style 2 — source-introspection structural gates (privacy.test.mjs /
|
|
* commands.test.mjs precedent): read the shipped source, strip
|
|
* comments, assert on code text only.
|
|
*
|
|
* Cases:
|
|
* CR1 the venue payload is structurally correct (lat/lng finite, title =
|
|
* canonical name, curated address, reply_markup.inline_keyboard)
|
|
* CR2 the OPEN button's URL carries the plain id and the CONFIGURED
|
|
* origin — <MINI_APP_URL>/?dest=<slug>, never a query-derived origin
|
|
* CR3 NO CRYPTO IN THE DEEP-LINK PATH (D-11's structural gate)
|
|
* CR4 the alternates ride on the SAME message — exactly one sendVenue,
|
|
* 2-4 alternates as alt:<slug> callback buttons
|
|
* CR5 the callback_data carries no user data — alt:<slug> only, <= 64
|
|
* bytes, no space/query/coordinates
|
|
* CR6 a no-match query sends NO venue and NO keyboard — the honest
|
|
* searchNoMatch refusal (D-13: never a fabricated pin)
|
|
* CR7 an over-long query is rejected before any search (V5, T-04-21)
|
|
* CR8 an empty query produces no venue card — the usage line
|
|
* CR9 every callback path answers the callback query (30-second rule,
|
|
* T-04-27) — the alt: matcher AND the catch-all
|
|
* CR10 the query text never reaches a log line (D-15) — every console.log
|
|
* in cari.ts is a category-only string literal
|
|
* CR11 the copy exists in both locales (refusals differ; the OPEN label
|
|
* and the OSM attribution are identical by design)
|
|
* CR12 the helpMenu carries the /cari line in both locales
|
|
* CR13 the registration script derives the /cari scope from helpMenu —
|
|
* "cari" in the command list, still exactly two fetch calls
|
|
* CR14 an alternate tap swaps to a NEW venue card for the tapped entry
|
|
* (no in-place edits — T-04-28)
|
|
* CR15 a hostile callback id is dropped, not echoed (T-04-23)
|
|
*/
|
|
import { strict as assert } from "node:assert";
|
|
import { readFileSync } from "node:fs";
|
|
import path from "node:path";
|
|
import { fileURLToPath } from "node:url";
|
|
import { test } from "./harness.mjs";
|
|
|
|
const { strings } = await import("../src/i18n/strings.ts");
|
|
const { createBot } = await import("../src/bot/bot.ts");
|
|
const { createGazetteerSource } = await import("../../search/src/index.ts");
|
|
|
|
const BOT_SRC = path.join(fileURLToPath(new URL(import.meta.url)), "..", "..", "src");
|
|
|
|
/** The comment-strip helper (web/test/no-storage.test.mjs precedent) —
|
|
* source-introspection gates must never assert on prose. */
|
|
function stripComments(src) {
|
|
return src
|
|
.replace(/\/\*[\s\S]*?\*\//g, " ")
|
|
.replace(/(^|[^:\\])\/\/[^\n]*/g, "$1");
|
|
}
|
|
|
|
/* ————— fake-transport harness (webhook.test.mjs's makeKV + baseFetch seam) ————— */
|
|
|
|
const TEST_TOKEN = "12345:TESTTOKEN";
|
|
const ORIGIN = "https://araharah-bot.example.workers.dev";
|
|
const BOT_USERNAME = "araharah_test_bot";
|
|
|
|
function makeKV() {
|
|
const map = new Map();
|
|
return {
|
|
async get(key) {
|
|
return map.has(key) ? map.get(key) : null;
|
|
},
|
|
async put(key, value) {
|
|
map.set(key, value);
|
|
},
|
|
async delete(key) {
|
|
map.delete(key);
|
|
},
|
|
map,
|
|
};
|
|
}
|
|
|
|
/** Records every outgoing Bot API call; answers getMe with a synthetic bot
|
|
* user and everything else with ok:true. NEVER touches the network. */
|
|
function makeTransport() {
|
|
const calls = [];
|
|
const fetchFn = async (url, init) => {
|
|
const u = String(url);
|
|
const matched = u.match(/bot[^/]+\/([A-Za-z]+)$/);
|
|
const method = matched ? matched[1] : u;
|
|
let body = null;
|
|
if (init?.body !== undefined) {
|
|
try {
|
|
body = JSON.parse(init.body);
|
|
} catch {
|
|
body = init.body;
|
|
}
|
|
}
|
|
calls.push({ method, url: u, body });
|
|
const result =
|
|
method === "getMe"
|
|
? { id: 12345, is_bot: true, first_name: "araharah", username: BOT_USERNAME }
|
|
: true;
|
|
return new Response(JSON.stringify({ ok: true, result }), {
|
|
headers: { "content-type": "application/json" },
|
|
});
|
|
};
|
|
return { calls, fetchFn };
|
|
}
|
|
|
|
async function makeBot() {
|
|
const { calls, fetchFn } = makeTransport();
|
|
const bot = createBot(
|
|
{
|
|
BOT_TOKEN: TEST_TOKEN,
|
|
WEBHOOK_SECRET: "wk-test-secret",
|
|
chat_sessions: makeKV(),
|
|
MINI_APP_URL: ORIGIN,
|
|
},
|
|
{ baseFetch: fetchFn },
|
|
);
|
|
await bot.init(); // the getMe lands in the fake transport, not the network
|
|
return { bot, calls };
|
|
}
|
|
|
|
function messageUpdate(text) {
|
|
const command = text.split(" ")[0] ?? text;
|
|
return {
|
|
update_id: Math.floor(Math.random() * 1e9),
|
|
message: {
|
|
message_id: 1,
|
|
from: { id: 42, is_bot: false, first_name: "Zul", language_code: "en" },
|
|
chat: { id: 42, type: "private" },
|
|
date: Math.floor(Date.now() / 1000),
|
|
text,
|
|
// Real Telegram command messages always carry this entity — grammY's
|
|
// command filter matches on it, so the synthetic update must too.
|
|
entities: [{ offset: 0, length: command.length, type: "bot_command" }],
|
|
},
|
|
};
|
|
}
|
|
|
|
function callbackUpdate(data) {
|
|
return {
|
|
update_id: Math.floor(Math.random() * 1e9),
|
|
callback_query: {
|
|
id: `cq${Math.floor(Math.random() * 1e9)}`,
|
|
from: { id: 42, is_bot: false, first_name: "Zul", language_code: "en" },
|
|
message: {
|
|
message_id: 1,
|
|
chat: { id: 42, type: "private" },
|
|
date: Math.floor(Date.now() / 1000),
|
|
text: "/cari KLCC",
|
|
},
|
|
data,
|
|
},
|
|
};
|
|
}
|
|
|
|
/* ————— recorded-call views (getMe is harness noise) ————— */
|
|
|
|
function apiCalls(calls) {
|
|
return calls.filter((c) => c.method !== "getMe");
|
|
}
|
|
function venueCalls(calls) {
|
|
return apiCalls(calls).filter((c) => c.method === "sendVenue");
|
|
}
|
|
function messageCalls(calls) {
|
|
return apiCalls(calls).filter((c) => c.method === "sendMessage");
|
|
}
|
|
|
|
const source = createGazetteerSource();
|
|
|
|
/* ————— CR1 — the venue payload is structurally correct ————— */
|
|
|
|
test("CR1 the venue payload is structurally correct", async () => {
|
|
const { bot, calls } = await makeBot();
|
|
await bot.handleUpdate(messageUpdate("/cari KLCC"));
|
|
const venues = venueCalls(calls);
|
|
assert.equal(venues.length, 1, "exactly one sendVenue (D-02: the card IS the confirmation)");
|
|
const body = venues[0].body;
|
|
assert.equal(body.chat_id, 42);
|
|
assert.ok(Number.isFinite(body.latitude), "latitude is a finite number");
|
|
assert.ok(Number.isFinite(body.longitude), "longitude is a finite number");
|
|
const entry = source.byId("suria-klcc");
|
|
assert.equal(body.latitude, entry.lat, "the pin is the entry's own coordinate");
|
|
assert.equal(body.longitude, entry.lng, "");
|
|
assert.ok(typeof body.title === "string" && body.title.length > 0, "title non-empty");
|
|
assert.equal(body.title, entry.name, "title is the entry's canonical name");
|
|
assert.ok(typeof body.address === "string" && body.address.length > 0, "curated address non-empty");
|
|
assert.equal(body.address, entry.address, "address is the CURATED string verbatim (never normalized)");
|
|
assert.ok(body.reply_markup?.inline_keyboard, "the card carries an inline keyboard (D-10)");
|
|
});
|
|
|
|
/* ————— CR2 — the OPEN button's URL carries the plain id and the configured origin ————— */
|
|
|
|
test("CR2 the OPEN button's URL carries the plain id and the configured origin", async () => {
|
|
const { bot, calls } = await makeBot();
|
|
await bot.handleUpdate(messageUpdate("/cari KLCC"));
|
|
const keyboard = venueCalls(calls)[0].body.reply_markup.inline_keyboard;
|
|
const open = keyboard[0].find((btn) => btn.web_app);
|
|
assert.ok(open, "row 0 carries the OPEN web_app button");
|
|
assert.equal(open.text, strings.en.searchOpenButton);
|
|
assert.equal(
|
|
open.web_app.url,
|
|
`${ORIGIN}/?dest=suria-klcc`,
|
|
"the URL is exactly <configured origin>/?dest=<plain id>",
|
|
);
|
|
assert.ok(
|
|
open.web_app.url.startsWith(`${ORIGIN}/`),
|
|
"the origin part equals the configured MINI_APP_URL — never a query-derived value",
|
|
);
|
|
const dest = new URL(open.web_app.url).searchParams.get("dest");
|
|
assert.match(dest, /^[A-Za-z0-9_-]{1,64}$/, "the dest value is a slug (start_param-safe charset)");
|
|
assert.ok(!open.web_app.url.includes("KLCC"), "the user's query text never reaches the URL");
|
|
});
|
|
|
|
/* ————— CR3 — NO CRYPTO IN THE DEEP-LINK PATH (D-11's structural gate) ————— */
|
|
|
|
test("CR3 NO CRYPTO IN THE DEEP-LINK PATH (D-11's structural gate)", () => {
|
|
const banned = [/createHmac/, /crypto\.subtle/, /sign\(/, /hmac/i, /signature/i, /sha256/i, /secret/i];
|
|
for (const rel of ["bot/commands/cari.ts", "bot/handlers/search-alternate.ts"]) {
|
|
const stripped = stripComments(readFileSync(path.join(BOT_SRC, ...rel.split("/")), "utf8"));
|
|
for (const pattern of banned) {
|
|
assert.doesNotMatch(
|
|
stripped,
|
|
pattern,
|
|
`${rel} — a crypto-shaped token appeared in code: ${pattern} (the deep-link payload is a PUBLIC place id — D-11)`,
|
|
);
|
|
}
|
|
}
|
|
});
|
|
|
|
/* ————— CR4 — the alternates ride on the SAME message ————— */
|
|
|
|
test("CR4 the alternates ride on the SAME message", async () => {
|
|
const { bot, calls } = await makeBot();
|
|
// "kuala" resolves 5 hits — 1 best + 4 alternates, exercising the cap.
|
|
await bot.handleUpdate(messageUpdate("/cari kuala"));
|
|
assert.equal(venueCalls(calls).length, 1, "exactly ONE venue message for the whole search (D-02)");
|
|
assert.equal(apiCalls(calls).length, 1, "exactly ONE outgoing Bot API message in total");
|
|
const keyboard = venueCalls(calls)[0].body.reply_markup.inline_keyboard;
|
|
const alternates = keyboard.flat().filter((btn) => btn.callback_data !== undefined);
|
|
assert.ok(alternates.length >= 2 && alternates.length <= 4, "2-4 alternates ride on the card");
|
|
for (const btn of alternates) {
|
|
assert.match(btn.callback_data, /^alt:[a-z0-9-]{1,64}$/, "every alternate is an alt:<slug> callback");
|
|
assert.ok(btn.text.length > 0, "each alternate's label is the entry's own name");
|
|
}
|
|
});
|
|
|
|
/* ————— CR5 — the callback_data carries no user data ————— */
|
|
|
|
test("CR5 the callback_data carries no user data", async () => {
|
|
const { bot, calls } = await makeBot();
|
|
await bot.handleUpdate(messageUpdate("/cari KLCC"));
|
|
const keyboard = venueCalls(calls)[0].body.reply_markup.inline_keyboard;
|
|
const allData = keyboard.flat().map((btn) => btn.callback_data).filter((d) => d !== undefined);
|
|
assert.ok(allData.length >= 1, "the keyboard carries callback buttons to inspect");
|
|
for (const data of allData) {
|
|
assert.match(data, /^alt:[a-z0-9-]+$/, `callback_data is exactly alt:<slug>: ${data}`);
|
|
assert.ok(!data.includes(" "), "no space in callback_data");
|
|
assert.ok(!/\d+\.\d+/.test(data.slice(4)), "no coordinate in callback_data");
|
|
assert.ok(Buffer.byteLength(data, "utf8") <= 64, `callback_data within Telegram's 64-byte limit: ${data}`);
|
|
}
|
|
});
|
|
|
|
/* ————— CR6 — a no-match query sends NO venue and NO keyboard ————— */
|
|
|
|
test("CR6 a no-match query sends NO venue and NO keyboard", async () => {
|
|
const { bot, calls } = await makeBot();
|
|
await bot.handleUpdate(messageUpdate("/cari Kuching"));
|
|
assert.equal(venueCalls(calls).length, 0, "no sendVenue for an out-of-area query (D-13)");
|
|
const messages = messageCalls(calls);
|
|
assert.equal(messages.length, 1, "the honest refusal is the only reply");
|
|
const body = messages[0].body;
|
|
assert.ok(body.reply_markup === undefined, "no reply_markup of any kind on the refusal");
|
|
assert.equal(body.text, strings.en.searchNoMatch, "the refusal names the v1 area, not the query");
|
|
assert.ok(!body.text.includes("Kuching"), "the refusal copy must not echo the query text");
|
|
});
|
|
|
|
/* ————— CR7 — an over-long query is rejected before any search ————— */
|
|
|
|
test("CR7 an over-long query is rejected before any search", async () => {
|
|
const { bot, calls } = await makeBot();
|
|
await bot.handleUpdate(messageUpdate(`/cari ${"x".repeat(200)}`));
|
|
assert.equal(venueCalls(calls).length, 0, "no venue card for an over-cap query (V5)");
|
|
const messages = messageCalls(calls);
|
|
assert.equal(messages.length, 1);
|
|
assert.equal(messages[0].body.text, strings.en.searchQueryTooLong, "the over-cap refusal copy");
|
|
assert.ok(messages[0].body.reply_markup === undefined, "no keyboard on the over-cap refusal");
|
|
});
|
|
|
|
/* ————— CR8 — an empty query produces no venue card ————— */
|
|
|
|
test("CR8 an empty query produces no venue card", async () => {
|
|
const { bot, calls } = await makeBot();
|
|
await bot.handleUpdate(messageUpdate("/cari"));
|
|
assert.equal(venueCalls(calls).length, 0, "no venue card without a query");
|
|
const messages = messageCalls(calls);
|
|
assert.equal(messages.length, 1);
|
|
assert.equal(messages[0].body.text, strings.en.searchUsage, "the usage copy");
|
|
assert.ok(messages[0].body.reply_markup === undefined, "no keyboard on the usage reply");
|
|
});
|
|
|
|
/* ————— CR9 — every callback path answers the callback query ————— */
|
|
|
|
test("CR9 every callback path answers the callback query", async () => {
|
|
const src = readFileSync(path.join(BOT_SRC, "bot", "handlers", "search-alternate.ts"), "utf8");
|
|
const answers = src.match(/answerCallbackQuery/g) ?? [];
|
|
assert.ok(answers.length >= 2, "the alt: matcher AND the catch-all both answer (30-second rule)");
|
|
assert.match(
|
|
src,
|
|
/bot\.on\("callback_query:data"/,
|
|
"the catch-all exists — Telegram never shows the 60-second spinner",
|
|
);
|
|
assert.match(src, /bot\.callbackQuery\(\s*\/\^alt:/, "the matcher is scoped to the alt: prefix");
|
|
// Behavioural half: an UNKNOWN callback data still gets answered.
|
|
const { bot, calls } = await makeBot();
|
|
await bot.handleUpdate(callbackUpdate("something-else-entirely"));
|
|
const answered = apiCalls(calls).some((c) => c.method === "answerCallbackQuery");
|
|
assert.ok(answered, "an unknown callback query is answered, not dropped on the floor");
|
|
assert.equal(venueCalls(calls).length, 0, "and it never fabricates a card");
|
|
});
|
|
|
|
/* ————— CR10 — the query text never reaches a log line (D-15) ————— */
|
|
|
|
test("CR10 the query text never reaches a log line (D-15)", () => {
|
|
const stripped = stripComments(readFileSync(path.join(BOT_SRC, "bot", "commands", "cari.ts"), "utf8"));
|
|
const logs = stripped.match(/console\.log\([^;]*\)/g) ?? [];
|
|
assert.ok(logs.length >= 1, "cari.ts carries its rejection categories");
|
|
for (const log of logs) {
|
|
assert.match(
|
|
log,
|
|
/^console\.log\("\[search\] rejected: [a-z-]+"\)$/,
|
|
`log must be a category-only string literal — no variable, no payload: ${log}`,
|
|
);
|
|
}
|
|
});
|
|
|
|
/* ————— CR11 — the copy exists in both locales ————— */
|
|
|
|
test("CR11 the copy exists in both locales", () => {
|
|
for (const field of ["searchNoMatch", "searchUsage", "searchQueryTooLong"]) {
|
|
assert.ok(strings.en[field]?.length > 0, `en ${field} non-empty`);
|
|
assert.ok(strings.ms[field]?.length > 0, `ms ${field} non-empty`);
|
|
assert.notEqual(strings.en[field], strings.ms[field], `${field} is not an untranslated copy`);
|
|
}
|
|
assert.equal(
|
|
strings.en.searchOpenButton,
|
|
strings.ms.searchOpenButton,
|
|
"the OPEN label is identical in both locales by design (a product affordance)",
|
|
);
|
|
assert.equal(strings.en.searchOpenButton, "OPEN IN ARAHARAH");
|
|
assert.equal(
|
|
strings.en.osmAttribution,
|
|
strings.ms.osmAttribution,
|
|
"the OSM attribution is identical in both locales (legal text)",
|
|
);
|
|
assert.equal(strings.en.osmAttribution, "© OpenStreetMap contributors");
|
|
});
|
|
|
|
/* ————— CR12 — the helpMenu carries the /cari line in both locales ————— */
|
|
|
|
function menuEntries(helpMenu) {
|
|
return helpMenu
|
|
.split("\n")
|
|
.filter((line) => line.startsWith("/"))
|
|
.map((line) => {
|
|
const em = line.indexOf(" — ");
|
|
assert.ok(em !== -1, `helpMenu line lacks its " — " description marker: ${line}`);
|
|
return { command: line.slice(1, em), description: line.slice(em + 3).trim() };
|
|
});
|
|
}
|
|
|
|
test("CR12 the helpMenu carries the /cari line in both locales", () => {
|
|
const en = menuEntries(strings.en.helpMenu).find((e) => e.command === "cari");
|
|
const ms = menuEntries(strings.ms.helpMenu).find((e) => e.command === "cari");
|
|
assert.ok(en, "en helpMenu has a /cari entry");
|
|
assert.ok(ms, "ms helpMenu has a /cari entry");
|
|
assert.ok(en.description.length > 0 && ms.description.length > 0, "both descriptions non-empty");
|
|
assert.notEqual(en.description, ms.description, "the ms description is in the ms locale's own language");
|
|
});
|
|
|
|
/* ————— CR13 — the registration script derives the /cari scope from helpMenu ————— */
|
|
|
|
test("CR13 the registration script derives the /cari scope from helpMenu", () => {
|
|
const src = readFileSync(
|
|
path.join(fileURLToPath(new URL(import.meta.url)), "..", "..", "scripts", "register-commands.mjs"),
|
|
"utf8",
|
|
);
|
|
assert.ok(src.includes('["help", "privacy", "cari"]'), "the hardcoded command list gained cari");
|
|
// Device-gate incident: all_private_chats SHADOWS default — /cari must be
|
|
// armed in the shadowing scope too, not only default.
|
|
const allPrivate = src.indexOf('"all_private_chats"');
|
|
assert.notEqual(allPrivate, -1, "all_private_chats scope must be armed explicitly (shadow law)");
|
|
assert.ok(src.includes("menuFor"), "every armed scope derives its set from helpMenu");
|
|
});
|
|
|
|
/* ————— CR14 — the alternates swap produces a new venue card ————— */
|
|
|
|
test("CR14 the alternates swap produces a new venue card for the tapped entry", async () => {
|
|
const { bot, calls } = await makeBot();
|
|
await bot.handleUpdate(callbackUpdate("alt:aquaria-klcc"));
|
|
const venues = venueCalls(calls);
|
|
assert.equal(venues.length, 1, "the tap produces exactly one new venue card");
|
|
const entry = source.byId("aquaria-klcc");
|
|
assert.ok(entry, "the tapped id resolves through the source");
|
|
assert.equal(venues[0].body.title, entry.name, "the swapped card is for the TAPPED entry");
|
|
assert.ok(
|
|
apiCalls(calls).some((c) => c.method === "answerCallbackQuery"),
|
|
"the swap path answers the callback first",
|
|
);
|
|
const handlerSrc = readFileSync(path.join(BOT_SRC, "bot", "handlers", "search-alternate.ts"), "utf8");
|
|
assert.ok(
|
|
!handlerSrc.includes("editMessageText"),
|
|
"the swap sends a NEW card — in-place edits never touch a venue message (T-04-28)",
|
|
);
|
|
});
|
|
|
|
/* ————— CR15 — a hostile callback id is dropped, not echoed ————— */
|
|
|
|
test("CR15 a hostile callback id is dropped, not echoed", async () => {
|
|
const { bot, calls } = await makeBot();
|
|
await bot.handleUpdate(callbackUpdate("alt:../../etc/passwd"));
|
|
assert.equal(venueCalls(calls).length, 0, "a traversal-shaped id produces NO venue card");
|
|
assert.equal(messageCalls(calls).length, 0, "nothing is echoed into the chat either");
|
|
const answered = apiCalls(calls).some((c) => c.method === "answerCallbackQuery");
|
|
assert.ok(answered, "even a hostile callback is answered (30-second rule) before being dropped");
|
|
});
|