hyb-oa/server/tests/unit/scripts/payment-postgres-concurrency.test.js

const fs = require("node:fs");
const path = require("node:path");

const {
  PaymentConcurrencyCheckError,
  validatePaymentConcurrencyEnvironment,
} = require("../../../src/scripts/check-payment-postgres-concurrency");

const REPO_ROOT = path.resolve(__dirname, "../../../..");

function validEnv() {
  return {
    RUN_PAYMENT_POSTGRES_CONCURRENCY: "1",
    NODE_ENV: "test",
    JOBS_ENABLED: "false",
    RATE_LIMIT_ENABLED: "false",
    TRUST_PROXY_HOPS: "0",
    PAYMENT_BATCH_ENABLED: "true",
    ERP_SYNC_ENABLED: "false",
    EMAIL_ENABLED: "false",
    SMTP_HOST: "",
    SMTP_USER: "",
    SMTP_PASS: "",
    IM_NOTIFIER_ENABLED: "false",
    WECOM_ENABLED: "false",
    WECOM_AGENT_SECRET: "",
    WECOM_CONTACT_SECRET: "",
    WECOM_HR_ASSISTANT_SECRET: "",
    OIDC_ENABLED: "false",
    OIDC_CLIENT_SECRET: "",
    SERVE_CLIENT_DIST: "false",
    DATABASE_URL:
      "postgresql://synthetic:[email protected]:5432/hyb_oa_payment_test?schema=public",
    PAYMENT_CONCURRENCY_DATABASE_CONFIRM: "hyb_oa_payment_test",
    JWT_SECRET: "synthetic-jwt-secret",
    FIELD_ENCRYPTION_KEY: "synthetic-field-key",
  };
}

function expectSafeFailure(env, expectedCode) {
  try {
    validatePaymentConcurrencyEnvironment(env);
    throw new Error("expected validation to fail");
  } catch (error) {
    expect(error).toBeInstanceOf(PaymentConcurrencyCheckError);
    expect(error.safeCode).toBe(expectedCode);
    expect(error.message).toBe(expectedCode);
  }
}

describe("payment PostgreSQL concurrency guard", () => {
  it("accepts only an explicitly confirmed isolated loopback target", () => {
    expect(validatePaymentConcurrencyEnvironment(validEnv())).toEqual(
      expect.objectContaining({
        databaseName: "hyb_oa_payment_test",
      }),
    );
  });

  it("requires explicit opt-in and test-only execution", () => {
    expectSafeFailure(
      { ...validEnv(), RUN_PAYMENT_POSTGRES_CONCURRENCY: "0" },
      "explicit_opt_in_required",
    );
    expectSafeFailure(
      { ...validEnv(), NODE_ENV: "production" },
      "test_environment_required",
    );
  });

  it("requires jobs, rate limiting and proxy trust to be disabled", () => {
    expectSafeFailure({ ...validEnv(), JOBS_ENABLED: "true" }, "jobs_must_be_disabled");
    expectSafeFailure(
      { ...validEnv(), RATE_LIMIT_ENABLED: "true" },
      "rate_limit_must_be_disabled",
    );
    expectSafeFailure(
      { ...validEnv(), TRUST_PROXY_HOPS: "1" },
      "trust_proxy_must_be_disabled",
    );
  });

  it("requires the payment path on and external financial sync off", () => {
    expectSafeFailure(
      { ...validEnv(), PAYMENT_BATCH_ENABLED: "false" },
      "payment_batch_must_be_enabled",
    );
    expectSafeFailure(
      { ...validEnv(), ERP_SYNC_ENABLED: "true" },
      "erp_sync_must_be_disabled",
    );
  });

  it("refuses external notification and identity providers", () => {
    expectSafeFailure(
      { ...validEnv(), EMAIL_ENABLED: "true" },
      "email_provider_must_be_disabled",
    );
    expectSafeFailure(
      { ...validEnv(), SMTP_HOST: "smtp.example.test" },
      "smtp_host_forbidden",
    );
    expectSafeFailure(
      { ...validEnv(), IM_NOTIFIER_ENABLED: "true" },
      "im_notifier_must_be_disabled",
    );
    expectSafeFailure(
      { ...validEnv(), WECOM_ENABLED: "true" },
      "wecom_must_be_disabled",
    );
    expectSafeFailure(
      { ...validEnv(), OIDC_ENABLED: "true" },
      "oidc_must_be_disabled",
    );
  });

  it("refuses remote, shared-looking and unconfirmed databases", () => {
    expectSafeFailure(
      {
        ...validEnv(),
        DATABASE_URL:
          "postgresql://synthetic:[email protected]:5432/hyb_oa_payment_test",
      },
      "database_host_not_loopback",
    );
    expectSafeFailure(
      {
        ...validEnv(),
        DATABASE_URL:
          "postgresql://synthetic:[email protected]:5432/hyb_oa_payment_test?host=db.example.test",
      },
      "database_host_not_loopback",
    );
    expectSafeFailure(
      {
        ...validEnv(),
        DATABASE_URL: "postgresql://synthetic:[email protected]:5432/hyb_oa",
        PAYMENT_CONCURRENCY_DATABASE_CONFIRM: "hyb_oa",
      },
      "database_name_not_isolated",
    );
    expectSafeFailure(
      { ...validEnv(), PAYMENT_CONCURRENCY_DATABASE_CONFIRM: "hyb_oa_payment_other" },
      "database_confirmation_mismatch",
    );
  });

  it("keeps the repository runner isolated and cleanup authoritative", () => {
    const source = fs.readFileSync(
      path.join(REPO_ROOT, "scripts/qa/run-web-gates.sh"),
      "utf8",
    );
    const dropFunction = source.slice(
      source.indexOf("qa_dropdb()"),
      source.indexOf("qa_cleanup_server()"),
    );

    expect(source).toContain('DEFAULT_QA_DB_PREFIX="hyb_oa_payment"');
    expect(source).toContain('RUN_PAYMENT_POSTGRES_CONCURRENCY=1');
    expect(source).toContain('export PAYMENT_CONCURRENCY_DATABASE_CONFIRM="$QA_DB_NAME"');
    expect(source).toContain('export ERP_SYNC_ENABLED=false');
    expect(source).toContain('export IM_NOTIFIER_ENABLED=false');
    expect(dropFunction).toContain("dropdb --force --if-exists");
    expect(dropFunction).toContain("return 1");
    expect(dropFunction).not.toContain("|| true");
  });
});