community-rule/tests/unit/uploadsPostRoute.test.ts

import { NextRequest } from "next/server";
import { beforeEach, describe, expect, it, vi } from "vitest";

const isDatabaseConfiguredMock = vi.fn();
const getSessionUserMock = vi.fn();
const getUploadRootFromEnvMock = vi.fn();

vi.mock("../../lib/server/env", () => ({
  isDatabaseConfigured: () => isDatabaseConfiguredMock(),
}));

vi.mock("../../lib/server/session", () => ({
  getSessionUser: () => getSessionUserMock(),
}));

vi.mock("../../lib/server/uploads/uploadRoot", () => ({
  getUploadRootFromEnv: () => getUploadRootFromEnvMock(),
}));

vi.mock("../../lib/server/rateLimit", () => ({
  rateLimitKey: () => ({ ok: true }),
}));

import { POST } from "../../app/api/uploads/route";

function multipartRequest(opts: {
  purpose?: string;
  fileName?: string;
  fileContent?: string;
  contentType?: string;
}): NextRequest {
  const boundary = "----VitestBoundary";
  const parts: string[] = [];
  if (opts.purpose) {
    parts.push(
      `--${boundary}\r\nContent-Disposition: form-data; name="purpose"\r\n\r\n${opts.purpose}\r\n`,
    );
  }
  if (opts.fileName && opts.fileContent !== undefined) {
    const contentType = opts.contentType ?? "image/png";
    parts.push(
      `--${boundary}\r\nContent-Disposition: form-data; name="file"; filename="${opts.fileName}"\r\nContent-Type: ${contentType}\r\n\r\n${opts.fileContent}\r\n`,
    );
  }
  parts.push(`--${boundary}--\r\n`);
  return new NextRequest("https://x.test/api/uploads", {
    method: "POST",
    body: parts.join(""),
    headers: {
      "content-type": `multipart/form-data; boundary=${boundary}`,
    },
  });
}

beforeEach(() => {
  isDatabaseConfiguredMock.mockReset();
  getSessionUserMock.mockReset();
  getUploadRootFromEnvMock.mockReset();
  isDatabaseConfiguredMock.mockReturnValue(true);
  getUploadRootFromEnvMock.mockReturnValue("/tmp/uploads");
  getSessionUserMock.mockResolvedValue({ id: "u1", email: "a@b.c" });
});

describe("POST /api/uploads", () => {
  it("returns 503 when the database is not configured", async () => {
    isDatabaseConfiguredMock.mockReturnValue(false);
    const res = await POST(
      new NextRequest("https://x.test/api/uploads", { method: "POST" }),
      undefined,
    );
    expect(res.status).toBe(503);
  });

  it("returns 401 when unauthenticated", async () => {
    getSessionUserMock.mockResolvedValueOnce(null);
    const res = await POST(
      new NextRequest("https://x.test/api/uploads", { method: "POST" }),
      undefined,
    );
    expect(res.status).toBe(401);
  });

  it("returns 500 when UPLOAD_ROOT is unset", async () => {
    getUploadRootFromEnvMock.mockReturnValueOnce(null);
    const res = await POST(
      new NextRequest("https://x.test/api/uploads", { method: "POST" }),
      undefined,
    );
    expect(res.status).toBe(500);
    const body = (await res.json()) as { error: { code: string } };
    expect(body.error.code).toBe("server_misconfigured");
  });

  it("returns 400 when purpose is missing", async () => {
    const res = await POST(
      multipartRequest({ fileName: "avatar.png", fileContent: "x" }),
      undefined,
    );
    expect(res.status).toBe(400);
    const body = (await res.json()) as { error: { code: string } };
    expect(body.error.code).toBe("validation_error");
  });

  it("returns 400 for an empty file", async () => {
    const res = await POST(
      multipartRequest({
        purpose: "communityAvatar",
        fileName: "empty.png",
        fileContent: "",
      }),
      undefined,
    );
    expect(res.status).toBe(400);
    const body = (await res.json()) as {
      error: { code: string };
      details?: { reason?: string };
    };
    expect(body.error.code).toBe("validation_error");
    expect(body.details?.reason).toBe("empty");
  });

  it("returns 400 for SVG even when named .png", async () => {
    const res = await POST(
      multipartRequest({
        purpose: "communityAvatar",
        fileName: "photo.png",
        fileContent: '<svg xmlns="http://www.w3.org/2000/svg"></svg>',
        contentType: "image/png",
      }),
      undefined,
    );
    expect(res.status).toBe(400);
    const body = (await res.json()) as {
      details?: { reason?: string };
    };
    expect(body.details?.reason).toBe("svg");
  });

  it("returns 400 for a text file spoofed as PNG", async () => {
    const res = await POST(
      multipartRequest({
        purpose: "communityAvatar",
        fileName: "photo.png",
        fileContent: "not an image",
        contentType: "image/png",
      }),
      undefined,
    );
    expect(res.status).toBe(400);
    const body = (await res.json()) as {
      details?: { reason?: string };
    };
    expect(body.details?.reason).toBe("invalidType");
  });
});