Paddy
17ca6399e0
New /feedback API domain backed by its own FEEDBACK_DB, mirroring the Calendar domain's router -> service -> DB pool layering: - Public endpoints (no auth): eligible-events listing, event config, submission with honeypot + rate limiting (in-memory + DB backstop). - Admin endpoints (session-header auth, reusing Calendar's users/sessions via a swappable feedback.auth.ts boundary): events/songs/questions CRUD, bulk reorder/assignment, aggregated reporting, CSV export. - Schema in sql/feedback/001_init.sql (8 tables), applied and verified against the real FEEDBACK_DB. - 64 Jest tests covering validation, auth, rate limiting, CSV escaping, and report aggregation (pure functions, no DB needed). Includes fixes from a security review: path traversal defense doesn't apply here (that's the frontend proxy, separate repo), but the rate-limiter cluster does - recordSubmission now counts every processed request (not just successful ones), the in-memory Map evicts empty entries instead of growing unbounded, FEEDBACK_IP_SALT is required at boot instead of silently degrading to unsalted hashing, and submission answer/rating arrays are capped and de-duplicated to bound insert amplification. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
58 lines
1.9 KiB
TypeScript
58 lines
1.9 KiB
TypeScript
import {escapeCsvField, formatDatetime} from '../../src/models/feedback/admin/csv.service';
|
|
|
|
describe('escapeCsvField', () => {
|
|
it('passes plain text through unchanged', () => {
|
|
expect(escapeCsvField('Abendlied')).toBe('Abendlied');
|
|
});
|
|
|
|
it('converts null/undefined to an empty string', () => {
|
|
expect(escapeCsvField(null)).toBe('');
|
|
expect(escapeCsvField(undefined)).toBe('');
|
|
});
|
|
|
|
it('converts numbers to strings', () => {
|
|
expect(escapeCsvField(5)).toBe('5');
|
|
});
|
|
|
|
it('quotes and doubles internal quotes (RFC 4180)', () => {
|
|
expect(escapeCsvField('Sie sagte "Danke"')).toBe('"Sie sagte ""Danke"""');
|
|
});
|
|
|
|
it('quotes a field containing the ; separator', () => {
|
|
expect(escapeCsvField('Rheinberger; Bach')).toBe('"Rheinberger; Bach"');
|
|
});
|
|
|
|
it('strips embedded newlines instead of breaking the row', () => {
|
|
expect(escapeCsvField('Zeile 1\r\nZeile 2')).toBe('Zeile 1 Zeile 2');
|
|
expect(escapeCsvField('Zeile 1\nZeile 2')).toBe('Zeile 1 Zeile 2');
|
|
});
|
|
|
|
it('prefixes formula-injection characters with an apostrophe', () => {
|
|
expect(escapeCsvField('=1+1')).toBe("'=1+1");
|
|
expect(escapeCsvField('+SUM(A1)')).toBe("'+SUM(A1)");
|
|
expect(escapeCsvField('-2')).toBe("'-2");
|
|
expect(escapeCsvField('@example')).toBe("'@example");
|
|
});
|
|
|
|
it('does not treat a mid-string = as formula injection', () => {
|
|
expect(escapeCsvField('x = y')).toBe('x = y');
|
|
});
|
|
});
|
|
|
|
describe('formatDatetime', () => {
|
|
it('formats a Date as YYYY-MM-DD HH:mm:ss, not the verbose Date.toString()', () => {
|
|
const d = new Date(2026, 7, 2, 21, 59, 21); // month is 0-indexed: August
|
|
expect(formatDatetime(d)).toBe('2026-08-02 21:59:21');
|
|
expect(formatDatetime(d)).not.toContain('GMT');
|
|
});
|
|
|
|
it('pads single-digit components', () => {
|
|
const d = new Date(2026, 0, 5, 3, 4, 5);
|
|
expect(formatDatetime(d)).toBe('2026-01-05 03:04:05');
|
|
});
|
|
|
|
it('returns an empty string for null', () => {
|
|
expect(formatDatetime(null)).toBe('');
|
|
});
|
|
});
|