Audit sécurité/qualité : corrections critiques, tests, CI et lint #4

Merged
cedric merged 28 commits from fix/audit-2026-07-04 into master 2026-07-04 17:01:30 +00:00
2 changed files with 88 additions and 2 deletions
Showing only changes of commit 4c13f47156 - Show all commits
@@ -39,3 +39,81 @@ describe('afterCreate — notification au soumetteur', () => {
expect(emailSend).toHaveBeenCalled() expect(emailSend).toHaveBeenCalled()
}) })
}) })
describe('beforeUpdate — notifications Telegram/Revolt', () => {
const originalEnv = {...process.env}
const axios = require('axios')
const originalPost = axios.post
function buildStrapi(previous) {
const dbQuery = {
findOne: vi.fn(async () => previous),
updateMany: vi.fn()
}
return {
db: {query: vi.fn(() => dbQuery)},
plugins: {email: {services: {email: {send: vi.fn()}}}},
log: {error: vi.fn()}
}
}
function buildEvent(overrides = {}) {
return {
state: {},
params: {
data: {documentId: 'doc-1', publishedAt: '2026-07-04T00:00:00.000Z', ...overrides}
}
}
}
afterEach(() => {
process.env = {...originalEnv}
axios.post = originalPost
delete global.strapi
})
it("n'interrompt pas la publication quand Telegram échoue, et encode le message", async () => {
process.env.TELEGRAM_API_TOKEN = 'fake-token'
process.env.TELEGRAM_CHAN_ID = 'fake-chan'
delete process.env.REVOLT_TOKEN
axios.post = vi.fn(async () => {
throw new Error('boom')
})
const previous = {publishedAt: null, slug: 'foo&bar', titre: 'Mon titre', user: null, userAdmin: null, artistes: []}
const strapiMock = buildStrapi(previous)
const {beforeUpdate} = await loadLifecycles(strapiMock)
await beforeUpdate(buildEvent())
expect(axios.post).toHaveBeenCalledTimes(1)
const [calledUrl] = axios.post.mock.calls[0]
expect(calledUrl).toContain('text=')
expect(calledUrl.split('text=')[1]).not.toContain('&bar')
expect(strapiMock.log.error).toHaveBeenCalledWith(expect.stringContaining('Telegram'))
})
it("n'interrompt pas la publication quand Revolt échoue", async () => {
delete process.env.TELEGRAM_API_TOKEN
process.env.REVOLT_TOKEN = 'fake-token'
process.env.REVOLT_TARGET = 'fake-target'
process.env.REVOLT_BOT_ID = 'fake-bot'
axios.post = vi.fn(async () => {
throw new Error('boom')
})
const previous = {publishedAt: null, slug: 'mon-titre', titre: 'Mon titre', user: null, userAdmin: null, artistes: []}
const strapiMock = buildStrapi(previous)
const {beforeUpdate} = await loadLifecycles(strapiMock)
await beforeUpdate(buildEvent())
expect(axios.post).toHaveBeenCalledTimes(1)
expect(strapiMock.log.error).toHaveBeenCalledWith(expect.stringContaining('Revolt'))
})
})
@@ -216,7 +216,11 @@ module.exports = {
} }
if (TELEGRAM_API_TOKEN) { if (TELEGRAM_API_TOKEN) {
await axios.post(`${MESSAGE_URL}&text=${message}`) try {
await axios.post(`${MESSAGE_URL}&text=${encodeURIComponent(message)}`)
} catch (err) {
strapi.log.error(`Notification Telegram : ${err.message}`)
}
} }
if (REVOLT_TOKEN && REVOLT_TARGET && REVOLT_BOT_ID) { if (REVOLT_TOKEN && REVOLT_TARGET && REVOLT_BOT_ID) {
@@ -234,7 +238,11 @@ module.exports = {
} }
} }
await axios.post(url, {content: revoltMessage}, config) try {
await axios.post(url, {content: revoltMessage}, config)
} catch (err) {
strapi.log.error(`Notification Revolt : ${err.message}`)
}
} }
} }
} }