Audit sécurité/qualité : corrections critiques, tests, CI et lint #4
@@ -39,3 +39,81 @@ describe('afterCreate — notification au soumetteur', () => {
|
||||
expect(emailSend).toHaveBeenCalled()
|
||||
})
|
||||
})
|
||||
|
||||
describe('beforeUpdate — notifications Telegram/Revolt', () => {
|
||||
const originalEnv = {...process.env}
|
||||
const axios = require('axios')
|
||||
const originalPost = axios.post
|
||||
|
||||
function buildStrapi(previous) {
|
||||
const dbQuery = {
|
||||
findOne: vi.fn(async () => previous),
|
||||
updateMany: vi.fn()
|
||||
}
|
||||
|
||||
return {
|
||||
db: {query: vi.fn(() => dbQuery)},
|
||||
plugins: {email: {services: {email: {send: vi.fn()}}}},
|
||||
log: {error: vi.fn()}
|
||||
}
|
||||
}
|
||||
|
||||
function buildEvent(overrides = {}) {
|
||||
return {
|
||||
state: {},
|
||||
params: {
|
||||
data: {documentId: 'doc-1', publishedAt: '2026-07-04T00:00:00.000Z', ...overrides}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
afterEach(() => {
|
||||
process.env = {...originalEnv}
|
||||
axios.post = originalPost
|
||||
delete global.strapi
|
||||
})
|
||||
|
||||
it("n'interrompt pas la publication quand Telegram échoue, et encode le message", async () => {
|
||||
process.env.TELEGRAM_API_TOKEN = 'fake-token'
|
||||
process.env.TELEGRAM_CHAN_ID = 'fake-chan'
|
||||
delete process.env.REVOLT_TOKEN
|
||||
|
||||
axios.post = vi.fn(async () => {
|
||||
throw new Error('boom')
|
||||
})
|
||||
|
||||
const previous = {publishedAt: null, slug: 'foo&bar', titre: 'Mon titre', user: null, userAdmin: null, artistes: []}
|
||||
const strapiMock = buildStrapi(previous)
|
||||
|
||||
const {beforeUpdate} = await loadLifecycles(strapiMock)
|
||||
|
||||
await beforeUpdate(buildEvent())
|
||||
|
||||
expect(axios.post).toHaveBeenCalledTimes(1)
|
||||
const [calledUrl] = axios.post.mock.calls[0]
|
||||
expect(calledUrl).toContain('text=')
|
||||
expect(calledUrl.split('text=')[1]).not.toContain('&bar')
|
||||
expect(strapiMock.log.error).toHaveBeenCalledWith(expect.stringContaining('Telegram'))
|
||||
})
|
||||
|
||||
it("n'interrompt pas la publication quand Revolt échoue", async () => {
|
||||
delete process.env.TELEGRAM_API_TOKEN
|
||||
process.env.REVOLT_TOKEN = 'fake-token'
|
||||
process.env.REVOLT_TARGET = 'fake-target'
|
||||
process.env.REVOLT_BOT_ID = 'fake-bot'
|
||||
|
||||
axios.post = vi.fn(async () => {
|
||||
throw new Error('boom')
|
||||
})
|
||||
|
||||
const previous = {publishedAt: null, slug: 'mon-titre', titre: 'Mon titre', user: null, userAdmin: null, artistes: []}
|
||||
const strapiMock = buildStrapi(previous)
|
||||
|
||||
const {beforeUpdate} = await loadLifecycles(strapiMock)
|
||||
|
||||
await beforeUpdate(buildEvent())
|
||||
|
||||
expect(axios.post).toHaveBeenCalledTimes(1)
|
||||
expect(strapiMock.log.error).toHaveBeenCalledWith(expect.stringContaining('Revolt'))
|
||||
})
|
||||
})
|
||||
|
||||
@@ -216,7 +216,11 @@ module.exports = {
|
||||
}
|
||||
|
||||
if (TELEGRAM_API_TOKEN) {
|
||||
await axios.post(`${MESSAGE_URL}&text=${message}`)
|
||||
try {
|
||||
await axios.post(`${MESSAGE_URL}&text=${encodeURIComponent(message)}`)
|
||||
} catch (err) {
|
||||
strapi.log.error(`Notification Telegram : ${err.message}`)
|
||||
}
|
||||
}
|
||||
|
||||
if (REVOLT_TOKEN && REVOLT_TARGET && REVOLT_BOT_ID) {
|
||||
@@ -234,7 +238,11 @@ module.exports = {
|
||||
}
|
||||
}
|
||||
|
||||
try {
|
||||
await axios.post(url, {content: revoltMessage}, config)
|
||||
} catch (err) {
|
||||
strapi.log.error(`Notification Revolt : ${err.message}`)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user