source: Klonkt/test/c2s-direct.test.js@ 407353e

// Direct notes (private mentions, shaer-tqc): never Public, never boostable.
import { test } from 'node:test';
import assert from 'node:assert/strict';

process.env.DATABASE_PATH = ':memory:';
process.env.PUBLIC_BASE_URL = 'https://test.example';

const dbMod = await import('../src/config/database.js');
const db = dbMod.default;
dbMod.initializeDatabase();
const AP = (await import('../src/services/ActivityPubService.js')).default;

const PUB = 'https://www.w3.org/ns/activitystreams#Public';
db.prepare('INSERT INTO users (id, username, email, password_hash, role) VALUES (?,?,?,?,?)').run('u1', 'u1', 'u1@test', 'x', 'god');
db.prepare('INSERT INTO sites (id, slug, title, owner_id, is_primary) VALUES (?,?,?,?,?)').run('s1', 'me', 'Me', 'u1', 1);
const site = db.prepare('SELECT * FROM sites WHERE id = ?').get('s1');
const user = { id: 'u1', username: 'u1' };

test('a direct outbox row addresses only its recipients, no Public, no cc', () => {
  db.prepare(`INSERT INTO ap_outbox (id, site_slug, post_id, post_slug, in_reply_to, to_actor, to_handle, content, visibility, to_actors, created_at)
    VALUES ('d1','me','',NULL,NULL,'https://r.test/u/g','@g@r.test','<p>help</p>','direct','["https://r.test/u/g","https://q.test/u/h"]',CURRENT_TIMESTAMP)`).run();
  const row = db.prepare('SELECT * FROM ap_outbox WHERE id = ?').get('d1');
  const note = AP.buildReplyNote('https://test.example', site, row);
  assert.deepEqual(note.to, ['https://r.test/u/g', 'https://q.test/u/h']);
  assert.deepEqual(note.cc, []);
  assert.ok(!JSON.stringify(note.to).includes(PUB) && !JSON.stringify(note.cc).includes(PUB));
});

test('a direct note carries its attachments (help-buoy capture)', () => {
  db.prepare(`INSERT INTO ap_outbox (id, site_slug, post_id, post_slug, in_reply_to, to_actor, to_handle, content, visibility, to_actors, attachments, created_at)
    VALUES ('d2','me','',NULL,NULL,'https://r.test/u/g','@g@r.test','<p>kijk</p>','direct','["https://r.test/u/g"]','[{"url":"/media/reply-media/x.png","mediaType":"image/png","name":"capture"}]',CURRENT_TIMESTAMP)`).run();
  const row = db.prepare('SELECT * FROM ap_outbox WHERE id = ?').get('d2');
  const note = AP.buildReplyNote('https://test.example', site, row);
  assert.equal(note.attachment.length, 1);
  assert.equal(note.attachment[0].type, 'Image');
  assert.ok(note.attachment[0].url.endsWith('/media/reply-media/x.png'));
  assert.deepEqual(note.cc, []);   // still direct
});

test('a help request emits shaer:helpRequest (FEP-633c 5.2.1)', () => {
  db.prepare(`INSERT INTO ap_outbox (id, site_slug, post_id, post_slug, in_reply_to, to_actor, to_handle, content, visibility, to_actors, help_request, created_at)
    VALUES ('d3','me','',NULL,NULL,'https://r.test/u/g','@g@r.test','<p>help</p>','direct','["https://r.test/u/g"]',1,CURRENT_TIMESTAMP)`).run();
  const row = db.prepare('SELECT * FROM ap_outbox WHERE id = ?').get('d3');
  const note = AP.buildReplyNote('https://test.example', site, row);
  assert.equal(note['shaer:helpRequest'], true);
  assert.deepEqual(note.cc, []);   // still strictly direct
  // and the namespace is declared, so the term is valid JSON-LD
  const ctx = AP.AP_CONTEXT.find((p) => p && typeof p === 'object');
  assert.equal(ctx.shaer, 'https://ns.klonkt.com/shaer#');
  // a plain direct note (no flag) does NOT carry the term
  const plainRow = db.prepare('SELECT * FROM ap_outbox WHERE id = ?').get('d1');
  assert.equal(AP.buildReplyNote('https://test.example', site, plainRow)['shaer:helpRequest'], undefined);
});

test('direct without any real recipient is refused (400 no_recipients)', async () => {
  const r = await AP.ingestOutboxActivity(site, user, {
    type: 'Note', content: '<p>x</p>',
    to: ['https://test.example/ap/users/me/followers'], cc: [],   // friends-shaped? no: followers in to = friends
  });
  // followers-only reads as friends, so force the direct shape: bare unknown string
  const r2 = await AP.ingestOutboxActivity(site, user, { type: 'Note', content: '<p>x</p>', to: [], cc: [] });
  // empty addressing = legacy public; the real no-recipient direct case:
  const r3 = await AP.ingestOutboxActivity(site, user, { type: 'Note', content: '<p>x</p>', to: ['not-a-uri'], cc: [] });
  assert.equal(r3.status, 400);
  assert.equal(r3.error, 'no_recipients');
  assert.ok(r && r2); // shapes above answered too (not the point of this test)
});

test('C2S Announce/Like of a non-public local post is refused (403)', async () => {
  db.prepare(`INSERT INTO posts (id, site_id, slug, author_id, title, content, status, type, fan_only, ap_visibility, created_at, updated_at, published_at)
    VALUES ('pf','s1','geheim','u1','','<p>prive</p>','published','post',1,'friends',datetime('now'),datetime('now'),datetime('now'))`).run();
  const noteUrl = 'https://test.example/ap/notes/pf';
  const boost = await AP.ingestOutboxActivity(site, user, { type: 'Announce', object: noteUrl });
  assert.equal(boost.status, 403);
  assert.equal(boost.error, 'not_public');
  const like = await AP.ingestOutboxActivity(site, user, { type: 'Like', object: noteUrl });
  assert.equal(like.status, 403);
});

// Een bijlage KAN het hele bericht zijn (shaer-6lcc).
//
// Twee lagen waren het oneens over wat een bericht is: de inname liet een
// note met alleen een bijlage door, en deliverDirectNote weigerde hem een
// laag lager op `!text.trim()`. Wie een foto op een gesprek liet vallen en
// niets typte kreeg daardoor "502 direct_failed".
test('een direct bericht met alleen een bijlage telt als inhoud', async () => {
  const { directNoteHasContent } = await import('../src/services/guardianship/delivery.js');

  assert.equal(directNoteHasContent({ text: 'hallo' }), true);
  assert.equal(directNoteHasContent({ html: '<p>hallo</p>' }), true);
  assert.equal(directNoteHasContent({
    text: '',
    attachments: [{ url: '/media/reply-media/x.png', mediaType: 'image/png' }],
  }), true, 'een foto zonder woorden is een bericht');
  assert.equal(directNoteHasContent({
    text: '   \n  ',
    attachments: [{ url: '/media/reply-media/x.png', mediaType: 'image/png' }],
  }), true, 'witruimte is geen tekst, maar de bijlage draagt hem');

  // En leeg blijft leeg: dit mag de deur niet uit.
  assert.equal(directNoteHasContent({}), false);
  assert.equal(directNoteHasContent({ text: '   ', html: '', attachments: [] }), false);
  assert.equal(directNoteHasContent(), false);
});

// De inname en de bezorging horen dezelfde grens te trekken. Loopt er eentje
// weg, dan is dat precies de 502 hierboven, en die valt buiten de tests om.
test('inname en bezorging zijn het eens over een leeg bericht', async () => {
  const { directNoteHasContent } = await import('../src/services/guardianship/delivery.js');
  const src = (await import('fs')).readFileSync('src/services/ap-c2s.js', 'utf8');
  assert.ok(src.includes("error: 'empty_note'"), 'de inname heeft nog een lege-bericht-controle');
  // De inname laat een bijlage-only note door; de bezorging hoort dat ook te doen.
  assert.equal(directNoteHasContent({ text: '', attachments: [{ url: '/media/x.png' }] }), true);
});