396 lines
22 KiB
PHP
396 lines
22 KiB
PHP
<?php
|
|||
|
|
/**
|
||
|
|
* PHP API test-suite (no PHPUnit dependency).
|
||
|
|
*
|
||
|
|
* npm run test:php (or: php tests/php/run.php)
|
||
|
|
*
|
||
|
|
* Boots two local servers:
|
||
|
|
* 127.0.0.1:8099 fake Mailchimp / Sinch / geocode providers (tests/php/mock-providers.php)
|
||
|
|
* 127.0.0.1:8098 the real API from ./public (php -S -t public)
|
||
|
|
* with VISIT_PRIVATE_DIR pointing at a throwaway directory, then exercises
|
||
|
|
* unit-level classes AND the HTTP endpoints end to end.
|
||
|
|
*/
|
||
|
|
declare(strict_types=1);
|
||
|
|
|
||
|
|
$ROOT = dirname(__DIR__, 2);
|
||
|
|
$TMP = __DIR__ . '/.tmp';
|
||
|
|
$PRIV = "$TMP/private";
|
||
|
|
$MOCK = 'http://127.0.0.1:8099';
|
||
|
|
$API = 'http://127.0.0.1:8098/api';
|
||
|
|
|
||
|
|
// ---------------------------------------------------------------- harness
|
||
|
|
$passed = 0;
|
||
|
|
$failed = 0;
|
||
|
|
$current = '';
|
||
|
|
function test(string $name, callable $fn): void
|
||
|
|
{
|
||
|
|
global $passed, $failed, $current;
|
||
|
|
$current = $name;
|
||
|
|
try {
|
||
|
|
$fn();
|
||
|
|
$passed++;
|
||
|
|
fwrite(STDOUT, " ✓ $name\n");
|
||
|
|
} catch (Throwable $e) {
|
||
|
|
$failed++;
|
||
|
|
fwrite(STDOUT, " ✗ $name\n " . $e->getMessage() . "\n");
|
||
|
|
}
|
||
|
|
}
|
||
|
|
function assertTrue($v, string $msg = 'expected true'): void { if (!$v) throw new RuntimeException($msg); }
|
||
|
|
function assertSame($exp, $act, string $msg = ''): void { if ($exp !== $act) throw new RuntimeException(($msg ? "$msg: " : '') . 'expected ' . var_export($exp, true) . ' got ' . var_export($act, true)); }
|
||
|
|
function assertContains(string $needle, string $hay, string $msg = ''): void { if (!str_contains($hay, $needle)) throw new RuntimeException(($msg ? "$msg: " : '') . "'$needle' not found in '$hay'"); }
|
||
|
|
|
||
|
|
function http(string $method, string $url, ?array $json = null, array $headers = []): array
|
||
|
|
{
|
||
|
|
$ch = curl_init($url);
|
||
|
|
$h = ['Accept: application/json'];
|
||
|
|
foreach ($headers as $k => $v) $h[] = "$k: $v";
|
||
|
|
if ($json !== null) { $h[] = 'Content-Type: application/json'; curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($json)); }
|
||
|
|
curl_setopt_array($ch, [CURLOPT_CUSTOMREQUEST => $method, CURLOPT_RETURNTRANSFER => true, CURLOPT_HTTPHEADER => $h, CURLOPT_TIMEOUT => 20]);
|
||
|
|
$body = curl_exec($ch);
|
||
|
|
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
|
||
|
|
return ['status' => $status, 'json' => json_decode((string)$body, true), 'body' => (string)$body];
|
||
|
|
}
|
||
|
|
function uuid(): string { $d = random_bytes(16); $d[6] = chr(ord($d[6]) & 0x0f | 0x40); $d[8] = chr(ord($d[8]) & 0x3f | 0x80); return vsprintf('%s%s-%s-%s-%s-%s%s%s', str_split(bin2hex($d), 4)); }
|
||
|
|
function validPayload(array $over = []): array
|
||
|
|
{
|
||
|
|
return array_merge([
|
||
|
|
'submissionId' => uuid(), 'firstName' => 'Jordan', 'lastName' => 'Lee', 'email' => 'jordan+' . bin2hex(random_bytes(3)) . '@example.com',
|
||
|
|
'phone' => '(508) 555-0142', 'campusId' => 'norwood', 'visitDate' => date('Y-m-d', time() + 7 * 86400), 'serviceTime' => 'Sunday 9:30 AM',
|
||
|
|
'adults' => 2, 'children' => 1, 'childAgeRanges' => ['3-5'], 'questions' => 'Is there parking?',
|
||
|
|
'emailConsent' => true, 'smsConsent' => true, 'consentVersion' => '2026-09-22.v1', 'website' => '',
|
||
|
|
'startedAt' => (int)(microtime(true) * 1000) - 15000,
|
||
|
|
'attribution' => ['utm_source' => 'facebook', 'utm_campaign' => 'fall-visit', 'fbclid' => 'FB123', 'variant' => 'b', 'landing_url' => 'https://visit.waterschurch.org/?utm_source=facebook', 'referrer' => 'https://l.facebook.com/', 'evil_key' => 'x'],
|
||
|
|
], $over);
|
||
|
|
}
|
||
|
|
|
||
|
|
// ---------------------------------------------------------------- setup
|
||
|
|
exec("rm -rf " . escapeshellarg($TMP));
|
||
|
|
mkdir($PRIV, 0777, true);
|
||
|
|
$env = <<<ENV
|
||
|
|
PUBLIC_SITE_URL=https://visit.waterschurch.org
|
||
|
|
ALLOWED_ORIGINS=http://127.0.0.1:8098,http://localhost:3000
|
||
|
|
INTEGRATION_MODE=live
|
||
|
|
LOG_LEVEL=debug
|
||
|
|
HASH_SALT=test-salt
|
||
|
|
MAILCHIMP_API_KEY=test-key-us1
|
||
|
|
MAILCHIMP_SERVER_PREFIX=us1
|
||
|
|
MAILCHIMP_AUDIENCE_ID=abc123
|
||
|
|
MAILCHIMP_JOURNEY_ID=42
|
||
|
|
MAILCHIMP_JOURNEY_STEP_ID=7
|
||
|
|
SINCH_API_BASE=$MOCK
|
||
|
|
SINCH_API_KEY=k
|
||
|
|
SINCH_API_SECRET=s
|
||
|
|
SINCH_DEFAULT_SOURCE_NUMBER=+17746436322
|
||
|
|
GEOIP_PROVIDER=ipapi_co
|
||
|
|
GEOCODE_PROVIDER=zippopotam
|
||
|
|
MIN_FORM_SECONDS=3
|
||
|
|
RATE_LIMIT_SUBMIT_PER_10MIN=100
|
||
|
|
RATE_LIMIT_SUBMIT_PER_DAY=100
|
||
|
|
ENV;
|
||
|
|
file_put_contents("$PRIV/.env", $env);
|
||
|
|
|
||
|
|
// Point Mailchimp at the mock: the adapter builds https://{dc}.api.mailchimp.com — we override via a test hook (see Mailchimp::baseUrl override below)
|
||
|
|
putenv("VISIT_PRIVATE_DIR=$PRIV");
|
||
|
|
putenv("MAILCHIMP_BASE_URL_OVERRIDE=$MOCK/3.0");
|
||
|
|
putenv("GEOIP_BASE_URL_OVERRIDE=$MOCK");
|
||
|
|
putenv("GEOCODE_BASE_URL_OVERRIDE=$MOCK");
|
||
|
|
|
||
|
|
$php = PHP_BINARY;
|
||
|
|
$servers = [];
|
||
|
|
$servers[] = proc_open([$php, '-S', '127.0.0.1:8099', __DIR__ . '/mock-providers.php'], [1 => ['file', "$TMP/mock.log", 'a'], 2 => ['file', "$TMP/mock.log", 'a']], $p1);
|
||
|
|
$servers[] = proc_open([$php, '-S', '127.0.0.1:8098', '-t', "$ROOT/public"], [1 => ['file', "$TMP/api.log", 'a'], 2 => ['file', "$TMP/api.log", 'a']], $p2, null, [
|
||
|
|
'VISIT_PRIVATE_DIR' => $PRIV, 'MAILCHIMP_BASE_URL_OVERRIDE' => "$MOCK/3.0", 'GEOIP_BASE_URL_OVERRIDE' => $MOCK, 'GEOCODE_BASE_URL_OVERRIDE' => $MOCK, 'PATH' => getenv('PATH'),
|
||
|
|
]);
|
||
|
|
register_shutdown_function(static function () use (&$servers) { foreach ($servers as $s) { if (is_resource($s)) { proc_terminate($s); } } });
|
||
|
|
usleep(600000);
|
||
|
|
|
||
|
|
// ---------------------------------------------------------------- unit tests
|
||
|
|
$_SERVER['DOCUMENT_ROOT'] = "$ROOT/public";
|
||
|
|
require "$ROOT/public/api/lib/bootstrap.php";
|
||
|
|
require "$ROOT/public/api/lib/Validator.php";
|
||
|
|
require "$ROOT/public/api/lib/LeadProcessor.php";
|
||
|
|
|
||
|
|
fwrite(STDOUT, "\nPhone\n");
|
||
|
|
test('normalizes NANP numbers to E.164', function () {
|
||
|
|
assertSame('+15086951300', Phone::normalizeNanp('(508) 695-1300'));
|
||
|
|
assertSame('+15086951300', Phone::normalizeNanp('1 508 695 1300'));
|
||
|
|
assertSame(null, Phone::normalizeNanp('508-695-130'));
|
||
|
|
assertSame(null, Phone::normalizeNanp('011 555 1234'));
|
||
|
|
assertSame(null, Phone::normalizeNanp('411 555 1234'));
|
||
|
|
});
|
||
|
|
|
||
|
|
fwrite(STDOUT, "\nValidator\n");
|
||
|
|
test('accepts a valid payload and normalizes fields', function () {
|
||
|
|
['data' => $d, 'errors' => $e] = Validator::planVisit(validPayload(['email' => 'Jordan@Example.COM ']));
|
||
|
|
assertSame([], $e);
|
||
|
|
assertSame('jordan@example.com', $d['email']);
|
||
|
|
assertSame('+15085550142', $d['phone_e164']);
|
||
|
|
assertSame('3-5', $d['child_age_ranges']);
|
||
|
|
assertSame(true, $d['sms_consent']);
|
||
|
|
});
|
||
|
|
test('enforces SMS consent ⇒ valid phone', function () {
|
||
|
|
['errors' => $e] = Validator::planVisit(validPayload(['phone' => '', 'smsConsent' => true]));
|
||
|
|
assertContains('mobile number', $e['phone'] ?? '');
|
||
|
|
['errors' => $e2] = Validator::planVisit(validPayload(['phone' => '', 'smsConsent' => false]));
|
||
|
|
assertSame([], $e2);
|
||
|
|
});
|
||
|
|
test('rejects launching/unknown campuses, bad emails, past dates, bad ranges', function () {
|
||
|
|
['errors' => $e] = Validator::planVisit(validPayload(['campusId' => 'orlando', 'email' => 'nope', 'visitDate' => '2020-01-01', 'childAgeRanges' => ['99-100']]));
|
||
|
|
assertTrue(isset($e['campusId']) && isset($e['email']) && isset($e['visitDate']));
|
||
|
|
['data' => $d] = Validator::planVisit(validPayload(['childAgeRanges' => ['99-100', '0-2']]));
|
||
|
|
assertSame('0-2', $d['child_age_ranges']);
|
||
|
|
});
|
||
|
|
test('whitelists attribution keys and strips control characters', function () {
|
||
|
|
['data' => $d] = Validator::planVisit(validPayload(['attribution' => ['utm_source' => "face\x00book", 'evil' => 'x', 'gclid' => str_repeat('a', 400)]]));
|
||
|
|
assertSame('facebook', $d['attribution']['utm_source']);
|
||
|
|
assertTrue(!isset($d['attribution']['evil']));
|
||
|
|
assertSame(200, strlen($d['attribution']['gclid']));
|
||
|
|
});
|
||
|
|
|
||
|
|
fwrite(STDOUT, "\nMailchimp mapping\n");
|
||
|
|
$campus = Campuses::get('norwood');
|
||
|
|
$leadRow = ['submission_id' => 'sub-1', 'first_name' => 'Jordan', 'last_name' => 'Lee', 'email' => 'j@example.com', 'phone_e164' => '+15085550142', 'visit_date' => '2026-10-04', 'service_time' => 'Sunday 9:30 AM', 'adults' => 2, 'children' => 1, 'child_age_ranges' => '3-5', 'questions' => 'Parking?', 'email_consent' => 1, 'sms_consent' => 1, 'attribution' => json_encode(['utm_source' => 'facebook', 'utm_campaign' => 'fall-visit', 'variant' => 'b'])];
|
||
|
|
test('maps merge fields', function () use ($leadRow, $campus) {
|
||
|
|
$p = Mailchimp::buildMemberPayload($leadRow, $campus);
|
||
|
|
assertSame('j@example.com', $p['email_address']);
|
||
|
|
assertSame('subscribed', $p['status_if_new']);
|
||
|
|
assertSame('Norwood', $p['merge_fields']['CAMPUS']);
|
||
|
|
assertSame('2026-10-04', $p['merge_fields']['VISITDATE']);
|
||
|
|
assertSame('+15085550142', $p['merge_fields']['PHONE']);
|
||
|
|
assertSame('facebook', $p['merge_fields']['UTMSOURCE']);
|
||
|
|
});
|
||
|
|
test('applies visitor, campus, source, platform, campaign, visit, kids and SMS tags', function () use ($leadRow, $campus) {
|
||
|
|
$t = Mailchimp::buildTags($leadRow, $campus);
|
||
|
|
assertSame('Visit:Norwood', $t[0], 'campus tag first, matching the Mailchimp journey trigger convention');
|
||
|
|
foreach (['Visit:First-Time Visitor', 'Visit:Norwood', 'Visit:Source visit.waterschurch.org', 'Visit:Platform Facebook', 'Visit:Campaign fall-visit', 'Visit:Visit 2026-10-04', 'Visit:Has Kids', 'Visit:SMS Opt-In'] as $x) {
|
||
|
|
assertTrue(in_array($x, $t, true), "missing tag $x");
|
||
|
|
}
|
||
|
|
});
|
||
|
|
test('skips Mailchimp without email consent', function () use ($leadRow, $campus) {
|
||
|
|
$r = Mailchimp::upsertVisitor(array_merge($leadRow, ['email_consent' => 0]), $campus);
|
||
|
|
assertSame('skipped', $r['status']);
|
||
|
|
});
|
||
|
|
|
||
|
|
fwrite(STDOUT, "\nSinch message construction\n");
|
||
|
|
test('builds a concise confirmation with campus, details and STOP language', function () use ($leadRow, $campus) {
|
||
|
|
$msg = Sinch::buildConfirmation($leadRow, $campus);
|
||
|
|
assertContains('Hi Jordan', $msg);
|
||
|
|
assertContains('Waters Church Norwood', $msg);
|
||
|
|
assertContains('Sun, Oct 4 · Sunday 9:30 AM', $msg);
|
||
|
|
assertContains('Reply STOP', $msg);
|
||
|
|
assertTrue(mb_strlen($msg) <= 320);
|
||
|
|
});
|
||
|
|
test('falls back to campus service times when no visit details were given', function () use ($leadRow, $campus) {
|
||
|
|
$msg = Sinch::buildConfirmation(array_merge($leadRow, ['visit_date' => null, 'service_time' => null]), $campus);
|
||
|
|
assertContains('Sunday 9:30 AM, 11:00 AM', $msg);
|
||
|
|
});
|
||
|
|
test('uses the campus number and sub-account', function () use ($campus) {
|
||
|
|
assertSame('+17817623357', Sinch::sourceNumberFor($campus));
|
||
|
|
assertSame('WatersChurch_OLA_0002', Sinch::accountFor($campus));
|
||
|
|
});
|
||
|
|
test('skips SMS without consent and never claims success without provider confirmation', function () use ($leadRow, $campus) {
|
||
|
|
assertSame('skipped', Sinch::sendVisitConfirmation(array_merge($leadRow, ['sms_consent' => 0]), $campus)['status']);
|
||
|
|
assertSame('failed', Sinch::sendVisitConfirmation(array_merge($leadRow, ['phone_e164' => null]), $campus)['status']);
|
||
|
|
});
|
||
|
|
|
||
|
|
fwrite(STDOUT, "\nLeadProcessor (persistence, idempotency, retries)\n");
|
||
|
|
test('persists first, replays duplicates idempotently', function () {
|
||
|
|
['data' => $d] = Validator::planVisit(validPayload());
|
||
|
|
$a = LeadProcessor::persist($d, '203.0.113.5', 'UA');
|
||
|
|
$b = LeadProcessor::persist($d, '203.0.113.5', 'UA');
|
||
|
|
assertSame(false, $a['duplicate']);
|
||
|
|
assertSame(true, $b['duplicate']);
|
||
|
|
assertSame($a['lead']['id'], $b['lead']['id']);
|
||
|
|
assertSame('pending', $a['lead']['mailchimp_status']);
|
||
|
|
assertSame('pending', $a['lead']['sms_status']);
|
||
|
|
assertTrue(strlen($a['lead']['consent_ip_hash']) === 64 && $a['lead']['consent_ip_hash'] !== '203.0.113.5', 'ip must be hashed');
|
||
|
|
});
|
||
|
|
test('runs both integrations exactly once (live mode against mock providers)', function () {
|
||
|
|
['data' => $d] = Validator::planVisit(validPayload());
|
||
|
|
$lead = LeadProcessor::persist($d, '203.0.113.5', 'UA')['lead'];
|
||
|
|
$s1 = LeadProcessor::runIntegrations($lead);
|
||
|
|
assertSame('sent', $s1['email']);
|
||
|
|
assertSame('sent', $s1['sms']);
|
||
|
|
$row = LeadProcessor::find($lead['submission_id']);
|
||
|
|
assertTrue(str_starts_with((string)$row['sms_message_id'], 'msg-'), 'provider message id stored');
|
||
|
|
$s2 = LeadProcessor::runIntegrations($row);
|
||
|
|
$row2 = LeadProcessor::find($lead['submission_id']);
|
||
|
|
assertSame(1, (int)$row2['sms_attempts'], 'second run must not resend');
|
||
|
|
assertSame(1, (int)$row2['mailchimp_attempts']);
|
||
|
|
assertSame('sent', $s2['sms']);
|
||
|
|
});
|
||
|
|
test('partial failure keeps the lead, marks retry with backoff, and cron recovers', function () use ($TMP) {
|
||
|
|
touch("$TMP/fail-sinch");
|
||
|
|
['data' => $d] = Validator::planVisit(validPayload());
|
||
|
|
$lead = LeadProcessor::persist($d, '203.0.113.5', 'UA')['lead'];
|
||
|
|
$s = LeadProcessor::runIntegrations($lead);
|
||
|
|
assertSame('sent', $s['email']);
|
||
|
|
assertSame('retry', $s['sms']);
|
||
|
|
$row = LeadProcessor::find($lead['submission_id']);
|
||
|
|
assertTrue($row['next_retry_at'] !== null, 'retry scheduled');
|
||
|
|
assertSame(1, (int)$row['sms_attempts']);
|
||
|
|
// not yet due → cron does nothing
|
||
|
|
$r0 = LeadProcessor::retryDue();
|
||
|
|
assertSame(0, $r0['processed']);
|
||
|
|
// make it due and fix the provider
|
||
|
|
Db::pdo()->prepare("UPDATE leads SET next_retry_at = '2000-01-01T00:00:00Z' WHERE id = ?")->execute([$row['id']]);
|
||
|
|
unlink("$TMP/fail-sinch");
|
||
|
|
$r1 = LeadProcessor::retryDue();
|
||
|
|
assertSame(1, $r1['processed']);
|
||
|
|
$fixed = LeadProcessor::find($lead['submission_id']);
|
||
|
|
assertSame('sent', $fixed['sms_status']);
|
||
|
|
assertSame(2, (int)$fixed['sms_attempts']);
|
||
|
|
assertSame(1, (int)$fixed['mailchimp_attempts'], 'mailchimp must not be re-sent');
|
||
|
|
});
|
||
|
|
test('gives up after MAX_ATTEMPTS', function () use ($TMP) {
|
||
|
|
touch("$TMP/fail-mailchimp");
|
||
|
|
['data' => $d] = Validator::planVisit(validPayload());
|
||
|
|
$lead = LeadProcessor::persist($d, '203.0.113.5', 'UA')['lead'];
|
||
|
|
for ($i = 0; $i < LeadProcessor::MAX_ATTEMPTS + 2; $i++) {
|
||
|
|
$row = LeadProcessor::find($lead['submission_id']);
|
||
|
|
Db::pdo()->prepare("UPDATE leads SET next_retry_at = '2000-01-01T00:00:00Z' WHERE id = ?")->execute([$row['id']]);
|
||
|
|
LeadProcessor::runIntegrations($row);
|
||
|
|
}
|
||
|
|
$row = LeadProcessor::find($lead['submission_id']);
|
||
|
|
unlink("$TMP/fail-mailchimp");
|
||
|
|
assertSame('failed', $row['mailchimp_status']);
|
||
|
|
assertSame(LeadProcessor::MAX_ATTEMPTS, (int)$row['mailchimp_attempts']);
|
||
|
|
});
|
||
|
|
test('backoff grows and is capped', function () {
|
||
|
|
assertSame(60, LeadProcessor::backoffSeconds(1));
|
||
|
|
assertSame(120, LeadProcessor::backoffSeconds(2));
|
||
|
|
assertSame(6 * 3600, LeadProcessor::backoffSeconds(20));
|
||
|
|
});
|
||
|
|
|
||
|
|
fwrite(STDOUT, "\nLog redaction\n");
|
||
|
|
test('redacts emails, phones and secrets', function () {
|
||
|
|
$r = Log::redact(['email' => 'jordan@example.com', 'note' => 'call +1 508 555 0142 or jo@x.io', 'authorization' => 'Basic abcdefghijklmnop']);
|
||
|
|
assertTrue(str_starts_with($r['email'], 'jo') && str_ends_with($r['email'], 'om') && !str_contains($r['email'], '@'), 'email masked');
|
||
|
|
assertContains('[phone]', $r['note']);
|
||
|
|
assertContains('[email]', $r['note']);
|
||
|
|
assertTrue(!str_contains($r['authorization'], 'abcdefghijklmnop'));
|
||
|
|
});
|
||
|
|
|
||
|
|
// ---------------------------------------------------------------- HTTP end-to-end
|
||
|
|
fwrite(STDOUT, "\nHTTP endpoints (php -S)\n");
|
||
|
|
$origin = ['Origin' => 'http://127.0.0.1:8098', 'X-Requested-With' => 'visit-page'];
|
||
|
|
test('health check reports ok', function () use ($API) {
|
||
|
|
$r = http('GET', "$API/health.php");
|
||
|
|
assertSame(200, $r['status'], $r['body']);
|
||
|
|
assertSame(true, $r['json']['ok']);
|
||
|
|
assertSame('live', $r['json']['checks']['integration_mode']);
|
||
|
|
});
|
||
|
|
test('rejects cross-origin and unknown-origin submissions', function () use ($API) {
|
||
|
|
$r = http('POST', "$API/plan-visit.php", validPayload(), ['Origin' => 'https://evil.example']);
|
||
|
|
assertSame(403, $r['status']);
|
||
|
|
$r2 = http('POST', "$API/plan-visit.php", validPayload()); // no origin, no custom header
|
||
|
|
assertSame(403, $r2['status']);
|
||
|
|
});
|
||
|
|
test('rejects wrong method', function () use ($API) {
|
||
|
|
assertSame(405, http('GET', "$API/plan-visit.php")['status']);
|
||
|
|
});
|
||
|
|
test('returns field errors for invalid input (422)', function () use ($API, $origin) {
|
||
|
|
$r = http('POST', "$API/plan-visit.php", validPayload(['email' => 'bad', 'firstName' => '']), $origin);
|
||
|
|
assertSame(422, $r['status']);
|
||
|
|
assertTrue(isset($r['json']['fieldErrors']['email']) && isset($r['json']['fieldErrors']['firstName']));
|
||
|
|
});
|
||
|
|
test('honeypot and too-fast submissions get a decoy success and are not stored', function () use ($API, $origin) {
|
||
|
|
$p = validPayload(['website' => 'http://spam']);
|
||
|
|
$r = http('POST', "$API/plan-visit.php", $p, $origin);
|
||
|
|
assertSame(200, $r['status']);
|
||
|
|
assertSame(true, $r['json']['ok']);
|
||
|
|
assertSame(null, LeadProcessor::find($p['submissionId']));
|
||
|
|
$p2 = validPayload(['startedAt' => (int)(microtime(true) * 1000) - 500]);
|
||
|
|
http('POST', "$API/plan-visit.php", $p2, $origin);
|
||
|
|
assertSame(null, LeadProcessor::find($p2['submissionId']));
|
||
|
|
});
|
||
|
|
test('successful submission persists, sends both, and replays idempotently', function () use ($API, $origin, $TMP) {
|
||
|
|
file_put_contents("$TMP/requests.log", '');
|
||
|
|
$p = validPayload();
|
||
|
|
$r = http('POST', "$API/plan-visit.php", $p, $origin);
|
||
|
|
assertSame(200, $r['status'], $r['body']);
|
||
|
|
assertSame(true, $r['json']['ok']);
|
||
|
|
assertSame(false, $r['json']['duplicate']);
|
||
|
|
assertSame('sent', $r['json']['email']['status']);
|
||
|
|
assertSame('sent', $r['json']['sms']['status']);
|
||
|
|
$row = LeadProcessor::find($p['submissionId']);
|
||
|
|
assertSame('norwood', $row['campus_id']);
|
||
|
|
$attr = json_decode($row['attribution'], true);
|
||
|
|
assertSame('fall-visit', $attr['utm_campaign']);
|
||
|
|
assertTrue(!isset($attr['evil_key']));
|
||
|
|
// provider requests: Sinch used the campus sub-account + number
|
||
|
|
$reqs = array_map(static fn($l) => json_decode($l, true), array_filter(explode("\n", file_get_contents("$TMP/requests.log"))));
|
||
|
|
$sinch = array_values(array_filter($reqs, static fn($q) => $q['path'] === '/v1/messages'));
|
||
|
|
assertSame(1, count($sinch), 'exactly one SMS');
|
||
|
|
assertSame('WatersChurch_OLA_0002', $sinch[0]['headers']['account']);
|
||
|
|
assertSame('+17817623357', $sinch[0]['body']['messages'][0]['source_number']);
|
||
|
|
assertSame('+15085550142', $sinch[0]['body']['messages'][0]['destination_number']);
|
||
|
|
assertContains('Reply STOP', $sinch[0]['body']['messages'][0]['content']);
|
||
|
|
$mc = array_values(array_filter($reqs, static fn($q) => str_starts_with($q['path'], '/3.0/lists/abc123/members/') && $q['method'] === 'PUT'));
|
||
|
|
assertSame(1, count($mc), 'exactly one Mailchimp upsert');
|
||
|
|
// duplicate replay
|
||
|
|
$r2 = http('POST', "$API/plan-visit.php", $p, $origin);
|
||
|
|
assertSame(true, $r2['json']['duplicate']);
|
||
|
|
$reqs2 = array_filter(explode("\n", file_get_contents("$TMP/requests.log")));
|
||
|
|
assertSame(count($reqs), count($reqs2), 'replay must not call providers again');
|
||
|
|
});
|
||
|
|
test('email-only consent never sends an SMS', function () use ($API, $origin, $TMP) {
|
||
|
|
file_put_contents("$TMP/requests.log", '');
|
||
|
|
$r = http('POST', "$API/plan-visit.php", validPayload(['smsConsent' => false]), $origin);
|
||
|
|
assertSame('skipped', $r['json']['sms']['status']);
|
||
|
|
assertSame('sent', $r['json']['email']['status']);
|
||
|
|
assertTrue(!str_contains(file_get_contents("$TMP/requests.log"), '/v1/messages'));
|
||
|
|
});
|
||
|
|
test('no consent at all still stores the lead', function () use ($API, $origin) {
|
||
|
|
$p = validPayload(['smsConsent' => false, 'emailConsent' => false, 'phone' => '']);
|
||
|
|
$r = http('POST', "$API/plan-visit.php", $p, $origin);
|
||
|
|
assertSame(200, $r['status']);
|
||
|
|
assertSame('skipped', $r['json']['email']['status']);
|
||
|
|
assertTrue(LeadProcessor::find($p['submissionId']) !== null);
|
||
|
|
});
|
||
|
|
test('provider outage → lead kept, sms queued for retry, user still gets a confirmation', function () use ($API, $origin, $TMP) {
|
||
|
|
touch("$TMP/fail-sinch");
|
||
|
|
$p = validPayload();
|
||
|
|
$r = http('POST', "$API/plan-visit.php", $p, $origin);
|
||
|
|
unlink("$TMP/fail-sinch");
|
||
|
|
assertSame(200, $r['status']);
|
||
|
|
assertSame(true, $r['json']['ok']);
|
||
|
|
assertSame('queued', $r['json']['sms']['status']);
|
||
|
|
assertSame('retry', LeadProcessor::find($p['submissionId'])['sms_status']);
|
||
|
|
});
|
||
|
|
test('rate limiter allows N hits per window then denies with a retry hint', function () {
|
||
|
|
require_once dirname(__DIR__, 2) . '/public/api/lib/RateLimit.php';
|
||
|
|
$bucket = 'test:' . bin2hex(random_bytes(4));
|
||
|
|
for ($i = 0; $i < 3; $i++) assertSame(true, RateLimit::hit($bucket, 3, 600)['allowed']);
|
||
|
|
$denied = RateLimit::hit($bucket, 3, 600);
|
||
|
|
assertSame(false, $denied['allowed']);
|
||
|
|
assertTrue($denied['retryAfter'] > 0 && $denied['retryAfter'] <= 600);
|
||
|
|
assertTrue(RateLimit::ipBucket('submit', '1.2.3.4') !== RateLimit::ipBucket('submit', '1.2.3.5'));
|
||
|
|
assertTrue(!str_contains(RateLimit::ipBucket('submit', '1.2.3.4'), '1.2.3.4'), 'ip must not appear in bucket key');
|
||
|
|
});
|
||
|
|
test('geocode resolves a ZIP and rejects junk', function () use ($API) {
|
||
|
|
$r = http('GET', "$API/geocode.php?zip=02062");
|
||
|
|
assertSame(true, $r['json']['ok'], $r['body']);
|
||
|
|
assertSame(42.1945, $r['json']['location']['lat']);
|
||
|
|
assertSame(400, http('GET', "$API/geocode.php?zip=12")['status']);
|
||
|
|
$r3 = http('GET', "$API/geocode.php?zip=00000");
|
||
|
|
assertSame(false, $r3['json']['ok']);
|
||
|
|
});
|
||
|
|
test('locate returns an approximate, rounded position (or a graceful unavailable)', function () use ($API) {
|
||
|
|
$r = http('GET', "$API/locate.php", null, ['X-Forwarded-For' => '203.0.113.9']);
|
||
|
|
assertSame(200, $r['status']);
|
||
|
|
// php -S sees 127.0.0.1 which is private → unavailable unless proxy headers trusted; both are valid outcomes
|
||
|
|
assertTrue(in_array($r['json']['ok'], [true, false], true));
|
||
|
|
if ($r['json']['ok']) {
|
||
|
|
assertSame(41.82, $r['json']['approximate']['lat']);
|
||
|
|
}
|
||
|
|
});
|
||
|
|
test('private folders are not web-accessible via php -S (router) and blocked by .htaccess on Apache', function () use ($ROOT) {
|
||
|
|
assertContains('Require all denied', file_get_contents("$ROOT/public/api/lib/.htaccess"));
|
||
|
|
assertContains('Require all denied', file_get_contents("$ROOT/public/api/cron/.htaccess"));
|
||
|
|
assertContains('RewriteRule ^(lib|cron|config|data)', file_get_contents("$ROOT/public/api/.htaccess"));
|
||
|
|
});
|
||
|
|
|
||
|
|
fwrite(STDOUT, "\n$passed passed, $failed failed\n");
|
||
|
|
exit($failed === 0 ? 0 : 1);
|