Kundenansicht: Beenden mit Rueckweg ins Ticketsystem, /me mit Ansichts-Kennung, Team-Routen Portal-Status, Protokoll, Preview-Link

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/kundenansichtEnde.test.js

@@ -0,0 +1,89 @@
+import { test, after } from 'node:test'
+import assert from 'node:assert/strict'
+import { startAppwriteMock } from './support/appwriteMock.js'
+import { startFakeStripe } from './support/fakeStripe.js'
+import { useTestEnv } from './support/testEnv.js'
+import { schemaKeys } from './support/schema.js'
+
+// Kundenansicht beenden (Rueckweg ins Ticketsystem) und /api/auth/me in der Kundenansicht
+const aw = await startAppwriteMock({ schema: { customerViewLog: schemaKeys('customerViewLog') } })
+const st = await startFakeStripe()
+useTestEnv({ appwriteUrl: aw.url, stripeUrl: st.url })
+const { config } = await import('../server/config.js')
+const { startTestApp, get, post } = await import('./support/testApp.js')
+const { seedFixtures, kundenansichtCookie, viewAsCookie } = await import('./support/fixtures.js')
+const { kundenansichtGuard } = await import('../server/middleware/kundenansichtGuard.js')
+const { default: authRoutes } = await import('../server/routes/auth.js')
+const { verifyPreviewSessionToken } = await import('../server/services/previewSession.js')
+const app = await startTestApp({ '/': kundenansichtGuard, '/api/auth': authRoutes })
+after(() => Promise.all([app.close(), aw.close(), st.close()]))
+
+seedFixtures(aw)
+
+const kv = (extra = {}) => ({ cookie: kundenansichtCookie(extra), headers: { 'x-kundenansicht': extra.viewId || 'a'.repeat(32) } })
+const clears = (res, name) => res.headers.getSetCookie().some((c) => c.startsWith(`${name}=`) && /Expires=Thu, 01 Jan 1970/.test(c))
+const cookieValue = (res, name) => {
+  const c = res.headers.getSetCookie().find((x) => x.startsWith(`${name}=`))
+  return c ? decodeURIComponent(c.split(';')[0].slice(name.length + 1)) : null
+}
+const logOf = (action) => [...aw.docs('customerViewLog').values()].filter((d) => d.action === action)
+const me = async (cookie) => {
+  const res = await fetch(`${app.url}/api/auth/me`, { headers: { cookie } })
+  return { status: res.status, body: await res.json(), headers: res.headers }
+}
+
+test('Beenden: Protokoll beendet, beide Cookies geloescht, Rueckweg zur Kundenseite im WOMS', async () => {
+  const before = logOf('beendet').length
+  const res = await post('/api/auth/kundenansicht/ende', {}, kv({ viewId: 'b'.repeat(32) }))
+  assert.equal(res.status, 200)
+  assert.equal(res.body.redirect, 'https://ticket.webklar.com/customers/c1')
+  assert.ok(clears(res, config.cookieName))
+  assert.ok(clears(res, 'preview_session'))
+  const ended = logOf('beendet')
+  assert.equal(ended.length, before + 1)
+  assert.deepEqual([ended.at(-1).customerId, ended.at(-1).staffName], ['c1', 'Andrej'])
+})
+
+test('Beenden ohne Kundenansicht -> Rueckweg /customers, kein Protokoll', async () => {
+  const before = logOf('beendet').length
+  const res = await post('/api/auth/kundenansicht/ende', {})
+  assert.equal(res.status, 200)
+  assert.equal(res.body.redirect, 'https://ticket.webklar.com/customers')
+  assert.equal(logOf('beendet').length, before)
+})
+
+test('/me in neuer Ansicht: viewId, viewExpiresAt, admin.name, Preview-Cookie nur fuer den Kunden', async () => {
+  const viewExpiresAt = Date.now() + 30 * 60 * 1000
+  const res = await me(kundenansichtCookie({ viewId: 'c'.repeat(32), viewExpiresAt }))
+  assert.equal(res.status, 200)
+  assert.equal(res.body.authenticated, true)
+  assert.equal(res.body.viewAs, true)
+  assert.equal(res.body.viewId, 'c'.repeat(32))
+  assert.equal(res.body.viewExpiresAt, viewExpiresAt)
+  assert.equal(res.body.admin.name, 'Andrej')
+  assert.equal(res.body.customer.id, 'c1')
+  const preview = await verifyPreviewSessionToken(cookieValue(res, 'preview_session'))
+  assert.deepEqual([preview.role, preview.customerId], ['customer', 'c1'])
+  assert.ok(preview.exp <= Math.ceil(viewExpiresAt / 1000) + 1, 'Preview endet mit der Ansicht')
+})
+
+test('/me abgelaufen -> authenticated false, reason view_expired, Protokoll abgelaufen einmal', async () => {
+  const before = logOf('abgelaufen').length
+  const cookie = kundenansichtCookie({ viewId: 'd'.repeat(32), viewExpiresAt: Date.now() - 1000 })
+  for (let i = 0; i < 2; i += 1) {
+    const res = await me(cookie)
+    assert.equal(res.status, 200)
+    assert.equal(res.body.authenticated, false)
+    assert.equal(res.body.reason, 'view_expired')
+    assert.equal(res.body.message, 'Die Kundenansicht ist abgelaufen. Bitte im Ticketsystem erneut öffnen.')
+    assert.ok(clears(res, config.cookieName))
+  }
+  assert.equal(logOf('abgelaufen').length, before + 1)
+})
+
+test('/me alte Ansicht (viewAsCookie) unveraendert: viewAs true, keine viewId', async () => {
+  const body = await get('/api/auth/me', { cookie: viewAsCookie('c1') })
+  assert.equal(body.viewAs, true)
+  assert.equal(body.viewId, undefined)
+  assert.equal(body.admin.name, 'Kenso')
+})

test/teamRoutes.test.js

@@ -0,0 +1,69 @@
+import { test, after } from 'node:test'
+import assert from 'node:assert/strict'
+import { startAppwriteMock } from './support/appwriteMock.js'
+import { startFakeStripe } from './support/fakeStripe.js'
+import { useTestEnv } from './support/testEnv.js'
+import { schemaKeys } from './support/schema.js'
+
+// Team-Routen fuers Ticketsystem: Portal-Status, Protokoll der Kundenansicht, Preview-Link fuer alle Mitarbeiter
+const aw = await startAppwriteMock({ schema: { customerViewLog: schemaKeys('customerViewLog') } })
+const st = await startFakeStripe()
+useTestEnv({ appwriteUrl: aw.url, stripeUrl: st.url })
+const { startTestApp, rawGet, post } = await import('./support/testApp.js')
+const { seedFixtures } = await import('./support/fixtures.js')
+const { default: teamRoutes } = await import('../server/routes/team/index.js')
+const { consumeStaffPreviewToken } = await import('../server/services/staffPreviewTokens.js')
+const app = await startTestApp({ '/api/team': teamRoutes })
+after(() => Promise.all([app.close(), aw.close(), st.close()]))
+
+seedFixtures(aw)
+aw.seed('employees', { $id: 'e_staff2', userId: 'u_staff2', displayName: 'Andrej', email: 'andrej@webklar.com' })
+aw.seed('customerPortalAccess', { $id: 'pa1', customerId: 'c1', enabled: true, lastLoginAt: '2026-09-30T10:00:00.000Z' })
+aw.seed('customerViewLog', { $id: 'v1', customerId: 'c1', staffUserId: 'u_staff2', staffName: 'Andrej', action: 'geoeffnet', detail: '', createdAt: '2026-09-30T10:00:00.000Z' })
+aw.seed('customerViewLog', { $id: 'v2', customerId: 'c1', staffUserId: 'u_staff2', staffName: 'Andrej', action: 'news_angelegt', detail: 'Hallo', createdAt: '2026-09-30T10:05:00.000Z' })
+aw.seed('customerViewLog', { $id: 'v3', customerId: 'c2', staffUserId: 'u_staff2', staffName: 'Andrej', action: 'geoeffnet', detail: '', createdAt: '2026-09-30T11:00:00.000Z' })
+aw.seed('websiteProjects', { $id: 'wp1', customerId: 'c1', projectName: 'Bäckerei', subdomain: 'baeckerei', status: 'ready' })
+aw.seed('websiteProjects', { $id: 'wp2', customerId: 'c1', projectName: 'Café', subdomain: 'cafe', status: 'building' })
+
+const auth = { headers: { authorization: 'Bearer jwt-staff' } }
+
+test('portal: hasAccess und lastLoginAt; c2 ohne Zugang hasAccess false; unbekannt 404', async () => {
+  const c1 = await rawGet('/api/team/customers/c1/portal', auth)
+  assert.equal(c1.status, 200)
+  assert.deepEqual(c1.body, { hasAccess: true, lastLoginAt: '2026-09-30T10:00:00.000Z' })
+  assert.deepEqual((await rawGet('/api/team/customers/c2/portal', auth)).body, { hasAccess: false, lastLoginAt: null })
+  assert.equal((await rawGet('/api/team/customers/gibtsnicht/portal', auth)).status, 404)
+})
+
+test('protokoll: Eintraege des Kunden neueste zuerst', async () => {
+  const res = await rawGet('/api/team/customers/c1/protokoll', auth)
+  assert.equal(res.status, 200)
+  assert.deepEqual(res.body.entries.map((e) => e.id), ['v2', 'v1'])
+  assert.deepEqual(res.body.entries[0], { id: 'v2', at: '2026-09-30T10:05:00.000Z', staffName: 'Andrej', action: 'news_angelegt', detail: 'Hallo' })
+})
+
+test('preview-link fuer Mitarbeiter ohne Admin-Label -> openUrl auf staff-preview', async () => {
+  const res = await post('/api/team/preview-link', { subdomain: 'baeckerei', previewUrl: 'https://baeckerei.project.webklar.com/' }, auth)
+  assert.equal(res.status, 200)
+  assert.match(res.body.openUrl, /^https:\/\/project\.webklar\.com\/api\/auth\/staff-preview\?token=[0-9a-f]{64}$/)
+  const data = consumeStaffPreviewToken(new URL(res.body.openUrl).searchParams.get('token'))
+  assert.deepEqual([data.userId, data.name, data.previewUrl, data.customerId], ['u_staff2', 'Andrej', 'https://baeckerei.project.webklar.com/', 'c1'])
+})
+
+test('preview-link: nicht bereit 409, unbekannt 404, ohne Subdomain 400', async () => {
+  assert.equal((await post('/api/team/preview-link', { subdomain: 'cafe' }, auth)).status, 409)
+  assert.equal((await post('/api/team/preview-link', { subdomain: 'gibtsnicht' }, auth)).status, 404)
+  assert.equal((await post('/api/team/preview-link', {}, auth)).status, 400)
+})
+
+test('alle Team-Routen ohne JWT -> 401', async () => {
+  for (const [method, p] of [
+    ['GET', '/api/team/customers/c1/portal'],
+    ['GET', '/api/team/customers/c1/protokoll'],
+    ['POST', '/api/team/customers/c1/kundenansicht'],
+    ['POST', '/api/team/preview-link'],
+  ]) {
+    const res = method === 'GET' ? await rawGet(p) : await post(p, {})
+    assert.equal(res.status, 401, `${method} ${p}`)
+  }
+})