2026-04-28 02:22:04 +02:00
|
|
|
/**
|
|
|
|
|
* Unit tests for the version-aware Documenso placement abstraction.
|
|
|
|
|
* Covers v1/v2 dispatch, percent→pixel coord conversion for v1, and the pure
|
|
|
|
|
* default-signature layout math for 1/2/3/5 recipients.
|
|
|
|
|
*/
|
|
|
|
|
import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
|
|
|
|
|
|
|
|
|
|
vi.mock('@/lib/services/port-config', () => ({
|
|
|
|
|
getPortDocumensoConfig: vi.fn(),
|
|
|
|
|
}));
|
|
|
|
|
|
|
|
|
|
import * as portConfig from '@/lib/services/port-config';
|
|
|
|
|
import {
|
|
|
|
|
__resetDocumensoCachesForTests,
|
|
|
|
|
computeDefaultSignatureLayout,
|
|
|
|
|
placeFields,
|
|
|
|
|
placeDefaultSignatureFields,
|
|
|
|
|
voidDocument,
|
|
|
|
|
} from '@/lib/services/documenso-client';
|
|
|
|
|
|
|
|
|
|
const fetchMock = vi.fn();
|
|
|
|
|
|
|
|
|
|
beforeEach(() => {
|
|
|
|
|
vi.stubGlobal('fetch', fetchMock);
|
|
|
|
|
__resetDocumensoCachesForTests();
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
afterEach(() => {
|
|
|
|
|
fetchMock.mockReset();
|
|
|
|
|
vi.unstubAllGlobals();
|
|
|
|
|
vi.mocked(portConfig.getPortDocumensoConfig).mockReset();
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
function configurePort(version: 'v1' | 'v2'): void {
|
|
|
|
|
vi.mocked(portConfig.getPortDocumensoConfig).mockResolvedValue({
|
|
|
|
|
apiUrl: 'https://documenso.test',
|
|
|
|
|
apiKey: 'sk_test',
|
2026-05-21 23:49:22 +02:00
|
|
|
apiKeySource: 'port',
|
|
|
|
|
apiUrlSource: 'port',
|
2026-04-28 02:22:04 +02:00
|
|
|
apiVersion: version,
|
fix(audit-tier-1): timeouts, lifecycle, per-port Documenso, FK constraints
Closes the second wave of HIGH-priority audit findings:
* fetchWithTimeout helper (new src/lib/fetch-with-timeout.ts) wraps
Documenso, OCR, currency, Umami, IMAP, etc. — a hung upstream can
no longer pin a worker concurrency slot indefinitely. OpenAI client
passes timeout: 30_000. ImapFlow gets socket / greeting / connection
timeouts.
* SIGTERM / SIGINT handler in src/server.ts drains in-flight HTTP,
closes Socket.io, and disconnects Redis before exit; compose
stop_grace_period bumped to 30s. Adds closeSocketServer() helper.
* env.ts gains zod-validated PORT and MULTI_NODE_DEPLOYMENT, and
filesystem.ts now reads from env (a typo can no longer silently
disable the multi-node guard).
* Per-port Documenso template + recipient IDs land in system_settings
with env fallback (PortDocumensoConfig now exposes eoiTemplateId,
clientRecipientId, developerRecipientId, approvalRecipientId).
document-templates.ts uses the per-port config and threads portId
into documensoGenerateFromTemplate().
* Migration 0042 wires the eleven HIGH-tier missing FK constraints
(documents/files/interests/reminders/berth_waiting_list/
form_submissions) plus polymorphic CHECK round 2
(yacht_ownership_history.owner_type, document_sends.document_kind),
invoices.billing_entity_id NOT EMPTY, and clients.merged_into self-FK.
Drizzle schema columns updated to .references(...) where possible
so the misleading "FK wired in relations.ts" comments are gone.
Test status: 1168/1168 vitest, tsc clean.
Refs: docs/audit-comprehensive-2026-05-05.md HIGH §§5,6,7,8,9,10 +
MED §§14,15,16,18.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-05 19:52:58 +02:00
|
|
|
eoiTemplateId: 8,
|
2026-04-28 02:22:04 +02:00
|
|
|
defaultPathway: 'documenso-template',
|
fix(audit-tier-1): timeouts, lifecycle, per-port Documenso, FK constraints
Closes the second wave of HIGH-priority audit findings:
* fetchWithTimeout helper (new src/lib/fetch-with-timeout.ts) wraps
Documenso, OCR, currency, Umami, IMAP, etc. — a hung upstream can
no longer pin a worker concurrency slot indefinitely. OpenAI client
passes timeout: 30_000. ImapFlow gets socket / greeting / connection
timeouts.
* SIGTERM / SIGINT handler in src/server.ts drains in-flight HTTP,
closes Socket.io, and disconnects Redis before exit; compose
stop_grace_period bumped to 30s. Adds closeSocketServer() helper.
* env.ts gains zod-validated PORT and MULTI_NODE_DEPLOYMENT, and
filesystem.ts now reads from env (a typo can no longer silently
disable the multi-node guard).
* Per-port Documenso template + recipient IDs land in system_settings
with env fallback (PortDocumensoConfig now exposes eoiTemplateId,
clientRecipientId, developerRecipientId, approvalRecipientId).
document-templates.ts uses the per-port config and threads portId
into documensoGenerateFromTemplate().
* Migration 0042 wires the eleven HIGH-tier missing FK constraints
(documents/files/interests/reminders/berth_waiting_list/
form_submissions) plus polymorphic CHECK round 2
(yacht_ownership_history.owner_type, document_sends.document_kind),
invoices.billing_entity_id NOT EMPTY, and clients.merged_into self-FK.
Drizzle schema columns updated to .references(...) where possible
so the misleading "FK wired in relations.ts" comments are gone.
Test status: 1168/1168 vitest, tsc clean.
Refs: docs/audit-comprehensive-2026-05-05.md HIGH §§5,6,7,8,9,10 +
MED §§14,15,16,18.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-05 19:52:58 +02:00
|
|
|
clientRecipientId: 192,
|
|
|
|
|
developerRecipientId: 193,
|
|
|
|
|
approvalRecipientId: 194,
|
feat: autonomous backlog push — admin UX overhaul + storage parity + residential parity + Documenso Phase 1
Massive multi-area push driven by docs/admin-ux-backlog.md. Every byte
path now goes through getStorageBackend() so signed EOIs, contracts,
brochures, berth PDFs, files, avatars, branding logos, and DB backups
all work identically on S3 and filesystem backends.
USER SETTINGS (rebuild)
- Country + Timezone selectors with cross-defaulting
- Browser-detected timezone banner ("Looks like you're in Europe/Paris…")
- Email change with verification flow (user_email_changes table,
OLD-address cancel link + NEW-address confirm link)
+ EMAIL_CHANGE_INSTANT=true dev shortcut
- Password reset triggered via better-auth requestPasswordReset
- Profile photo upload + crop (square 256×256) via shared
<ImageCropperDialog> + /api/v1/me/avatar
BRANDING
- Shared <ImageCropperDialog> using react-easy-crop
- Logo upload + crop in /admin/branding (writes via
/api/v1/admin/settings/image -> storage backend)
- Email header/footer HTML defaults injectable via "Insert default"
- SettingsFormCard new field types: timezone (combobox), image-upload
STORAGE ADMIN OVERHAUL
- S3 config form FIRST, swap action SECOND
- Test connection before any switch
- Two-button switch: "Switch + migrate" vs "Switch only" with
warning modals
- runMigration() honours skipMigration flag
- /api/ready + system-monitoring health check use the active
storage backend instead of always probing MinIO
- Filesystem backend already had full feature parity — verified
BACKUP MANAGEMENT (real)
- New backup_jobs table (id / status / trigger / size / storage_path)
- runBackup() service spawns pg_dump --format=custom, streams to
active storage backend via getStorageBackend().put()
- /admin/backup page: trigger, history, download .dump for restore
- Super-admin gated
AI ADMIN PANEL
- /admin/ai consolidates master switch + monthly token cap +
provider credentials
- Per-feature settings (OCR, berth-PDF parser, recommender)
linked from the same page
ONBOARDING WIZARD
- /admin/onboarding now real with auto-checked steps
- Reads each setting key + lists endpoint (roles/users/tags) to
decide completion
- Manual checkboxes for steps without an auto-detect signal
- Progress bar + Mark done/Mark incomplete buttons
- State persisted in system_settings.onboarding_manual_status
RESIDENTIAL PARITY (full)
- New residential_client_notes + residential_interest_notes tables
(mirror marina-side shape)
- Polymorphic notes.service.ts extended (verifyParent, listForEntity,
create, update, delete) for residential_clients/_interests
- <NotesList> component accepts the new entity types
- 4 new note endpoints (GET/POST/PATCH/DELETE for clients + interests)
- 2 new activity endpoints (residential clients + interests)
- residential-client-tabs.tsx + residential-interest-tabs.tsx use
DetailLayout (Overview / Interests / Notes / Activity)
- residential-client-detail-header.tsx mirrors marina-side strip
- useBreadcrumbHint wired into both detail components
- Configurable Assigned-to dropdown (residential_interests.view perm)
CONFIGURABLE RESIDENTIAL STAGES
- residential-stages.service.ts with list / save / orphan-check
- /api/v1/residential/stages GET/PUT
- /admin/residential-stages admin UI with reassign-on-remove modal
- Validators relaxed from z.enum to z.string
DOCUMENSO PHASE 1
- Schema: document_signers.invited_at / opened_at /
last_reminder_sent_at / signing_token (+ idx_ds_signing_token)
- Schema: documents.completion_cc_emails (text[]) +
auto_reminder_interval_days (int)
- transformSigningUrl() now maps SignerRole -> URL segment via
ROLE_TO_URL_SEGMENT (approver->cc, witness->witness) — fixes
Risk #5 where approver invites landed on /sign/error
- POST /api/v1/documents/[id]/send-invitation with auto-pick of
next pending signer
- Per-port settings: documenso_developer_label / _approver_label
+ documenso_developer_user_id / _approver_user_id (Phase 7
Project Director RBAC binding fields)
ADMIN UX RAPID-FIRE
- Sidebar collapse removed (always-expanded design)
- Audit log: input sizes (h-9), date pickers w-44, action cell
sub-label so single-row entries aren't blank
- Sales email config: token list <details> + tooltips on
threshold + body fields
- Custom Settings card: long-form description
- Reminder digest timezone uses TimezoneCombobox
- Port form: currency dropdown (10 common currencies) + timezone
combobox + brand color picker
- Permissions count badge opens modal with granted/denied per
resource
- Role names display-normalized via prettifyRoleName
- Tag form: native input type=color
- Custom Fields page: amber heads-up about non-integration
- Settings manager: select field type + fallthrough_policy as dropdown
- Storage admin S3 fields ship as proper password + boolean
LIST PAGES
- Residential client list: clickable email/phone (mailto/tel/wa.me)
- Residential interests + Documents Hub search inputs sized h-9
CURRENCY API
- scripts/test-currency-api.ts verifies live Frankfurter fetch
-> DB upsert -> getRate -> convert. Inverse-rate drift <=0.001
TESTS
- 1185/1185 vitest passing
- tsc clean
- eslint 0 errors (16 pre-existing warnings)
Note: WEBSITE_INTAKE_SECRET added to .env.example but committed
separately due to pre-commit hook policy on .env* files.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-07 21:02:12 +02:00
|
|
|
developerName: 'Test Developer',
|
|
|
|
|
developerEmail: 'dev@test.invalid',
|
|
|
|
|
approverName: 'Test Approver',
|
|
|
|
|
approverEmail: 'approver@test.invalid',
|
|
|
|
|
sendMode: 'manual',
|
|
|
|
|
embeddedSigningHost: null,
|
|
|
|
|
contractTemplateId: null,
|
|
|
|
|
reservationTemplateId: null,
|
|
|
|
|
developerLabel: 'Developer',
|
|
|
|
|
approverLabel: 'Approver',
|
|
|
|
|
developerUserId: null,
|
|
|
|
|
approverUserId: null,
|
feat(documenso): full v2 endpoint coverage + sequential signing + redirectUrl
Wire up the remaining version-aware paths so a port pointed at Documenso 2.x
takes the v2 endpoint on every CRUD operation, with two new v2-only settings
exposed in admin UI.
documenso-client.ts:
- createDocument: v2 multipart /envelope/create + getDocument follow-up to
return the full doc shape (v1 path unchanged)
- sendDocument: v2 /envelope/distribute (returns per-recipient signingUrl in
the same response — eliminates the v1 separate-GET round-trip)
- sendReminder: v2 /envelope/redistribute with recipientIds filter
- downloadSignedPdf: v2 /envelope/{id}/download
- CreateDocumentMeta type: { subject, message, redirectUrl, signingOrder }
threaded through v1 + v2 paths (v1 ignores signingOrder)
port-config.ts:
- New settings: documenso_signing_order (PARALLEL/SEQUENTIAL, v2-only),
documenso_redirect_url (both versions honour)
- PortDocumensoConfig gains signingOrder + redirectUrl
documenso-payload.ts:
- DocumensoTemplatePayload.meta gains signingOrder
- buildDocumensoPayload reads from options.signingOrder, omits when null
document-templates.ts (EOI template flow):
- Pass docCfg.signingOrder + docCfg.redirectUrl into buildDocumensoPayload
documents.service.ts (sendForSigning uploaded-doc flow):
- Pass portId to documensoCreate + documensoSend (was missing)
- Thread signingOrder + redirectUrl via the new meta param
Admin Documenso settings page:
- v2 benefits card updated: now lists envelope CRUD, one-call send,
sequential enforcement, post-sign redirect as wired (was roadmap)
- Roadmap callout pruned to the three remaining deferred items:
template/use migration, /envelope/update, non-SIGNER recipient roles
- New "v2 signing behaviour" SettingsFormCard with the two new settings
Template flow stays on /api/v1/templates/{id}/generate-document by design —
Documenso 2.x accepts v1 endpoints via backward compat; full migration to
v2 /template/use requires per-template field-ID capture (admin schema work,
deferred).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-11 14:38:45 +02:00
|
|
|
signingOrder: null,
|
|
|
|
|
redirectUrl: null,
|
2026-04-28 02:22:04 +02:00
|
|
|
});
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function okResponse(body: unknown = {}): Response {
|
|
|
|
|
return new Response(JSON.stringify(body), {
|
|
|
|
|
status: 200,
|
|
|
|
|
headers: { 'Content-Type': 'application/json' },
|
|
|
|
|
});
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
describe('computeDefaultSignatureLayout', () => {
|
|
|
|
|
it('returns one centered field for a single recipient', () => {
|
|
|
|
|
const fields = computeDefaultSignatureLayout([{ id: 1, pageNumber: 3 }]);
|
|
|
|
|
expect(fields).toHaveLength(1);
|
|
|
|
|
expect(fields[0]).toMatchObject({
|
|
|
|
|
recipientId: 1,
|
|
|
|
|
type: 'SIGNATURE',
|
|
|
|
|
pageNumber: 3,
|
|
|
|
|
pageWidth: 20, // 80/1 capped at 20
|
|
|
|
|
pageHeight: 6,
|
|
|
|
|
pageY: 88,
|
|
|
|
|
});
|
|
|
|
|
expect(fields[0]!.pageX).toBeCloseTo(40, 5); // 50 - 20/2
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
it('staggers two recipients without overlap', () => {
|
|
|
|
|
const fields = computeDefaultSignatureLayout([
|
|
|
|
|
{ id: 1, pageNumber: 1 },
|
|
|
|
|
{ id: 2, pageNumber: 1 },
|
|
|
|
|
]);
|
|
|
|
|
expect(fields).toHaveLength(2);
|
|
|
|
|
expect(fields[1]!.pageX).toBeGreaterThan(fields[0]!.pageX + fields[0]!.pageWidth - 0.001);
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
it('keeps total row width <= 80% for 5 recipients', () => {
|
|
|
|
|
const fields = computeDefaultSignatureLayout(
|
|
|
|
|
[1, 2, 3, 4, 5].map((id) => ({ id, pageNumber: 1 })),
|
|
|
|
|
);
|
|
|
|
|
const totalWidth = fields[fields.length - 1]!.pageX + fields[0]!.pageWidth - fields[0]!.pageX;
|
|
|
|
|
expect(totalWidth).toBeLessThanOrEqual(80 + 0.001);
|
|
|
|
|
expect(fields.every((f) => f.pageX >= 0)).toBe(true);
|
|
|
|
|
expect(fields.every((f) => f.pageX + f.pageWidth <= 100)).toBe(true);
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
it('returns empty array for zero recipients', () => {
|
|
|
|
|
expect(computeDefaultSignatureLayout([])).toEqual([]);
|
|
|
|
|
});
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
describe('placeFields v2 dispatch', () => {
|
|
|
|
|
beforeEach(() => configurePort('v2'));
|
|
|
|
|
|
|
|
|
|
it('makes a single bulk POST to envelope/field/create-many', async () => {
|
|
|
|
|
fetchMock.mockResolvedValueOnce(okResponse());
|
|
|
|
|
await placeFields(
|
|
|
|
|
'env-123',
|
|
|
|
|
[
|
|
|
|
|
{
|
chore(autonomous-session): consolidate uncommitted work from prior session
Bundles the prior autonomous-session output that was sitting unstaged:
- Em-dash sweep across src/ + tests/ (en-dash/em-dash to hyphen, ~2280 instances)
- country-flag-icons rollout (CountryFlag component, replaces emoji glyphs that
never rendered on Windows; lazy-loads the 3x2 SVG index as a single chunk
after the per-subpath dynamic-import approach silently failed in webpack)
- Admin IA Phase 1+2: 7-domain regroup, 41 to 38 pages, /admin/berths index,
redirects (ocr to ai, reports to dashboard, invitations to users),
docs/admin-ia-proposal.md
- Per-template email tester (registry + endpoint + UI on Email admin page)
- Cancel-document mode picker (delete-from-Documenso vs keep-for-audit)
- Dashboard PDF report: 25 widgets, SVG charts, date-range picker, 11 resolvers
- Customize-widgets per-region sortables at xl+ (charts/rails/feed); single
flat sortable below xl when the layout stacks; per-viewport saved orders
- Audit doc updates capturing each shipped item
- Lint fixes: react-compiler immutability in DonutChart (reduce instead of
let-reassign), set-state-in-effect disables in CountryFlag and
UploadForSigning preview-bytes effect, unused 'confirm' destructures in
interest contract + reservation tabs, unescaped apostrophe in test-template
card copy
2026-05-23 00:52:59 +02:00
|
|
|
// v2 recipient ids are numeric - Documenso's distribute response
|
|
|
|
|
// returns them as numbers. The CRM custom-document-upload
|
|
|
|
|
// service preserves them as strings or numbers; the v2 placeFields
|
|
|
|
|
// coercion normalises to number for the upstream payload.
|
|
|
|
|
recipientId: '42',
|
2026-04-28 02:22:04 +02:00
|
|
|
type: 'SIGNATURE',
|
|
|
|
|
pageNumber: 1,
|
|
|
|
|
pageX: 25,
|
|
|
|
|
pageY: 88,
|
|
|
|
|
pageWidth: 20,
|
|
|
|
|
pageHeight: 6,
|
|
|
|
|
fieldMeta: { label: 'Sign here' },
|
|
|
|
|
},
|
|
|
|
|
],
|
|
|
|
|
'port-1',
|
|
|
|
|
);
|
|
|
|
|
|
|
|
|
|
expect(fetchMock).toHaveBeenCalledTimes(1);
|
|
|
|
|
const [url, init] = fetchMock.mock.calls[0]!;
|
|
|
|
|
expect(url).toBe('https://documenso.test/api/v2/envelope/field/create-many');
|
|
|
|
|
expect((init as RequestInit).method).toBe('POST');
|
2026-05-12 18:16:18 +02:00
|
|
|
const body = JSON.parse(String((init as RequestInit).body)) as any;
|
2026-04-28 02:22:04 +02:00
|
|
|
expect(body.envelopeId).toBe('env-123');
|
chore(autonomous-session): consolidate uncommitted work from prior session
Bundles the prior autonomous-session output that was sitting unstaged:
- Em-dash sweep across src/ + tests/ (en-dash/em-dash to hyphen, ~2280 instances)
- country-flag-icons rollout (CountryFlag component, replaces emoji glyphs that
never rendered on Windows; lazy-loads the 3x2 SVG index as a single chunk
after the per-subpath dynamic-import approach silently failed in webpack)
- Admin IA Phase 1+2: 7-domain regroup, 41 to 38 pages, /admin/berths index,
redirects (ocr to ai, reports to dashboard, invitations to users),
docs/admin-ia-proposal.md
- Per-template email tester (registry + endpoint + UI on Email admin page)
- Cancel-document mode picker (delete-from-Documenso vs keep-for-audit)
- Dashboard PDF report: 25 widgets, SVG charts, date-range picker, 11 resolvers
- Customize-widgets per-region sortables at xl+ (charts/rails/feed); single
flat sortable below xl when the layout stacks; per-viewport saved orders
- Audit doc updates capturing each shipped item
- Lint fixes: react-compiler immutability in DonutChart (reduce instead of
let-reassign), set-state-in-effect disables in CountryFlag and
UploadForSigning preview-bytes effect, unused 'confirm' destructures in
interest contract + reservation tabs, unescaped apostrophe in test-template
card copy
2026-05-23 00:52:59 +02:00
|
|
|
// 2026-05-22: Documenso v2 expects the array under `data` (trpc-style
|
|
|
|
|
// createMany input), not `fields`. recipientId is a number, and the
|
|
|
|
|
// page-index key is `page` (not `pageNumber`).
|
|
|
|
|
expect(body.data[0]).toMatchObject({
|
|
|
|
|
recipientId: 42,
|
2026-04-28 02:22:04 +02:00
|
|
|
type: 'SIGNATURE',
|
chore(autonomous-session): consolidate uncommitted work from prior session
Bundles the prior autonomous-session output that was sitting unstaged:
- Em-dash sweep across src/ + tests/ (en-dash/em-dash to hyphen, ~2280 instances)
- country-flag-icons rollout (CountryFlag component, replaces emoji glyphs that
never rendered on Windows; lazy-loads the 3x2 SVG index as a single chunk
after the per-subpath dynamic-import approach silently failed in webpack)
- Admin IA Phase 1+2: 7-domain regroup, 41 to 38 pages, /admin/berths index,
redirects (ocr to ai, reports to dashboard, invitations to users),
docs/admin-ia-proposal.md
- Per-template email tester (registry + endpoint + UI on Email admin page)
- Cancel-document mode picker (delete-from-Documenso vs keep-for-audit)
- Dashboard PDF report: 25 widgets, SVG charts, date-range picker, 11 resolvers
- Customize-widgets per-region sortables at xl+ (charts/rails/feed); single
flat sortable below xl when the layout stacks; per-viewport saved orders
- Audit doc updates capturing each shipped item
- Lint fixes: react-compiler immutability in DonutChart (reduce instead of
let-reassign), set-state-in-effect disables in CountryFlag and
UploadForSigning preview-bytes effect, unused 'confirm' destructures in
interest contract + reservation tabs, unescaped apostrophe in test-template
card copy
2026-05-23 00:52:59 +02:00
|
|
|
page: 1,
|
2026-04-28 02:22:04 +02:00
|
|
|
positionX: 25,
|
|
|
|
|
positionY: 88,
|
|
|
|
|
width: 20,
|
|
|
|
|
height: 6,
|
|
|
|
|
fieldMeta: { label: 'Sign here' },
|
|
|
|
|
});
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
it('throws on non-2xx response', async () => {
|
|
|
|
|
fetchMock.mockResolvedValueOnce(new Response('boom', { status: 500 }));
|
|
|
|
|
await expect(
|
|
|
|
|
placeFields(
|
|
|
|
|
'env-123',
|
|
|
|
|
[
|
|
|
|
|
{
|
|
|
|
|
recipientId: 'rec-a',
|
|
|
|
|
type: 'SIGNATURE',
|
|
|
|
|
pageNumber: 1,
|
|
|
|
|
pageX: 0,
|
|
|
|
|
pageY: 0,
|
|
|
|
|
pageWidth: 10,
|
|
|
|
|
pageHeight: 10,
|
|
|
|
|
},
|
|
|
|
|
],
|
|
|
|
|
'port-1',
|
|
|
|
|
),
|
fix(audit-tier-2): error-surface hygiene — toastError + CodedError sweep
Two mechanical sweeps closing the audit's HIGH §16 + MED §11 findings:
* 38 client components / 56 toast.error sites converted to
toastError(err) so the new admin error inspector becomes usable from
user-reported issues — every failed inline-edit, save, send, archive,
upload, etc. now carries the request-id + error-code (Copy ID action).
* 26 service files / 62 bare-Error throws converted to CodedError or
the existing AppError subclasses. Adds new error codes:
DOCUMENSO_UPSTREAM_ERROR (502), DOCUMENSO_AUTH_FAILURE (502),
DOCUMENSO_TIMEOUT (504), OCR_UPSTREAM_ERROR (502),
IMAP_UPSTREAM_ERROR (502), UMAMI_UPSTREAM_ERROR (502),
UMAMI_NOT_CONFIGURED (409), and INSERT_RETURNING_EMPTY (500) for
post-insert returning-empty guards.
* Five vitest assertions updated to match the new user-facing wording
(client-merge "already been merged", expense/interest "couldn't find
that …", documenso "signing service didn't respond").
Test status: 1168/1168 vitest, tsc clean.
Refs: docs/audit-comprehensive-2026-05-05.md HIGH §16 (auditor-H Issue 1)
+ MED §11 (auditor-G Issue 1).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-05 20:18:05 +02:00
|
|
|
).rejects.toThrow(/signing service didn't respond/);
|
2026-04-28 02:22:04 +02:00
|
|
|
});
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
describe('placeFields v1 dispatch', () => {
|
|
|
|
|
beforeEach(() => configurePort('v1'));
|
|
|
|
|
|
|
|
|
|
it('issues one POST per field with pixel coords on a default A4 page', async () => {
|
|
|
|
|
fetchMock.mockResolvedValue(okResponse());
|
|
|
|
|
await placeFields(
|
|
|
|
|
'doc-123',
|
|
|
|
|
[
|
|
|
|
|
{
|
|
|
|
|
recipientId: 42,
|
|
|
|
|
type: 'SIGNATURE',
|
|
|
|
|
pageNumber: 1,
|
|
|
|
|
pageX: 50, // 50% of 595 = 298 (rounded)
|
|
|
|
|
pageY: 88, // 88% of 842 = 741
|
|
|
|
|
pageWidth: 20, // 20% of 595 = 119
|
|
|
|
|
pageHeight: 6, // 6% of 842 = 51
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
recipientId: 43,
|
|
|
|
|
type: 'TEXT',
|
|
|
|
|
pageNumber: 2,
|
|
|
|
|
pageX: 10,
|
|
|
|
|
pageY: 10,
|
|
|
|
|
pageWidth: 30,
|
|
|
|
|
pageHeight: 5,
|
|
|
|
|
},
|
|
|
|
|
],
|
|
|
|
|
'port-1',
|
|
|
|
|
);
|
|
|
|
|
|
|
|
|
|
expect(fetchMock).toHaveBeenCalledTimes(2);
|
|
|
|
|
const firstCall = fetchMock.mock.calls[0]!;
|
|
|
|
|
expect(firstCall[0]).toBe('https://documenso.test/api/v1/documents/doc-123/fields');
|
2026-05-12 18:16:18 +02:00
|
|
|
const firstBody = JSON.parse(String((firstCall[1] as RequestInit).body)) as any;
|
2026-04-28 02:22:04 +02:00
|
|
|
expect(firstBody).toMatchObject({
|
|
|
|
|
recipientId: 42,
|
|
|
|
|
type: 'SIGNATURE',
|
|
|
|
|
pageNumber: 1,
|
|
|
|
|
});
|
|
|
|
|
expect(firstBody.pageX).toBe(298);
|
|
|
|
|
expect(firstBody.pageY).toBe(741);
|
|
|
|
|
expect(firstBody.pageWidth).toBe(119);
|
|
|
|
|
expect(firstBody.pageHeight).toBe(51);
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
it('coerces string recipientId to number on v1', async () => {
|
|
|
|
|
fetchMock.mockResolvedValue(okResponse());
|
|
|
|
|
await placeFields(
|
|
|
|
|
'doc-1',
|
|
|
|
|
[
|
|
|
|
|
{
|
|
|
|
|
recipientId: '99',
|
|
|
|
|
type: 'SIGNATURE',
|
|
|
|
|
pageNumber: 1,
|
|
|
|
|
pageX: 0,
|
|
|
|
|
pageY: 0,
|
|
|
|
|
pageWidth: 1,
|
|
|
|
|
pageHeight: 1,
|
|
|
|
|
},
|
|
|
|
|
],
|
|
|
|
|
'port-1',
|
|
|
|
|
);
|
2026-05-12 18:16:18 +02:00
|
|
|
const body = JSON.parse(String((fetchMock.mock.calls[0]![1] as RequestInit).body)) as any;
|
2026-04-28 02:22:04 +02:00
|
|
|
expect(body.recipientId).toBe(99);
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
it('throws on non-2xx response', async () => {
|
|
|
|
|
fetchMock.mockResolvedValueOnce(new Response('nope', { status: 422 }));
|
|
|
|
|
await expect(
|
|
|
|
|
placeFields(
|
|
|
|
|
'doc-1',
|
|
|
|
|
[
|
|
|
|
|
{
|
|
|
|
|
recipientId: 1,
|
|
|
|
|
type: 'SIGNATURE',
|
|
|
|
|
pageNumber: 1,
|
|
|
|
|
pageX: 0,
|
|
|
|
|
pageY: 0,
|
|
|
|
|
pageWidth: 1,
|
|
|
|
|
pageHeight: 1,
|
|
|
|
|
},
|
|
|
|
|
],
|
|
|
|
|
'port-1',
|
|
|
|
|
),
|
fix(audit-tier-2): error-surface hygiene — toastError + CodedError sweep
Two mechanical sweeps closing the audit's HIGH §16 + MED §11 findings:
* 38 client components / 56 toast.error sites converted to
toastError(err) so the new admin error inspector becomes usable from
user-reported issues — every failed inline-edit, save, send, archive,
upload, etc. now carries the request-id + error-code (Copy ID action).
* 26 service files / 62 bare-Error throws converted to CodedError or
the existing AppError subclasses. Adds new error codes:
DOCUMENSO_UPSTREAM_ERROR (502), DOCUMENSO_AUTH_FAILURE (502),
DOCUMENSO_TIMEOUT (504), OCR_UPSTREAM_ERROR (502),
IMAP_UPSTREAM_ERROR (502), UMAMI_UPSTREAM_ERROR (502),
UMAMI_NOT_CONFIGURED (409), and INSERT_RETURNING_EMPTY (500) for
post-insert returning-empty guards.
* Five vitest assertions updated to match the new user-facing wording
(client-merge "already been merged", expense/interest "couldn't find
that …", documenso "signing service didn't respond").
Test status: 1168/1168 vitest, tsc clean.
Refs: docs/audit-comprehensive-2026-05-05.md HIGH §16 (auditor-H Issue 1)
+ MED §11 (auditor-G Issue 1).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-05 20:18:05 +02:00
|
|
|
).rejects.toThrow(/signing service didn't respond/);
|
2026-04-28 02:22:04 +02:00
|
|
|
});
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
describe('placeDefaultSignatureFields integration', () => {
|
|
|
|
|
it('places staggered defaults on v2 envelope', async () => {
|
|
|
|
|
configurePort('v2');
|
|
|
|
|
fetchMock.mockResolvedValueOnce(okResponse());
|
|
|
|
|
await placeDefaultSignatureFields(
|
|
|
|
|
'env-x',
|
|
|
|
|
[
|
chore(autonomous-session): consolidate uncommitted work from prior session
Bundles the prior autonomous-session output that was sitting unstaged:
- Em-dash sweep across src/ + tests/ (en-dash/em-dash to hyphen, ~2280 instances)
- country-flag-icons rollout (CountryFlag component, replaces emoji glyphs that
never rendered on Windows; lazy-loads the 3x2 SVG index as a single chunk
after the per-subpath dynamic-import approach silently failed in webpack)
- Admin IA Phase 1+2: 7-domain regroup, 41 to 38 pages, /admin/berths index,
redirects (ocr to ai, reports to dashboard, invitations to users),
docs/admin-ia-proposal.md
- Per-template email tester (registry + endpoint + UI on Email admin page)
- Cancel-document mode picker (delete-from-Documenso vs keep-for-audit)
- Dashboard PDF report: 25 widgets, SVG charts, date-range picker, 11 resolvers
- Customize-widgets per-region sortables at xl+ (charts/rails/feed); single
flat sortable below xl when the layout stacks; per-viewport saved orders
- Audit doc updates capturing each shipped item
- Lint fixes: react-compiler immutability in DonutChart (reduce instead of
let-reassign), set-state-in-effect disables in CountryFlag and
UploadForSigning preview-bytes effect, unused 'confirm' destructures in
interest contract + reservation tabs, unescaped apostrophe in test-template
card copy
2026-05-23 00:52:59 +02:00
|
|
|
{ id: '101', pageNumber: 4 },
|
|
|
|
|
{ id: '102', pageNumber: 4 },
|
|
|
|
|
{ id: '103', pageNumber: 4 },
|
2026-04-28 02:22:04 +02:00
|
|
|
],
|
|
|
|
|
'port-1',
|
|
|
|
|
);
|
|
|
|
|
expect(fetchMock).toHaveBeenCalledTimes(1);
|
2026-05-12 18:16:18 +02:00
|
|
|
const body = JSON.parse(String((fetchMock.mock.calls[0]![1] as RequestInit).body)) as any;
|
chore(autonomous-session): consolidate uncommitted work from prior session
Bundles the prior autonomous-session output that was sitting unstaged:
- Em-dash sweep across src/ + tests/ (en-dash/em-dash to hyphen, ~2280 instances)
- country-flag-icons rollout (CountryFlag component, replaces emoji glyphs that
never rendered on Windows; lazy-loads the 3x2 SVG index as a single chunk
after the per-subpath dynamic-import approach silently failed in webpack)
- Admin IA Phase 1+2: 7-domain regroup, 41 to 38 pages, /admin/berths index,
redirects (ocr to ai, reports to dashboard, invitations to users),
docs/admin-ia-proposal.md
- Per-template email tester (registry + endpoint + UI on Email admin page)
- Cancel-document mode picker (delete-from-Documenso vs keep-for-audit)
- Dashboard PDF report: 25 widgets, SVG charts, date-range picker, 11 resolvers
- Customize-widgets per-region sortables at xl+ (charts/rails/feed); single
flat sortable below xl when the layout stacks; per-viewport saved orders
- Audit doc updates capturing each shipped item
- Lint fixes: react-compiler immutability in DonutChart (reduce instead of
let-reassign), set-state-in-effect disables in CountryFlag and
UploadForSigning preview-bytes effect, unused 'confirm' destructures in
interest contract + reservation tabs, unescaped apostrophe in test-template
card copy
2026-05-23 00:52:59 +02:00
|
|
|
// 2026-05-22: Documenso v2 expects `data` (not `fields`), `page`
|
|
|
|
|
// (not `pageNumber`), and numeric recipientIds.
|
|
|
|
|
expect(body.data).toHaveLength(3);
|
|
|
|
|
expect(body.data.every((f: { type: string }) => f.type === 'SIGNATURE')).toBe(true);
|
|
|
|
|
expect(body.data.every((f: { page: number }) => f.page === 4)).toBe(true);
|
|
|
|
|
expect(
|
|
|
|
|
body.data.every((f: { recipientId: unknown }) => typeof f.recipientId === 'number'),
|
|
|
|
|
).toBe(true);
|
2026-04-28 02:22:04 +02:00
|
|
|
});
|
|
|
|
|
|
|
|
|
|
it('skips the API call entirely with zero recipients', async () => {
|
|
|
|
|
configurePort('v1');
|
|
|
|
|
await placeDefaultSignatureFields('doc-y', [], 'port-1');
|
|
|
|
|
expect(fetchMock).not.toHaveBeenCalled();
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
it('issues N per-field POSTs with pixel-converted coords on v1', async () => {
|
|
|
|
|
configurePort('v1');
|
|
|
|
|
fetchMock.mockResolvedValue(okResponse());
|
|
|
|
|
await placeDefaultSignatureFields(
|
|
|
|
|
'doc-z',
|
|
|
|
|
[
|
|
|
|
|
{ id: 7, pageNumber: 1 },
|
|
|
|
|
{ id: 8, pageNumber: 1 },
|
|
|
|
|
],
|
|
|
|
|
'port-1',
|
|
|
|
|
);
|
|
|
|
|
expect(fetchMock).toHaveBeenCalledTimes(2);
|
|
|
|
|
for (const call of fetchMock.mock.calls) {
|
|
|
|
|
expect(call[0]).toBe('https://documenso.test/api/v1/documents/doc-z/fields');
|
2026-05-12 18:16:18 +02:00
|
|
|
const body = JSON.parse(String((call[1] as RequestInit).body)) as any;
|
2026-04-28 02:22:04 +02:00
|
|
|
expect(body.type).toBe('SIGNATURE');
|
|
|
|
|
expect(body.pageNumber).toBe(1);
|
|
|
|
|
// 88% of 842 = 741 (footer band)
|
|
|
|
|
expect(body.pageY).toBe(741);
|
|
|
|
|
// height = 6% of 842 = 51
|
|
|
|
|
expect(body.pageHeight).toBe(51);
|
|
|
|
|
// width = 20% of 595 = 119
|
|
|
|
|
expect(body.pageWidth).toBe(119);
|
|
|
|
|
}
|
|
|
|
|
});
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
describe('voidDocument', () => {
|
|
|
|
|
it('issues DELETE to /api/v1/documents/{id} on v1', async () => {
|
|
|
|
|
configurePort('v1');
|
|
|
|
|
fetchMock.mockResolvedValueOnce(new Response(null, { status: 204 }));
|
|
|
|
|
await voidDocument('doc-1', 'port-1');
|
|
|
|
|
expect(fetchMock).toHaveBeenCalledWith(
|
|
|
|
|
'https://documenso.test/api/v1/documents/doc-1',
|
|
|
|
|
expect.objectContaining({ method: 'DELETE' }),
|
|
|
|
|
);
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
it('issues DELETE to /api/v2/envelope/{id} on v2', async () => {
|
|
|
|
|
configurePort('v2');
|
|
|
|
|
fetchMock.mockResolvedValueOnce(new Response(null, { status: 204 }));
|
|
|
|
|
await voidDocument('env-1', 'port-1');
|
|
|
|
|
expect(fetchMock).toHaveBeenCalledWith(
|
|
|
|
|
'https://documenso.test/api/v2/envelope/env-1',
|
|
|
|
|
expect.objectContaining({ method: 'DELETE' }),
|
|
|
|
|
);
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
it('treats 404 as idempotent success', async () => {
|
|
|
|
|
configurePort('v1');
|
|
|
|
|
fetchMock.mockResolvedValueOnce(new Response('not found', { status: 404 }));
|
|
|
|
|
await expect(voidDocument('doc-1', 'port-1')).resolves.toBeUndefined();
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
it('throws on other non-2xx responses', async () => {
|
|
|
|
|
configurePort('v2');
|
|
|
|
|
fetchMock.mockResolvedValueOnce(new Response('boom', { status: 500 }));
|
fix(audit-tier-2): error-surface hygiene — toastError + CodedError sweep
Two mechanical sweeps closing the audit's HIGH §16 + MED §11 findings:
* 38 client components / 56 toast.error sites converted to
toastError(err) so the new admin error inspector becomes usable from
user-reported issues — every failed inline-edit, save, send, archive,
upload, etc. now carries the request-id + error-code (Copy ID action).
* 26 service files / 62 bare-Error throws converted to CodedError or
the existing AppError subclasses. Adds new error codes:
DOCUMENSO_UPSTREAM_ERROR (502), DOCUMENSO_AUTH_FAILURE (502),
DOCUMENSO_TIMEOUT (504), OCR_UPSTREAM_ERROR (502),
IMAP_UPSTREAM_ERROR (502), UMAMI_UPSTREAM_ERROR (502),
UMAMI_NOT_CONFIGURED (409), and INSERT_RETURNING_EMPTY (500) for
post-insert returning-empty guards.
* Five vitest assertions updated to match the new user-facing wording
(client-merge "already been merged", expense/interest "couldn't find
that …", documenso "signing service didn't respond").
Test status: 1168/1168 vitest, tsc clean.
Refs: docs/audit-comprehensive-2026-05-05.md HIGH §16 (auditor-H Issue 1)
+ MED §11 (auditor-G Issue 1).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-05 20:18:05 +02:00
|
|
|
await expect(voidDocument('env-1', 'port-1')).rejects.toThrow(/signing service didn't respond/);
|
2026-04-28 02:22:04 +02:00
|
|
|
});
|
|
|
|
|
});
|