should fail before SMTP
', + attachments: [{ fileId: OTHER_PORT_FILE_ID! }], + }, + }); + expect(res.status()).toBe(403); + }); +}); diff --git a/tests/e2e/realapi/minio-file-lifecycle.spec.ts b/tests/e2e/realapi/minio-file-lifecycle.spec.ts new file mode 100644 index 0000000..f748f4f --- /dev/null +++ b/tests/e2e/realapi/minio-file-lifecycle.spec.ts @@ -0,0 +1,62 @@ +import 'dotenv/config'; +import { test, expect } from '@playwright/test'; + +import { login, apiHeaders } from '../smoke/helpers'; + +/** + * Real-API spec for the MinIO file lifecycle (Phase A PR11). + * + * Uploads a file via POST /api/v1/files, lists it, downloads it, asserts + * byte-equality with the upload, then deletes it. Verifies port-isolation + * by attempting download with no auth and expecting 401. + * + * Requires MINIO_* env to be configured (the dev-server startup already + * validates these via env.ts). Skips when MINIO_ENDPOINT is unset. + */ + +const MINIO_ENDPOINT = process.env.MINIO_ENDPOINT; + +test.describe('MinIO file lifecycle', () => { + test.skip(!MINIO_ENDPOINT, 'MINIO_ENDPOINT not configured'); + + test.beforeEach(async ({ page }) => { + await login(page, 'super_admin'); + }); + + test('upload → list → download → delete round-trip', async ({ page }) => { + const headers = await apiHeaders(page); + const sentinel = `phase-a-minio-${Date.now()}`; + const buffer = Buffer.from(sentinel.repeat(8)); + + // Upload + const uploadRes = await page.request.post('/api/v1/files', { + headers, + multipart: { + file: { + name: 'phase-a-minio.txt', + mimeType: 'text/plain', + buffer, + }, + }, + }); + expect(uploadRes.ok(), `upload: ${uploadRes.status()}`).toBe(true); + const uploadBody = (await uploadRes.json()) as { data: { id: string } }; + const fileId = uploadBody.data.id; + + // List should include the file + const list = await page.request.get('/api/v1/files?limit=50', { headers }); + expect(list.ok()).toBe(true); + const listBody = (await list.json()) as { data: Array<{ id: string }> }; + expect(listBody.data.find((f) => f.id === fileId)).toBeDefined(); + + // Download — assert byte-equality + const dlRes = await page.request.get(`/api/v1/files/${fileId}/download`, { headers }); + expect(dlRes.ok()).toBe(true); + const dlBody = await dlRes.body(); + expect(dlBody.equals(buffer)).toBe(true); + + // Delete + const delRes = await page.request.delete(`/api/v1/files/${fileId}`, { headers }); + expect(delRes.ok()).toBe(true); + }); +}); diff --git a/tests/e2e/realapi/smtp-system-send.spec.ts b/tests/e2e/realapi/smtp-system-send.spec.ts new file mode 100644 index 0000000..d3ec369 --- /dev/null +++ b/tests/e2e/realapi/smtp-system-send.spec.ts @@ -0,0 +1,98 @@ +import 'dotenv/config'; +import { test, expect } from '@playwright/test'; +import { ImapFlow } from 'imapflow'; +import { simpleParser } from 'mailparser'; + +import { login, apiHeaders } from '../smoke/helpers'; + +/** + * Real-API spec for the system-path send (Phase A PR8). + * + * Composes via the email composer with senderType=system, asserts the message + * lands in the configured IMAP mailbox via the port-config noreply identity, + * and verifies the attachment bytes round-trip end-to-end. + * + * Requires: + * SMTP_HOST / SMTP_PORT / SMTP_USER / SMTP_PASS — outbound transport + * IMAP_HOST / IMAP_PORT / IMAP_USER / IMAP_PASS — inbound for verification + */ + +const SMTP_HOST = process.env.SMTP_HOST; +const IMAP_HOST = process.env.IMAP_HOST; +const IMAP_PORT = process.env.IMAP_PORT ? Number(process.env.IMAP_PORT) : 993; +const IMAP_USER = process.env.IMAP_USER; +const IMAP_PASS = process.env.IMAP_PASS; + +test.describe('SMTP system-path send', () => { + test.skip(!SMTP_HOST || !IMAP_HOST || !IMAP_USER || !IMAP_PASS, 'SMTP/IMAP env not configured'); + + test.beforeEach(async ({ page }) => { + await login(page, 'super_admin'); + }); + + test('system send → IMAP fetch → attachment bytes match', async ({ page }) => { + const headers = await apiHeaders(page); + + // 1. Upload a small file we'll attach to the email. + const sentinel = `phase-a-attach-${Date.now()}`; + const uploadRes = await page.request.post('/api/v1/files', { + headers, + multipart: { + file: { + name: 'phase-a.txt', + mimeType: 'text/plain', + buffer: Buffer.from(sentinel), + }, + }, + }); + expect(uploadRes.ok(), `upload: ${uploadRes.status()}`).toBe(true); + const uploadBody = (await uploadRes.json()) as { data: { id: string } }; + + // 2. Compose via system path + const subject = `Phase A system send ${Date.now()}`; + const sendRes = await page.request.post('/api/v1/email/compose', { + headers, + data: { + senderType: 'system', + to: [IMAP_USER!], + subject, + bodyHtml: 'System-path send.
', + attachments: [{ fileId: uploadBody.data.id, filename: 'phase-a.txt' }], + }, + }); + expect(sendRes.ok(), `compose: ${sendRes.status()} ${await sendRes.text()}`).toBe(true); + + // 3. Poll IMAP for the message. + const client = new ImapFlow({ + host: IMAP_HOST!, + port: IMAP_PORT, + secure: IMAP_PORT === 993, + auth: { user: IMAP_USER!, pass: IMAP_PASS! }, + logger: false, + }); + await client.connect(); + try { + let attempts = 0; + let attachmentMatched = false; + while (attempts++ < 18 && !attachmentMatched) { + await new Promise((r) => setTimeout(r, 5_000)); + const lock = await client.getMailboxLock('INBOX'); + try { + for await (const msg of client.fetch({ subject } as never, { source: true })) { + const parsed = await simpleParser(msg.source as Buffer); + const att = parsed.attachments.find((a) => a.filename === 'phase-a.txt'); + if (att && att.content.toString() === sentinel) { + attachmentMatched = true; + break; + } + } + } finally { + lock.release(); + } + } + expect(attachmentMatched, 'attachment bytes match').toBe(true); + } finally { + await client.logout(); + } + }); +});