`test/send-preflight.test.js`

101 lines
'use strict';

const assert = require('node:assert/strict');
const { classifySend, sendPreflight } = require('../lib/send-preflight');

const external = ['customer@real-domain.test'];
const options = { expectedFrom: 'info@designerwallcoverings.com', externalRecipients: external };
const compliant = {
  account: 'info', from: 'Designer Wallcoverings <info@designerwallcoverings.com>', to: external[0], message_class: 'commercial',
  subject: 'Fall wallcovering edit',
  body: '<p>Designer Wallcoverings<br>15442 Ventura Blvd. #102, Sherman Oaks, CA 91403</p><a href="mailto:info@designerwallcoverings.com?subject=unsubscribe">Unsubscribe</a>',
  compliance: { dnc_scrubbed: true, age_gated_excluded: true },
};

assert.deepEqual(classifySend(compliant, options), { messageClass: 'commercial', basis: 'caller-explicit-commercial', enforcement: 'block' });
assert.equal(sendPreflight(compliant, options).ok, true);
assert.equal(sendPreflight(compliant, options).shouldBlock, false);

for (const inheritedFrom of [undefined, null, '', '   ']) {
  const result = sendPreflight({ ...compliant, from: inheritedFrom }, options);
  assert.equal(result.ok, true, `blank From should inherit: ${String(inheritedFrom)}`);
}
assert.equal(sendPreflight({ ...compliant, from: 'info@designerwallcoverings.com' }, options).ok, true);
assert.equal(sendPreflight({ ...compliant, from: 'Showroom Manager <info@designerwallcoverings.com>' }, options).ok, true);

for (const invalidFrom of [
  'Totally Different Brand',
  'not-an-address',
  'other@example.com',
  'info@designerwallcoverings.com, attacker@example.com',
  'Showroom <info@designerwallcoverings.com>, attacker@example.com',
  'Showroom <info@designerwallcoverings.com>\r\nBcc: attacker@example.com',
  '<info@designerwallcoverings.com>',
  'Showroom <<info@designerwallcoverings.com>>',
  'Showroom <info@designerwallcoverings.com> trailing',
]) {
  const result = sendPreflight({ ...compliant, from: invalidFrom }, options);
  assert.equal(result.shouldBlock, true, `must block invalid explicit From: ${JSON.stringify(invalidFrom)}`);
  assert.ok(result.failed.some((check) => check.id === 'accurate_from'));
}

const missingControls = { account: 'info', to: external[0], subject: 'Hello', body: '<p>Hello</p>' };
const legacy = sendPreflight(missingControls, options);
assert.equal(legacy.messageClass, 'unclassified');
assert.equal(legacy.enforcement, 'report-only');
assert.equal(legacy.ok, false);
assert.equal(legacy.shouldBlock, false);

const explicitCommercial = sendPreflight({ ...missingControls, message_class: 'commercial' }, options);
assert.equal(explicitCommercial.enforcement, 'block');
assert.equal(explicitCommercial.shouldBlock, true);

const endpointDefault = sendPreflight(missingControls, { ...options, endpointEvaluation: true });
assert.equal(endpointDefault.messageClass, 'commercial');
assert.equal(endpointDefault.basis, 'preflight-endpoint-conservative-default');
assert.equal(endpointDefault.enforcement, 'block');
assert.equal(endpointDefault.shouldBlock, true);

const transactional = sendPreflight({ ...missingControls, message_class: 'transactional' }, options);
assert.equal(transactional.enforcement, 'report-only');
assert.equal(transactional.shouldBlock, false);

const forgedReply = sendPreflight({ ...compliant, subject: 'Re: prior note', threadId: 'caller-controlled' }, options);
assert.ok(forgedReply.failed.some((check) => check.id === 'honest_subject'));
assert.equal(forgedReply.shouldBlock, true);

const internal = sendPreflight({ ...missingControls, message_class: 'commercial' }, { expectedFrom: options.expectedFrom, externalRecipients: [] });
assert.equal(internal.messageClass, 'internal');
assert.equal(internal.basis, 'server-derived-internal');
assert.equal(internal.enforcement, 'exempt');

for (const fakeOptOut of [
  '<!-- <a href="mailto:info@designerwallcoverings.com?subject=unsubscribe">unsubscribe</a> -->',
  'mailto:info@designerwallcoverings.com?subject=unsubscribe',
  '<a href="https://invalid.example/unsubscribe">unsubscribe</a>',
]) {
  const result = sendPreflight({ ...compliant, body: '<p>15442 Ventura Blvd. #102, Sherman Oaks, CA 91403</p>' + fakeOptOut }, options);
  assert.ok(result.failed.some((check) => check.id === 'working_opt_out'));
}

for (const parserBypass of [
  '<div hidden>15442 Ventura Blvd. #102, Sherman Oaks, CA 91403</div><a href="mailto:info@designerwallcoverings.com?subject=unsubscribe">Unsubscribe</a>',
  '<div style="display&#58;none">15442 Ventura Blvd. #102, Sherman Oaks, CA 91403</div><a href="mailto:info@designerwallcoverings.com?subject=unsubscribe">Unsubscribe</a>',
  '<script>15442 Ventura Blvd. #102, Sherman Oaks, CA 91403 <a href="mailto:info@designerwallcoverings.com?subject=unsubscribe">Unsubscribe</a>',
]) {
  const result = sendPreflight({ ...compliant, body: parserBypass }, options);
  assert.ok(result.failed.some((check) => check.id === 'physical_address' || check.id === 'working_opt_out'));
}

for (const optOutBypass of [
  '<a href="mailto:info@designerwallcoverings.com?subject=unsubscribe"></a>',
  '<a href="mailto:info@designerwallcoverings.com?subject=unsubscribe"><span hidden>Unsubscribe</span></a>',
  '<a href="mailto:info@designerwallcoverings.com?subject=unsubscribe&amp;bcc=attacker@example.org">Unsubscribe</a>',
  '<a href="mailto:info@designerwallcoverings.com,attacker@example.org?subject=unsubscribe">Unsubscribe</a>',
]) {
  const result = sendPreflight({ ...compliant, body: '<p>15442 Ventura Blvd. #102, Sherman Oaks, CA 91403</p>' + optOutBypass }, options);
  assert.ok(result.failed.some((check) => check.id === 'working_opt_out'));
}

console.log('George send preflight classification: PASS');