`test/pre-send-gate.test.js`

97 lines
'use strict';

const assert = require('node:assert/strict');
const { assertPreSendCompliance, REQUIRED_FROM } = require('../lib/pre-send-gate');
const { compose } = require('../lib/compose');

const compliant = compose({
  name: 'Test Vendor',
  account_number: '123',
  sample_email: 'samples@example.com',
  ship_to: {
    name: 'Designer Wallcoverings',
    line1: '15442 Ventura Blvd. #102',
    city_state_zip: 'Sherman Oaks, CA 91403',
    phone: '1-888-373-4564',
  },
}, [{ sku: 'DW-1', requested: '08/01/2026', mfr: 'ABC' }]);

assert.equal(assertPreSendCompliance({ from: REQUIRED_FROM, subject: compliant.subject, body: compliant.html }), true);

for (const mutation of [
  { from: 'wrong@example.com', subject: compliant.subject, body: compliant.html },
  { from: REQUIRED_FROM, subject: `Re: ${compliant.subject}`, body: compliant.html },
  { from: REQUIRED_FROM, subject: compliant.subject, body: compliant.html.replace(/15442 Ventura Blvd\. #102/g, '') },
  { from: REQUIRED_FROM, subject: compliant.subject, body: compliant.html.replace(/<a href="mailto:info@designerwallcoverings\.com\?subject=Unsubscribe[\s\S]*?<\/a>/, '') },
]) {
  assert.throws(() => assertPreSendCompliance(mutation), { code: 'PRE_SEND_COMPLIANCE_BLOCKED' });
}

const bodyWithoutLink = compliant.html.replace(/<a href="mailto:info@designerwallcoverings\.com\?subject=Unsubscribe[\s\S]*?<\/a>/, 'unsubscribe here');
for (const fakeLink of [
  '<!-- <a href="mailto:info@designerwallcoverings.com?subject=Unsubscribe">unsubscribe</a> -->',
  'mailto:info@designerwallcoverings.com?subject=Unsubscribe',
  '<a href="https://invalid.example/unsubscribe">unsubscribe</a>',
]) {
  assert.throws(() => assertPreSendCompliance({ from: REQUIRED_FROM, subject: compliant.subject, body: bodyWithoutLink + fakeLink }), { code: 'PRE_SEND_COMPLIANCE_BLOCKED' });
}

const bodyWithoutAddress = compliant.html
  .replace(/Designer Wallcoverings · 15442 Ventura Blvd\. #102 · Sherman Oaks, CA 91403<br>/, '')
  .replace(/Designer Wallcoverings<br>\s*15442 Ventura Blvd\. #102<br>\s*Sherman Oaks, CA 91403<br>/, '');
for (const hiddenAddress of [
  '<div hidden>15442 Ventura Blvd. #102, Sherman Oaks, CA 91403</div>',
  '<div style="display:none">15442 Ventura Blvd. #102, Sherman Oaks, CA 91403</div>',
  '<script>const address = "15442 Ventura Blvd. #102, Sherman Oaks, CA 91403"</script>',
  '<template>15442 Ventura Blvd. #102, Sherman Oaks, CA 91403</template>',
]) {
  assert.throws(() => assertPreSendCompliance({ from: REQUIRED_FROM, subject: compliant.subject, body: bodyWithoutAddress + hiddenAddress }), { code: 'PRE_SEND_COMPLIANCE_BLOCKED' });
}

const scriptOnly = bodyWithoutLink + '<script>document.write(`<a href="mailto:info@designerwallcoverings.com?subject=Unsubscribe">unsubscribe</a>`)</script>';
assert.throws(() => assertPreSendCompliance({ from: REQUIRED_FROM, subject: compliant.subject, body: scriptOnly }), { code: 'PRE_SEND_COMPLIANCE_BLOCKED' });

const attackerOwned = bodyWithoutLink + '<a href="https://attacker.example.org/unsubscribe">unsubscribe</a>';
assert.throws(() => assertPreSendCompliance({ from: REQUIRED_FROM, subject: compliant.subject, body: attackerOwned }), { code: 'PRE_SEND_COMPLIANCE_BLOCKED' });

for (const labelBypass of [
  '<a href="mailto:info@designerwallcoverings.com?subject=Unsubscribe"></a>',
  '<a href="mailto:info@designerwallcoverings.com?subject=Unsubscribe">   </a>',
  '<a href="mailto:info@designerwallcoverings.com?subject=Unsubscribe">✉</a>',
  '<a href="mailto:info@designerwallcoverings.com?subject=Unsubscribe"><span hidden>unsubscribe</span></a>',
  '<a href="mailto:info@designerwallcoverings.com?subject=Unsubscribe"><span style="display:none">opt out</span></a>',
]) {
  assert.throws(() => assertPreSendCompliance({ from: REQUIRED_FROM, subject: compliant.subject, body: bodyWithoutLink + labelBypass }), { code: 'PRE_SEND_COMPLIANCE_BLOCKED' });
}

for (const mailtoInjection of [
  'mailto:info@designerwallcoverings.com?subject=Unsubscribe&bcc=attacker@example.org',
  'mailto:info@designerwallcoverings.com?subject=Unsubscribe&cc=attacker@example.org',
  'mailto:info@designerwallcoverings.com?subject=Unsubscribe&to=attacker@example.org',
  'mailto:info@designerwallcoverings.com?subject=Unsubscribe&subject=Opt%20out',
  'mailto:info@designerwallcoverings.com?subject=Unsubscribe&body=remove%20me',
  'mailto:info@designerwallcoverings.com?subject=Unsubscribe&x-extra=1',
  'mailto:info@designerwallcoverings.com,attacker@example.org?subject=Unsubscribe',
  'mailto:info@designerwallcoverings.com%2Cattacker@example.org?subject=Unsubscribe',
  'mailto:info@designerwallcoverings.com;attacker@example.org?subject=Unsubscribe',
  'mailto:info@designerwallcoverings.com?subject=Unsubscribe#attacker',
  'mailto:info@designerwallcoverings.com?subject=Unsubscribe%0ABcc%3Aattacker%40example.org',
]) {
  const injected = bodyWithoutLink + `<a href="${mailtoInjection.replace(/&/g, '&amp;')}">unsubscribe here</a>`;
  assert.throws(() => assertPreSendCompliance({ from: REQUIRED_FROM, subject: compliant.subject, body: injected }), { code: 'PRE_SEND_COMPLIANCE_BLOCKED' });
}

const validOptOut = compliant.html.match(/<a href="mailto:[\s\S]*?<\/a>/)[0];
for (const parserBypass of [
  '<div style="display&#58;none">15442 Ventura Blvd. #102, Sherman Oaks, CA 91403</div>' + validOptOut,
  '<div style="display:/**/none">15442 Ventura Blvd. #102, Sherman Oaks, CA 91403</div>' + validOptOut,
  '<script>15442 Ventura Blvd. #102, Sherman Oaks, CA 91403 <a href="mailto:info@designerwallcoverings.com?subject=Unsubscribe">unsubscribe</a>',
]) {
  assert.throws(() => assertPreSendCompliance({ from: REQUIRED_FROM, subject: compliant.subject, body: parserBypass }), { code: 'PRE_SEND_COMPLIANCE_BLOCKED' });
}

const reconciledFooter = `<div><p>Ship to:<br>Designer Wallcoverings<br>15442 Ventura Blvd. #102<br>Sherman Oaks, CA 91403<br>1-888-373-4564</p><p>Thank you!<br>Showroom Manager</p><p>Designer Wallcoverings · 15442 Ventura Blvd. #102 · Sherman Oaks, CA 91403<br>To stop receiving sample follow-up emails, <a href="mailto:info@designerwallcoverings.com?subject=Unsubscribe%20from%20sample%20follow-ups">unsubscribe here</a>.</p></div>`;
assert.equal(assertPreSendCompliance({ from: REQUIRED_FROM, subject: 'Sample Follow-Up — Outstanding Memos — Designer Wallcoverings', body: reconciledFooter }), true);

console.log('pre-send compliance gate: PASS');