Merge remote-tracking branch 'origin/main' into feat/analytics-csv-export

Author: PiyushTheProgrammer

CODE_OF_CONDUCT.md

@@ -0,0 +1,31 @@
+# Code of Conduct
+
+## Our Pledge
+
+We are committed to creating a welcoming, respectful, and inclusive environment for everyone participating in this project.
+
+## Expected Behavior
+
+- Be respectful and supportive
+- Use inclusive and professional language
+- Accept constructive feedback gracefully
+- Collaborate positively with others
+
+## Unacceptable Behavior
+
+- Harassment or discrimination
+- Offensive or abusive language
+- Personal attacks or trolling
+- Sharing private information without permission
+
+## Responsibilities
+
+Maintainers are responsible for enforcing this Code of Conduct and ensuring a safe environment for all contributors.
+
+## Enforcement
+
+Violations may result in warnings, temporary restrictions, or permanent removal from the community depending on the severity of the behavior.
+
+## Final Note
+
+By participating in this project, you agree to follow this Code of Conduct and help maintain a positive community.

apps/backend/src/__tests__/follow.test.ts

@@ -0,0 +1,57 @@
+import Fastify from 'fastify';
+import { describe, expect, it, vi } from 'vitest';
+
+import { followRoutes } from '../routes/follow.js';
+
+vi.mock('../utils/encryption.js', () => ({
+  decrypt: vi.fn(() => 'fake-access-token'),
+}));
+
+describe('POST /api/follow/:platform/:targetUsername', () => {
+  it('returns 400 when API follow is not supported for the platform', async () => {
+    const app = Fastify({ logger: false });
+
+    const findUnique = vi.fn().mockResolvedValue({
+      id: 'token-1',
+      userId: 'user-1',
+      platform: 'unknown',
+      accessToken: 'encrypted-token',
+    });
+
+    app.decorate('prisma', {
+      oAuthToken: {
+        findUnique,
+      },
+      followLog: {
+        create: vi.fn(),
+      },
+    }as any);
+
+    app.decorate('authenticate', async (request: any) => {
+      request.user = { id: 'user-1' };
+    });
+
+    await app.register(followRoutes, { prefix: '/api/follow' });
+    await app.ready();
+
+    const response = await app.inject({
+      method: 'POST',
+      url: '/api/follow/unknown/targetUser',
+    });
+
+    const body = response.json();
+
+    expect(response.statusCode).toBe(400);
+    expect(body.error).toContain('API follow not supported');
+    expect(findUnique).toHaveBeenCalledWith({
+      where: {
+        userId_platform: {
+          userId: 'user-1',
+          platform: 'unknown',
+        },
+      },
+    });
+
+    await app.close();
+  });
+});

apps/backend/src/__tests__/profiles.test.ts

@@ -1,39 +1,103 @@
 import { describe, it, expect, beforeEach, vi } from 'vitest';
+import Fastify from 'fastify';
+import { profileRoutes } from '../routes/profiles.js';
 
-// Mock test for duplicate username check
-// Note: This test verifies the expected behavior of the /api/profiles/me PUT endpoint
-// when attempting to change username to one that's already taken.
-//
-// The actual implementation in profiles.ts (lines 54-63) already handles this correctly:
-// - Checks for existing username with different user ID
-// - Returns 409 status with { error: "Username already taken" }
-//
-// Concurrency note: The current implementation uses a simple findFirst query.
-// For production, consider adding a timestamp/version field to handle race conditions
-// where two users might try to claim the same username simultaneously.
-
-describe('PUT /api/profiles/me - Duplicate Username', () => {
-  // This test would require setting up the full Fastify app with test database
-  // For now, documenting the expected behavior based on profiles.ts implementation
-
-  it('should return 409 with error "Username already taken" when username exists', async () => {
-    // Expected behavior (from profiles.ts lines 54-63):
-    // const existing = await app.prisma.user.findFirst({
-    //   where: {
-    //     username: parsed.data.username,
-    //     NOT: { id: userId },
-    //   },
-    // });
-    // if (existing) {
-    //   return reply.status(409).send({ error: 'Username already taken' });
-    // }
-
-    // Expected response:
-    expect(true).toBe(true); // Placeholder - actual test needs full app setup
+const mockUser = {
+  id: 'user-123',
+  email: 'test@example.com',
+  username: 'testuser',
+  displayName: 'Test User',
+  bio: null,
+  pronouns: null,
+  role: null,
+  company: null,
+  avatarUrl: null,
+  accentColor: '#ffffff',
+  platformLinks: [],
+  cards: [],
+  provider: 'github',
+  providerId: 'gh-123',
+};
+
+const mockPrisma = {
+  user: {
+    findUnique: vi.fn(),
+    findFirst: vi.fn(),
+    update: vi.fn(),
+  },
+};
+
+async function buildApp() {
+  const app = Fastify();
+  app.decorate('prisma', mockPrisma);
+  app.decorate('authenticate', async (request: any) => {
+    request.user = { id: 'user-123' };
+  });
+  app.register(profileRoutes, { prefix: '/api/profiles' });
+  await app.ready();
+  return app;
+}
+
+describe('GET /api/profiles/me', () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it('should return user profile with displayName', async () => {
+    mockPrisma.user.findUnique.mockResolvedValue(mockUser);
+    const app = await buildApp();
+    const res = await app.inject({ method: 'GET', url: '/api/profiles/me' });
+    expect(res.statusCode).toBe(200);
+    const body = res.json();
+    expect(body.displayName).toBe('Test User');
+    expect(body.email).toBe('test@example.com');
+    expect(body.provider).toBeUndefined();
+    expect(body.providerId).toBeUndefined();
+  });
+
+  it('should return 404 if user not found', async () => {
+    mockPrisma.user.findUnique.mockResolvedValue(null);
+    const app = await buildApp();
+    const res = await app.inject({ method: 'GET', url: '/api/profiles/me' });
+    expect(res.statusCode).toBe(404);
+    expect(res.json().error).toBe('User not found');
+  });
+});
+
+describe('PUT /api/profiles/me', () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it('should update profile and return updated data', async () => {
+    mockPrisma.user.findFirst.mockResolvedValue(null);
+    mockPrisma.user.update.mockResolvedValue({ ...mockUser, displayName: 'Updated Name' });
+    const app = await buildApp();
+    const res = await app.inject({
+      method: 'PUT',
+      url: '/api/profiles/me',
+      payload: { displayName: 'Updated Name' },
+    });
+    expect(res.statusCode).toBe(200);
+    expect(res.json().displayName).toBe('Updated Name');
+  });
+
+  it('should return 400 for invalid accentColor', async () => {
+    const app = await buildApp();
+    const res = await app.inject({
+      method: 'PUT',
+      url: '/api/profiles/me',
+      payload: { accentColor: 'notacolor' },
+    });
+    expect(res.statusCode).toBe(400);
+    expect(res.json().error).toBe('Validation failed');
   });
 
-  it('should allow username change when username is available', async () => {
-    // Expected: 200 OK with updated profile
-    expect(true).toBe(true);
+  it('should return 409 if username is already taken', async () => {
+    mockPrisma.user.findFirst.mockResolvedValue({ id: 'other-user' });
+    const app = await buildApp();
+    const res = await app.inject({
+      method: 'PUT',
+      url: '/api/profiles/me',
+      payload: { username: 'takenuser' },
+    });
+    expect(res.statusCode).toBe(409);
+    expect(res.json().error).toBe('Username already taken');
   });
 });

apps/backend/src/app.ts

@@ -37,7 +37,22 @@ export async function buildApp() {
     credentials: true,
   });
 
-  await app.register(helmet, { contentSecurityPolicy: false });
+  await app.register(helmet, {
+    contentSecurityPolicy: {
+      directives: {
+        defaultSrc: ["'self'"],
+        baseUri: ["'self'"],
+        fontSrc: ["'self'", 'https:', 'data:', 'https://fonts.gstatic.com'],
+        frameAncestors: ["'self'"],
+        imgSrc: ["'self'", 'data:', 'https:'],
+        objectSrc: ["'none'"],
+        scriptSrc: ["'self'"],
+        scriptSrcAttr: ["'none'"],
+        styleSrc: ["'self'", 'https:', "'unsafe-inline'", 'https://fonts.googleapis.com'],
+        upgradeInsecureRequests: [],
+      },
+    },
+  });
 
   await app.register(jwt, {
     secret: process.env.JWT_SECRET || 'dev-secret-change-me',