test/plan.test.js (2516 bytes)
1 "use strict"; 2 const test = require("node:test"); 3 const assert = require("node:assert/strict"); 4 const fc = require("fast-check"); 5 const Plan = require("../lib/plan.js"); 6 7 // Any text in the place of an address: a web address, another scheme, or none. 8 const address = fc.oneof( 9 fc.webUrl(), 10 fc.string(), 11 fc.constantFrom("javascript:alert(1)", "data:text/html,x", "file:///etc/passwd", "ftp://example.org/"), 12 ); 13 14 test("each payment link is a web address", () => { 15 fc.assert(fc.property(address, address, address, address, address, (support, manage, teams, large, terms) => { 16 for (const l of Plan.links({ support, manage, teams, teams_large: large, terms })) { 17 assert.match(l.href, /^https?:\/\//); 18 assert.equal(new URL(l.href).href, l.href); 19 } 20 }), { numRuns: 1000 }); 21 }); 22 23 test("a web address stays", () => { 24 fc.assert(fc.property(fc.webUrl(), (u) => { 25 assert.equal(Plan.web(u), new URL(u).href); 26 assert.equal(Plan.links({ support: u }).length, 1); 27 }), { numRuns: 1000 }); 28 }); 29 30 test("the links of the server, in the order of the server", () => { 31 // An answer of GET /api/account, as the server gives it. 32 const info = JSON.parse('{"email":"me@example.org","state":"Sync is on.","plans":[],"portal":false,' + 33 '"terms":"https://sbm.example.org/terms","support":"https://buy.stripe.com/support",' + 34 '"manage":"https://billing.stripe.com/p/login/x","teams":"https://buy.stripe.com/small",' + 35 '"teams_large":"https://buy.stripe.com/large"}'); 36 assert.deepEqual(Plan.links(info).map((l) => l.text + " = " + l.href), [ 37 "Become a supporter = https://buy.stripe.com/support", 38 "Manage or cancel a supporter subscription = https://billing.stripe.com/p/login/x", 39 "Team bookmarks: up to 10 people = https://buy.stripe.com/small", 40 "Team bookmarks: 11 people or more = https://buy.stripe.com/large", 41 "Terms of sale = https://sbm.example.org/terms", 42 ]); 43 assert.deepEqual(Plan.links({ email: "me@example.org", state: "Sync is on.", plans: [], portal: false }), []); 44 }); 45 46 test("other schemes go", () => { 47 for (const bad of ["javascript:alert(1)", "data:text/html,x", "file:///etc/passwd", "not an address", "", undefined]) { 48 assert.equal(Plan.web(bad), "", String(bad)); 49 } 50 }); 51 52 test("a Stripe page must use https", () => { 53 assert.equal(Plan.web("https://checkout.stripe.com/c/pay/cs_test_1", ["https:"]), "https://checkout.stripe.com/c/pay/cs_test_1"); 54 assert.equal(Plan.web("http://checkout.stripe.com/c/pay/cs_test_1", ["https:"]), ""); 55 });