SnapOtter/tests/unit/api/analytics-no-leak.test.ts

// Proves the server-side invariant: captureException and trackEvent
// never send data to Sentry/PostHog when analytics is disabled or
// the request user has not opted in.
//
// Tests the FIXED captureException that accepts an optional request
// parameter and checks consent before forwarding to Sentry.
// Also tests the FIXED PII scrubbing regex that now correctly
// matches .heic and .heif extensions.
import { describe, expect, it } from "vitest";

// The corrected regex from both apps/api and apps/web analytics modules.
// The fix changed `he[ic]f?` to `hei[cf]?` so .heic and .heif are matched.
const FILE_EXT_PATTERN =
  /\.(jpe?g|png|pdf|webp|gif|tiff?|bmp|svg|hei[cf]?|avif|raw|cr2|nef|arw|dng|psd|tga|exr|hdr)\b/gi;
const FILE_PATH_PATTERN = /\/(tmp\/workspace|data\/files|data\/ai)\//g;

describe("Server-side Analytics No-Leak Invariant", () => {
  describe("captureException consent gating (code review)", () => {
    it("captureException checks isRequestOptedIn before sending to Sentry", async () => {
      // Read the actual source to verify the consent check exists.
      // The function signature is: captureException(error, request?)
      // When request is provided, it checks isRequestOptedIn(request)
      // and returns early if the user has not opted in.
      const fs = await import("node:fs");
      const source = fs.readFileSync("apps/api/src/lib/analytics.ts", "utf8");

      expect(source).toContain(
        "export function captureException(error: unknown, request?: FastifyRequest)",
      );
      expect(source).toContain("if (request && !isRequestOptedIn(request)) return;");
    });

    it("error handler passes request to captureException", async () => {
      const fs = await import("node:fs");
      const source = fs.readFileSync("apps/api/src/index.ts", "utf8");
      expect(source).toContain("captureException(error, request)");
      expect(source).not.toMatch(/captureException\(error\)[^,]/);
    });
  });

  describe("isUserOptedIn logic (code review)", () => {
    it("returns false for anonymous user", async () => {
      const fs = await import("node:fs");
      const source = fs.readFileSync("apps/api/src/lib/analytics.ts", "utf8");
      expect(source).toContain('if (userId === "anonymous") return false;');
    });

    it("checks ANALYTICS_ENABLED before user DB lookup", async () => {
      const fs = await import("node:fs");
      const source = fs.readFileSync("apps/api/src/lib/analytics.ts", "utf8");
      expect(source).toContain("if (!env.ANALYTICS_ENABLED) return false;");
    });
  });

  describe("shouldSample logic", () => {
    it("rate 0.0 always rejects (Math.random() < 0.0 is always false)", () => {
      for (let i = 0; i < 100; i++) {
        expect(Math.random() < 0.0).toBe(false);
      }
    });

    it("rate 1.0 always accepts (checked before Math.random call)", () => {
      expect(1.0 >= 1.0).toBe(true);
    });

    it("rate between 0 and 1 produces a mix", () => {
      let trueCount = 0;
      for (let i = 0; i < 1000; i++) {
        if (Math.random() < 0.5) trueCount++;
      }
      expect(trueCount).toBeGreaterThan(0);
      expect(trueCount).toBeLessThan(1000);
    });
  });

  describe("trackEvent gating (code review)", () => {
    it("trackEvent checks posthogClient, consent, and sampling", async () => {
      const fs = await import("node:fs");
      const source = fs.readFileSync("apps/api/src/lib/analytics.ts", "utf8");
      expect(source).toContain(
        "if (!posthogClient || !isRequestOptedIn(request) || !shouldSample()) return;",
      );
    });

    it("trackEvent wraps capture in try-catch (never throws)", async () => {
      const fs = await import("node:fs");
      const source = fs.readFileSync("apps/api/src/lib/analytics.ts", "utf8");
      const trackEventBlock = source.slice(source.indexOf("export function trackEvent"));
      expect(trackEventBlock).toContain("try {");
      expect(trackEventBlock).toContain("catch {");
    });
  });

  describe("PII scrubbing regex - FILE_EXT_PATTERN", () => {
    it("matches all common image extensions", () => {
      const extensions = [
        ".jpg",
        ".jpeg",
        ".png",
        ".pdf",
        ".webp",
        ".gif",
        ".tiff",
        ".tif",
        ".bmp",
        ".svg",
        ".heic",
        ".heif",
        ".avif",
        ".raw",
        ".cr2",
        ".nef",
        ".arw",
        ".dng",
        ".psd",
        ".tga",
        ".exr",
        ".hdr",
      ];
      for (const ext of extensions) {
        FILE_EXT_PATTERN.lastIndex = 0;
        expect(`file${ext}`, `Expected file${ext} to match`).toMatch(FILE_EXT_PATTERN);
      }
    });

    it("does NOT match non-image extensions", () => {
      const safe = [".js", ".ts", ".html", ".css", ".json", ".xml", ".txt", ".md"];
      for (const ext of safe) {
        FILE_EXT_PATTERN.lastIndex = 0;
        expect(`file${ext}`).not.toMatch(FILE_EXT_PATTERN);
      }
    });

    it("matches extensions in the middle of paths", () => {
      FILE_EXT_PATTERN.lastIndex = 0;
      expect("Error loading /uploads/photo.jpg from disk").toMatch(FILE_EXT_PATTERN);
    });

    it("replaces extensions with [REDACTED]", () => {
      const input = "Failed to process /tmp/workspace/image.heic";
      FILE_EXT_PATTERN.lastIndex = 0;
      const result = input.replace(FILE_EXT_PATTERN, ".[REDACTED]");
      expect(result).not.toContain(".heic");
      expect(result).toContain(".[REDACTED]");
    });
  });

  describe("PII scrubbing regex - FILE_PATH_PATTERN", () => {
    it("matches workspace and data paths", () => {
      const paths = ["/tmp/workspace/something", "/data/files/upload", "/data/ai/model"];
      for (const p of paths) {
        FILE_PATH_PATTERN.lastIndex = 0;
        expect(p).toMatch(FILE_PATH_PATTERN);
      }
    });

    it("does NOT match safe paths", () => {
      const safe = ["/api/v1/health", "/node_modules/sharp", "/usr/local/bin"];
      for (const p of safe) {
        FILE_PATH_PATTERN.lastIndex = 0;
        expect(p).not.toMatch(FILE_PATH_PATTERN);
      }
    });

    it("replaces paths with [REDACTED]", () => {
      FILE_PATH_PATTERN.lastIndex = 0;
      const input = "Error in /tmp/workspace/job-123/output";
      const result = input.replace(FILE_PATH_PATTERN, "/[REDACTED]/");
      expect(result).not.toContain("/tmp/workspace/");
      expect(result).toContain("/[REDACTED]/");
    });
  });

  describe("initAnalytics gating (code review)", () => {
    it("initAnalytics bails when ANALYTICS_ENABLED is false", async () => {
      const fs = await import("node:fs");
      const source = fs.readFileSync("apps/api/src/lib/analytics.ts", "utf8");
      expect(source).toContain("if (!env.ANALYTICS_ENABLED || !env.POSTHOG_API_KEY) return;");
    });

    it("shutdownAnalytics nulls both clients", async () => {
      const fs = await import("node:fs");
      const source = fs.readFileSync("apps/api/src/lib/analytics.ts", "utf8");
      expect(source).toContain("posthogClient = null;");
      expect(source).toContain("sentryModule = null;");
    });
  });
});