fathom-gating.test.ts

apps/dashboard/test/fathom-gating.test.ts

1. /**
2. * The participant gate, asserted against rendered HTML.
3. *
4. * HTML and not a view-model, because the page is what a person receives. A
5. * view-model test proves a filter returns the right rows; it does not prove that
6. * no other part of the template reached past the filter and printed a meeting
7. * title in a summary line, an unowned-items panel, or a list of unrecognised
8. * names. Any surface can add one of those for a good reason without knowing
9. * about the others; only the finished document can prove there are none.
10. *
11. * This is the security control, not a second layer: Fathom's own permissions
12. * cannot gate the board (every meeting reads `shared_with: no_teams`, and keys
13. * return meetings their owner did not record). Why it reads that way is not
14. * established, and the suite defends the observation, not a reason for it.
15. *
16. * The fixture's meeting 0 is a leadership call attended by Sam and Nora only.
17. * Marco, Rosa, Rafael, Ines and Theo must find no trace of it.
18. */
20. import { describe, expect, it } from 'vitest'
21. import { FIXTURE_SNAPSHOT, FIXTURE_MEETINGS } from '../src/fixtures.js'
22. import { headline, type Snapshot } from '../src/collect.js'
23. import { render } from '../src/render.js'
24. import { buildBriefingPayload } from '../src/briefing-payload.js'
25. import { buildViewModel, meetingsFor } from '../src/view-model.js'
26. import { COMPANY_VIEWER, viewerFor } from '../src/viewer.js'
27. import { bucketByTopic } from '../../../config/fathom-topics.js'
28. import { esc } from '../src/html.js'
30. /**
31. * Assertions go through esc() and the render's own 28-character title
32. * truncation. Comparing raw strings against a rendered page silently passes:
33. * an apostrophe becomes ' and a long title is cut, so `not.toContain(raw)`
34. * is true whether the gate works or not. That is a test that has stopped
35. * checking anything, which this suite has already been bitten by twice.
36. */
37. const asRendered = (text: string) => esc(text)
38. const titleAsRendered = (title: string) => esc(title.slice(0, 28))
40. const snap = FIXTURE_SNAPSHOT
41. const page = (email: string | null) =>
42. render(snap, headline(snap), [], '2026-08-12', null, email ? viewerFor(email) : COMPANY_VIEWER)
44. /** The leadership meeting the fixture reserves for Sam and Nora. */
45. const secret = FIXTURE_MEETINGS[0]!
46. const ATTENDEES = { sam: 'hello@meridiandisplay.example', nora: 'nora.l@meridiandisplay.example' }
47. const OUTSIDERS = {
48. marco: 'studio@meridiandisplay.example',
49. rosa: 'accounts@meridiandisplay.example',
50. rafael: 'orderdesk@meridiandisplay.example',
51. ines: 'projects@meridiandisplay.example',
52. theo: 'frontdesk@meridiandisplay.example',
53. }
55. describe('the fixture actually exercises the gate', () => {
56. it('reserves meeting 0 to two people, so the tests below can mean something', () => {
57. // A fixture where everyone attends everything would let a broken gate pass.
58. expect(secret.participants).toEqual(['Sam Whitaker', 'Nora Lindqvist'])
59. expect(secret.items.length).toBeGreaterThan(0)
60. expect(secret.title).toMatch(/Leadership/i)
61. })
62. })
64. describe('a non-attendee finds NO TRACE of the meeting in their page', () => {
65. it.each(Object.entries(OUTSIDERS))('%s cannot see the title', (_who, email) => {
66. const html = page(email)
67. expect(html).not.toContain(titleAsRendered(secret.title))
68. expect(html).not.toContain(secret.title)
69. })
71. it.each(Object.entries(OUTSIDERS))('%s cannot see any item text', (_who, email) => {
72. const html = page(email)
73. for (const item of secret.items) {
74. expect(html).not.toContain(asRendered(item.text))
75. expect(html).not.toContain(item.text)
76. }
77. })
79. it.each(Object.entries(OUTSIDERS))('%s cannot see the recording URL', (_who, email) => {
80. expect(page(email)).not.toContain(secret.url)
81. })
82. })
84. describe('an attendee does see it, otherwise the gate is just a mute button', () => {
85. it.each(Object.entries(ATTENDEES))('%s sees the title', (_who, email) => {
86. expect(page(email)).toContain(titleAsRendered(secret.title))
87. })
89. it('an attendee sees ALL of its items, not only the ones assigned to them', () => {
90. // You were in the room, you heard all of it. What this buys is a
91. // record of what the meeting produced and who owns each piece.
92. const html = page(ATTENDEES.sam)
93. for (const item of secret.items) expect(html).toContain(asRendered(item.text))
94. })
95. })
97. describe('the company page carries no meeting content at all', () => {
98. // The company view gets nothing at all: not titles, not counts. Even
99. // "Leadership sync · 4 items" discloses that the meeting happened and that
100. // somebody was left out of it.
101. const html = page(null)
103. it('shows no meeting titles', () => {
104. for (const m of FIXTURE_MEETINGS) {
105. expect(html).not.toContain(titleAsRendered(m.title))
106. expect(html).not.toContain(m.title)
107. }
108. })
110. it('shows no action item text from any meeting', () => {
111. for (const m of FIXTURE_MEETINGS) {
112. for (const item of m.items) {
113. expect(html).not.toContain(asRendered(item.text))
114. expect(html).not.toContain(item.text)
115. }
116. }
117. })
119. it('no longer renders the panels that used to leak', () => {
120. expect(html).not.toMatch(/Unowned commitments/i)
121. expect(html).not.toMatch(/Nobody owns this/i)
122. expect(html).not.toMatch(/Unrecognized Fathom names/i)
123. })
124. })
126. describe('the briefing payload is gated too, being its own leak path', () => {
127. const payload = buildBriefingPayload(snap)
128. const person = (name: string) => payload.people.find((p) => p.name === name)!
130. it('gives an attendee the meeting', () => {
131. expect(person('Sam Whitaker').meetings?.map((m) => m.title)).toContain(secret.title)
132. })
134. it('withholds it from everyone who was not there', () => {
135. for (const name of ['Marco Ibáñez', 'Rosa Galván', 'Rafael Montero', 'Ines Carvalho', 'Theo Bassett']) {
136. expect(person(name).meetings?.map((m) => m.title) ?? []).not.toContain(secret.title)
137. }
138. })
140. it('keeps meeting content out of the company and exec slices entirely', () => {
141. // These feed the company and all-hands briefings, which everyone reads. A
142. // model handed a leadership meeting here would summarise it to the team.
143. const shared = JSON.stringify({ company: payload.company, exec: payload.exec })
144. for (const item of secret.items) expect(shared).not.toContain(item.text)
145. expect(shared).not.toContain(secret.title)
146. // The payload is JSON, not HTML, so raw text is the right comparison here.
147. })
148. })
150. describe('meetingsFor fails closed', () => {
151. it('gives the company viewer nothing', () => {
152. expect(meetingsFor(snap, COMPANY_VIEWER)).toEqual([])
153. })
155. it('gives an authenticated address nobody has claimed nothing', () => {
156. // A real @meridiandisplay.example sign-in that is not on the roster.
157. expect(meetingsFor(snap, viewerFor('newhire@meridiandisplay.example'))).toEqual([])
158. })
160. it('gives a null viewer nothing', () => {
161. expect(meetingsFor(snap, null)).toEqual([])
162. })
164. it('returns NULL, not [], when Fathom is not configured', () => {
165. // Not-tracked and no-meetings must stay distinguishable: one of them means
166. // the person has a clear desk and the other means we never looked.
167. const unset: Snapshot = { ...snap, fathomConfigured: false }
168. expect(meetingsFor(unset, viewerFor(ATTENDEES.sam))).toBeNull()
169. })
171. it('returns NULL when the fetch failed, rather than an empty desk', () => {
172. const broken: Snapshot = {
173. ...snap,
174. meetings: { ok: false, data: [], error: 'HTTP 500' },
175. }
176. expect(meetingsFor(broken, viewerFor(ATTENDEES.sam))).toBeNull()
177. })
179. it('does not admit someone the board could not resolve', () => {
180. // An unmatched participant is a question for a human, not a viewer. Letting
181. // one through would be resolving-by-guess on an access list.
182. const withUnmatched: Snapshot = {
183. ...snap,
184. meetings: {
185. ok: true,
186. error: null,
187. data: [{ ...secret, participants: [], unmatchedParticipants: ['Director MeridianDisplay'] }],
188. },
189. }
190. expect(meetingsFor(withUnmatched, viewerFor(ATTENDEES.sam))).toEqual([])
191. })
192. })
194. describe('not-tracked never renders as a clear desk', () => {
195. it('says so on the page when Fathom is unconfigured', () => {
196. const unset: Snapshot = { ...snap, fathomConfigured: false }
197. const html = render(unset, headline(unset), [], '2026-08-12', null, viewerFor(ATTENDEES.sam))
198. expect(html).toMatch(/not tracked/i)
199. expect(html).not.toMatch(/Nothing came out of your meetings/i)
200. })
201. })
203. /**
204. * The topic buttons are inside the gate.
205. *
206. * Deriving a stable, board-wide button set (from `snap.meetings` rather than
207. * from the viewer's own items) would disclose the existence of meetings a
208. * person was not in. Different people seeing different buttons is the correct
209. * behaviour, not a bug to smooth over.
210. */
211. describe('topic buttons cannot leak a meeting you were not in', () => {
212. it('gives the company page no topic buttons at all', () => {
213. const html = page(null)
214. // The MARKUP, not the class name: .topic-panel is in the inlined
215. // stylesheet on every page whether or not any panel is rendered.
216. expect(html).not.toContain('data-topic=')
217. expect(html).not.toContain('data-topic-panel=')
218. })
220. it('builds a viewer’s buttons only from items they can already see', () => {
221. // Every label rendered must be derivable from that viewer's own
222. // commitments. If a button appears for a topic none of their items match,
223. // it came from somewhere it should not have.
224. for (const email of ['hello@meridiandisplay.example', 'studio@meridiandisplay.example']) {
225. const viewer = viewerFor(email)
226. const vm = buildViewModel(snap, headline(snap), [], '2026-08-12', viewer)
227. // myDays is the per-person list; the card rendered for this viewer is
228. // their own, which is the only one whose commitments passed the gate.
229. const own = vm.myDays.flatMap((m) => m.commitments)
230. const expected = new Set(bucketByTopic(own).map((b) => b.slug))
231. const html = page(email)
232. const rendered = new Set([...html.matchAll(/data-topic="([^"]+)"/g)].map((m) => m[1]!))
233. expect(rendered, email).toEqual(expected)
234. }
235. })
237. it('still says "not tracked" rather than showing zero buttons', () => {
238. // A person with no Fathom key and a person with no action items must not
239. // look the same. An empty row of buttons would make them identical.
240. const dark: Snapshot = { ...snap, fathomConfigured: false }
241. const html = render(dark, headline(dark), [], '2026-08-12', null, viewerFor('hello@meridiandisplay.example'))
242. expect(html).toMatch(/not tracked/i)
243. expect(html).not.toContain('data-topic=')
244. })
245. })