health-inbox.test.ts

apps/worker/test/health-inbox.test.ts

1. /**
2. * /health reports the Gmail setup.
3. *
4. * Here and not on the board: `wrangler dev` has no Cloudflare Access in front
5. * of it, so the Worker cannot identify a local request and correctly refuses
6. * it, which looks like a broken setup rather than a working guard. /health is the one deliberately identity-free route, so
7. * it is the only place a Gmail credential can be verified before deploying.
8. *
9. * The bound this must hold: mailbox names and error reasons, never mail.
10. */
12. import { describe, expect, it } from 'vitest'
13. import worker from '../src/index.js'
15. const kv = (store: Record<string, string>) => ({
16. get: async (k: string) => store[k] ?? null,
17. put: async (k: string, v: string) => void (store[k] = v),
18. })
20. const INBOX = JSON.stringify({
21. syncedAt: '2026-09-01T06:00:00.000Z',
22. mailboxes: [
23. {
24. mailbox: 'hello@meridiandisplay.example',
25. ok: true,
26. error: null,
27. messages: [
28. { id: 'm1', threadId: 't1', mailbox: 'hello@meridiandisplay.example', sender: 'news@upscaler.vendor.example',
29. senderName: 'Upscaler Labs', subject: 'SECRET-SUBJECT-LINE', date: '2026-09-01T00:00:00.000Z', labels: [] },
30. ],
31. canSend: true,
32. },
33. { mailbox: 'orderdesk@meridiandisplay.example', ok: true, error: null, messages: [], canSend: false },
34. { mailbox: 'studio@meridiandisplay.example', ok: true, error: null, messages: [], canSend: null },
35. { mailbox: 'accounts@meridiandisplay.example', ok: false, error: 'unauthorized_client', messages: [], canSend: null },
36. ],
37. })
39. const env = (store: Record<string, string> = {}) =>
40. ({ DASHBOARD: kv({ 'dashboard:payload': JSON.stringify({ generatedAt: new Date().toISOString() }), ...store }) }) as never
42. const get = async (e: unknown) =>
43. (await worker.fetch(new Request('http://x/health'), e as never)).json() as Promise<Record<string, never>>
45. describe('/health inbox block', () => {
46. it('names which mailboxes read and which failed, with the reason', async () => {
47. const body = (await get(env({ 'inbox:messages': INBOX }))) as unknown as {
48. inbox: { read: string[]; failed: { mailbox: string; error: string }[] }
49. }
50. expect(body.inbox.read).toContain('hello@meridiandisplay.example')
51. expect(body.inbox.failed).toEqual([
52. { mailbox: 'accounts@meridiandisplay.example', error: 'unauthorized_client' },
53. ])
54. })
56. it('carries no mail: no sender, no subject, no counts', async () => {
57. // The endpoint is identity-free, so anything it holds is readable by anyone
58. // who can reach it. Mailbox names and failure reasons are ours; the contents
59. // are not.
60. const raw = JSON.stringify(await get(env({ 'inbox:messages': INBOX })))
61. expect(raw).not.toContain('SECRET-SUBJECT-LINE')
62. expect(raw).not.toContain('news@upscaler.vendor.example')
63. expect(raw).not.toContain('Upscaler Labs')
64. })
66. it('is null before the first sync, which is not the same as no mailboxes', async () => {
67. const body = (await get(env())) as unknown as { inbox: unknown }
68. expect(body.inbox).toBeNull()
69. })
70. })
72. /**
73. * Whether each mailbox can send.
74. *
75. * /health is the only identity-free route, which is what makes it the only
76. * place a credential can be checked before deploying, and "does every mailbox
77. * token carry the send scope?" is exactly that kind of question.
78. * The bound is unchanged: mailbox names and booleans, never mail.
79. */
80. describe('/health reports send capability', () => {
81. it('carries canSend per mailbox, keeping true, false and null apart', async () => {
82. const body = (await get(env({ 'inbox:messages': INBOX }))) as unknown as {
83. inbox: { canSend: Record<string, boolean | null> }
84. }
85. expect(body.inbox.canSend['hello@meridiandisplay.example']).toBe(true)
86. expect(body.inbox.canSend['orderdesk@meridiandisplay.example']).toBe(false)
87. // null is "Google reported no scopes", not "cannot send". They need
88. // different responses and must not render the same.
89. expect(body.inbox.canSend['studio@meridiandisplay.example']).toBeNull()
90. expect(body.inbox.canSend['accounts@meridiandisplay.example']).toBeNull()
91. })
93. it('still carries no mail alongside it', async () => {
94. const raw = JSON.stringify(await get(env({ 'inbox:messages': INBOX })))
95. expect(raw).not.toContain('SECRET-SUBJECT-LINE')
96. expect(raw).not.toContain('news@upscaler.vendor.example')
97. })
98. })