wordpress-theme-aksrt/tests/widget-system/download-config-contract.test.cjs

'use strict';

const assert = require('node:assert/strict');
const fs = require('node:fs');
const path = require('node:path');
const test = require('node:test');

const root = path.resolve(__dirname, '..', '..');
const read = (file) => fs.readFileSync(path.join(root, file), 'utf8');

test('Download.php derives endpoint, ttl and max uses from configuration', () => {
  const dl = read('src/Content/Download.php');

  // Dead hard-coded values are gone.
  assert.doesNotMatch(dl, /const ENDPOINT/);
  assert.doesNotMatch(dl, /const TOKEN_TTL/);
  assert.doesNotMatch(dl, /aksrt-dl/);

  // Rewrite regex and URL building share the configured alias.
  assert.match(dl, /preg_quote\(\$this->config\(\)\['endpoint'\], '\/'\)/);
  assert.match(dl, /home_url\('\/' \. \$config\['endpoint'\] \. '\/' \. \$token\)/);
  assert.match(dl, /add_action\('init', \[\$this, 'maybe_flush_rewrite'\], 99\)/);
  assert.match(dl, /flush_rewrite_rules\(false\)/);
  assert.match(dl, /aksrt_dl_rewrite_version/);

  // TTL and per-token max uses come from the settings section.
  assert.match(dl, /'expires_in'\s+=> \$config\['ttl'\]/);
  assert.match(dl, /'max_uses'\s+=> \(int\) \$config\['max_uses'\]/);
});

test('usage is counted only after full delivery, never for probes', () => {
  const dl = read('src/Content/Download.php');

  // Probe detection covers HEAD requests and speculative prefetches, which
  // validate availability but consume nothing.
  assert.match(dl, /private function is_probe_request\(\): bool/);
  assert.match(dl, /REQUEST_METHOD.*=== 'HEAD'/);
  assert.match(dl, /HTTP_SEC_PURPOSE/);
  assert.match(dl, /'prefetch'/);
  assert.match(dl, /!\$is_probe\) \{\s*\$this->consume_token/);

  // Local streaming splits headers from body and aborts stop consumption.
  assert.match(dl, /private function send_download_headers\(string \$path\): void/);
  assert.match(dl, /private function stream_body\(string \$path\): bool/);
  assert.match(dl, /if \(connection_aborted\(\)\) \{/);
  assert.match(dl, /return !connection_aborted\(\);/);

  // Atomic cap so concurrent finishes can not overshoot max_uses.
  assert.match(dl, /SET used_count = used_count \+ 1 WHERE token = %s AND used_count < max_uses/);

  // Expired / exhausted links stay a dead end instead of re-issuing silently.
  assert.match(dl, /status_header\(410\)/);
  assert.match(dl, /请回到资源页重新获取/);
  assert.doesNotMatch(dl, /fail_410\(\);\s*issue_token/);
});

test('expired links render a themed flat 410 page that follows the theme color', () => {
  const dl = read('src/Content/Download.php');

  // Full theme chrome instead of a bare wp_die page.
  assert.match(dl, /private function render_expired_page\(\): void/);
  assert.match(dl, /get_header\(\)/);
  assert.match(dl, /get_footer\(\)/);

  // wp_die remains only as the safety net when output already started.
  assert.match(dl, /headers_sent\(\)/);

  // Flat hero keyed to the runtime theme variables (light + html.dark).
  assert.match(dl, /var\(--color-primary-soft/);
  assert.match(dl, /var\(--color-primary/);
  assert.match(dl, /var\(--key-color/);
  assert.match(dl, /var\(--muted-4-color/);

  // Theme button system and FA5 icon form only (never "fa fa-").
  assert.match(dl, /class="btn-primary"/);
  assert.match(dl, /class="btn-outline"/);
  assert.match(dl, /fa fas fa-hourglass-end/);
  assert.doesNotMatch(dl, /\bfa fa-/);

  // The 410 page is a utility rewrite; the header component must never match
  // a page type for it (custom rewrites retain the is_home flag).
  const slider = read('inc/helpers/homepage/header-components.php');
  assert.match(slider, /class_exists\('\\AKSRT\\Content\\Download'\)/);
  assert.match(slider, /get_query_var\(\\AKSRT\\Content\\Download::QUERY_VAR\)/);
});

test('token generation retries on primary-key collisions', () => {
  const dl = read('src/Content/Download.php');
  assert.match(dl, /PRIMARY KEY\(token\) already guarantees uniqueness/);
  assert.match(dl, /for \(\$attempt = 0; \$attempt < 3; \$attempt\+\+\)/);
});

test('master switch off puts the token system to sleep and renders direct links', () => {
  const dl = read('src/Content/Download.php');
  const box = read('templates/parts/resource-download-box.php');
  const pay = read('inc/helpers/aksrt-pay.php');

  // The switch is a public runtime check; missing key means enabled.
  assert.match(dl, /public function is_enabled\(\): bool/);
  assert.match(dl, /!isset\(\$cfg\['enabled'\]\) \|\| !empty\(\$cfg\['enabled'\]\)/);

  // Rewrite, REST routes and token serving all bail out when disabled.
  assert.match(dl, /if \(!\$this->is_enabled\(\)\) \{\s*return;\s*\}/);
  assert.match(dl, /Master switch off: the token system is retired/);

  // The unused policy endpoint stays removed.
  assert.doesNotMatch(dl, /download\/policy/);
  assert.doesNotMatch(dl, /rest_policy/);

  // Direct mode renders anchors to the raw source URL instead of token buttons.
  assert.match(box, /\$direct_download = class_exists\('\\AKSRT\\Content\\Download'\)/);
  assert.match(box, /elseif \(\$direct_download\) \{/);
  assert.match(box, /href="<\?php echo esc_url\(\$btn_href\); \?>/);
  assert.match(box, /data-clipboard-text="<\?php echo esc_attr\(\$extract_code\); \?>/);
  assert.match(pay, /if \(\$direct_download\) \{\s*\$buttons \.= '<a class="mr10 but /);

  // Dead standalone-page helper stays removed.
  assert.doesNotMatch(pay, /aksrt_is_download_alone_page_enabled/);
});