Build the agent-native compute CRM platform

apps/api/test/imports.test.ts

@@ -0,0 +1,100 @@
+import { strict as assert } from 'node:assert';
+import { describe, it } from 'node:test';
+import { ACCOUNT_SIDES } from '@pig/core';
+import type { Database } from '@pig/db';
+import type { Principal } from '../src/lib/auth';
+import { executeMutation } from '../src/lib/mutation';
+import { createImportCommitMutationDefinition } from '../src/routes/imports';
+import { convertImportRow, findDuplicateImportKeys } from '../src/services/imports';
+import { parseCsv, parseWorksheetXml } from '../src/services/tabular-import';
+
+const principal: Principal = {
+  userId: '00000000-0000-4000-8000-000000000001',
+  email: 'admin@example.com',
+  name: 'Import admin',
+  isPlatformAdmin: false,
+  teams: [{ team: 'demand', role: 'admin' }],
+  via: 'jwt',
+  scopes: ['read', 'write'],
+};
+
+describe('untrusted tabular parsing', () => {
+  it('keeps multiline CSV and formula-like cells as inert text', () => {
+    const parsed = parseCsv('external_id,name\n1,"Acme\nCompute"\n2,"=WEBSERVICE(""https://example.test"")"');
+    assert.deepEqual(parsed.headers, ['external_id', 'name']);
+    assert.equal(parsed.rows[0]?.[1], 'Acme\nCompute');
+    assert.equal(parsed.rows[1]?.[1], '=WEBSERVICE("https://example.test")');
+    assert.match(parsed.warnings.join(' '), /inert text/);
+  });
+
+  it('does not execute XLSX formulas or follow formula URLs', () => {
+    const parsed = parseWorksheetXml(
+      '<worksheet><sheetData><row>' +
+      '<c r="A1" t="inlineStr"><is><t>external_id</t></is></c>' +
+      '<c r="B1" t="inlineStr"><is><t>score</t></is></c>' +
+      '</row><row><c r="A2"><v>1</v></c>' +
+      '<c r="B2"><f>WEBSERVICE(&quot;https://example.test&quot;)</f><v>7</v></c>' +
+      '</row></sheetData></worksheet>',
+    );
+    assert.deepEqual(parsed.rows, [['1', '7']]);
+    assert.match(parsed.warnings.join(' '), /not executed/);
+  });
+});
+
+describe('import row decisions', () => {
+  it('rejects duplicate user-selected source identities', () => {
+    assert.deepEqual([...findDuplicateImportKeys(['vendor-1', 'vendor-2', 'vendor-1'])], ['vendor-1']);
+  });
+
+  it('validates ontology values from core rather than accepting invented sides', () => {
+    const converted = convertImportRow(
+      'account',
+      ['external_id', 'name', 'side'],
+      ['vendor-1', 'Acme', 'marketplace'],
+      { name: 'name', side: 'side' },
+      true,
+    );
+    assert.equal(converted.values.name, 'Acme');
+    const message = converted.errors[0]?.message ?? '';
+    assert.match(message, /must be one of/);
+    for (const side of ACCOUNT_SIDES) assert.ok(message.includes(side));
+  });
+});
+
+describe('import commit mutation', () => {
+  it('commits imported records and their audit evidence in one transaction', async () => {
+    const events: string[] = [];
+    const tx = {
+      insert: () => ({ values: async () => events.push('activity') }),
+    };
+    const db = {
+      transaction: async (work: (transaction: unknown) => Promise<unknown>) => {
+        events.push('begin');
+        const result = await work(tx);
+        events.push('commit');
+        return result;
+      },
+    } as unknown as Database;
+    const definition = createImportCommitMutationDefinition((transaction) => {
+      assert.equal(transaction, tx);
+      return {
+        commit: async () => {
+          events.push('records-and-identities');
+          return { created: 1, updated: 0, total: 1 };
+        },
+      };
+    });
+
+    await executeMutation(db, principal, async () => ({
+      entity: 'account',
+      sourceName: 'accounts.csv',
+      headers: ['external_id', 'name', 'side'],
+      rows: [['vendor-1', 'Acme', 'demand']],
+      mapping: { name: 'name', side: 'side' },
+      keySourceColumn: 'external_id',
+      previewDigest: 'a'.repeat(64),
+    }), definition);
+
+    assert.deepEqual(events, ['begin', 'records-and-identities', 'activity', 'commit']);
+  });
+});