Initial SMM panel implementation

2026-08-13 19:05:47 +02:00
commit 7717a674c7
64 changed files with 8626 additions and 0 deletions
@@ -0,0 +1,379 @@
+const assert = require('node:assert/strict');
+const test = require('node:test');
+const bcrypt = require('bcryptjs');
+
+const { createApp } = require('../src/app');
+const { closeDbPool, getDb } = require('../src/config/db');
+const { validateEnv } = require('../src/config/env');
+
+const createdUserIds = [];
+const createdServiceIds = [];
+const createdOrderIds = [];
+const createdPaymentMethodIds = [];
+
+function unique(prefix) {
+  return `${prefix}_${Date.now()}_${Math.random().toString(36).slice(2)}`;
+}
+
+function listen(app) {
+  return new Promise((resolve) => {
+    const server = app.listen(0, '127.0.0.1', () => {
+      resolve({
+        baseUrl: `http://127.0.0.1:${server.address().port}`,
+        close: () => new Promise((done) => server.close(done))
+      });
+    });
+  });
+}
+
+async function request(baseUrl, path, options = {}) {
+  const response = await fetch(`${baseUrl}${path}`, {
+    ...options,
+    headers: {
+      'content-type': 'application/json',
+      ...(options.headers || {})
+    }
+  });
+  const body = await response.json().catch(() => ({}));
+
+  return { response, body };
+}
+
+async function createAccount(baseUrl, prefix) {
+  const account = {
+    username: unique(prefix),
+    email: `${unique(prefix)}@example.com`,
+    password: 'StrongPass123'
+  };
+  const registered = await request(baseUrl, '/auth/register', {
+    method: 'POST',
+    body: JSON.stringify(account)
+  });
+
+  assert.equal(registered.response.status, 201);
+  createdUserIds.push(registered.body.user.id);
+
+  return {
+    ...account,
+    id: registered.body.user.id
+  };
+}
+
+async function createDbAccount(prefix, overrides = {}) {
+  const db = getDb();
+  const password = 'StrongPass123';
+  const account = {
+    username: unique(prefix),
+    email: `${unique(prefix)}@example.com`,
+    password
+  };
+  const [id] = await db('users').insert({
+    username: account.username,
+    email: account.email,
+    password_hash: await bcrypt.hash(password, 12),
+    balance: '0.0000',
+    role: 'user',
+    status: 'active',
+    ...overrides
+  });
+
+  createdUserIds.push(id);
+
+  return {
+    ...account,
+    id
+  };
+}
+
+async function login(baseUrl, account) {
+  const loggedIn = await request(baseUrl, '/auth/login', {
+    method: 'POST',
+    body: JSON.stringify({
+      email: account.email,
+      password: account.password
+    })
+  });
+
+  assert.equal(loggedIn.response.status, 200);
+  return loggedIn.body.accessToken;
+}
+
+test.after(async () => {
+  const db = getDb();
+
+  if (createdOrderIds.length > 0) {
+    await db('orders').whereIn('id', createdOrderIds).del();
+  }
+
+  if (createdServiceIds.length > 0) {
+    await db('services').whereIn('id', createdServiceIds).del();
+  }
+
+  if (createdPaymentMethodIds.length > 0) {
+    await db('payment_methods').whereIn('id', createdPaymentMethodIds).del();
+  }
+
+  if (createdUserIds.length > 0) {
+    await db('password_reset_tokens').whereIn('user_id', createdUserIds).del();
+    await db('refresh_tokens').whereIn('user_id', createdUserIds).del();
+    await db('deposits').whereIn('user_id', createdUserIds).orWhereIn('reviewed_by', createdUserIds).del();
+    await db('transactions').whereIn('user_id', createdUserIds).del();
+    await db('users').whereIn('id', createdUserIds).del();
+  }
+
+  await closeDbPool();
+});
+
+test('admin users and stats work, while normal users receive 403', async () => {
+  process.env.JWT_SECRET = process.env.JWT_SECRET || 'test_secret';
+  const api = await listen(createApp());
+
+  try {
+    const db = getDb();
+    const admin = await createAccount(api.baseUrl, 'admin_test_admin');
+    const user = await createAccount(api.baseUrl, 'admin_test_user');
+
+    await db('users').where({ id: admin.id }).update({ role: 'admin' });
+
+    const [serviceId] = await db('services').insert({
+      provider_service_id: unique('admin_provider_service'),
+      name: 'Admin Test Service',
+      category: 'Admin',
+      provider_price: '4.0000',
+      markup_percent: '25.0000',
+      sell_price: '5.0000',
+      min: 100,
+      max: 10000,
+      is_active: true
+    });
+    createdServiceIds.push(serviceId);
+
+    const [orderId] = await db('orders').insert({
+      user_id: user.id,
+      service_id: serviceId,
+      link: 'https://example.com/admin-order',
+      quantity: 1000,
+      charge: '5.0000',
+      provider_order_id: unique('admin_provider_order'),
+      status: 'completed'
+    });
+    createdOrderIds.push(orderId);
+
+    const adminToken = await login(api.baseUrl, admin);
+    const userToken = await login(api.baseUrl, user);
+
+    const users = await request(api.baseUrl, '/admin/users', {
+      headers: { authorization: `Bearer ${adminToken}` }
+    });
+    assert.equal(users.response.status, 200);
+    assert.equal(users.body.users.some((row) => Number(row.id) === Number(user.id)), true);
+
+    const stats = await request(api.baseUrl, '/admin/stats', {
+      headers: { authorization: `Bearer ${adminToken}` }
+    });
+    assert.equal(stats.response.status, 200);
+    assert.equal(stats.body.stats.gross_sales, '5.0000');
+    assert.equal(stats.body.stats.provider_cost, '4.0000');
+    assert.equal(stats.body.stats.profit, '1.0000');
+
+    const adjusted = await request(api.baseUrl, `/admin/users/${user.id}`, {
+      method: 'PATCH',
+      headers: { authorization: `Bearer ${adminToken}` },
+      body: JSON.stringify({
+        amount: '3.0000',
+        note: 'Admin test credit'
+      })
+    });
+    assert.equal(adjusted.response.status, 200);
+    assert.equal(adjusted.body.user.balance, '3.0000');
+    assert.equal(adjusted.body.wallet.balance, '3.0000');
+
+    const banned = await request(api.baseUrl, `/admin/users/${user.id}`, {
+      method: 'PATCH',
+      headers: { authorization: `Bearer ${adminToken}` },
+      body: JSON.stringify({ status: 'banned' })
+    });
+    assert.equal(banned.response.status, 200);
+    assert.equal(banned.body.user.status, 'banned');
+
+    const forbiddenChecks = [
+      request(api.baseUrl, '/admin/users', { headers: { authorization: `Bearer ${userToken}` } }),
+      request(api.baseUrl, '/admin/deposits', { headers: { authorization: `Bearer ${userToken}` } }),
+      request(api.baseUrl, '/admin/orders', { headers: { authorization: `Bearer ${userToken}` } }),
+      request(api.baseUrl, '/admin/services', { headers: { authorization: `Bearer ${userToken}` } }),
+      request(api.baseUrl, '/admin/payment-methods', { headers: { authorization: `Bearer ${userToken}` } }),
+      request(api.baseUrl, '/admin/stats', { headers: { authorization: `Bearer ${userToken}` } }),
+      request(api.baseUrl, `/admin/users/${user.id}`, {
+        method: 'PATCH',
+        headers: { authorization: `Bearer ${userToken}` },
+        body: JSON.stringify({ status: 'active' })
+      }),
+      request(api.baseUrl, '/admin/services/sync', {
+        method: 'POST',
+        headers: { authorization: `Bearer ${userToken}` },
+        body: JSON.stringify({})
+      }),
+      request(api.baseUrl, '/admin/deposits/1', {
+        method: 'PATCH',
+        headers: { authorization: `Bearer ${userToken}` },
+        body: JSON.stringify({ action: 'reject' })
+      }),
+      request(api.baseUrl, `/admin/services/${serviceId}`, {
+        method: 'PATCH',
+        headers: { authorization: `Bearer ${userToken}` },
+        body: JSON.stringify({ is_active: false })
+      }),
+      request(api.baseUrl, '/admin/payment-methods', {
+        method: 'POST',
+        headers: { authorization: `Bearer ${userToken}` },
+        body: JSON.stringify({
+          code: unique('normal_forbidden'),
+          label_ar: 'Forbidden',
+          instructions: 'Forbidden payment method'
+        })
+      })
+    ];
+    const forbiddenResponses = await Promise.all(forbiddenChecks);
+
+    assert.equal(forbiddenResponses.every((result) => result.response.status === 403), true);
+  } finally {
+    await api.close();
+  }
+});
+
+test('admin can manage payment methods and active list hides disabled methods', async () => {
+  process.env.JWT_SECRET = process.env.JWT_SECRET || 'test_secret';
+  const api = await listen(createApp());
+
+  try {
+    const db = getDb();
+    const admin = await createAccount(api.baseUrl, 'payment_admin');
+    const user = await createAccount(api.baseUrl, 'payment_user');
+
+    await db('users').where({ id: admin.id }).update({ role: 'admin' });
+
+    const adminToken = await login(api.baseUrl, admin);
+    const userToken = await login(api.baseUrl, user);
+    const code = unique('payment_method').replace(/[^a-z0-9_]/g, '_').slice(0, 30);
+
+    const created = await request(api.baseUrl, '/admin/payment-methods', {
+      method: 'POST',
+      headers: { authorization: `Bearer ${adminToken}` },
+      body: JSON.stringify({
+        code,
+        label_ar: 'اختبار دفع',
+        instructions: 'تعليمات قناة الدفع الاختبارية',
+        destination: 'test@example.com',
+        sort_order: 999
+      })
+    });
+    assert.equal(created.response.status, 201);
+    createdPaymentMethodIds.push(created.body.paymentMethod.id);
+
+    const active = await request(api.baseUrl, '/payment-methods', {
+      headers: { authorization: `Bearer ${userToken}` }
+    });
+    assert.equal(active.response.status, 200);
+    assert.equal(active.body.paymentMethods.some((method) => method.code === code), true);
+
+    const disabled = await request(api.baseUrl, `/admin/payment-methods/${created.body.paymentMethod.id}`, {
+      method: 'PATCH',
+      headers: { authorization: `Bearer ${adminToken}` },
+      body: JSON.stringify({ is_active: false })
+    });
+    assert.equal(disabled.response.status, 200);
+    assert.equal(disabled.body.paymentMethod.is_active, 0);
+
+    const hidden = await request(api.baseUrl, '/payment-methods', {
+      headers: { authorization: `Bearer ${userToken}` }
+    });
+    assert.equal(hidden.response.status, 200);
+    assert.equal(hidden.body.paymentMethods.some((method) => method.code === code), false);
+  } finally {
+    await api.close();
+  }
+});
+
+test('admin user update refuses self-ban and blocks rate-limited sensitive routes', async () => {
+  process.env.JWT_SECRET = process.env.JWT_SECRET || 'test_secret';
+  const api = await listen(createApp());
+
+  try {
+    const admin = await createDbAccount('security_admin', { role: 'admin' });
+    const user = await createDbAccount('security_user');
+
+    const adminToken = await login(api.baseUrl, admin);
+    const userToken = await login(api.baseUrl, user);
+
+    const selfBan = await request(api.baseUrl, `/admin/users/${admin.id}`, {
+      method: 'PATCH',
+      headers: { authorization: `Bearer ${adminToken}` },
+      body: JSON.stringify({ status: 'banned' })
+    });
+    assert.equal(selfBan.response.status, 400);
+    assert.equal(selfBan.body.error.code, 'ADMIN_SELF_BAN_FORBIDDEN');
+
+    const forgotResponses = [];
+    for (let index = 0; index < 6; index += 1) {
+      forgotResponses.push(await request(api.baseUrl, '/auth/forgot-password', {
+        method: 'POST',
+        body: JSON.stringify({ email: `missing_${index}@example.com` })
+      }));
+    }
+    assert.equal(forgotResponses.slice(0, 5).every((result) => result.response.status === 200), true);
+    assert.equal(forgotResponses[5].response.status, 429);
+
+    const depositResponses = [];
+    for (let index = 0; index < 11; index += 1) {
+      depositResponses.push(await request(api.baseUrl, '/deposits', {
+        method: 'POST',
+        headers: { authorization: `Bearer ${userToken}` },
+        body: JSON.stringify({
+          amount: '1.0000',
+          method: 'paypal',
+          tx_ref: unique(`rate_limited_deposit_${index}`)
+        })
+      }));
+    }
+    assert.equal(depositResponses.slice(0, 10).every((result) => result.response.status === 201), true);
+    assert.equal(depositResponses[10].response.status, 429);
+  } finally {
+    await api.close();
+  }
+});
+
+test('production environment requires CORS_ORIGIN', () => {
+  const previous = {
+    NODE_ENV: process.env.NODE_ENV,
+    DATABASE_URL: process.env.DATABASE_URL,
+    JWT_SECRET: process.env.JWT_SECRET,
+    PROVIDER_API_URL: process.env.PROVIDER_API_URL,
+    PROVIDER_API_KEY: process.env.PROVIDER_API_KEY,
+    CORS_ORIGIN: process.env.CORS_ORIGIN
+  };
+
+  try {
+    process.env.NODE_ENV = 'production';
+    process.env.DATABASE_URL = 'mysql://smm:smm_password@127.0.0.1:3306/smm';
+    process.env.JWT_SECRET = 'a'.repeat(32);
+    process.env.PROVIDER_API_URL = 'https://provider.real/api/v2';
+    process.env.PROVIDER_API_KEY = 'real_provider_key';
+    delete process.env.CORS_ORIGIN;
+
+    assert.throws(
+      () => validateEnv(),
+      /Missing required environment variables: CORS_ORIGIN/
+    );
+
+    process.env.CORS_ORIGIN = 'https://panel.example.com';
+    assert.doesNotThrow(() => validateEnv());
+  } finally {
+    Object.entries(previous).forEach(([key, value]) => {
+      if (value === undefined) {
+        delete process.env[key];
+      } else {
+        process.env[key] = value;
+      }
+    });
+  }
+});