bmc_hub/tests/js/customer-merge.test.cjs

const fs = require('node:fs');
const vm = require('node:vm');
const assert = require('node:assert/strict');
const test = require('node:test');

test('multi-selection, preview confirmation, stale selection and escaped customer names', async () => {
    const html = fs.readFileSync('app/customers/frontend/customers.html', 'utf8');
    const script = html.match(/<script>([\s\S]*?)<\/script>/)[1];
    const area = {innerHTML:'', replaceChildren(){this.innerHTML='';}};
    const inputs = [{value:'1'}, {value:'2'}, {value:'3'}];
    const section = {
        querySelector(){return {value:'1'};},
        querySelectorAll(query){return query === '.merge-source:checked' ? inputs : inputs;}
    };
    const sent=[];
    const context = vm.createContext({console, URLSearchParams, AbortController,
        document:{addEventListener(){},getElementById(){return section;},querySelector(){return area;}},
        fetch: async (url, options) => {
            sent.push({url,body:JSON.parse(options.body)});
            return {ok:true,json:async()=>({target_id:1,source_ids:[2,3],preview_token:'a'.repeat(64),
                customers:[{id:1,name:'Main <script>alert(1)</script>'}],relations:[{table:'sag_sager',count:4}],
                filled_fields:[],kept_main_fields:[],history_id:9})};
        }
    });
    vm.runInContext(script,context);
    const button={disabled:false};
    await context.previewCustomerMerge(0,button);
    assert.deepEqual(sent[0].body,{target_id:1,source_ids:[2,3]});
    assert.match(area.innerHTML,/Bekræft sammenlægning af 3 kunder/);
    assert.match(area.innerHTML,/&lt;script&gt;/);
    assert.ok(!area.innerHTML.includes('<script>'));
    context.resetCustomerMerge(0);
    await context.confirmCustomerMerge(0,button);
    assert.equal(sent.length,1,'changed selections must discard the confirmation token');
    await context.previewCustomerMerge(0,button);
    context.loadCustomers=()=>{};
    await context.confirmCustomerMerge(0,button);
    assert.equal(sent.at(-1).url,'/api/v1/customers/merge');
    assert.equal(sent.at(-1).body.preview_token,'a'.repeat(64));
    assert.match(area.innerHTML,/Kunderne er samlet/);
});