Click
",
+ "Navigate", "",
+ "", "Team
");
+ const path = `assets/${createHash("sha256").update(bytes).digest("hex")}.html`;
+ const fetch = vi.fn().mockImplementationOnce(async () => json({ ...item, image: { path: `assets/${"0".repeat(64)}.png`, alt: "Poster" }, animation: { path, alt: "Team" } }))
+ .mockImplementationOnce(async () => new Response(bytes, { headers: { "Content-Type": "text/html; charset=utf-8" } }));
+ const service = announcementFeedService({ version: "1.0.0", feedUrl: "https://mirror.example/preview/current.json", fetch });
+ expect(await service.animation("wrong-id")).toBeNull();
+ const result = await Promise.all([service.animation(item.id), service.animation(item.id)]);
+ expect(result[0]?.bytes.toString()).toContain("Team");
+ expect(result[1]).toEqual(result[0]);
+ await service.animation(item.id);
+ expect(fetch).toHaveBeenCalledTimes(2);
+ expect(String(fetch.mock.calls[1][0])).toBe(`https://mirror.example/preview/${path}`);
+ expect(fetch.mock.calls[1][1]).toMatchObject({ credentials: "omit", redirect: "error", headers: { Accept: "text/html" } });
+ });
+ it.each([
+ ["", "text/html", 200],
+ ["ok
", "text/plain", 200],
+ ["not found", "text/html", 404],
+ ["x".repeat(128 * 1024 + 1), "text/html", 200],
+ ])("falls back on rejected animation assets and cools down retries", async (html, contentType, status) => {
+ const path = `assets/${createHash("sha256").update(html).digest("hex")}.html`;
+ const fetch = vi.fn().mockImplementationOnce(async () => json({ ...item, image: { path: `assets/${"0".repeat(64)}.png`, alt: "Poster" }, animation: { path, alt: "Team" } }))
+ .mockImplementation(async () => new Response(html, { status, headers: { "Content-Type": contentType } }));
+ const service = announcementFeedService({ version: "1.0.0", fetch });
+ expect(await service.animation(item.id)).toBeNull();
+ expect(await service.animation(item.id)).toBeNull();
+ expect((await service.current())?.id).toBe(item.id);
+ expect(fetch).toHaveBeenCalledTimes(2);
+ });
+
+});
diff --git a/server/src/__tests__/announcement-publisher.test.ts b/server/src/__tests__/announcement-publisher.test.ts
new file mode 100644
index 0000000000..6568d45257
--- /dev/null
+++ b/server/src/__tests__/announcement-publisher.test.ts
@@ -0,0 +1,74 @@
+import { createHash } from "node:crypto";
+import { mkdtemp, mkdir, writeFile, symlink, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, describe, expect, it } from "vitest";
+import { prepareAnnouncementPublish, announcementUploadArgs, parseAnnouncementPublishArgs, announcementPublishPrefix } from "../../../scripts/publish-announcements.js";
+
+const dirs: string[] = [];
+async function fixture() { const dir = await mkdtemp(path.join(os.tmpdir(), "announcement-publish-")); dirs.push(dir); return dir; }
+afterEach(async () => { for (const dir of dirs.splice(0)) await rm(dir, { recursive: true, force: true }); });
+describe("announcement publishing", () => {
+ it("keeps named staging feeds separate from production and defaults to dry-run", async () => {
+ const dir = await fixture();
+ await writeFile(path.join(dir, "current.json"), JSON.stringify({ schemaVersion: 1, announcement: null }));
+ const result = await prepareAnnouncementPublish(dir, "preview-projects");
+ expect(result.files.map((file) => file.key)).toEqual(["announcements/staging/preview-projects/v1/current.json"]);
+ expect(parseAnnouncementPublishArgs(["--staging", "preview-projects"])).toEqual({
+ sourceDirectory: "announcements/examples/staging", staging: "preview-projects", publish: false,
+ });
+ expect(parseAnnouncementPublishArgs([dir, "--staging", "preview-projects", "--publish"]).publish).toBe(true);
+ expect(announcementPublishPrefix()).toBe("announcements/v1");
+ expect((await prepareAnnouncementPublish(dir, "preview-projects", "storybook/branches/codex-announcements")).files[0].key)
+ .toBe("storybook/branches/codex-announcements/announcements/staging/preview-projects/v1/current.json");
+ for (const prefix of ["../outside", "/leading", "trailing/", "bad//path", "", "https://example.com"]) {
+ expect(() => announcementPublishPrefix("preview-projects", prefix)).toThrow();
+ }
+ for (const name of ["../v1", "", "/production", "preview/nested"]) {
+ expect(() => announcementPublishPrefix(name)).toThrow();
+ }
+ for (const args of [["--staging"], ["--publish", "--dry-run"], ["one", "two"], ["--unknown"]]) {
+ expect(() => parseAnnouncementPublishArgs(args)).toThrow();
+ }
+ });
+
+ it("uploads content-addressed assets before the five-minute manifest", async () => {
+ const dir = await fixture();
+ const bytes = Buffer.from("test-image");
+ const imagePath = `assets/${createHash("sha256").update(bytes).digest("hex")}.png`;
+ await mkdir(path.join(dir, "assets"));
+ await writeFile(path.join(dir, imagePath), bytes);
+ await writeFile(path.join(dir, "current.json"), JSON.stringify({ schemaVersion: 1, announcement: { id: "test", title: "Test", eyebrow: "New", description: "Example", image: { path: imagePath, alt: "" }, primaryAction: { kind: "route", label: "Open", path: "/projects" } } }));
+ const { files } = await prepareAnnouncementPublish(dir);
+ expect(files.map((file) => file.key)).toEqual([`announcements/v1/${imagePath}`, "announcements/v1/current.json"]);
+ expect(files[0].cacheControl).toContain("immutable");
+ expect(announcementUploadArgs("bucket", files[1])).toContain("public,max-age=300");
+ await writeFile(path.join(dir, imagePath), "changed");
+ await expect(prepareAnnouncementPublish(dir)).rejects.toThrow("SHA-256");
+ });
+ it("validates HTML animation fixtures and uploads both assets before the manifest", async () => {
+ const result = await prepareAnnouncementPublish(path.resolve(import.meta.dirname, "../../../announcements/examples/animated"), "animated-preview");
+ expect(result.files.map((file) => file.contentType)).toEqual(["image/png", "text/html", "application/json"]);
+ const dir = await fixture();
+ await mkdir(path.join(dir, "assets"));
+ const html = "";
+ const asset = `assets/${createHash("sha256").update(html).digest("hex")}.html`;
+ const image = result.files[0];
+ const imagePath = result.manifest.announcement!.image!.path;
+ await writeFile(path.join(dir, imagePath), await import("node:fs/promises").then((fs) => fs.readFile(image.file)));
+ await writeFile(path.join(dir, asset), html);
+ await writeFile(path.join(dir, "current.json"), JSON.stringify({ ...result.manifest, announcement: { ...result.manifest.announcement, animation: { path: asset, alt: "Unsafe" } } }));
+ await expect(prepareAnnouncementPublish(dir)).rejects.toThrow("only visual HTML/CSS");
+ });
+ it("supports withdrawal and rejects symlinks and unsupported schemas", async () => {
+ const dir = await fixture();
+ await writeFile(path.join(dir, "current.json"), JSON.stringify({ schemaVersion: 1, announcement: null }));
+ expect((await prepareAnnouncementPublish(dir)).files).toHaveLength(1);
+ const link = path.join(dir, "link"); await symlink(dir, link);
+ await expect(prepareAnnouncementPublish(link)).rejects.toThrow("real directory");
+ await writeFile(path.join(dir, "current.json"), JSON.stringify({ schemaVersion: 2, announcement: null }));
+ await expect(prepareAnnouncementPublish(dir)).rejects.toThrow();
+ await writeFile(path.join(dir, "current.json"), JSON.stringify({ schemaVersion: 1, announcement: null, announcements: [] }));
+ await expect(prepareAnnouncementPublish(dir)).rejects.toThrow();
+ });
+});
diff --git a/server/src/__tests__/announcements-routes.test.ts b/server/src/__tests__/announcements-routes.test.ts
new file mode 100644
index 0000000000..be2ca76cea
--- /dev/null
+++ b/server/src/__tests__/announcements-routes.test.ts
@@ -0,0 +1,119 @@
+import express from "express";
+import { createHash } from "node:crypto";
+import request from "supertest";
+import { afterAll, beforeAll, beforeEach, describe, expect, it } from "vitest";
+import { eq } from "drizzle-orm";
+import { activityLog, announcementDismissals, announcementPublications, companies, createDb, startEmbeddedPostgresTestDatabase, type EmbeddedPostgresTestDatabase } from "@paperclipai/db";
+import { announcementRoutes } from "../routes/announcements.js";
+import { announcementService } from "../services/announcements.js";
+import { errorHandler } from "../middleware/error-handler.js";
+
+const companyId = "11111111-1111-4111-8111-111111111111";
+const otherCompanyId = "22222222-2222-4222-8222-222222222222";
+const item = { id: "new-projects", eyebrow: "New", title: "Projects", description: "Organize your work.", primaryAction: { kind: "route", label: "Open", path: "/projects" } };
+describe("announcement routes and durable dismissals", () => {
+ let database: EmbeddedPostgresTestDatabase;
+ let db: ReturnTypeTeam
";
+ const path = `assets/${createHash("sha256").update(html).digest("hex")}.html`;
+ const server = app("alice", undefined, { ...item, image: { path: `assets/${"0".repeat(64)}.png`, alt: "Poster" }, animation: { path, alt: "Team" } }, 200, html);
+ const response = await request(server).get(`/api/announcements/${item.id}/animation`);
+ expect(response.status).toBe(200);
+ expect(response.headers["cache-control"]).toBe("private, no-store");
+ expect(response.headers["content-security-policy"]).toContain("sandbox; default-src 'none'");
+ expect(response.headers["referrer-policy"]).toBe("no-referrer");
+ expect(response.headers["x-content-type-options"]).toBe("nosniff");
+ expect(response.type).toBe("text/html");
+ expect((await request(server).get("/api/announcements/wrong-id/animation")).status).toBe(404);
+ });
+ it("persists across app/service restarts, browsers and companies, isolated by user", async () => {
+ const first = app();
+ const response = await request(first).get("/api/announcements/current");
+ expect(response.body.id).toBe(item.id);
+ expect(response.headers["cache-control"]).toBe("private, no-store");
+ expect((await request(first).post(`/api/announcements/${item.id}/dismiss`).send({ companyId })).status).toBe(204);
+ expect((await request(app()).get("/api/announcements/current")).body).toBeNull();
+ expect((await request(app("bob")).get("/api/announcements/current")).body.id).toBe(item.id);
+ await request(app()).post(`/api/announcements/${item.id}/dismiss`).send({ companyId: otherCompanyId });
+ expect(await db.select().from(activityLog)).toHaveLength(1);
+ });
+ it("accepts viewers and concurrent duplicate dismissals with one audit", async () => {
+ const server = app();
+ await request(server).get("/api/announcements/current");
+ const responses = await Promise.all(Array.from({ length: 5 }, () => request(server).post(`/api/announcements/${item.id}/dismiss`).send({ companyId })));
+ expect(responses.map((res) => res.status)).toEqual([204, 204, 204, 204, 204]);
+ expect(await db.select().from(announcementDismissals)).toHaveLength(1);
+ expect(await db.select().from(activityLog).where(eq(activityLog.action, "announcement.dismissed"))).toHaveLength(1);
+ });
+ it("rolls back the dismissal if its audit cannot commit", async () => {
+ await announcementService(db).registerPublication(item.id);
+ await expect(announcementService(db).dismiss("alice", item.id, "33333333-3333-4333-8333-333333333333")).rejects.toThrow();
+ expect(await announcementService(db).isDismissed("alice", item.id)).toBe(false);
+ });
+ it("never resurrects a dismissed ID after copy changes or rollback; a new ID appears", async () => {
+ await announcementService(db).registerPublication(item.id);
+ await announcementService(db).dismiss("alice", item.id, companyId);
+ expect((await request(app("alice", undefined, { ...item, title: "Fixed copy" })).get("/api/announcements/current")).body).toBeNull();
+ expect((await request(app("alice", undefined, { ...item, id: "next" })).get("/api/announcements/current")).body.id).toBe("next");
+ expect((await request(app()).get("/api/announcements/current")).body).toBeNull();
+ });
+ it("uses the local-board identity without an auth user row", async () => {
+ const server = app("local-board", { type: "board", userId: "local-board", source: "local_implicit" });
+ await request(server).get("/api/announcements/current");
+ expect((await request(server).post(`/api/announcements/${item.id}/dismiss`).send({ companyId })).status).toBe(204);
+ expect(await announcementService(db).isDismissed("local-board", item.id)).toBe(true);
+ });
+ it("rejects invented IDs without storing dismissals or audit entries", async () => {
+ const server = app();
+ await request(server).get("/api/announcements/current");
+ for (const id of ["invented-one", "invented-two", "invented-three"]) {
+ expect((await request(server).post(`/api/announcements/${id}/dismiss`).send({ companyId })).status).toBe(404);
+ }
+ expect(await db.select().from(announcementDismissals)).toHaveLength(0);
+ expect(await db.select().from(activityLog)).toHaveLength(0);
+ expect(await db.select().from(announcementPublications)).toEqual([{ announcementId: item.id }]);
+ });
+ it("accepts offline retries for validated IDs after withdrawal and restart", async () => {
+ await request(app()).get("/api/announcements/current");
+ const restarted = app("alice", undefined, null, 404);
+ expect((await request(restarted).get("/api/announcements/current")).body).toBeNull();
+ expect((await request(restarted).post(`/api/announcements/${item.id}/dismiss`).send({ companyId })).status).toBe(204);
+ expect(await announcementService(db).isDismissed("alice", item.id)).toBe(true);
+ expect(await db.select().from(activityLog)).toHaveLength(1);
+ });
+ it("rejects anonymous/agent callers and inaccessible audit companies", async () => {
+ for (const actor of [{ type: "none" }, { type: "agent", companyId, userId: "alice" }]) {
+ const server = app("alice", actor);
+ const expected = actor.type === "none" ? 401 : 403;
+ for (const url of ["current", `${item.id}/image`, `${item.id}/animation`]) expect((await request(server).get(`/api/announcements/${url}`)).status).toBe(expected);
+ expect((await request(server).post(`/api/announcements/${item.id}/dismiss`).send({ companyId })).status).toBe(expected);
+ }
+ expect((await request(app()).post(`/api/announcements/${item.id}/dismiss`).send({ companyId: "33333333-3333-4333-8333-333333333333" })).status).toBe(404);
+ expect((await request(app()).post(`/api/announcements/${item.id}/dismiss`).send({ companyId, userId: "bob" })).status).toBe(400);
+ });
+});
diff --git a/server/src/__tests__/openapi-routes.test.ts b/server/src/__tests__/openapi-routes.test.ts
index 287823be4e..9e29753867 100644
--- a/server/src/__tests__/openapi-routes.test.ts
+++ b/server/src/__tests__/openapi-routes.test.ts
@@ -19,6 +19,7 @@ const apiPrefixes: RecordAnimated hero
", { headers: { "Content-Type": "text/html" } })));
+ const { div, dismiss, cleanup } = await animatedCard();
+ const frame = div.querySelector("iframe")!;
+ expect(frame.getAttribute("sandbox")).toBe("");
+ expect(frame.getAttribute("tabindex")).toBe("-1");
+ expect(frame.getAttribute("aria-hidden")).toBe("true");
+ expect(frame.srcdoc).toContain("default-src 'none'");
+ expect(frame.srcdoc).toContain("Animated hero");
+ expect(div.querySelector('[role="img"]')?.getAttribute("aria-label")).toBe(announcementAnimationPreview.animation!.alt);
+ expect(Array.from(div.querySelectorAll("button"), (button) => button.getAttribute("aria-label")))
+ .toEqual(["Dismiss announcement"]);
+ expect(div.querySelectorAll("a")).toHaveLength(2);
+ expect(dismiss).not.toHaveBeenCalled();
+ await cleanup();
+ });
+ it("does not load animation when reduced motion is requested", async () => {
+ vi.stubGlobal("matchMedia", () => ({ matches: true, addEventListener: vi.fn(), removeEventListener: vi.fn() }));
+ const fetch = vi.fn(); vi.stubGlobal("fetch", fetch);
+ const { div, cleanup } = await animatedCard();
+ expect(fetch).not.toHaveBeenCalled();
+ expect(div.querySelector("iframe")).toBeNull();
+ expect(div.querySelector("img")).not.toBeNull();
+ await cleanup();
+ });
+ it.each([404, 503])("keeps the poster and actions usable for animation HTTP %s", async (status) => {
+ vi.stubGlobal("fetch", vi.fn().mockResolvedValue(new Response("unavailable", { status })));
+ const { div, dismiss, cleanup } = await animatedCard();
+ expect(div.querySelector("iframe")).toBeNull();
+ expect(div.querySelector("img")).not.toBeNull();
+ await act(async () => div.querySelector
+ {showImage && 
setFailedImage(src)} className="h-full w-full object-cover" />}
+ {showAnimation &&
}
+
+
+
+
}
+
+
+ {announcement.eyebrow}
+{announcement.title}
+{announcement.description}
+
+ {announcement.secondaryLink &&
+ {observed.announcement?.id}
;
+ }
+ const render = async () => { await act(async () => root.render(
+ {}} />
+ {}} />
+ {}} />
+
+