Dashboard refactor: UI rebuild, typed data layer, strict TS, CI test gate

.github/workflows/build-and-test.yaml

@@ -66,11 +66,51 @@ jobs:
           pnpm run build
           pnpm test
 
-      - name: Build web
+      # Web previously ran `build` only, so its unit and e2e suites never
+      # gated a merge. Lint, typecheck and unit tests are fast and
+      # deterministic, so they block.
+      - name: Install web dependencies
         run: |
           cd web
           pnpm install
-          pnpm run build 
+
+      - name: Lint web
+        run: |
+          cd web
+          pnpm lint
+
+      - name: Typecheck web
+        run: |
+          cd web
+          pnpm typecheck
+
+      - name: Unit test web
+        run: |
+          cd web
+          pnpm test
+
+      - name: Build web
+        run: |
+          cd web
+          pnpm run build
+
+      # E2e is fully mocked (e2e/mock-api.ts intercepts every backend call),
+      # but it drives a real browser, so it is reported without blocking until
+      # it has proven stable across a few merges.
+      #
+      # TODO: remove continue-on-error once that is established. It is here to
+      # avoid wedging the merge queue on a browser flake, not because e2e
+      # failures are acceptable.
+      - name: Install Playwright browser
+        run: |
+          cd web
+          pnpm exec playwright install --with-deps chromium
+
+      - name: E2e test web (non-blocking for now)
+        continue-on-error: true
+        run: |
+          cd web
+          pnpm test:e2e
 
   build-and-test-android:
     name: Build and Test Android

api/src/auth/auth.service.ts

@@ -21,6 +21,12 @@ import {
   EmailVerificationDocument,
 } from './schemas/email-verification.schema'
 
+// For register and login, which hold the hash in memory before responding.
+export const withoutPassword = (user: UserDocument) => {
+  const { password, ...safe } = user.toObject()
+  return safe
+}
+
 @Injectable()
 export class AuthService {
   constructor(
@@ -39,7 +45,9 @@ export class AuthService {
   async login(userData: any) {
     await this.turnstileService.verify(userData.turnstileToken)
 
-    const user = await this.usersService.findOne({ email: userData.email })
+    const user = await this.usersService.findOneWithPassword({
+      email: userData.email,
+    })
     if (!user) {
       throw new HttpException(
         { error: 'Invalid credentials' },
@@ -60,7 +68,7 @@ export class AuthService {
     const payload = { email: user.email, sub: user._id }
     return {
       accessToken: this.jwtService.sign(payload),
-      user,
+      user: withoutPassword(user),
     }
   }
 
@@ -101,7 +109,7 @@ export class AuthService {
     const payload = { email: user.email, sub: user._id }
     return {
       accessToken: this.jwtService.sign(payload),
-      user,
+      user: withoutPassword(user),
     }
   }
 
@@ -140,7 +148,7 @@ export class AuthService {
 
     return {
       accessToken: this.jwtService.sign(payload),
-      user,
+      user: withoutPassword(user),
     }
   }
 
@@ -240,7 +248,9 @@ export class AuthService {
     input: { oldPassword: string; newPassword: string },
     user: UserDocument,
   ) {
-    const userToUpdate = await this.usersService.findOne({ _id: user._id })
+    const userToUpdate = await this.usersService.findOneWithPassword({
+      _id: user._id,
+    })
     if (!userToUpdate) {
       throw new HttpException({ error: 'User not found' }, HttpStatus.NOT_FOUND)
     }

api/src/auth/without-password.spec.ts

@@ -0,0 +1,41 @@
+import { withoutPassword } from './auth.service'
+import type { UserDocument } from '../users/schemas/user.schema'
+
+// Fake document: only toObject() matters to the helper.
+const doc = (fields: Record<string, unknown>) =>
+  ({ toObject: () => ({ ...fields }) }) as unknown as UserDocument
+
+describe('withoutPassword', () => {
+  it('removes the password hash', () => {
+    const safe = withoutPassword(
+      doc({ email: 'a@b.com', password: '$2a$10$hashedvalue' })
+    )
+
+    expect(safe).not.toHaveProperty('password')
+  })
+
+  it('keeps everything else the client needs', () => {
+    const safe = withoutPassword(
+      doc({
+        _id: 'u1',
+        email: 'a@b.com',
+        name: 'Ada',
+        role: 'regular',
+        password: '$2a$10$hashedvalue',
+      })
+    )
+
+    expect(safe).toEqual({
+      _id: 'u1',
+      email: 'a@b.com',
+      name: 'Ada',
+      role: 'regular',
+    })
+  })
+
+  it('is harmless when the hash was never loaded', () => {
+    const safe = withoutPassword(doc({ email: 'a@b.com' }))
+
+    expect(safe).toEqual({ email: 'a@b.com' })
+  })
+})

api/src/gateway/escape-regexp.spec.ts

@@ -0,0 +1,35 @@
+import { escapeRegExp } from './escape-regexp'
+
+describe('escapeRegExp', () => {
+  it('leaves plain text untouched', () => {
+    expect(escapeRegExp('hello world')).toBe('hello world')
+    expect(escapeRegExp('+14155550101')).toBe('\\+14155550101')
+  })
+
+  it('makes an unbalanced paren safe to compile', () => {
+    // Unescaped, `new RegExp('(')` throws and would fail the whole request.
+    expect(() => new RegExp(escapeRegExp('('))).not.toThrow()
+    expect(() => new RegExp(escapeRegExp('a)b['))).not.toThrow()
+  })
+
+  it('treats wildcards as literal characters', () => {
+    const pattern = new RegExp(escapeRegExp('.*'), 'i')
+    // A literal ".*" must not match arbitrary text.
+    expect(pattern.test('anything at all')).toBe(false)
+    expect(pattern.test('literally .* here')).toBe(true)
+  })
+
+  it('treats a dot as a dot, not "any character"', () => {
+    const pattern = new RegExp(escapeRegExp('a.c'), 'i')
+    expect(pattern.test('abc')).toBe(false)
+    expect(pattern.test('a.c')).toBe(true)
+  })
+
+  it('defuses a nested quantifier (ReDoS shape)', () => {
+    const pattern = new RegExp(escapeRegExp('(a+)+$'), 'i')
+    const start = Date.now()
+    pattern.test('a'.repeat(2000) + 'b')
+    // As a literal it is a plain substring scan, not catastrophic backtracking.
+    expect(Date.now() - start).toBeLessThan(100)
+  })
+})

api/src/gateway/escape-regexp.ts

@@ -0,0 +1,11 @@
+/**
+ * Escape every regular-expression metacharacter in a string so it can be
+ * embedded in a RegExp as a literal.
+ *
+ * Search terms come straight from user input. Without this, "(" alone throws
+ * a SyntaxError and fails the request, "." matches any character instead of a
+ * dot, and a nested quantifier is a ReDoS vector.
+ */
+export function escapeRegExp(value: string): string {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+}

api/src/gateway/gateway.controller.ts

@@ -160,8 +160,9 @@ export class GatewayController {
     const page = req.query.page ? parseInt(req.query.page, 10) : 1;
     const limit = req.query.limit ? Math.min(parseInt(req.query.limit, 10), 100) : 50;
     const type = req.query.type || '';
-
-    const result = await this.gatewayService.getMessages(deviceId, type, page, limit);
+    const search = req.query.search || '';
+
+    const result = await this.gatewayService.getMessages(deviceId, type, page, limit, search);
     return result;
   }
 

api/src/gateway/gateway.service.spec.ts

@@ -802,6 +802,65 @@ describe('GatewayService', () => {
         HttpException,
       )
     })
+
+    it('should search across message body, recipient and sender', async () => {
+      await service.getMessages(mockDeviceId, '', 1, 10, 'alice')
+
+      const expectedQuery = {
+        device: mockDevice._id,
+        $or: [
+          { message: /alice/i },
+          { recipient: /alice/i },
+          { sender: /alice/i },
+        ],
+      }
+
+      expect(mockSmsModel.countDocuments).toHaveBeenCalledWith(expectedQuery)
+      expect(mockSmsModel.find).toHaveBeenCalledWith(
+        expectedQuery,
+        null,
+        expect.any(Object),
+      )
+    })
+
+    it('should combine search with the type filter', async () => {
+      await service.getMessages(mockDeviceId, 'sent', 1, 10, 'alice')
+
+      expect(mockSmsModel.find).toHaveBeenCalledWith(
+        expect.objectContaining({
+          device: mockDevice._id,
+          type: SMSType.SENT,
+          $or: expect.any(Array),
+        }),
+        null,
+        expect.any(Object),
+      )
+    })
+
+    it('should ignore an empty or whitespace-only search', async () => {
+      await service.getMessages(mockDeviceId, '', 1, 10, '   ')
+
+      expect(mockSmsModel.find).toHaveBeenCalledWith(
+        { device: mockDevice._id },
+        null,
+        expect.any(Object),
+      )
+    })
+
+    it('should escape regex metacharacters in the search term', async () => {
+      // Unescaped, this throws a SyntaxError and fails the request.
+      await expect(
+        service.getMessages(mockDeviceId, '', 1, 10, '('),
+      ).resolves.toBeDefined()
+
+      // A wildcard must be matched literally, not treated as "any character".
+      await service.getMessages(mockDeviceId, '', 1, 10, '.*')
+
+      const call = mockSmsModel.find.mock.calls.at(-1)
+      const messagePattern = call[0].$or[0].message as RegExp
+      expect(messagePattern.test('anything at all')).toBe(false)
+      expect(messagePattern.test('contains .* literally')).toBe(true)
+    })
   })
 
   describe('getStatsForUser', () => {

api/src/gateway/gateway.service.ts

@@ -24,6 +24,7 @@ import { WebhookEvent } from '../webhook/webhook-event.enum'
 import { WebhookService } from '../webhook/webhook.service'
 import { BillingService } from '../billing/billing.service'
 import { SmsQueueService } from './queue/sms-queue.service'
+import { escapeRegExp } from './escape-regexp'
 
 @Injectable()
 export class GatewayService {
@@ -947,6 +948,7 @@ export class GatewayService {
     type = '',
     page = 1,
     limit = 50,
+    search = '',
   ): Promise<{ data: any[]; meta: any }> {
     const device = await this.deviceModel.findById(deviceId)
 
@@ -972,6 +974,19 @@ export class GatewayService {
       query.type = SMSType.RECEIVED
     }
 
+    // Free-text search across the message body and either party's number.
+    // The input is escaped before it reaches RegExp: an unescaped "(" throws
+    // and fails the request, and a crafted pattern is a ReDoS vector.
+    const trimmedSearch = search?.trim()
+    if (trimmedSearch) {
+      const pattern = new RegExp(escapeRegExp(trimmedSearch), 'i')
+      query.$or = [
+        { message: pattern },
+        { recipient: pattern },
+        { sender: pattern },
+      ]
+    }
+
     // Get total count for pagination metadata
     const total = await this.smsModel.countDocuments(query)
 

api/src/users/schemas/user.schema.spec.ts

@@ -0,0 +1,14 @@
+import { UserSchema } from './user.schema'
+
+describe('User schema', () => {
+  it('never selects the password hash by default', () => {
+    expect(UserSchema.path('password').options.select).toBe(false)
+  })
+
+  it.each(['email', 'name', 'role', 'emailVerifiedAt'])(
+    'still returns %s by default',
+    (field) => {
+      expect(UserSchema.path(field).options.select).toBeUndefined()
+    }
+  )
+})

api/src/users/schemas/user.schema.ts

@@ -23,7 +23,8 @@ export class User {
   @Prop({ type: String, trim: true })
   phone?: string
 
-  @Prop({ type: String })
+  // Never loaded unless a caller asks with .select('+password').
+  @Prop({ type: String, select: false })
   password: string
 
   @Prop({ type: String, default: UserRole.REGULAR })

api/src/users/users.service.ts

@@ -18,6 +18,11 @@ export class UsersService {
     return await this.userModel.findOne(params)
   }
 
+  // Only for flows that verify a password. Never return this to a client.
+  async findOneWithPassword(params) {
+    return await this.userModel.findOne(params).select('+password')
+  }
+
   async findAll() {
     return await this.userModel.find()
   }

web/.env.example

@@ -4,9 +4,10 @@ NEXT_PUBLIC_LATEST_APP_VERSION_CODE=17
 NEXT_PUBLIC_GOOGLE_CLIENT_ID=
 NEXT_PUBLIC_TAWKTO_EMBED_URL=
 
-AUTH_SECRET= # https://generate-secret.vercel.app/32
-
-DATABASE_URL=mongodb://adminUser:adminPassword@textbee-db:27017/textbee?authSource=admin
+# Used by NextAuth (next-auth v4) to sign/verify the session JWT. Must match
+# the value read by proxy.ts (process.env.NEXTAUTH_SECRET).
+NEXTAUTH_SECRET= # https://generate-secret.vercel.app/32
+NEXTAUTH_URL=http://localhost:3000
 
 MAIL_HOST=
 MAIL_PORT=

web/.gitignore

@@ -7,6 +7,9 @@
 
 # testing
 /coverage
+/test-results
+/playwright-report
+/playwright/.cache
 
 # next.js
 /.next/