Merge branch 'main' into feat/opacity-url-param

Author: JhaSourav07

app/api/compare/route.test.ts

@@ -0,0 +1,93 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { GET } from './route';
+
+vi.mock('@/lib/github', () => ({
+  getFullDashboardData: vi.fn(),
+}));
+
+import { getFullDashboardData } from '@/lib/github';
+
+const makeRequest = (search: string) => new Request(`http://localhost:3000/api/compare?${search}`);
+
+describe('GET /api/compare', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.mocked(getFullDashboardData).mockResolvedValue({
+      calendar: { totalContributions: 50, weeks: [] },
+    } as never);
+  });
+
+  // ── Validation ────────────────────────────────────────────────────────────
+
+  it('returns 400 when user1 is missing', async () => {
+    const res = await GET(makeRequest('user2=octocat'));
+    expect(res.status).toBe(400);
+  });
+
+  it('returns 400 when user2 is missing', async () => {
+    const res = await GET(makeRequest('user1=octocat'));
+    expect(res.status).toBe(400);
+  });
+
+  it('returns 400 when both users are missing', async () => {
+    const res = await GET(makeRequest(''));
+    expect(res.status).toBe(400);
+  });
+
+  it('returns 400 for invalid GitHub username format for user1', async () => {
+    const res = await GET(makeRequest('user1=-invalid&user2=octocat'));
+    expect(res.status).toBe(400);
+    const data = await res.json();
+    expect(data.details.fieldErrors.user1).toBeDefined();
+  });
+
+  it('returns 400 for invalid GitHub username format for user2', async () => {
+    const res = await GET(makeRequest('user1=octocat&user2=-invalid'));
+    expect(res.status).toBe(400);
+    const data = await res.json();
+    expect(data.details.fieldErrors.user2).toBeDefined();
+  });
+
+  it('returns 400 for username exceeding 39 characters', async () => {
+    const res = await GET(makeRequest(`user1=${'a'.repeat(40)}&user2=octocat`));
+    expect(res.status).toBe(400);
+  });
+
+  it('returns 400 when comparing a user with themselves', async () => {
+    const res = await GET(makeRequest('user1=octocat&user2=octocat'));
+    expect(res.status).toBe(400);
+    const data = await res.json();
+    expect(data.details.fieldErrors.user2).toContain('Cannot compare a user with themselves.');
+  });
+
+  it('returns 400 for self-comparison regardless of case', async () => {
+    const res = await GET(makeRequest('user1=OctoCat&user2=octocat'));
+    expect(res.status).toBe(400);
+  });
+
+  // ── Success ──────────────────────────────────────────────────────────────
+
+  it('returns 200 with comparison data for valid users', async () => {
+    const res = await GET(makeRequest('user1=alice&user2=bob'));
+    expect(res.status).toBe(200);
+    const data = await res.json();
+    expect(data.user1).toBeDefined();
+    expect(data.user2).toBeDefined();
+  });
+
+  // ── Error handling ────────────────────────────────────────────────────────
+
+  it('returns 404 when user1 is not found on GitHub', async () => {
+    vi.mocked(getFullDashboardData).mockRejectedValueOnce(new Error('Not found'));
+    const res = await GET(makeRequest('user1=ghost123&user2=octocat'));
+    expect(res.status).toBe(404);
+  });
+
+  it('returns 404 when user2 is not found on GitHub', async () => {
+    vi.mocked(getFullDashboardData)
+      .mockResolvedValueOnce({ calendar: { totalContributions: 0, weeks: [] } } as never)
+      .mockRejectedValueOnce(new Error('Not found'));
+    const res = await GET(makeRequest('user1=octocat&user2=ghost123'));
+    expect(res.status).toBe(404);
+  });
+});

app/api/compare/route.ts

@@ -1,23 +1,23 @@
 import { NextResponse } from 'next/server';
 import { getFullDashboardData } from '@/lib/github';
+import { compareParamsSchema } from '@/lib/validations';
 
 export const revalidate = 3600;
 
 export async function GET(request: Request) {
   const { searchParams } = new URL(request.url);
-  const user1 = searchParams.get('user1');
-  const user2 = searchParams.get('user2');
 
-  if (!user1 || !user2) {
+  const parseResult = compareParamsSchema.safeParse(Object.fromEntries(searchParams.entries()));
+
+  if (!parseResult.success) {
+    const fieldErrors = parseResult.error.flatten();
     return NextResponse.json(
-      { error: 'Both user1 and user2 query parameters are required.' },
+      { error: 'Invalid parameters', details: fieldErrors },
       { status: 400 }
     );
   }
 
-  if (user1.toLowerCase() === user2.toLowerCase()) {
-    return NextResponse.json({ error: 'Cannot compare a user with themselves.' }, { status: 400 });
-  }
+  const { user1, user2 } = parseResult.data;
 
   try {
     const [result1, result2] = await Promise.allSettled([

app/api/notify/route.test.ts

@@ -95,4 +95,43 @@ describe('GET /api/notify', () => {
     const res = await GET(makeRequest('GET', undefined, 'user=testuser'));
     expect(res.status).toBe(200);
   });
+
+  it('masks the email address in GET responses to prevent PII exposure', async () => {
+    vi.mocked(Notification.findOne).mockResolvedValue({
+      username: 'testuser',
+      email: 'john.doe@gmail.com',
+      frequency: 'weekly',
+      notifyOnCommit: true,
+      notifyOnStreak: false,
+      notifyOnMilestone: true,
+    } as never);
+
+    const res = await GET(makeRequest('GET', undefined, 'user=testuser'));
+    const body = await res.json();
+
+    expect(res.status).toBe(200);
+    // Assert the exact masked output for a known input
+    expect(body.data.email).toBe('jo***@gm***.com');
+    // The full email must never be returned
+    expect(body.data.email).not.toBe('john.doe@gmail.com');
+  });
+
+  it('masks emails without a TLD dot correctly (no trailing dot)', async () => {
+    vi.mocked(Notification.findOne).mockResolvedValue({
+      username: 'localuser',
+      email: 'admin@localhost',
+      frequency: 'daily',
+      notifyOnCommit: true,
+      notifyOnStreak: true,
+      notifyOnMilestone: true,
+    } as never);
+
+    const res = await GET(makeRequest('GET', undefined, 'user=localuser'));
+    const body = await res.json();
+
+    expect(res.status).toBe(200);
+    expect(body.data.email).toBe('ad***@lo***');
+    // Must not have a trailing dot
+    expect(body.data.email.endsWith('.')).toBe(false);
+  });
 });

app/api/notify/route.ts

@@ -3,6 +3,31 @@ import dbConnect from '@/lib/mongodb';
 import { Notification } from '@/models/Notification';
 import { NotificationPayload, NotificationResponse } from '@/types/index';
 
+/**
+ * Masks an email address to prevent PII exposure in unauthenticated responses.
+ * Example: "john.doe@gmail.com" → "jo***@gm***.com"
+ */
+function maskEmail(email: string): string {
+  const [local, domain] = email.split('@');
+  if (!local || !domain) return '***@***.***';
+
+  const maskedLocal = local.slice(0, Math.min(2, local.length)) + '***';
+
+  const dotIndex = domain.lastIndexOf('.');
+  if (dotIndex === -1) {
+    // Domain without a TLD (e.g., "localhost") — mask without trailing dot
+    const maskedDomain = domain.slice(0, Math.min(2, domain.length)) + '***';
+    return `${maskedLocal}@${maskedDomain}`;
+  }
+
+  const domainName = domain.slice(0, dotIndex);
+  const tld = domain.slice(dotIndex + 1);
+
+  const maskedDomain = domainName.slice(0, Math.min(2, domainName.length)) + '***';
+
+  return `${maskedLocal}@${maskedDomain}.${tld}`;
+}
+
 // ─── POST /api/notify ────────────────────────────────────────────────────────
 // Register or update email notification preferences for a user
 export async function POST(req: NextRequest): Promise<NextResponse<NotificationResponse>> {
@@ -106,13 +131,15 @@ export async function GET(req: NextRequest): Promise<NextResponse<NotificationRe
       );
     }
 
+    // Mask the email to prevent PII exposure in unauthenticated GET responses.
+    // The full email is only accepted on POST (write) — never returned on GET (read).
     return NextResponse.json(
       {
         success: true,
         message: 'Notification preferences fetched successfully.',
         data: {
           username: notification.username,
-          email: notification.email,
+          email: maskEmail(notification.email),
           frequency: notification.frequency,
           preferences: {
             notifyOnCommit: notification.notifyOnCommit,

app/api/streak/route.test.ts

@@ -724,12 +724,17 @@ describe('GET /api/streak', () => {
       expect(body).toContain('--cp-bg');
     });
 
-    it('falls back to the dark theme without crashing when an unknown theme is given', async () => {
-      const response = await GET(makeRequest({ user: 'octocat', theme: 'does-not-exist' }));
-      const body = await response.text();
+    it('returns 400 Bad Request listing allowed themes when an invalid theme is provided', async () => {
+      const response = await GET(makeRequest({ user: 'octocat', theme: 'nonexistent_theme_name' }));
+      expect(response.status).toBe(400);
 
-      expect(response.status).toBe(200);
-      expect(body).toContain('58a6ff');
+      const body = await response.json();
+      expect(body.error).toBe('Invalid parameters');
+      const fieldError = body.details.fieldErrors.theme[0];
+      expect(fieldError).toContain('Invalid theme. Supported themes:');
+      expect(fieldError).toContain('dark');
+      expect(fieldError).toContain('light');
+      expect(fieldError).toContain('neon');
     });
   });
 
@@ -1337,4 +1342,54 @@ describe('GET /api/streak', () => {
       expect(body).toContain('strictly for organizations');
     });
   });
+
+  describe('JSON output mode (format=json)', () => {
+    it('returns JSON with correct Content-Type when format=json is set', async () => {
+      const response = await GET(makeRequest({ user: 'octocat', format: 'json' }));
+      expect(response.status).toBe(200);
+      expect(response.headers.get('Content-Type')).toContain('application/json');
+    });
+
+    it('returns stats, monthlyStats, and calendar in JSON response', async () => {
+      const response = await GET(makeRequest({ user: 'octocat', format: 'json' }));
+      const data = await response.json();
+
+      expect(data.user).toBe('octocat');
+      expect(data.stats).toBeDefined();
+      expect(data.stats.currentStreak).toBeDefined();
+      expect(data.stats.longestStreak).toBeDefined();
+      expect(data.stats.totalContributions).toBeDefined();
+      expect(data.monthlyStats).toBeDefined();
+      expect(data.monthlyStats.currentMonthTotal).toBeDefined();
+      expect(data.calendar).toBeDefined();
+      expect(data.calendar.totalContributions).toBe(10);
+      expect(data.calendar.weeks).toHaveLength(2);
+    });
+
+    it('includes Cache-Control header in JSON response', async () => {
+      const response = await GET(makeRequest({ user: 'octocat', format: 'json' }));
+      expect(response.headers.get('Cache-Control')).toContain('s-maxage=');
+    });
+
+    it('includes X-Cache-Status header in JSON response', async () => {
+      const response = await GET(makeRequest({ user: 'octocat', format: 'json' }));
+      expect(response.headers.get('X-Cache-Status')).toBe('HIT');
+    });
+
+    it('returns SVG when format is not set (default)', async () => {
+      const response = await GET(makeRequest({ user: 'octocat' }));
+      expect(response.headers.get('Content-Type')).toBe('image/svg+xml');
+    });
+
+    it('falls back to SVG for invalid format values', async () => {
+      const response = await GET(makeRequest({ user: 'octocat', format: 'xml' }));
+      expect(response.headers.get('Content-Type')).toBe('image/svg+xml');
+    });
+
+    it('uses org name as user field when org parameter is provided', async () => {
+      const response = await GET(makeRequest({ user: 'octocat', org: 'github', format: 'json' }));
+      const data = await response.json();
+      expect(data.user).toBe('github');
+    });
+  });
 });

app/api/streak/route.ts

@@ -94,6 +94,7 @@ export async function GET(request: Request) {
       tz: tzParam,
       disable_particles,
       glow,
+      format,
     } = parseResult.data;
 
     const themeName = theme || 'dark';
@@ -107,6 +108,8 @@ export async function GET(request: Request) {
       : year
         ? `${year}-12-31T23:59:59Z`
         : undefined;
+    const currentYear = new Date().getUTCFullYear();
+    const isHistoricalYear = !!year && Number(year) < currentYear;
 
     let timezone = 'UTC';
     if (tzParam) {
@@ -196,6 +199,42 @@ export async function GET(request: Request) {
       }
     }
 
+    // ─── JSON output mode ──────────────────────────────────────────────────
+    if (format === 'json') {
+      const stats = calculateStreak(calendar, timezone, undefined, grace);
+      const monthlyStats = calculateMonthlyStats(
+        calendar,
+        timezone,
+        getMonthlyReferenceDate(year, timezone)
+      );
+
+      const secondsToMidnight = tzParam
+        ? getSecondsUntilMidnightInTimezone(timezone)
+        : getSecondsUntilUTCMidnight();
+      const cacheControl = refresh
+        ? 'no-cache, no-store, must-revalidate'
+        : `public, s-maxage=${secondsToMidnight}, stale-while-revalidate=86400`;
+
+      return NextResponse.json(
+        {
+          user: targetEntity,
+          stats,
+          monthlyStats,
+          calendar: {
+            totalContributions: calendar.totalContributions,
+            weeks: calendar.weeks,
+          },
+        },
+        {
+          headers: {
+            'Cache-Control': cacheControl,
+            'X-Cache-Status': refresh ? `BYPASS, fetched=${new Date().toISOString()}` : 'HIT',
+          },
+        }
+      );
+    }
+
+    // ─── SVG output mode (default) ──────────────────────────────────────────
     let svg = '';
     if (view === 'monthly') {
       const stats = calculateMonthlyStats(
@@ -226,7 +265,9 @@ export async function GET(request: Request) {
       : getSecondsUntilUTCMidnight();
     const cacheControl = refresh
       ? 'no-cache, no-store, must-revalidate'
-      : `public, s-maxage=${secondsToMidnight}, stale-while-revalidate=86400`;
+      : isHistoricalYear
+        ? 'public, s-maxage=31536000, immutable'
+        : `public, s-maxage=${secondsToMidnight}, stale-while-revalidate=86400`;
 
     return new NextResponse(svg, {
       headers: {