fix(policy): startup warn for missing SubjectRegistration + mailer test coverage

lib/helpers/mailer/tests/mailer.unit.tests.js

@@ -131,6 +131,18 @@ describe('mailer index with resend provider unit tests:', () => {
     ).rejects.toThrow('exceeds 25 MB limit');
   });
 
+  test('should throw when attachment filename is an empty string', async () => {
+    await expect(
+      mailer.sendMail({
+        to: 'user@example.com',
+        subject: 'Test',
+        template: 'welcome',
+        params: { name: 'Bob' },
+        attachments: [{ filename: '', content: 'data' }],
+      }),
+    ).rejects.toThrow('Attachment filename must be a non-empty string');
+  });
+
   test('should throw when attachment filename is not a string', async () => {
     await expect(
       mailer.sendMail({

lib/helpers/mailer/tests/provider.resend.unit.tests.js

@@ -84,6 +84,26 @@ describe('ResendProvider unit tests:', () => {
     expect(result).toEqual(mockData);
   });
 
+  test('should encode Buffer attachment content to base64', async () => {
+    const buffer = Buffer.from('binary data');
+    const mockData = { id: 'email_buf' };
+    sendMock.mockResolvedValue({ data: mockData, error: null });
+
+    await provider.send({
+      from: 'from@test.com',
+      to: 'to@test.com',
+      subject: 'Test',
+      html: '<p>test</p>',
+      attachments: [{ filename: 'data.bin', content: buffer }],
+    });
+
+    expect(sendMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        attachments: [{ filename: 'data.bin', content: Buffer.from(buffer).toString('base64') }],
+      }),
+    );
+  });
+
   test('should throw on Resend API error', async () => {
     sendMock.mockResolvedValue({ data: null, error: { message: 'Invalid API key' } });
 

lib/middlewares/policy.js

@@ -3,6 +3,7 @@
  */
 import path from 'path';
 import responses from '../helpers/responses.js';
+import logger from '../services/logger.js';
 
 const methodToAction = {
   get: 'read', post: 'create', put: 'update', patch: 'update', delete: 'delete',
@@ -255,9 +256,16 @@ const discoverPolicies = async (policyPaths) => {
       }
       // Call subject registration functions exported by module policy files
       if (normalizedKey.endsWith('subjectregistration')) {
+        entry.hasSubjectRegistration = true;
         value({ registerDocumentSubject, registerPathSubject });
       }
     }
+    // Warn if the module exports abilities but no SubjectRegistration — document subjects will not be resolved
+    if ((entry.abilities || entry.guestAbilities) && !entry.hasSubjectRegistration) {
+      logger.warn(
+        `[policy] ${path.basename(policyPath)}: exports abilities but no SubjectRegistration — document subjects will not be resolved`,
+      );
+    }
     // Also support old invokeRolesPolicies pattern during transition — skip if new-style exports found
     if (entry.abilities || entry.guestAbilities) {
       registerAbilities(entry);

lib/middlewares/tests/fixtures/policy-abilities-only.js

@@ -0,0 +1,4 @@
+// Fixture: policy file with abilities but no SubjectRegistration
+export function taskAbilities(user, membership, { can }) {
+  can('read', 'Task');
+}

lib/middlewares/tests/fixtures/policy-guest-abilities-only.js

@@ -0,0 +1,4 @@
+// Fixture: policy file with guestAbilities but no SubjectRegistration
+export function taskGuestAbilities({ can }) {
+  can('read', 'Task');
+}

lib/middlewares/tests/fixtures/policy-registration-only.js

@@ -0,0 +1,4 @@
+// Fixture: policy file with SubjectRegistration only (no abilities)
+export function taskSubjectRegistration({ registerDocumentSubject }) {
+  registerDocumentSubject('task', 'Task');
+}

lib/middlewares/tests/fixtures/policy-with-registration.js

@@ -0,0 +1,8 @@
+// Fixture: policy file with abilities AND SubjectRegistration
+export function taskAbilities(user, membership, { can }) {
+  can('read', 'Task');
+}
+
+export function taskSubjectRegistration({ registerDocumentSubject }) {
+  registerDocumentSubject('task', 'Task');
+}

lib/middlewares/tests/policy.unit.tests.js

@@ -0,0 +1,67 @@
+/**
+ * Module dependencies.
+ */
+import { jest, describe, test, expect, beforeEach } from '@jest/globals';
+import { fileURLToPath } from 'url';
+import path from 'path';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+// Mock logger before importing policy
+jest.unstable_mockModule('../../services/logger.js', () => ({
+  default: {
+    warn: jest.fn(),
+    info: jest.fn(),
+    error: jest.fn(),
+  },
+}));
+
+// Mock @casl/ability
+jest.unstable_mockModule('@casl/ability', () => ({
+  AbilityBuilder: jest.fn().mockImplementation(() => ({
+    can: jest.fn(),
+    cannot: jest.fn(),
+    build: jest.fn().mockReturnValue({ can: jest.fn().mockReturnValue(true) }),
+  })),
+  Ability: jest.fn(),
+  subject: jest.fn((type, doc) => doc),
+}));
+
+const { default: logger } = await import('../../services/logger.js');
+const { default: policy } = await import('../policy.js');
+
+const fixture = (name) => path.join(__dirname, 'fixtures', name);
+
+describe('policy discoverPolicies unit tests:', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  test('should warn when a policy file exports abilities but no SubjectRegistration', async () => {
+    await policy.discoverPolicies([fixture('policy-abilities-only.js')]);
+
+    expect(logger.warn).toHaveBeenCalledWith(
+      expect.stringContaining('exports abilities but no SubjectRegistration'),
+    );
+  });
+
+  test('should not warn when a policy file exports both abilities and SubjectRegistration', async () => {
+    await policy.discoverPolicies([fixture('policy-with-registration.js')]);
+
+    expect(logger.warn).not.toHaveBeenCalled();
+  });
+
+  test('should not warn when a policy file exports only SubjectRegistration without abilities', async () => {
+    await policy.discoverPolicies([fixture('policy-registration-only.js')]);
+
+    expect(logger.warn).not.toHaveBeenCalled();
+  });
+
+  test('should warn when a policy file exports guestAbilities but no SubjectRegistration', async () => {
+    await policy.discoverPolicies([fixture('policy-guest-abilities-only.js')]);
+
+    expect(logger.warn).toHaveBeenCalledWith(
+      expect.stringContaining('exports abilities but no SubjectRegistration'),
+    );
+  });
+});