veza/tests/e2e/29-dmca-notice.spec.ts

import { test, expect } from '@chromatic-com/playwright';
import { CONFIG } from './helpers';

/**
 * v1.0.9 W3 Day 14 — DMCA workflow E2E.
 *
 * Roundtrip :
 *   1. Anonymous user submits notice via POST /api/v1/dmca/notice.
 *   2. Admin logs in (MFA-bearing account from seed) and lists pending
 *      notices via GET /api/v1/admin/dmca/notices.
 *   3. Admin honors the takedown via POST /api/v1/admin/dmca/notices/:id/takedown.
 *   4. The previously-public track is now 451-gated on
 *      GET /api/v1/tracks/:id/stream.
 *
 * The test gates itself behind two conditions :
 *   - Admin requires MFA (RequireMFA is in the chain). If the seed
 *     admin doesn't carry an MFA-bypassing token in this environment,
 *     the admin-side calls 403 ; we skip rather than report a false
 *     red. Set E2E_DMCA_ADMIN=1 once MFA seeding is in CI.
 *   - The seed creator track must exist + be public. We pick the first
 *     track returned by /api/v1/tracks for the creator login.
 */

const ADMIN_AVAILABLE = process.env.E2E_DMCA_ADMIN === '1';

interface ApiEnvelope<T> {
  success?: boolean;
  data: T;
  error?: { code?: string; message?: string };
}

async function login(
  request: import('@playwright/test').APIRequestContext,
  email: string,
  password: string,
): Promise<{ accessToken: string }> {
  const resp = await request.post(`${CONFIG.apiURL}/api/v1/auth/login`, {
    data: { email, password, remember_me: false },
  });
  expect(resp.status()).toBe(200);
  const body = (await resp.json()) as ApiEnvelope<{ token: { access_token: string } }>;
  const data = body?.data ?? (body as unknown as { token: { access_token: string } });
  const accessToken: string = data?.token?.access_token ?? '';
  expect(accessToken.length).toBeGreaterThan(0);
  return { accessToken };
}

test.describe('LEGAL — DMCA notice workflow (v1.0.9 W3 Day 14)', () => {
  test('29. anonymous notice submission produces a pending receipt', async ({ request }) => {
    test.setTimeout(30_000);

    const resp = await request.post(`${CONFIG.apiURL}/api/v1/dmca/notice`, {
      data: {
        claimant_name: 'E2E Tester',
        claimant_email: `e2e_dmca_${Date.now()}@example.com`,
        claimant_address: '1 Test Lane, Testville, Testland',
        work_description:
          'E2E test work description — this is a DMCA test notice generated by the playwright suite. Not a real claim.',
        sworn_statement: true,
      },
    });
    expect(resp.status(), 'public DMCA submission must accept a well-formed notice').toBe(201);
    const body = (await resp.json()) as ApiEnvelope<{ id: string; status: string }>;
    const receipt = body?.data ?? (body as unknown as { id: string; status: string });
    expect(receipt.id).toMatch(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i);
    expect(receipt.status).toBe('pending');
  });

  test('30. sworn_statement=false is rejected (DMCA § 512(c)(3)(A)(vi))', async ({ request }) => {
    const resp = await request.post(`${CONFIG.apiURL}/api/v1/dmca/notice`, {
      data: {
        claimant_name: 'E2E Tester',
        claimant_email: `e2e_dmca_${Date.now()}@example.com`,
        claimant_address: '1 Test Lane',
        work_description: 'A description that meets the min length requirement easily.',
        sworn_statement: false,
      },
    });
    // The binding=required on a boolean treats `false` as the zero
    // value, so gin's validator returns 400 — same shape we'd get for
    // any malformed payload.
    expect(resp.status()).toBe(400);
  });

  test('31. admin takedown gates playback with 451', async ({ request }) => {
    test.setTimeout(60_000);

    if (!ADMIN_AVAILABLE) {
      test.skip(
        true,
        'Set E2E_DMCA_ADMIN=1 once admin MFA bypass for tests is wired in the CI seed.',
      );
    }

    // Step 1 : creator publishes a track. Reuse the first track from
    // the seeded creator account ; we don't upload a fresh one to keep
    // the test fast.
    const { accessToken: creatorToken } = await login(
      request,
      CONFIG.users.creator.email,
      CONFIG.users.creator.password,
    );
    const tracksResp = await request.get(`${CONFIG.apiURL}/api/v1/tracks`, {
      headers: { Authorization: `Bearer ${creatorToken}` },
    });
    expect(tracksResp.status()).toBe(200);
    const tracksBody = (await tracksResp.json()) as ApiEnvelope<{ tracks: { id: string }[] }>;
    const tracks = tracksBody.data?.tracks ?? [];
    expect(tracks.length, 'seed creator account must have at least one track').toBeGreaterThan(0);
    const trackID = tracks[0].id;

    // Step 2 : anonymous claimant files a notice naming that track.
    const noticeResp = await request.post(`${CONFIG.apiURL}/api/v1/dmca/notice`, {
      data: {
        claimant_name: 'E2E Rights Holder',
        claimant_email: `e2e_dmca_admin_${Date.now()}@example.com`,
        claimant_address: '1 Holder St, Rights City',
        work_description:
          'E2E test — claimed work is the seed creator track ' + trackID + '.',
        infringing_track_id: trackID,
        sworn_statement: true,
      },
    });
    expect(noticeResp.status()).toBe(201);
    const noticeBody = (await noticeResp.json()) as ApiEnvelope<{ id: string }>;
    const noticeID = noticeBody.data.id;

    // Step 3 : admin approves takedown.
    const { accessToken: adminToken } = await login(
      request,
      CONFIG.users.admin.email,
      CONFIG.users.admin.password,
    );
    const takedownResp = await request.post(
      `${CONFIG.apiURL}/api/v1/admin/dmca/notices/${noticeID}/takedown`,
      {
        headers: { Authorization: `Bearer ${adminToken}` },
        data: { note: 'E2E test takedown' },
      },
    );
    expect(takedownResp.status(), 'admin takedown must succeed').toBe(200);

    // Step 4 : streaming the track now returns 451 (Unavailable For Legal Reasons).
    const streamResp = await request.get(
      `${CONFIG.apiURL}/api/v1/tracks/${trackID}/stream`,
      { headers: { Authorization: `Bearer ${creatorToken}` } },
    );
    expect(streamResp.status(), 'DMCA-blocked track must 451 even for the owner').toBe(451);
  });
});