Include complete digest batches and validate email transport outcomes

tests/email-transport.test.mjs

@@ -0,0 +1,22 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {sendEmail,tenderDigestHtml} from '../server/email.mjs';
+test('email transport preserves pinned sender and idempotency key, bounds requests and rejects ambiguous success',async()=>{
+ const original=globalThis.fetch,oldKey=process.env.RESEND_API_KEY;process.env.RESEND_API_KEY='re_synthetic_only';
+ try {
+  let request;
+  globalThis.fetch=async(url,options)=>{request=options;return {ok:true,json:async()=>({id:'provider-id'})};};
+  const mail={to:'qa@example.test',subject:'QA',html:'<p>QA</p>',from:'Pinned <qa@example.test>',idempotencyKey:'notify/123'};
+  assert.equal((await sendEmail(mail)).id,'provider-id');
+  assert.equal(request.headers['Idempotency-Key'],'notify/123');assert.equal(JSON.parse(request.body).from,mail.from);assert.ok(request.signal instanceof AbortSignal);
+  globalThis.fetch=async()=>({ok:true,json:async()=>({})});
+  await assert.rejects(sendEmail(mail),/sonucu belirsiz/);
+  globalThis.fetch=async()=>assert.fail('invalid key must not reach provider');
+  await assert.rejects(sendEmail({...mail,idempotencyKey:'bad\r\nkey'}),/Geçersiz/);
+ }finally {globalThis.fetch=original;if(oldKey===undefined)delete process.env.RESEND_API_KEY;else process.env.RESEND_API_KEY=oldKey;}
+});
+test('digest includes every selected tender and escapes untrusted content',()=>{
+ const html=tenderDigestHtml({name:'<script>',tenders:Array.from({length:25},(_,i)=>({baslik:'KALEM-'+i,sehir:'<img>',tarih:'10.09.2026'}))});
+ for(let i=0;i<25;i++)assert.ok(html.includes('>KALEM-'+i+'<'));
+ assert.ok(html.includes('&lt;script&gt;'));assert.ok(html.includes('&lt;img&gt;'));assert.equal(html.includes('<script>'),false);
+});