chore: import upstream snapshot with attribution

apps/sim/app/api/webhooks/tiktok/route.test.ts

@@ -0,0 +1,116 @@
+/**
+ * @vitest-environment node
+ */
+
+import crypto from 'node:crypto'
+import { NextRequest } from 'next/server'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockEnqueue, mockExecuteTikTokWebhookIngress, mockRelease } = vi.hoisted(() => ({
+  mockEnqueue: vi.fn(),
+  mockExecuteTikTokWebhookIngress: vi.fn(),
+  mockRelease: vi.fn(),
+}))
+
+vi.mock('@/background/tiktok-webhook-ingress', () => ({
+  executeTikTokWebhookIngress: mockExecuteTikTokWebhookIngress,
+  TIKTOK_WEBHOOK_INGRESS_CONCURRENCY_LIMIT: 50,
+  TIKTOK_WEBHOOK_INGRESS_MAX_ATTEMPTS: 3,
+}))
+
+vi.mock('@/lib/core/admission/gate', () => ({
+  admissionRejectedResponse: vi.fn(() => new Response(null, { status: 503 })),
+  tryAdmit: vi.fn(() => ({ release: mockRelease })),
+}))
+
+vi.mock('@/lib/core/async-jobs', () => ({
+  getJobQueue: vi.fn(async () => ({ enqueue: mockEnqueue })),
+}))
+
+vi.mock('@/lib/core/config/env', () => ({
+  env: {
+    TIKTOK_CLIENT_ID: 'client-key',
+    TIKTOK_CLIENT_SECRET: 'client-secret',
+  },
+}))
+
+vi.mock('@/lib/core/utils/request', () => ({
+  generateRequestId: vi.fn(() => 'request-1'),
+}))
+
+vi.mock('@/lib/core/utils/with-route-handler', () => ({
+  withRouteHandler:
+    (handler: (request: NextRequest) => Promise<Response>) => (request: NextRequest) =>
+      handler(request),
+}))
+
+import { POST } from '@/app/api/webhooks/tiktok/route'
+
+function signedRequest(overrides?: { clientKey?: string }): NextRequest {
+  const body = JSON.stringify({
+    client_key: overrides?.clientKey ?? 'client-key',
+    event: 'post.publish.complete',
+    create_time: 1_725_000_000,
+    user_openid: 'act.user',
+    content: '{"publish_id":"publish-1"}',
+  })
+  const timestamp = String(Math.floor(Date.now() / 1000))
+  const signature = crypto
+    .createHmac('sha256', 'client-secret')
+    .update(`${timestamp}.${body}`, 'utf8')
+    .digest('hex')
+
+  return new NextRequest('http://localhost/api/webhooks/tiktok', {
+    method: 'POST',
+    headers: {
+      'content-type': 'application/json',
+      'TikTok-Signature': `t=${timestamp},s=${signature}`,
+    },
+    body,
+  })
+}
+
+describe('TikTok webhook ingress route', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockEnqueue.mockResolvedValue('ingress-job-1')
+  })
+
+  it('returns 200 only after the verified delivery is accepted by the job queue', async () => {
+    const response = await POST(signedRequest())
+
+    expect(response.status).toBe(200)
+    await expect(response.json()).resolves.toEqual({ ok: true })
+    expect(mockEnqueue).toHaveBeenCalledWith(
+      'tiktok-webhook-ingress',
+      expect.objectContaining({
+        envelope: expect.objectContaining({
+          client_key: 'client-key',
+          user_openid: 'act.user',
+        }),
+        requestId: 'request-1',
+      }),
+      expect.objectContaining({
+        maxAttempts: 3,
+        runner: expect.any(Function),
+      })
+    )
+    expect(mockRelease).toHaveBeenCalledOnce()
+  })
+
+  it('returns 503 when durable acceptance fails so TikTok retries', async () => {
+    mockEnqueue.mockRejectedValue(new Error('queue unavailable'))
+
+    const response = await POST(signedRequest())
+
+    expect(response.status).toBe(503)
+    expect(mockRelease).toHaveBeenCalledOnce()
+  })
+
+  it('rejects a signed delivery for a different TikTok app', async () => {
+    const response = await POST(signedRequest({ clientKey: 'other-client-key' }))
+
+    expect(response.status).toBe(401)
+    expect(mockEnqueue).not.toHaveBeenCalled()
+  })
+})