OpenFrame/tests/unit/lib/email-validation.test.ts

import { describe, expect, it } from 'vitest';
import {
  isDisposableEmailDomain,
  isValidEmailAddress,
  normalizeEmail,
} from '@/lib/email-validation';

describe('normalizeEmail', () => {
  it.each([
    ['  [email protected]  ', '[email protected]'],
    ['[email protected]', '[email protected]'],
    ['\[email protected]\n', '[email protected]'],
    ['[email protected]', '[email protected]'],
  ])('normalises %s to %s', (input, expected) => {
    expect(normalizeEmail(input)).toBe(expected);
  });

  it('does not strip internal whitespace', () => {
    expect(normalizeEmail('a [email protected]')).toBe('a [email protected]');
  });
});

describe('isValidEmailAddress', () => {
  it.each([
    '[email protected]',
    '[email protected]',
    '[email protected]',
    '[email protected]',
    "o'[email protected]",
    '[email protected]',
    '[email protected]',
  ])('accepts %s', (email) => {
    expect(isValidEmailAddress(email)).toBe(true);
  });

  it.each([
    ['an empty string', ''],
    ['a two character string', 'a@'],
    ['no at sign', 'userexample.com'],
    ['a leading at sign', '@example.com'],
    ['two at signs', 'user@[email protected]'],
    ['a domain with no dot', 'user@example'],
    ['a domain that is only a dot', 'user@.'],
    ['an empty domain label', '[email protected]'],
    ['a trailing dot', '[email protected].'],
    ['a leading dot in the domain', '[email protected]'],
    ['an internal space', 'user [email protected]'],
    ['a leading space', ' [email protected]'],
    ['a tab', 'user\[email protected]'],
    ['a newline', '[email protected]\n'],
    ['a carriage return', 'user\[email protected]'],
    ['a null byte', 'user\[email protected]'],
    ['a delete character', 'user\[email protected]'],
    ['an empty local part', '@b.co'],
  ])('rejects %s', (_label, email) => {
    expect(isValidEmailAddress(email)).toBe(false);
  });

  it('accepts a local part of exactly 64 characters', () => {
    expect(isValidEmailAddress(`${'a'.repeat(64)}@example.com`)).toBe(true);
  });

  it('rejects a local part of 65 characters', () => {
    expect(isValidEmailAddress(`${'a'.repeat(65)}@example.com`)).toBe(false);
  });

  it('accepts a domain label of exactly 63 characters', () => {
    expect(isValidEmailAddress(`user@${'a'.repeat(63)}.com`)).toBe(true);
  });

  it('rejects a domain label of 64 characters', () => {
    expect(isValidEmailAddress(`user@${'a'.repeat(64)}.com`)).toBe(false);
  });

  it('accepts an address of exactly 254 characters', () => {
    const local = 'a'.repeat(64);
    const domain = `${'b'.repeat(63)}.${'c'.repeat(63)}.${'d'.repeat(61)}`;
    const email = `${local}@${domain}`;

    expect(email).toHaveLength(254);
    expect(isValidEmailAddress(email)).toBe(true);
  });

  it('rejects an address of 255 characters', () => {
    const local = 'a'.repeat(64);
    const domain = `${'b'.repeat(63)}.${'c'.repeat(63)}.${'d'.repeat(62)}`;
    const email = `${local}@${domain}`;

    expect(email).toHaveLength(255);
    expect(isValidEmailAddress(email)).toBe(false);
  });

  it('rejects a three character address because the domain cannot hold a dot', () => {
    // The length floor is 3, so this documents that the domain rule, not the
    // length rule, is what rejects the shortest inputs.
    expect(isValidEmailAddress('a@b')).toBe(false);
    expect(isValidEmailAddress('ab')).toBe(false);
  });
});

describe('isDisposableEmailDomain', () => {
  it.each([
    '[email protected]',
    '[email protected]',
    '[email protected]',
    '[email protected]',
  ])('refuses %s', (email) => {
    expect(isDisposableEmailDomain(email)).toBe(true);
  });

  // Several of these providers hand out a fresh subdomain per visit, so an
  // exact-match lookup would let every one of them through.
  it('follows a disposable provider into its subdomains', () => {
    expect(isDisposableEmailDomain('[email protected]')).toBe(true);
    expect(isDisposableEmailDomain('[email protected]')).toBe(true);
  });

  it('is not fooled by a domain that merely ends with the same letters', () => {
    expect(isDisposableEmailDomain('[email protected]')).toBe(false);
    expect(isDisposableEmailDomain('[email protected]')).toBe(false);
  });

  it.each([
    '[email protected]',
    '[email protected]',
    // Forwarding and masking services are what privacy-minded paying customers
    // actually use. Blocking them would cost real revenue.
    '[email protected]',
    '[email protected]',
    '[email protected]',
  ])('accepts %s', (email) => {
    expect(isDisposableEmailDomain(email)).toBe(false);
  });

  it('ignores case and surrounding whitespace in the domain', () => {
    expect(isDisposableEmailDomain('[email protected]')).toBe(true);
  });

  it('returns false for a string with no domain at all', () => {
    expect(isDisposableEmailDomain('someone')).toBe(false);
    expect(isDisposableEmailDomain('')).toBe(false);
  });
});