redefined-designs/backend/tests/unit/analyticsConsent.test.ts

import { analyticsConsent } from '../../src/routes/customers';
import { ANALYTICS_CONSENT_TEXT, MARKETING_CONSENT_TEXT } from '../../src/utils';

/**
 * The rule this file exists for: the Brevo tracker runs only for a customer who
 * agreed to the *analytics* sentence, and marketing consent has nothing to do
 * with it (#56).
 *
 * Both halves matter and both are compliance requirements rather than taste.
 * GDPR requires consent to be granular — email and tracking are separate
 * purposes with separate recipients, and current EDPB guidance treats bundling
 * them as invalid. Quebec's Law 25 s.8.1 requires profiling to be off until the
 * person switches it on, which is why the column defaults to false.
 *
 * The failure mode is silent: reading the wrong flag tracks people whose
 * marketing consent really is `true` and who never agreed to any of this.
 */
describe('analyticsConsent', () => {
  it('is true for a customer who agreed to the current analytics wording', () => {
    expect(
      analyticsConsent({ analytics_consent: true, analytics_consent_text: ANALYTICS_CONSENT_TEXT })
    ).toBe(true);
  });

  it('is false when analytics consent was never given', () => {
    // Where the migration leaves every existing customer, and where Law 25
    // requires a new one to start.
    expect(
      analyticsConsent({ analytics_consent: false, analytics_consent_text: null })
    ).toBe(false);
  });

  it('is false when the stored wording is not the current one', () => {
    // Re-wording the sentence re-asks rather than assuming. Anyone who agreed
    // to a previous version stops qualifying until they agree to this one.
    expect(
      analyticsConsent({ analytics_consent: true, analytics_consent_text: 'some older sentence' })
    ).toBe(false);
  });

  it('is false when the flag is set but no wording was recorded', () => {
    expect(
      analyticsConsent({ analytics_consent: true, analytics_consent_text: null })
    ).toBe(false);
  });

  it('is false when withdrawal wrote its reason rather than the consent text', () => {
    expect(
      analyticsConsent({
        analytics_consent: false,
        analytics_consent_text: 'Withdrew analytics consent via account settings'
      })
    ).toBe(false);
  });

  it('does not accept a near-miss', () => {
    expect(
      analyticsConsent({
        analytics_consent: true,
        analytics_consent_text: `${ANALYTICS_CONSENT_TEXT} `
      })
    ).toBe(false);
  });

  describe('the two consents stay separate', () => {
    // Not a tautology. These fail if anyone re-bundles the purposes — either by
    // folding tracking back into the marketing sentence, or by pointing this
    // function at the marketing columns — which is the specific pattern GDPR
    // and Law 25 both reject, and which this project shipped once already
    // before it was caught.
    it('marketing consent alone does not authorise tracking', () => {
      expect(
        analyticsConsent({ analytics_consent: false, analytics_consent_text: MARKETING_CONSENT_TEXT })
      ).toBe(false);
    });

    it('the marketing sentence says nothing about tracking', () => {
      expect(MARKETING_CONSENT_TEXT).not.toContain('browse');
      expect(MARKETING_CONSENT_TEXT).not.toContain('Brevo');
    });

    it('the analytics sentence names the recipient and says it is optional', () => {
      // Informed consent means the customer can tell who receives their data;
      // "our email provider" is not something they can act on.
      expect(ANALYTICS_CONSENT_TEXT).toContain('Brevo');
      expect(ANALYTICS_CONSENT_TEXT).toContain('optional');
    });

    it('the two sentences are not the same string', () => {
      expect(ANALYTICS_CONSENT_TEXT).not.toBe(MARKETING_CONSENT_TEXT);
    });
  });
});