Add settings-gated appointment notifications and fix Bird key validation.

Patients can be SMS/email notified on booking and video schedule when enabled in Settings. Bird validation now accepts only lsk_live_ keys, strips paste artifacts, and surfaces the platform error. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-13 13:31:28 +00:00
parent 7c33432dc9
commit d13d460e32
10 changed files with 625 additions and 15 deletions
@@ -218,4 +218,59 @@ class CareMessagingIntegrationsTest extends TestCase
                && $request['from_name'] === 'Clinic';
        });
    }
+
+    public function test_saving_bird_credentials_rejects_acct_prefix(): void
+    {
+        $this->actingAs($this->user)
+            ->post(route('care.integrations.bird.save'), [
+                'bird_api_key' => 'lsk_acct_'.str_repeat('a', 32),
+                'bird_from_email' => 'clinic@example.test',
+                'bird_from_name' => 'Clinic',
+            ])
+            ->assertRedirect()
+            ->assertSessionHas('error');
+    }
+
+    public function test_saving_bird_credentials_encrypts_live_key(): void
+    {
+        Http::fake([
+            '*/api/smtp/me' => Http::response([
+                'api_key_prefix' => 'lsk_live_abcd1234',
+                'status' => 'active',
+                'verified_domains' => ['example.test'],
+            ]),
+        ]);
+
+        $plain = 'lsk_live_'.str_repeat('e', 32);
+
+        $this->actingAs($this->user)
+            ->post(route('care.integrations.bird.save'), [
+                'bird_api_key' => "  {$plain}\n",
+                'bird_from_email' => 'clinic@example.test',
+                'bird_from_name' => 'Clinic',
+            ])
+            ->assertRedirect()
+            ->assertSessionHas('success');
+
+        $row = MessagingCredential::query()->where('organization_id', $this->organization->id)->first();
+        $this->assertNotNull($row);
+        $this->assertSame($plain, Crypt::decryptString($row->bird_api_key_encrypted));
+        $this->assertSame(MessagingCredential::STATUS_VALID, $row->bird_status);
+        $this->assertSame('clinic@example.test', $row->bird_from_email);
+    }
+
+    public function test_saving_bird_credentials_surfaces_platform_401(): void
+    {
+        Http::fake([
+            '*/api/smtp/me' => Http::response(['error' => 'Invalid or missing API key.'], 401),
+        ]);
+
+        $this->actingAs($this->user)
+            ->post(route('care.integrations.bird.save'), [
+                'bird_api_key' => 'lsk_live_'.str_repeat('f', 32),
+                'bird_from_email' => 'clinic@example.test',
+            ])
+            ->assertRedirect()
+            ->assertSessionHas('error', 'Invalid or missing API key.');
+    }
 }