fix: remediate audited tech debt and close functional test gaps

Backend:
- validate PUT /admin/publication with a Zod schema (was raw json -> 500)
- wrap category delete and entry membership/label writes in db.batch (atomic)
- add JWT crypto-path tests (sig/exp/nbf/alg/issuer/audience), image/move/
  menu-delete/hours route tests, rate-limiter and demo-bypass tests
- packages/schemas: tests per module (was zero)

Web:
- surface errors on MenusPage toggle/reorder/delete and TranslationTabs translate
- route confirm()/alert() through ConfirmDeleteModal where it fits
- dedupe aiVoice<->aiChat coupling in SettingsPage
- add api mutation, imageUpload, sanitizeI18nData, restaurantStore schedule,
  TranslationTabs, MenusPage, CategoriesPage tests

Chat worker:
- sanitize user content before WorkersAI prompt flattening (injection)
- consume daily quota only after successful menu load; document KV race ceiling
- unify token caps via shared constant; log silent JSON parse failures
- align debug.ts with the real provider path
- add allergen-exclusion, Anthropic/WorkersAI provider, and handler tests

npm run health passes end-to-end.

Author: vekexasia

.pii-allowlist

@@ -166,3 +166,9 @@ registry[.]npmjs[.]org
 (?i)^orari di apertura$
 (?i)^ravioli de$
 (?i)^hausgemacht$
+
+# ── Test fixtures (not PII) ──
+# Fake URL used as the request target in chat worker handler tests.
+^https?://x/chat$
+# Fixed system-clock dates used in vitest rate-limit/daily-cap window tests.
+^2026-02-01T

backend/src/__tests__/admin-routes-extra.test.ts

@@ -0,0 +1,206 @@
+import { describe, it, expect, beforeAll } from 'vitest';
+import { testRequest } from './helpers';
+import { createTestDb, makeDbEnv, seedSettings, seedMenu, seedCategory, seedEntry, signTestJwt, installJwksMock } from './helpers/db';
+
+beforeAll(() => installJwksMock());
+
+const ADMIN_UID = 'admin-1';
+const R2_BASE = 'https://cdn.test.local';
+
+// Minimal in-memory R2 stub recording put/delete calls.
+function makeR2() {
+  const objects = new Map<string, unknown>();
+  const calls = { put: [] as string[], delete: [] as string[] };
+  const bucket = {
+    async put(key: string, value: unknown) {
+      calls.put.push(key);
+      objects.set(key, value);
+      return { key } as R2Object;
+    },
+    async delete(key: string) {
+      calls.delete.push(key);
+      objects.delete(key);
+    },
+    async get() { return null; },
+    async head() { return null; },
+    async list() { return { objects: [], truncated: false } as unknown as R2Objects; },
+  } as unknown as R2Bucket;
+  return { bucket, objects, calls };
+}
+
+function jpegBody(): ArrayBuffer {
+  const buf = new Uint8Array(64);
+  buf[0] = 0xff; buf[1] = 0xd8; buf[2] = 0xff;
+  return buf.buffer;
+}
+
+async function adminEnv(r2?: ReturnType<typeof makeR2>, db = createTestDb()) {
+  seedSettings(db);
+  const overrides: Record<string, unknown> = { ADMIN_EMAILS: ADMIN_UID };
+  if (r2) {
+    overrides.PUBLIC_MENU_BUCKET = r2.bucket;
+    overrides.R2_PUBLIC_URL = R2_BASE;
+  }
+  const env = makeDbEnv(db, overrides);
+  const token = await signTestJwt(ADMIN_UID);
+  return { db, env, headers: { 'Cf-Access-Jwt-Assertion': token } };
+}
+
+describe('POST /admin/entries/:id/image', () => {
+  it('puts to R2 and stores image_url on the entry', async () => {
+    const r2 = makeR2();
+    const { db, env, headers } = await adminEnv(r2);
+    seedCategory(db, 'cat-1');
+    seedEntry(db, 'entry-1', 'cat-1');
+
+    const res = await testRequest('/admin/entries/entry-1/image', {
+      method: 'POST', headers, env, body: jpegBody(),
+    });
+    expect(res.status).toBe(200);
+    const body = await res.json() as { imageUrl: string };
+    expect(r2.calls.put.some(k => k.startsWith('images/entries/entry-1-'))).toBe(true);
+    expect(body.imageUrl.startsWith(`${R2_BASE}/images/entries/entry-1-`)).toBe(true);
+
+    const row = db.raw.prepare('SELECT image_url FROM menu_entries WHERE id = ?').get('entry-1') as { image_url: string };
+    expect(row.image_url).toBe(body.imageUrl);
+  });
+
+  it('returns 404 for a missing entry', async () => {
+    const r2 = makeR2();
+    const { env, headers } = await adminEnv(r2);
+    const res = await testRequest('/admin/entries/nope/image', {
+      method: 'POST', headers, env, body: jpegBody(),
+    });
+    expect(res.status).toBe(404);
+  });
+});
+
+describe('DELETE /admin/entries/:id/image', () => {
+  it('deletes the old R2 object and nulls image_url', async () => {
+    const r2 = makeR2();
+    const { db, env, headers } = await adminEnv(r2);
+    seedCategory(db, 'cat-1');
+    seedEntry(db, 'entry-1', 'cat-1');
+    const key = 'images/entries/entry-1-123.jpg';
+    db.raw.prepare('UPDATE menu_entries SET image_url = ? WHERE id = ?').run(`${R2_BASE}/${key}`, 'entry-1');
+
+    const res = await testRequest('/admin/entries/entry-1/image', { method: 'DELETE', headers, env });
+    expect(res.status).toBe(200);
+    expect(r2.calls.delete).toContain(key);
+    const row = db.raw.prepare('SELECT image_url FROM menu_entries WHERE id = ?').get('entry-1') as { image_url: string | null };
+    expect(row.image_url).toBeNull();
+  });
+});
+
+describe('POST /admin/header-image', () => {
+  it('uploads and stores headerImage on settings.info', async () => {
+    const r2 = makeR2();
+    const { db, env, headers } = await adminEnv(r2);
+
+    const res = await testRequest('/admin/header-image', {
+      method: 'POST', headers, env, body: jpegBody(),
+    });
+    expect(res.status).toBe(200);
+    const body = await res.json() as { imageUrl: string };
+    expect(r2.calls.put.some(k => k.startsWith('images/settings/header-'))).toBe(true);
+
+    const row = db.raw.prepare('SELECT info FROM settings WHERE id = 1').get() as { info: string };
+    expect(JSON.parse(row.info).headerImage).toBe(body.imageUrl);
+  });
+});
+
+describe('POST /admin/promotion-image', () => {
+  it('uploads and stores url on settings.promotion_alert', async () => {
+    const r2 = makeR2();
+    const { db, env, headers } = await adminEnv(r2);
+
+    const res = await testRequest('/admin/promotion-image', {
+      method: 'POST', headers, env, body: jpegBody(),
+    });
+    expect(res.status).toBe(200);
+    const body = await res.json() as { imageUrl: string };
+
+    const row = db.raw.prepare('SELECT promotion_alert FROM settings WHERE id = 1').get() as { promotion_alert: string };
+    expect(JSON.parse(row.promotion_alert).url).toBe(body.imageUrl);
+  });
+});
+
+describe('DELETE /admin/entries/:id removes its R2 image', () => {
+  it('deletes the entry image object on entry delete', async () => {
+    const r2 = makeR2();
+    const { db, env, headers } = await adminEnv(r2);
+    seedCategory(db, 'cat-1');
+    seedEntry(db, 'entry-1', 'cat-1');
+    const key = 'images/entries/entry-1-9.jpg';
+    db.raw.prepare('UPDATE menu_entries SET image_url = ? WHERE id = ?').run(`${R2_BASE}/${key}`, 'entry-1');
+
+    const res = await testRequest('/admin/entries/entry-1', { method: 'DELETE', headers, env });
+    expect(res.status).toBe(200);
+    expect(r2.calls.delete).toContain(key);
+  });
+});
+
+describe('DELETE /admin/menus/:menuId FK cascade', () => {
+  it('removes the menu and its memberships, keeps the entry', async () => {
+    const { db, env, headers } = await adminEnv();
+    seedMenu(db, 'm-1', 'food');
+    seedCategory(db, 'cat-1');
+    seedEntry(db, 'entry-1', 'cat-1');
+    db.raw.prepare('INSERT INTO menu_entry_memberships (menu_id, entry_id) VALUES (?, ?)').run('m-1', 'entry-1');
+
+    const res = await testRequest('/admin/menus/m-1', { method: 'DELETE', headers, env });
+    expect(res.status).toBe(200);
+    expect(db.raw.prepare('SELECT COUNT(*) AS n FROM menus').get()).toEqual({ n: 0 });
+    expect(db.raw.prepare('SELECT COUNT(*) AS n FROM menu_entry_memberships').get()).toEqual({ n: 0 });
+    expect(db.raw.prepare('SELECT COUNT(*) AS n FROM menu_entries').get()).toEqual({ n: 1 });
+  });
+});
+
+describe('PUT /admin/hours', () => {
+  it('persists a valid opening schedule', async () => {
+    const { db, env, headers } = await adminEnv();
+    const openingSchedule = {
+      open: true,
+      minWaitSlot: 0,
+      slotDuration: 30,
+      maxDaysLookAhead: 7,
+      schedule: [[{ start: '09:00', end: '12:00' }], [], [], [], [], [], []],
+    };
+    const res = await testRequest('/admin/hours', {
+      method: 'PUT', headers, env, body: { openingSchedule },
+    });
+    expect(res.status).toBe(200);
+    const row = db.raw.prepare('SELECT opening_schedule FROM settings WHERE id = 1').get() as { opening_schedule: string };
+    expect(JSON.parse(row.opening_schedule)).toEqual(openingSchedule);
+  });
+
+  it('rejects a malformed schedule with 400', async () => {
+    const { env, headers } = await adminEnv();
+    const res = await testRequest('/admin/hours', {
+      method: 'PUT', headers, env, body: { openingSchedule: { open: true } },
+    });
+    expect(res.status).toBe(400);
+  });
+});
+
+describe('POST /admin/entries/:id/move (404 path)', () => {
+  it('returns 404 when target category is missing', async () => {
+    const { db, env, headers } = await adminEnv();
+    seedCategory(db, 'cat-1');
+    seedEntry(db, 'entry-1', 'cat-1');
+    const res = await testRequest('/admin/entries/entry-1/move', {
+      method: 'POST', headers, env, body: { targetCategoryId: 'ghost' },
+    });
+    expect(res.status).toBe(404);
+  });
+});
+
+describe('PUT /admin/publication validation', () => {
+  it('rejects a malformed body with 400 instead of 500', async () => {
+    const { env, headers } = await adminEnv();
+    const res = await testRequest('/admin/publication', {
+      method: 'PUT', headers, env, body: { published: 'yes' },
+    });
+    expect(res.status).toBe(400);
+  });
+});

backend/src/__tests__/auth-jwt.test.ts

@@ -0,0 +1,85 @@
+import { describe, it, expect, beforeAll } from 'vitest';
+import { testRequest } from './helpers';
+import {
+  createTestDb,
+  makeDbEnv,
+  signTestJwt,
+  signTestJwtRaw,
+  installJwksMock,
+  TEST_JWT_ISSUER,
+  TEST_JWT_AUDIENCE,
+  TEST_JWT_KID,
+} from './helpers/db';
+
+beforeAll(() => installJwksMock());
+
+/**
+ * Exercises the real verifyJwt crypto path through requireAuth on the
+ * auth-only /admin/me route. The JWKS fetch is intercepted (installJwksMock)
+ * so the actual signature verification, claim checks, and time-window checks
+ * all run unmocked.
+ */
+const NOW = () => Math.floor(Date.now() / 1000);
+
+async function meWith(token: string): Promise<Response> {
+  const db = createTestDb();
+  return testRequest('/admin/me', {
+    headers: { 'Cf-Access-Jwt-Assertion': token },
+    env: makeDbEnv(db),
+  });
+}
+
+describe('verifyJwt / requireAuth crypto path', () => {
+  it('accepts a token with a valid signature and claims', async () => {
+    const res = await meWith(await signTestJwt('user@test.com'));
+    expect(res.status).toBe(200);
+  });
+
+  it('rejects a token whose signature was tampered with', async () => {
+    const token = await signTestJwt('user@test.com');
+    const [h, p] = token.split('.');
+    // Re-sign body with a different payload tail but keep the original signature:
+    // mutate one char of the payload so the signature no longer matches.
+    const tampered = `${h}.${p.slice(0, -2)}AA.${token.split('.')[2]}`;
+    const res = await meWith(tampered);
+    expect(res.status).toBe(401);
+  });
+
+  it('rejects an expired token (exp in the past)', async () => {
+    const res = await meWith(await signTestJwt('user@test.com', { exp: NOW() - 60 }));
+    expect(res.status).toBe(401);
+  });
+
+  it('rejects a not-yet-valid token (nbf in the future)', async () => {
+    const res = await meWith(await signTestJwt('user@test.com', { nbf: NOW() + 3600 }));
+    expect(res.status).toBe(401);
+  });
+
+  it('rejects a non-RS256 algorithm', async () => {
+    const token = await signTestJwtRaw(
+      { alg: 'HS256', kid: TEST_JWT_KID, typ: 'JWT' },
+      { email: 'user@test.com', iss: TEST_JWT_ISSUER, aud: TEST_JWT_AUDIENCE, exp: NOW() + 3600 },
+    );
+    const res = await meWith(token);
+    expect(res.status).toBe(401);
+  });
+
+  it('rejects a wrong issuer', async () => {
+    const res = await meWith(await signTestJwt('user@test.com', { iss: 'https://evil.example.com' }));
+    expect(res.status).toBe(401);
+  });
+
+  it('rejects a wrong audience', async () => {
+    const res = await meWith(await signTestJwt('user@test.com', { aud: 'some-other-aud' }));
+    expect(res.status).toBe(401);
+  });
+
+  it('rejects a token signed with an unknown kid', async () => {
+    const token = await signTestJwtRaw(
+      { alg: 'RS256', kid: 'unknown-kid', typ: 'JWT' },
+      { email: 'user@test.com', iss: TEST_JWT_ISSUER, aud: TEST_JWT_AUDIENCE, exp: NOW() + 3600 },
+    );
+    const res = await meWith(token);
+    expect(res.status).toBe(401);
+  });
+});

backend/src/__tests__/demo-bypass.test.ts

@@ -0,0 +1,44 @@
+import { describe, it, expect, beforeAll } from 'vitest';
+import { testRequest } from './helpers';
+import { createTestDb, makeDbEnv, seedSettings, installJwksMock } from './helpers/db';
+import { isDemoMode } from '../lib/demo';
+
+beforeAll(() => installJwksMock());
+
+/**
+ * Pins the by-design demo-mode behavior: when DEMO_MODE === 'true' both
+ * requireAuth and requireAdmin are bypassed. This is intentional (demo
+ * deployments have no Cloudflare Access in front). These tests exist to make
+ * any accidental change to that contract loud.
+ *
+ * Production safety: DEMO_MODE only activates on the exact string 'true'
+ * (see isDemoMode). wrangler.toml ships DEMO_MODE = "false", and Env has no
+ * default, so an unset/empty/any-other value leaves demo mode OFF.
+ */
+describe('demo mode auth bypass (by design)', () => {
+  it('isDemoMode only treats the literal string "true" as enabled', () => {
+    expect(isDemoMode({} as never)).toBe(false);
+    expect(isDemoMode({ DEMO_MODE: 'false' } as never)).toBe(false);
+    expect(isDemoMode({ DEMO_MODE: 'TRUE' } as never)).toBe(false);
+    expect(isDemoMode({ DEMO_MODE: '1' } as never)).toBe(false);
+    expect(isDemoMode({ DEMO_MODE: 'true' } as never)).toBe(true);
+  });
+
+  it('reaches admin routes without any Access JWT when demo mode is on', async () => {
+    const db = createTestDb();
+    seedSettings(db);
+    const res = await testRequest('/admin/settings', {
+      env: makeDbEnv(db, { DEMO_MODE: 'true' }),
+    });
+    expect(res.status).toBe(200);
+  });
+
+  it('still requires auth (401) when demo mode is off', async () => {
+    const db = createTestDb();
+    seedSettings(db);
+    const res = await testRequest('/admin/settings', {
+      env: makeDbEnv(db, { DEMO_MODE: 'false' }),
+    });
+    expect(res.status).toBe(401);
+  });
+});

backend/src/__tests__/helpers.ts

@@ -33,8 +33,12 @@ export async function testRequest(path: string, options: TestRequestOptions = {}
 
   const init: RequestInit = { method, headers };
   if (body !== undefined) {
-    init.body = typeof body === 'string' ? body : JSON.stringify(body);
-    init.headers = { 'Content-Type': 'application/json', ...headers };
+    if (body instanceof ArrayBuffer || ArrayBuffer.isView(body)) {
+      init.body = body as BodyInit;
+    } else {
+      init.body = typeof body === 'string' ? body : JSON.stringify(body);
+      init.headers = { 'Content-Type': 'application/json', ...headers };
+    }
   }
 
   const app = createApp();

backend/src/__tests__/helpers/db.ts

@@ -288,6 +288,31 @@ export async function signTestJwt(email: string, extra: Record<string, unknown>
   return `${signingInput}.${base64url(signature)}`;
 }
 
+/**
+ * Sign an arbitrary header + payload with the test RSA key. Used to exercise
+ * the verifyJwt failure paths (wrong alg, missing kid, etc.) that signTestJwt
+ * cannot produce because it always emits a well-formed RS256 header.
+ */
+export async function signTestJwtRaw(
+  header: Record<string, unknown>,
+  payload: Record<string, unknown>,
+): Promise<string> {
+  await ensureKeyPair();
+  const headerB64 = strToB64url(JSON.stringify(header));
+  const payloadB64 = strToB64url(JSON.stringify(payload));
+  const signingInput = `${headerB64}.${payloadB64}`;
+  const signature = await crypto.subtle.sign(
+    'RSASSA-PKCS1-v1_5',
+    _keyPair!.privateKey,
+    new TextEncoder().encode(signingInput),
+  );
+  return `${signingInput}.${base64url(signature)}`;
+}
+
+export const TEST_JWT_ISSUER = TEST_ISSUER;
+export const TEST_JWT_AUDIENCE = TEST_AUDIENCE;
+export const TEST_JWT_KID = TEST_KID;
+
 // ── Env factory ───────────────────────────────────────────────────────
 
 /**