test: cover playbook insights, CORS allowlists, portal origin, impersonation

[cursor]

Summary

Focused regression coverage for high-blast-radius helpers still unclaimed vs open drafts #30–#75 (main tip 48f3c2f).

Risky behavior now covered

• Manager playbook insights: rent late→action / partial→watch / grace headlines; utilities draft+owed→action; disputed shares→danger; row cap at 8; onboarding incomplete→action
• LAN/Tailscale CORS: RFC1918 + Tailscale 100.64–127 allowlist; public/malformed/non-http origins rejected (credentialed CORS blast radius)
• Production CORS canonicalization: bare http:// host → https://www. ; localhost/loopback stay null; allowlist expands bare+www http+https
• Email portal origin: localhost/127.0.0.1 CLIENT_ORIGIN never ships in outbound pay/maintenance links (rewrites to production www)
• Client impersonation gates: property_manager → history-only manager gate; owner/super_admin do not; corrupt session fails closed

Test files added/updated

• scripts/test-manager-playbook-insights.js + src/services/manager-playbook-insights-pure.js
• scripts/test-lan-dev-cors.js
• scripts/test-cors-origins.js + src/utils/cors-origins.js
• scripts/test-portal-origin.js (export resolvePortalOrigin)
• scripts/test-client-impersonation-gates.js
• package.json npm scripts for the above

Why this reduces regression risk

These paths drive manager collection urgency, who can CORS into the API on LAN, which origin cookies/emails use in prod, and whether managers see charge UI while previewing tenants. None were covered on main; none were claimed by parallel coverage PRs (#72 Gmail redirect / #71 server impersonation pay guards / #75 email escape utils are different surfaces).

Validation

npm run test:manager-playbook-insights
npm run test:lan-dev-cors
npm run test:cors-origins
npm run test:portal-origin
npm run test:client-impersonation-gates

All passed locally (deterministic Node assert; no DB/Stripe).

Notes

• Tiny extract/export-only testability changes; no intentional production behavior change.
• Prefer merging focused test: cover identity activate, deposit PI races, password guards #70–test: cover ops-alert, site-visit commons, oversight display, email utils #75 before mega consolidations test: consolidate coverage — identity/RBAC, Connect, Cash App, utilities #66–test: cover Stripe webhook gates, bank summary, visit pay nags #69.