[conatus]

Fourth of the settings page regression test PRs. Stacked on #135 (Membership Plans) → #134 → #133.

Covers every setting on the Integrations tab. Each test changes the setting on the settings page, reads it back through Settings::get, and checks its effect against fakes of the real services. A legacy test loads the tab as Carbon Fields stored it.

What's covered

CRMs, Auth0 and webhooks (integrations-crm.spec.ts). Each test joins through the real join form: the form's /join request is caught at its last step and passed to the plugin unchanged.

• Zetkin:
  • Without OAuth, the join form submission goes to the organisation and form set here, with the token.
  • The membership tier and join date custom fields are sent only when set.
  • Sandbox (the default) and live use Zetkin's dev and live servers respectively.
  • With OAuth credentials, the plugin signs in with the client ID, secret and JWT, adds the person and tags them.
• Mailchimp: the member goes to the audience set here, with the API key; the key's suffix picks the server.
• Action Network: the member is added with the API key set here.
• Join Complete Webhook URL: the join is posted to it without bank details. The form only ever sees a UUID, never the URL.
• Step Webhook Url: each step is posted to it, again without bank details.
• Auth0: the account is created with the credentials and audience set here, using the member's password.

Payments and postcodes (integrations-payments.spec.ts)

• Stripe:
  • Direct debit on gives card + Bacs; Direct Debit only gives Bacs only; off gives card only. Checked as the payment methods Stripe's fields are set up with.
  • Direct Debit only is hidden, and dropped on save, unless direct debit is on.
  • Download Subscriptions produces the expected CSV, reading Stripe with the secret key, and is admin-only.
• GoCardless: members are sent to GoCardless's billing flow, set up with the access token. Sandbox and live use different APIs.
• Chargebee: with hosted pages on, card payments go to a Chargebee page created with the site and API key. With it off, card details are taken in the form.
• Postcode lookup:
  • Off by default.
  • getAddress.io finds addresses and fills in the chosen one.
  • Ideal Postcodes finds addresses.
  • Each provider is refused without its key.

Logging services (integrations-logging.spec.ts)

• By default, logs go to disk only.
• Loggly: logs go there instead of to disk, tagged with Loggly Tags (default join-block). The Logging tab says so.
• Sentry: errors (not info) reach Sentry, and the join form is set up with the same DSN.
• Google Cloud Logging: logs reach the project's log, signed in as the key file's service account.

Supporting changes

• Fake API:
  • A small in-memory Zetkin.
  • OAuth token answers for Auth0 and Google.
  • Stripe invoices.
  • gzip request bodies (Sentry sends them).
  • New hostnames for Loggly, Sentry and Google, so the test certificate was regenerated.
  • Also reachable as http://fake-api, for webhook URLs.
• The Chargebee PHP SDK now trusts the test CA, like the Stripe SDK.
• stubStripe() (new) and a fuller stubChargebee() stand in for Stripe.js and Chargebee.js, so the payment steps render offline.
• joinThroughForm(), JoinSettingsPage.setSelect().
• Docs: coverage table and fake API section.

Problem found

• JOIN-167: Download Subscriptions writes a PHP warning into the CSV when a Stripe list (e.g. invoices) is empty. There's a skipped test for it; I checked it fails when enabled.

Testing

Locally, all of tests/settings: 122 passed, 6 skipped (the known-problem tests).

---

Generated by Claude Code

[conatus]

Supplementary review: one spec reaches past JoinSettingsPage into Carbon Fields markup. This adds to the inline findings already posted.

---

Generated by Claude Code

[linear-code]

JOIN-173