@1agh/maude 0.49.1 → 0.50.0

package/apps/studio/test/canvas-move-api.test.ts

@@ -0,0 +1,556 @@
+// /_api/fs-move — feature-file-tree-drag-drop-folders (Task 3). Covers the
+// HTTP round-trip (happy path, containment, DS refusal, collision, full
+// re-key across every sidecar) plus, in-process (no server boot needed), the
+// collab-pin refusal — the one guard an HTTP-only black-box test can't drive,
+// since pinning a room requires reaching into the dev-server's in-memory
+// collab registry.
+
+import { describe, expect, test } from 'bun:test';
+import { existsSync, mkdirSync, readFileSync, symlinkSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+import { createApi } from '../api.ts';
+import { type Context, createBus } from '../context.ts';
+import { bootServer, killProc, makeSandbox, nextPort } from './_helpers.ts';
+
+async function createBoard(port: number, name: string, group?: string) {
+  const r = await fetch(`http://localhost:${port}/_api/canvas`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ name, kind: 'brief-board', group }),
+  });
+  return (await r.json()) as { file: string; rel: string; slug: string };
+}
+
+function move(port: number, file: string, toDir: string) {
+  return fetch(`http://localhost:${port}/_api/fs-move`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ file, toDir }),
+  });
+}
+
+describe('/_api/fs-move — POST round-trip', () => {
+  test('happy path: relocates the primary + meta into the destination dir', async () => {
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      const created = await createBoard(port, 'Movable');
+      const r = await move(port, created.rel, 'ui/sub');
+      expect(r.status).toBe(200);
+      const j = (await r.json()) as {
+        ok: boolean;
+        fromRel: string;
+        toRel: string;
+        fromSlug: string;
+        toSlug: string;
+        moved: string[];
+      };
+      expect(j.ok).toBe(true);
+      expect(j.toRel).toBe('ui/sub/Movable.tsx');
+      expect(j.fromSlug).toBe('ui-movable');
+      expect(j.toSlug).toBe('ui-sub-movable');
+
+      expect(existsSync(join(designRoot, 'ui', 'Movable.tsx'))).toBe(false);
+      expect(existsSync(join(designRoot, 'ui', 'sub', 'Movable.tsx'))).toBe(true);
+      expect(existsSync(join(designRoot, 'ui', 'sub', 'Movable.meta.json'))).toBe(true);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('full re-key: history, canvas-state view, comments, annotations, locator all follow the move', async () => {
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      const created = await createBoard(port, 'Full Rekey');
+      const fromSlug = created.slug; // 'ui-full_rekey'
+
+      mkdirSync(join(designRoot, '_history', fromSlug), { recursive: true });
+      writeFileSync(join(designRoot, '_history', fromSlug, 'snap.json'), '{}');
+      mkdirSync(join(designRoot, '_canvas-state'), { recursive: true });
+      writeFileSync(
+        join(designRoot, '_canvas-state', `${fromSlug}.view.json`),
+        JSON.stringify({ viewport: { x: 1, y: 2, scale: 1 } })
+      );
+      mkdirSync(join(designRoot, '_comments'), { recursive: true });
+      writeFileSync(join(designRoot, '_comments', `${fromSlug}.json`), '[]');
+      writeFileSync(
+        join(designRoot, `${fromSlug}.annotations.svg`),
+        '<svg xmlns="http://www.w3.org/2000/svg" data-mdcc-annotations="1"></svg>'
+      );
+      const locatorAbs = join(designRoot, '_locator.json');
+      const locatorKey = 'ui/Full Rekey'; // locatorKeyFor shape: posix, ext-less, NOT slugified
+      writeFileSync(
+        locatorAbs,
+        JSON.stringify({
+          [locatorKey]: {
+            a1b2c3d4: { canvas: '/x', line: 1, col: 0, jsxPath: [], componentName: '' },
+          },
+        })
+      );
+
+      const r = await move(port, created.rel, 'ui/nested');
+      expect(r.status).toBe(200);
+      const j = (await r.json()) as { toSlug: string };
+      const toSlug = j.toSlug; // 'ui-nested-full_rekey'
+
+      expect(existsSync(join(designRoot, '_history', toSlug, 'snap.json'))).toBe(true);
+      expect(existsSync(join(designRoot, '_history', fromSlug))).toBe(false);
+      expect(existsSync(join(designRoot, '_canvas-state', `${toSlug}.view.json`))).toBe(true);
+      expect(existsSync(join(designRoot, '_canvas-state', `${fromSlug}.view.json`))).toBe(false);
+      expect(existsSync(join(designRoot, '_comments', `${toSlug}.json`))).toBe(true);
+      expect(existsSync(join(designRoot, `${toSlug}.annotations.svg`))).toBe(true);
+      expect(existsSync(join(designRoot, `${fromSlug}.annotations.svg`))).toBe(false);
+
+      const locator = JSON.parse(readFileSync(locatorAbs, 'utf8'));
+      expect(locator['ui/nested/Full Rekey']).toBeDefined();
+      expect(locator[locatorKey]).toBeUndefined();
+
+      // Forensic log for the non-atomic move.
+      expect(existsSync(join(designRoot, '_history', toSlug, '_move.json'))).toBe(true);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('containment: a toDir escaping the design root is rejected (400), nothing moved', async () => {
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      const created = await createBoard(port, 'Contained');
+      const r = await move(port, created.rel, '../../../../tmp');
+      expect(r.status).toBe(400);
+      expect(existsSync(join(designRoot, 'ui', 'Contained.tsx'))).toBe(true);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('refuses moving a design-system canvas (400, untouched)', async () => {
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      mkdirSync(join(designRoot, 'system', 'project'), { recursive: true });
+      const dsFile = join(designRoot, 'system', 'project', 'Spec.tsx');
+      writeFileSync(dsFile, 'export default function S(){return null}');
+      const r = await move(port, '.design/system/project/Spec.tsx', 'ui');
+      expect(r.status).toBe(400);
+      expect(existsSync(dsFile)).toBe(true);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('refuses moving INTO the design-system group (400, untouched)', async () => {
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      const created = await createBoard(port, 'Into DS');
+      const r = await move(port, created.rel, 'system/project');
+      expect(r.status).toBe(400);
+      expect(existsSync(join(designRoot, 'ui', 'Into DS.tsx'))).toBe(true);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('a name collision at the destination returns 409, nothing moved', async () => {
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      const created = await createBoard(port, 'Dup');
+      mkdirSync(join(designRoot, 'ui', 'sub'), { recursive: true });
+      writeFileSync(
+        join(designRoot, 'ui', 'sub', 'Dup.tsx'),
+        'export default function D(){return null}'
+      );
+      const r = await move(port, created.rel, 'ui/sub');
+      expect(r.status).toBe(409);
+      expect(existsSync(join(designRoot, 'ui', 'Dup.tsx'))).toBe(true);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('a no-op move (same dir) is rejected with 400', async () => {
+    const { root } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      const created = await createBoard(port, 'Same Dir');
+      const r = await move(port, created.rel, 'ui');
+      expect(r.status).toBe(400);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('a missing source canvas returns 404', async () => {
+    const { root } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      const r = await move(port, 'ui/Nope.tsx', 'ui/sub');
+      expect(r.status).toBe(404);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('emits a canvas-list-update "moved" action over the inspector WS', async () => {
+    const { root } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    let socket: WebSocket | null = null;
+    try {
+      const messages: Array<{ type: string; payload?: Record<string, unknown> }> = [];
+      const sock = new WebSocket(`ws://localhost:${port}/_ws`);
+      socket = sock;
+      await new Promise<void>((res, rej) => {
+        sock.addEventListener('open', () => res());
+        sock.addEventListener('error', () => rej(new Error('ws error')));
+        setTimeout(() => rej(new Error('ws open timeout')), 2000);
+      });
+      sock.addEventListener('message', (ev) => {
+        try {
+          messages.push(JSON.parse(String(ev.data)));
+        } catch {
+          /* ignore */
+        }
+      });
+      const created = await createBoard(port, 'Live Move');
+      const r = await move(port, created.rel, 'ui/sub');
+      expect(r.status).toBe(200);
+
+      const deadline = Date.now() + 2000;
+      let hit: (typeof messages)[number] | undefined;
+      while (Date.now() < deadline && !hit) {
+        hit = messages.find(
+          (m) => m.type === 'canvas-list-update' && m.payload?.action === 'moved'
+        );
+        if (!hit) await Bun.sleep(25);
+      }
+      expect(hit?.payload?.toSlug ?? hit?.payload?.slug).toBeTruthy();
+      expect(hit?.payload?.fromSlug).toBe('ui-live_move');
+    } finally {
+      try {
+        socket?.close();
+      } catch {
+        /* ignore */
+      }
+      await killProc(proc);
+    }
+  }, 10_000);
+
+  test('unknown method (GET) returns 405', async () => {
+    const { root } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      const r = await fetch(`http://localhost:${port}/_api/fs-move`, { method: 'GET' });
+      expect(r.status).toBe(405);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('rejects a cross-origin move (CSRF guard)', async () => {
+    const { root } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      const created = await createBoard(port, 'Forge Move');
+      const r = await fetch(`http://localhost:${port}/_api/fs-move`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', Origin: 'http://evil.example' },
+        body: JSON.stringify({ file: created.rel, toDir: 'ui/sub' }),
+      });
+      expect(r.status).toBe(403);
+    } finally {
+      await killProc(proc);
+    }
+  });
+});
+
+// Security review finding: canvasSlugFromRel's `/`→`-` flattening is not
+// injective — "ui/a-b.tsx" and "ui/a/b.tsx" both hash to slug "ui-a-b". A
+// move that creates this collision would, pre-fix, silently clobber the
+// OTHER canvas's history/comments/annotations the moment the primary rename
+// landed. moveCanvas/moveFolder now refuse with 409 via fileForSlug().
+// Security review finding: `path.resolve()`-only containment does not follow
+// symlinks. A symlink planted inside a canvas group (malicious git peer, hub
+// sync, or accident) pointing outside designRoot passed every pre-fix
+// containment check while rename()/mkdir() followed it at the OS level.
+describe('/_api/fs-move — symlink escape guard (security review finding)', () => {
+  test('refuses moving a canvas INTO a symlinked destination folder', async () => {
+    const { root, designRoot } = makeSandbox();
+    const outside = join(root, 'OUTSIDE');
+    mkdirSync(outside, { recursive: true });
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      const created = await createBoard(port, 'Escapee');
+      symlinkSync(outside, join(designRoot, 'ui', 'link'));
+      const r = await move(port, created.rel, 'ui/link');
+      expect(r.status).toBe(400);
+      expect(existsSync(join(outside, 'Escapee.tsx'))).toBe(false);
+      expect(existsSync(join(designRoot, 'ui', 'Escapee.tsx'))).toBe(true);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('refuses moving a symlinked FOLDER as the source', async () => {
+    const { root, designRoot } = makeSandbox();
+    const outside = join(root, 'OUTSIDE');
+    mkdirSync(outside, { recursive: true });
+    writeFileSync(join(outside, 'Secret.tsx'), 'export default function S(){return null}');
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      symlinkSync(outside, join(designRoot, 'ui', 'evil'));
+      const r = await move(port, 'ui/evil', 'ui/dest');
+      expect(r.status).toBe(400);
+      expect(existsSync(join(designRoot, 'ui', 'dest'))).toBe(false);
+    } finally {
+      await killProc(proc);
+    }
+  });
+});
+
+describe('/_api/fs-move — slug-collision guard (security review finding)', () => {
+  test('refuses a move whose destination slug collides with an existing DIFFERENT canvas', async () => {
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      // Victim: ui/a-b.tsx -> slug "ui-a-b". Give it a real annotations
+      // sidecar so a silent clobber would be observable.
+      const victim = await createBoard(port, 'a-b');
+      expect(victim.slug).toBe('ui-a-b');
+      writeFileSync(join(designRoot, `${victim.slug}.annotations.svg`), '<svg>VICTIM</svg>');
+
+      // Mover: ui/b.tsx, about to move into ui/a/ -> would become
+      // ui/a/b.tsx -> slug "ui-a-b" too.
+      const mover = await createBoard(port, 'b');
+      const r = await move(port, mover.rel, 'ui/a');
+      expect(r.status).toBe(409);
+      const j = (await r.json()) as { error: string };
+      expect(j.error).toContain('ui-a-b');
+
+      // Nothing moved; the victim's sidecar is untouched.
+      expect(existsSync(join(designRoot, 'ui', 'b.tsx'))).toBe(true);
+      expect(existsSync(join(designRoot, 'ui', 'a', 'b.tsx'))).toBe(false);
+      expect(readFileSync(join(designRoot, `${victim.slug}.annotations.svg`), 'utf8')).toBe(
+        '<svg>VICTIM</svg>'
+      );
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('a folder move refuses when a nested canvas would collide with an OUTSIDE canvas', async () => {
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      // A folder move preserves the moved folder's OWN basename as a path
+      // segment, so to collide with "ui/dest-sub-inner.tsx" (slug
+      // "ui-dest-sub-inner"), move folder "ui/sub" (containing "inner.tsx")
+      // into "ui/dest" -> "ui/dest/sub/inner.tsx" -> same slug.
+      const victim = await createBoard(port, 'dest-sub-inner');
+      expect(victim.slug).toBe('ui-dest-sub-inner');
+
+      await createBoard(port, 'inner');
+      const moveIntoSub = await move(port, 'ui/inner.tsx', 'ui/sub');
+      expect(moveIntoSub.status).toBe(200);
+
+      const r = await move(port, 'ui/sub', 'ui/dest');
+      expect(r.status).toBe(409);
+      expect(existsSync(join(designRoot, 'ui', 'sub'))).toBe(true);
+      expect(existsSync(join(designRoot, 'ui', 'dest', 'sub'))).toBe(false);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('does NOT refuse when the "collision" is the canvas moving into its OWN new slug (no-op false positive)', async () => {
+    const { root } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      const created = await createBoard(port, 'Solo');
+      const r = await move(port, created.rel, 'ui/sub');
+      expect(r.status).toBe(200);
+    } finally {
+      await killProc(proc);
+    }
+  });
+});
+
+describe('/_api/fs-move — folder move (Task 11)', () => {
+  test('moving a folder relocates every nested canvas + its sidecars', async () => {
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      await createBoard(port, 'One', 'ui');
+      const r1 = await move(port, 'ui/One.tsx', 'ui/Src');
+      expect(r1.status).toBe(200);
+      await createBoard(port, 'Two', 'ui');
+      const r2 = await move(port, 'ui/Two.tsx', 'ui/Src');
+      expect(r2.status).toBe(200);
+      // Seed a history sidecar for One to prove slug-keyed sidecars follow too.
+      mkdirSync(join(designRoot, '_history', 'ui-src-one'), { recursive: true });
+      writeFileSync(join(designRoot, '_history', 'ui-src-one', 'snap.json'), '{}');
+
+      const r = await move(port, 'ui/Src', 'ui/Dest');
+      expect(r.status).toBe(200);
+      const j = (await r.json()) as { ok: boolean; toRel: string; moved: string[] };
+      expect(j.ok).toBe(true);
+      expect(j.toRel).toBe('ui/Dest/Src');
+
+      expect(existsSync(join(designRoot, 'ui', 'Src'))).toBe(false);
+      expect(existsSync(join(designRoot, 'ui', 'Dest', 'Src', 'One.tsx'))).toBe(true);
+      expect(existsSync(join(designRoot, 'ui', 'Dest', 'Src', 'Two.tsx'))).toBe(true);
+      expect(existsSync(join(designRoot, '_history', 'ui-dest-src-one', 'snap.json'))).toBe(true);
+      expect(existsSync(join(designRoot, '_history', 'ui-src-one'))).toBe(false);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('refuses moving a folder into itself or a descendant (400)', async () => {
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      mkdirSync(join(designRoot, 'ui', 'Parent', 'Child'), { recursive: true });
+      const intoSelf = await move(port, 'ui/Parent', 'ui/Parent');
+      expect(intoSelf.status).toBe(400);
+      const intoChild = await move(port, 'ui/Parent', 'ui/Parent/Child');
+      expect(intoChild.status).toBe(400);
+      expect(existsSync(join(designRoot, 'ui', 'Parent', 'Child'))).toBe(true);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('refuses moving a canvas GROUP ROOT (not a user-created folder) (400)', async () => {
+    const { root } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      const r = await move(port, 'ui', 'system');
+      expect(r.status).toBe(400);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('a missing source folder returns 404', async () => {
+    const { root } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      const r = await move(port, 'ui/Nope', 'ui/Dest');
+      expect(r.status).toBe(404);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('a destination collision returns 409, nothing moved', async () => {
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      mkdirSync(join(designRoot, 'ui', 'Src'), { recursive: true });
+      mkdirSync(join(designRoot, 'ui', 'Dest', 'Src'), { recursive: true });
+      const r = await move(port, 'ui/Src', 'ui/Dest');
+      expect(r.status).toBe(409);
+      expect(existsSync(join(designRoot, 'ui', 'Src'))).toBe(true);
+    } finally {
+      await killProc(proc);
+    }
+  });
+});
+
+// In-process: the collab-pin guard. Reaching a REAL pinned room requires the
+// MAUDE_SHARED_DOC sync runtime; exercising the guard through api.moveCanvas
+// directly with a stub `isRoomPinned` hook proves the refusal wiring without
+// standing up the whole shared-doc machinery.
+describe('moveCanvas — collab-pin guard (in-process)', () => {
+  function mkCtx(root: string, designRoot: string): Context {
+    return {
+      cfg: {
+        canvasGroups: [
+          { label: 'Design system', path: 'system' },
+          { label: 'Canvases', path: 'ui' },
+        ],
+      } as Context['cfg'],
+      projectLabel: 'test',
+      bus: createBus(),
+      paths: {
+        repoRoot: root,
+        designRel: '.design',
+        designRoot,
+        serverInfoFile: join(designRoot, '_server.json'),
+        activeFile: join(designRoot, '_active.json'),
+        commentsDir: join(designRoot, '_comments'),
+        canvasStateDir: join(designRoot, '_canvas-state'),
+        historyDir: join(designRoot, '_history'),
+        tokensUrlRel: '',
+        systemDirRel: 'system',
+      },
+    };
+  }
+
+  test('refuses the move (409) when the slug is pinned, and does not touch disk', async () => {
+    const { root, designRoot } = makeSandbox();
+    const abs = join(designRoot, 'ui', 'Pinned.tsx');
+    mkdirSync(join(designRoot, 'ui'), { recursive: true });
+    writeFileSync(abs, 'export default function P(){return null}');
+    const ctx = mkCtx(root, designRoot);
+    const api = createApi(ctx, {
+      onCommentsChanged: () => {},
+      isRoomPinned: (slug) => slug === 'ui-pinned',
+      flushAndDropRoom: async () => {
+        throw new Error('must not be called when pinned');
+      },
+    });
+
+    const result = await api.moveCanvas({ file: 'ui/Pinned.tsx', toDir: 'ui/sub' });
+    expect(result.ok).toBe(false);
+    if (!result.ok) expect(result.status).toBe(409);
+    expect(existsSync(abs)).toBe(true);
+  });
+
+  test('calls flushAndDropRoom when NOT pinned', async () => {
+    const { root, designRoot } = makeSandbox();
+    const abs = join(designRoot, 'ui', 'Unpinned.tsx');
+    mkdirSync(join(designRoot, 'ui'), { recursive: true });
+    writeFileSync(abs, 'export default function U(){return null}');
+    const ctx = mkCtx(root, designRoot);
+    let flushed = false;
+    const api = createApi(ctx, {
+      onCommentsChanged: () => {},
+      isRoomPinned: () => false,
+      flushAndDropRoom: async (slug) => {
+        expect(slug).toBe('ui-unpinned');
+        flushed = true;
+      },
+    });
+
+    const result = await api.moveCanvas({ file: 'ui/Unpinned.tsx', toDir: 'ui/sub' });
+    expect(result.ok).toBe(true);
+    expect(flushed).toBe(true);
+  });
+});

package/apps/studio/test/canvas-origin-gate.test.ts

@@ -77,6 +77,12 @@ describe('canvas-origin gate — A1/A2 traversal + privilege containment', () =>
         '/_api/export-jobs',
         '/_api/export-jobs/download',
         '/_api/canvas',
+        // feature-file-tree-drag-drop-folders (Task 5) — move/mkdir are
+        // file-write routes, same MAIN-ORIGIN-ONLY posture as /_api/canvas
+        // right above: absent from CANVAS_SAFE_API + startCanvasServer's
+        // routes, so a GET here 403s at the gate, not 405 from the handler.
+        '/_api/fs-move',
+        '/_api/fs-mkdir',
         '/_api/edit-css',
         '/_api/edit-text',
         '/_api/edit-attr',