@1agh/maude 0.58.1 → 0.58.3

package/apps/studio/test/exporters/unsupported-media.test.ts

@@ -0,0 +1,123 @@
+// RCA issue-mp4-audio-export-html5audio-silent-degrade — the pre-flight scanner.
+//
+// The cases here are the ones the RCA's Testing Requirements name, and the
+// barrel case is the one that matters most: the reproducer does NOT import
+// `Audio` from 'remotion' in the canvas file. It imports it from `_broadcast`,
+// which re-exports it. A scanner that reads only the canvas sees a clean local
+// import and waves the export through — which is exactly how this shipped.
+
+import { describe, expect, test } from 'bun:test';
+import { mkdtempSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { audioRefusalMessage, scanUnsupportedMedia } from '../../exporters/unsupported-media.ts';
+
+function sandbox(files: Record<string, string>): string {
+  const dir = mkdtempSync(join(tmpdir(), 'maude-unsupported-'));
+  for (const [name, body] of Object.entries(files)) {
+    writeFileSync(join(dir, name), body);
+  }
+  return dir;
+}
+
+describe('scanUnsupportedMedia', () => {
+  test('flags a direct <Audio> import from remotion', () => {
+    const dir = sandbox({
+      'c.tsx': `import { AbsoluteFill, Audio } from 'remotion';
+        export const C = () => <AbsoluteFill><Audio src="x.mp3" /></AbsoluteFill>;`,
+    });
+    const found = scanUnsupportedMedia(join(dir, 'c.tsx'));
+    expect(found).toHaveLength(1);
+    expect(found[0].element).toBe('Audio');
+    expect(found[0].viaBarrel).toBe(false);
+  });
+
+  test('flags it in a multi-binding import alongside supported names', () => {
+    const dir = sandbox({
+      'c.tsx': `import { AbsoluteFill, OffthreadVideo, Audio } from 'remotion';
+        export const C = () => <><Audio src="a" /><OffthreadVideo src="v" /></>;`,
+    });
+    const els = scanUnsupportedMedia(join(dir, 'c.tsx')).map((f) => f.element);
+    expect(els).toContain('Audio');
+    expect(els).toContain('OffthreadVideo');
+  });
+
+  test('sees through a re-export barrel one hop away — the actual shape of the bug', () => {
+    const dir = sandbox({
+      '_broadcast.tsx': `export { Audio } from 'remotion';
+        export const Brand = () => null;`,
+      'c.tsx': `import { Audio, Brand } from './_broadcast';
+        export const C = () => <><Brand /><Audio src="sax.mp3" /></>;`,
+    });
+    const found = scanUnsupportedMedia(join(dir, 'c.tsx'));
+    expect(found).toHaveLength(1);
+    expect(found[0].element).toBe('Audio');
+    expect(found[0].viaBarrel).toBe(true);
+    expect(found[0].sourceFile).toContain('_broadcast');
+  });
+
+  test('does NOT flag the supported @remotion/media import', () => {
+    const dir = sandbox({
+      'c.tsx': `import { Audio, Video } from '@remotion/media';
+        export const C = () => <><Audio src="a" /><Video src="v" /></>;`,
+    });
+    expect(scanUnsupportedMedia(join(dir, 'c.tsx'))).toHaveLength(0);
+  });
+
+  test('does not flag a sibling package whose name merely starts with remotion', () => {
+    const dir = sandbox({
+      'c.tsx': `import { TransitionSeries } from '@remotion/transitions';
+        import { Audio } from '@remotion/media';
+        export const C = () => <Audio src="a" />;`,
+    });
+    expect(scanUnsupportedMedia(join(dir, 'c.tsx'))).toHaveLength(0);
+  });
+
+  test('ignores an unused import — not worth refusing an export over', () => {
+    const dir = sandbox({
+      'c.tsx': `import { AbsoluteFill, Audio } from 'remotion';
+        export const C = () => <AbsoluteFill>silent</AbsoluteFill>;`,
+    });
+    expect(scanUnsupportedMedia(join(dir, 'c.tsx'))).toHaveLength(0);
+  });
+
+  test('catches an aliased import mounted under its alias', () => {
+    const dir = sandbox({
+      'c.tsx': `import { Audio as Sound } from 'remotion';
+        export const C = () => <Sound src="a" />;`,
+    });
+    const found = scanUnsupportedMedia(join(dir, 'c.tsx'));
+    expect(found).toHaveLength(1);
+    // Reported as the element it IS, but matched on the name it renders under.
+    expect(found[0].element).toBe('Audio');
+    expect(found[0].localName).toBe('Sound');
+  });
+
+  test('an aliased-but-unused import is still not worth refusing over', () => {
+    const dir = sandbox({
+      'c.tsx': `import { Audio as Sound } from 'remotion';
+        export const C = () => <div>silent</div>;`,
+    });
+    expect(scanUnsupportedMedia(join(dir, 'c.tsx'))).toHaveLength(0);
+  });
+
+  test('an unreadable canvas is not this check’s business to report', () => {
+    expect(scanUnsupportedMedia('/definitely/not/here.tsx')).toEqual([]);
+  });
+});
+
+describe('audioRefusalMessage', () => {
+  test('states the cause, the cost, and the one-word fix', () => {
+    const msg = audioRefusalMessage(
+      { element: 'Audio', sourceFile: '/x/_broadcast.tsx', viaBarrel: true, localName: 'Audio' },
+      'ui/social/Krpole.tsx'
+    );
+    expect(msg).toContain('Html5Audio');
+    expect(msg).toContain('@remotion/media');
+    expect(msg).toContain('_broadcast.tsx');
+    // The escape hatch must be discoverable from the refusal itself, or a user
+    // who genuinely wants a muted export is stuck.
+    expect(msg).toContain('allowUnsupportedMedia');
+  });
+});

package/apps/studio/test/fetch-asset-gate.test.ts

@@ -0,0 +1,189 @@
+// `_fetch-asset.mjs` — the gate's pure decision functions, plus the three
+// DDR-216 additions. Standing tests, not optional hardening: DDR-216's
+// Consequences names each of these by hand because this is a SHARED,
+// security-reviewed helper whose OTHER caller (the DDR-147 moodboard lane) has
+// no host allowlist at all.
+
+import { describe, expect, test } from 'bun:test';
+
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import {
+  FetchAssetError,
+  fetchAsset,
+  parseHttpsTarget,
+  sniffImageExt,
+  sniffStagedKind,
+} from '../bin/_fetch-asset.mjs';
+
+const FIGMA_HOSTS = ['figma.com', 'figma-alpha-api.s3.us-west-2.amazonaws.com'];
+
+const png = () => Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0, 0, 0, 0]);
+const svg = (s = '<svg xmlns="http://www.w3.org/2000/svg"><rect/></svg>') => Buffer.from(s, 'utf8');
+
+describe('the host allowlist is exact-or-dotted-suffix, never endsWith', () => {
+  test.each([
+    ['the apex', 'https://figma.com/x'],
+    ['a real subdomain', 'https://www.figma.com/x'],
+    ['a deep subdomain', 'https://a.b.figma.com/x'],
+    ['the render bucket, exactly', 'https://figma-alpha-api.s3.us-west-2.amazonaws.com/x'],
+  ])('admits %s', (_label, url) => {
+    expect(() => parseHttpsTarget(url, { allowHosts: FIGMA_HOSTS })).not.toThrow();
+  });
+
+  test.each([
+    // The classic suffix bug: a bare endsWith('figma.com') admits this.
+    ['a suffix look-alike', 'https://evil-figma.com/x'],
+    ['figma.com as a prefix of another domain', 'https://figma.com.evil.tld/x'],
+    ['an unrelated host', 'https://evil.tld/x'],
+    // A bare endsWith('.amazonaws.com') would admit EVERY S3 bucket on earth.
+    ['a different S3 bucket', 'https://attacker-bucket.s3.us-west-2.amazonaws.com/x'],
+    ['the bare bucket parent', 'https://s3.us-west-2.amazonaws.com/x'],
+  ])('refuses %s', (_label, url) => {
+    expect(() => parseHttpsTarget(url, { allowHosts: FIGMA_HOSTS })).toThrow(FetchAssetError);
+  });
+
+  test("an absent allowlist keeps today's unrestricted behaviour", () => {
+    // The moodboard/research lane passes no allowlist and must be untouched.
+    expect(() => parseHttpsTarget('https://upload.wikimedia.org/x.png')).not.toThrow();
+    expect(parseHttpsTarget('https://anything.example/x').host).toBe('anything.example');
+  });
+
+  test('a refusal names the host as a charset-validated token, never raw (D10)', () => {
+    try {
+      parseHttpsTarget('https://evil.tld/x', { allowHosts: FIGMA_HOSTS });
+      throw new Error('expected a rejection');
+    } catch (err) {
+      expect((err as Error).message).toMatch(/^host not in this lane's allowlist: [a-z0-9.-]+$/);
+    }
+  });
+});
+
+describe('port pinning is opt-in, and is new logic', () => {
+  test('the default still accepts any valid port (unchanged behaviour)', () => {
+    expect(parseHttpsTarget('https://example.test:8443/x').port).toBe(8443);
+  });
+
+  test('the pinned lane refuses a non-443 port', () => {
+    expect(() => parseHttpsTarget('https://figma.com:8443/x', { pinPort443: true })).toThrow(
+      FetchAssetError
+    );
+  });
+
+  test('the pinned lane accepts 443, explicit or implicit', () => {
+    expect(parseHttpsTarget('https://figma.com/x', { pinPort443: true }).port).toBe(443);
+    expect(parseHttpsTarget('https://figma.com:443/x', { pinPort443: true }).port).toBe(443);
+  });
+});
+
+describe('the allowlist NARROWS the gate — it never replaces the rest of it', () => {
+  test.each([
+    ['non-https', 'http://figma.com/x'],
+    ['embedded credentials', 'https://user:pw@figma.com/x'],
+    ['a file URL', 'file:///etc/passwd'],
+  ])('%s is still refused even on an allowlisted host', (_label, url) => {
+    expect(() => parseHttpsTarget(url, { allowHosts: FIGMA_HOSTS })).toThrow(FetchAssetError);
+  });
+});
+
+describe('sniffImageExt is NOT widened — the moodboard lane depends on it', () => {
+  test.each([
+    ['an SVG', svg()],
+    ['an XML-prologue SVG', svg('<?xml version="1.0"?><svg></svg>')],
+    ['an SVG comment prologue', svg('<!-- c --><svg></svg>')],
+    ['HTML', Buffer.from('<!doctype html><html></html>', 'utf8')],
+    ['a script', Buffer.from('alert(1)', 'utf8')],
+  ])('still returns null for %s', (_label, bytes) => {
+    // DDR-216 D11 step 6: this is THE test that makes the tempting two-line
+    // "just add svg to the sniff" fix fail CI. If it ever goes green for SVG,
+    // arbitrary remote vectors can land in the versioned, peer-synced assets/
+    // tree of a lane this feature never touches.
+    expect(sniffImageExt(bytes)).toBeNull();
+  });
+
+  test('still accepts a real raster', () => {
+    expect(sniffImageExt(png())).toBe('png');
+  });
+});
+
+describe('sniffStagedKind — the --raw-out accept set', () => {
+  test('accepts everything sniffImageExt accepts', () => {
+    expect(sniffStagedKind(png())).toBe('png');
+  });
+
+  test('additionally accepts SVG, which is the whole point of the mode', () => {
+    expect(sniffStagedKind(svg())).toBe('svg');
+    expect(sniffStagedKind(svg('<?xml version="1.0"?><svg></svg>'))).toBe('svg');
+  });
+
+  test('still REFUSES the things a bypass would let through', () => {
+    // `--raw-out` must never mean "skip the type gate" — that would turn the one
+    // reviewable downloader into an unsniffed one for the next caller.
+    expect(sniffStagedKind(Buffer.from('<!doctype html><html></html>', 'utf8'))).toBeNull();
+    expect(sniffStagedKind(Buffer.from('alert(1)', 'utf8'))).toBeNull();
+    expect(sniffStagedKind(Buffer.from('PKzipbytes', 'utf8'))).toBeNull();
+    expect(sniffStagedKind(Buffer.from('', 'utf8'))).toBeNull();
+  });
+
+  test('only the HEAD is probed — a late `<svg` does not rescue a blob', () => {
+    const late = Buffer.concat([Buffer.alloc(512, 0x41), svg()]);
+    expect(sniffStagedKind(late)).toBeNull();
+  });
+});
+
+describe('--raw-out containment survives an OS-symlinked temp root', () => {
+  test('a legitimate staging path under os.tmpdir() is ACCEPTED', async () => {
+    // The bug this pins: `realpathSync` on the root but not the target compares
+    // `/private/var/…` against `/var/…` on macOS (both `/var` and `/tmp` are
+    // OS-level symlinks) and rejects every legitimate path. It shipped, and the
+    // first real import skipped all 29 of its assets with a generic
+    // "download or sanitize failed". Same trap DDR-172 Decision 1 documents.
+    const dir = mkdtempSync(join(tmpdir(), 'raw-out-probe-'));
+    try {
+      const out = join(dir, 'staged.png');
+      // Reaches the network gate rather than the containment check: any throw
+      // must NOT be the containment one.
+      let err: unknown;
+      try {
+        await fetchAsset({
+          url: 'https://figma.com/definitely-not-real.png',
+          root: dir,
+          rawOut: out,
+          rawRoot: dir,
+          allowHosts: FIGMA_HOSTS,
+          maxTime: 1,
+        });
+      } catch (e) {
+        err = e;
+      }
+      expect((err as Error | undefined)?.message ?? '').not.toContain('--raw-out must resolve');
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  test('a path OUTSIDE the declared root is still refused', async () => {
+    const dir = mkdtempSync(join(tmpdir(), 'raw-out-probe-'));
+    try {
+      await expect(
+        fetchAsset({
+          url: 'https://figma.com/x.png',
+          root: dir,
+          rawOut: join(dir, '..', 'escaped.png'),
+          rawRoot: dir,
+          allowHosts: FIGMA_HOSTS,
+        })
+      ).rejects.toThrow(/--raw-out must resolve inside/);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  test('--raw-out without --raw-root is refused outright', async () => {
+    await expect(
+      fetchAsset({ url: 'https://figma.com/x.png', root: '/tmp', rawOut: '/tmp/x.png' })
+    ).rejects.toThrow(/requires --raw-root/);
+  });
+});

package/apps/studio/test/figma-provenance.test.ts

@@ -0,0 +1,108 @@
+// Provenance for an imported canvas (DDR-216 D7 / T9).
+//
+// The plan flags this exact prop-threading as having silently no-opped once
+// before: a badge shipped prop-threaded-but-never-stored, so `.meta.json` said
+// one thing and the tree showed nothing. So this asserts the SERVER half
+// end-to-end against a live `/_index-data` — that `kind` actually survives
+// `loadCanvasMeta` → `NOTABLE_KINDS` → the wire — rather than unit-testing a
+// constant that a missing wire would leave green.
+
+import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import type { Subprocess } from 'bun';
+
+import { bootServer, killProc, makeSandbox, nextPort } from './_helpers.ts';
+
+let proc: Subprocess;
+let base: string;
+let designRoot: string;
+
+const CANVAS = `import { DCArtboard, DesignCanvas } from '@maude/canvas-lib';
+export default function Canvas() {
+  return (
+    <DesignCanvas>
+      <DCArtboard id="node-2-23" label="Imported" width={400} height={300} kind="digital" />
+    </DesignCanvas>
+  );
+}
+`;
+
+beforeAll(async () => {
+  const sandbox = makeSandbox();
+  designRoot = sandbox.designRoot;
+  mkdirSync(join(designRoot, 'ui'), { recursive: true });
+
+  // An imported canvas: `kind` + a source block carrying IDENTIFIERS ONLY.
+  writeFileSync(join(designRoot, 'ui', 'imported.tsx'), CANVAS);
+  writeFileSync(
+    join(designRoot, 'ui', 'imported.meta.json'),
+    JSON.stringify({
+      kind: 'imported-figma',
+      source: {
+        fileKey: 'dGNzRC2kmrmGnOxaBa0RI7',
+        nodeId: '2:23',
+        importedAt: '2026-08-09T00:00:00.000Z',
+      },
+      layout: { artboards: [{ id: 'node-2-23', x: 0, y: 0 }] },
+    })
+  );
+
+  // A hand-authored canvas alongside it — the badge must NOT appear on this one.
+  writeFileSync(join(designRoot, 'ui', 'handmade.tsx'), CANVAS);
+  writeFileSync(join(designRoot, 'ui', 'handmade.meta.json'), JSON.stringify({ layout: {} }));
+
+  const port = nextPort();
+  base = `http://localhost:${port}`;
+  proc = await bootServer(sandbox.root, port);
+});
+
+afterAll(async () => {
+  await killProc(proc);
+});
+
+async function indexData(): Promise<Record<string, unknown>> {
+  const res = await fetch(`${base}/_index-data`);
+  expect(res.status).toBe(200);
+  return (await res.json()) as Record<string, unknown>;
+}
+
+describe('the imported-figma kind reaches the tree', () => {
+  test('canvasKinds carries it for the imported canvas', async () => {
+    const data = await indexData();
+    const kinds = data.canvasKinds as Record<string, string>;
+    const entry = Object.entries(kinds).find(([p]) => p.endsWith('imported.tsx'));
+    expect(entry).toBeDefined();
+    expect(entry?.[1]).toBe('imported-figma');
+  });
+
+  test('a hand-authored canvas gets NO kind — the badge means something', async () => {
+    const data = await indexData();
+    const kinds = data.canvasKinds as Record<string, string>;
+    expect(Object.keys(kinds).some((p) => p.endsWith('handmade.tsx'))).toBe(false);
+  });
+});
+
+describe('provenance carries identifiers only (D7)', () => {
+  test('no Figma NAME or node text is anywhere on the wire', async () => {
+    // `.meta.json` and `config.json` are versioned, peer-synced (DDR-054) AND
+    // read into multiple agents' context. DDR-172 Decision 8 traced exactly
+    // this class and ELIMINATED the free-text sink rather than bounding it;
+    // D7 applies the same elimination here.
+    const raw = JSON.stringify(await indexData());
+    expect(raw).not.toContain('Karta');
+    expect(raw).not.toContain('žluť');
+    expect(raw).not.toContain('<script');
+  });
+
+  test('the recorded source fields are charset-constrained shapes', async () => {
+    const meta = JSON.parse(
+      await Bun.file(join(designRoot, 'ui', 'imported.meta.json')).text()
+    ) as { source: { fileKey: string; nodeId: string; importedAt: string } };
+    expect(meta.source.fileKey).toMatch(/^[A-Za-z0-9]{10,64}$/);
+    expect(meta.source.nodeId).toMatch(/^[0-9]+:[0-9]+$/);
+    expect(Number.isNaN(Date.parse(meta.source.importedAt))).toBe(false);
+    // Exactly three fields — no room for a name, a title or a description.
+    expect(Object.keys(meta.source).sort()).toEqual(['fileKey', 'importedAt', 'nodeId']);
+  });
+});