@bongos/core 1.19.349 → 1.19.351

package/tests/task_visuals.mjs

@@ -0,0 +1,200 @@
+// tests/task_visuals.mjs
+//
+// Unit tests for ship-time task visuals (task 1003109, goal 1000072 "Human
+// legibility"): filename safety / path-traversal, the task-id a stored name
+// belongs to, the upload screening (type allowlist, size cap, magic-byte sniff),
+// the AUDIENCE predicate that decides whether an image is public, alt-text
+// normalization, and persist/delete against a temp dir. No network, no DB.
+//
+// Run:  node tests/task_visuals.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import os from 'node:os';
+import path from 'node:path';
+import fs from 'node:fs/promises';
+const require = createRequire(import.meta.url);
+
+// Point storage at a throwaway dir BEFORE requiring the module.
+const TMP = path.join(os.tmpdir(), `otb-taskvisual-${process.pid}`);
+process.env.TASK_VISUALS_DIR = TMP;
+const tv = require('../modules/lifecycle/task-visuals.js');
+const kit = require('../modules/hall-ui/public/hall-kit.js');
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  return Promise.resolve().then(fn)
+    .then(() => { passed++; console.log(`  PASS  ${name}`); })
+    .catch((e) => { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); });
+}
+
+// Minimal real headers, long enough for the sniff's 12-byte floor.
+const PNG = Buffer.from('89504e470d0a1a0a0000000d49484452', 'hex');
+const JPG = Buffer.from('ffd8ffe000104a46494600010101', 'hex');
+const GIF = Buffer.from('4749463839610100010080000000', 'hex');
+const WEBP = Buffer.concat([Buffer.from('RIFF'), Buffer.from([0, 0, 0, 0]), Buffer.from('WEBPVP8 ')]);
+const NOT_AN_IMAGE = Buffer.from('<?php system($_GET[0]); ?>            ');
+
+console.log('Ship-time task visuals (task 1003109):');
+
+// ---- isSafeName / resolveSafe / taskIdFromName -----------------------------
+await t('isSafeName: accepts a server-generated name, rejects junk + traversal', () => {
+  assert.equal(tv.isSafeName('task-1003109-0011223344556677.png'), true);
+  assert.equal(tv.isSafeName('task-1-aabbccddeeff0011.webp'), true);
+  // Not the minted shape: user-chosen names, wrong hex length, bad extension.
+  assert.equal(tv.isSafeName('screenshot.png'), false);
+  assert.equal(tv.isSafeName('task-1003109-00112233.png'), false);
+  assert.equal(tv.isSafeName('task-1003109-0011223344556677.svg'), false);
+  assert.equal(tv.isSafeName('task-1003109-0011223344556677.png.php'), false);
+  // Traversal, absolute paths, and a name that merely CONTAINS a valid one.
+  assert.equal(tv.isSafeName('../task-1003109-0011223344556677.png'), false);
+  assert.equal(tv.isSafeName('/etc/passwd'), false);
+  assert.equal(tv.isSafeName('a/task-1003109-0011223344556677.png'), false);
+  assert.equal(tv.isSafeName(null), false);
+  assert.equal(tv.isSafeName(42), false);
+});
+
+await t('resolveSafe: stays inside the dir, and returns null for anything unsafe', () => {
+  const p = tv.resolveSafe('task-7-0011223344556677.png', { dir: TMP });
+  assert.equal(p, path.join(path.resolve(TMP), 'task-7-0011223344556677.png'));
+  assert.equal(tv.resolveSafe('../../etc/passwd', { dir: TMP }), null);
+  assert.equal(tv.resolveSafe('task-7-0011223344556677.png/../../x', { dir: TMP }), null);
+});
+
+await t('taskIdFromName: reads the owning task, and fails closed on a bad name', () => {
+  assert.equal(tv.taskIdFromName('task-1003109-0011223344556677.png'), 1003109);
+  // Fails CLOSED: the serve route looks the task up through this, and a null id
+  // resolves to no task, which resolves to "not public" — never to open access.
+  assert.equal(tv.taskIdFromName('../secrets.png'), null);
+  assert.equal(tv.taskIdFromName(''), null);
+});
+
+// ---- screening -------------------------------------------------------------
+await t('screenImage: accepts each allowlisted format with matching bytes', () => {
+  assert.deepEqual(tv.screenImage(PNG, 'image/png'), { ok: true, ext: 'png' });
+  assert.deepEqual(tv.screenImage(JPG, 'image/jpeg'), { ok: true, ext: 'jpg' });
+  assert.deepEqual(tv.screenImage(GIF, 'image/gif'), { ok: true, ext: 'gif' });
+  assert.deepEqual(tv.screenImage(WEBP, 'image/webp'), { ok: true, ext: 'webp' });
+  // A content-type with parameters still resolves.
+  assert.deepEqual(tv.screenImage(PNG, 'image/png; charset=binary'), { ok: true, ext: 'png' });
+});
+
+await t('screenImage: refuses a type outside the allowlist (SVG is executable)', () => {
+  assert.equal(tv.screenImage(PNG, 'image/svg+xml').ok, false);
+  assert.equal(tv.screenImage(PNG, 'text/html').ok, false);
+  assert.equal(tv.screenImage(PNG, 'application/octet-stream').ok, false);
+  assert.equal(tv.screenImage(PNG, '').ok, false);
+});
+
+await t('screenImage: a mislabeled content-type cannot smuggle a non-image in', () => {
+  const r = tv.screenImage(NOT_AN_IMAGE, 'image/png');
+  assert.equal(r.ok, false);
+  assert.equal(r.reason, 'sniff_mismatch');
+  // Right family, wrong format: JPEG bytes claiming to be a PNG.
+  assert.equal(tv.screenImage(JPG, 'image/png').reason, 'sniff_mismatch');
+});
+
+await t('screenImage: refuses empty and over-cap payloads', () => {
+  assert.equal(tv.screenImage(Buffer.alloc(0), 'image/png').reason, 'empty');
+  const huge = Buffer.concat([PNG, Buffer.alloc(tv.MAX_BYTES)]);
+  const r = tv.screenImage(huge, 'image/png');
+  assert.equal(r.ok, false);
+  assert.equal(r.reason, 'too_big');
+  assert.equal(r.bytes, huge.length);
+});
+
+// ---- the audience predicate ------------------------------------------------
+await t('isPubliclyViewable: already-public work only', () => {
+  assert.equal(tv.isPubliclyViewable({ status: 'shipped' }), true);
+  assert.equal(tv.isPubliclyViewable({ status: 'confirmed' }), true);
+  // In-flight work is builders-only, exactly like its value_summary.
+  for (const status of ['backlog', 'ready', 'active', 'completed', 'abandoned']) {
+    assert.equal(tv.isPubliclyViewable({ status }), false, status);
+  }
+});
+
+await t('isPubliclyViewable: fails closed, and narrows on security_sensitive', () => {
+  assert.equal(tv.isPubliclyViewable(null), false);
+  assert.equal(tv.isPubliclyViewable(undefined), false);
+  assert.equal(tv.isPubliclyViewable({}), false);
+  // The one deliberate narrowing vs value_summary: a shipped security task's
+  // screenshot stays builders-only.
+  assert.equal(tv.isPubliclyViewable({ status: 'shipped', security_sensitive: true }), false);
+  assert.equal(tv.isPubliclyViewable({ status: 'shipped', security_sensitive: false }), true);
+});
+
+// ---- alt text --------------------------------------------------------------
+await t('normalizeAlt: flattens, trims, bounds — and empty becomes null', () => {
+  assert.equal(tv.normalizeAlt('  before  and\n after '), 'before and after');
+  assert.equal(tv.normalizeAlt(''), null);
+  assert.equal(tv.normalizeAlt('   '), null);
+  assert.equal(tv.normalizeAlt(null), null);
+  assert.equal(tv.normalizeAlt('x'.repeat(1000)).length, tv.MAX_ALT_LENGTH);
+});
+
+// ---- persist / delete ------------------------------------------------------
+await t('persistImageBuffer: writes a name the serve route accepts, under the right task', async () => {
+  const r = await tv.persistImageBuffer(PNG, { taskId: 1003109, contentType: 'image/png', dir: TMP });
+  assert.equal(r.ok, true);
+  assert.equal(tv.isSafeName(r.file), true);
+  assert.equal(tv.taskIdFromName(r.file), 1003109);
+  assert.equal(r.url, `/api/bongos/task-visuals/${r.file}`);
+  // Both prefixes are permanent aliases, so a URL minted under either resolves.
+  assert.equal(kit.isTaskVisualUrl(r.url), true);
+  assert.equal(r.bytes, PNG.length);
+  const onDisk = await fs.readFile(path.join(TMP, r.file));
+  assert.deepEqual(onDisk, PNG);
+});
+
+await t('persistImageBuffer: two writes never collide (a replace keeps the old file distinct)', async () => {
+  const a = await tv.persistImageBuffer(PNG, { taskId: 5, contentType: 'image/png', dir: TMP });
+  const b = await tv.persistImageBuffer(PNG, { taskId: 5, contentType: 'image/png', dir: TMP });
+  assert.notEqual(a.file, b.file);
+});
+
+await t('persistImageBuffer: refuses without writing anything', async () => {
+  const before = (await fs.readdir(TMP)).length;
+  assert.equal((await tv.persistImageBuffer(NOT_AN_IMAGE, { taskId: 1, contentType: 'image/png', dir: TMP })).reason, 'sniff_mismatch');
+  assert.equal((await tv.persistImageBuffer(PNG, { taskId: 0, contentType: 'image/png', dir: TMP })).reason, 'bad_task_id');
+  assert.equal((await tv.persistImageBuffer(PNG, { taskId: 'x', contentType: 'image/png', dir: TMP })).reason, 'bad_task_id');
+  assert.equal((await fs.readdir(TMP)).length, before);
+});
+
+await t('deleteStored: removes by name or URL, is idempotent, refuses a traversal', async () => {
+  const r = await tv.persistImageBuffer(PNG, { taskId: 9, contentType: 'image/png', dir: TMP });
+  assert.equal(await tv.deleteStored(r.url, { dir: TMP }), true);
+  // Idempotent — removing an already-absent visual is a success, so a replace
+  // whose old file was already swept doesn't error.
+  assert.equal(await tv.deleteStored(r.url, { dir: TMP }), true);
+  assert.equal(await tv.deleteStored('../../etc/passwd', { dir: TMP }), false);
+});
+
+// ---- the client-side URL guard --------------------------------------------
+await t('hall-kit: only a server-minted visual URL is ever rendered', () => {
+  assert.equal(kit.isTaskVisualUrl('/api/gds/task-visuals/task-1003109-0011223344556677.png'), true);
+  assert.equal(kit.isTaskVisualUrl('/api/bongos/task-visuals/task-1-aabbccddeeff0011.webp'), true);
+  // Anything that is not that exact shape renders nothing — including an
+  // absolute URL to another origin, and a javascript: payload.
+  assert.equal(kit.isTaskVisualUrl('https://evil.example/x.png'), false);
+  assert.equal(kit.isTaskVisualUrl('javascript:alert(1)'), false);
+  assert.equal(kit.isTaskVisualUrl('/api/gds/task-visuals/../../secrets'), false);
+  assert.equal(kit.isTaskVisualUrl(''), false);
+  assert.equal(kit.isTaskVisualUrl(null), false);
+});
+
+await t('hall-kit: no visual renders nothing at all — never a placeholder', () => {
+  assert.equal(kit.shipVisualThumbHtml({ id: 1 }), '');
+  assert.equal(kit.shipVisualThumbHtml({ id: 1, visual_url: null }), '');
+  assert.equal(kit.shipVisualThumbHtml(null), '');
+  const html = kit.shipVisualThumbHtml({ id: 1, visual_url: '/api/gds/task-visuals/task-1-0011223344556677.png', visual_alt: 'a "before" shot' });
+  assert.ok(html.includes('ship-visual-thumb'));
+  // The caption is attacker-adjacent text (a builder wrote it) — it must be escaped.
+  assert.ok(html.includes('&quot;before&quot;'));
+  assert.ok(!html.includes('"before"'));
+});
+
+// ---- cleanup ---------------------------------------------------------------
+await fs.rm(TMP, { recursive: true, force: true });
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);