@flancer32/teq-web 0.2.0 → 0.3.0

package/test/unit/Back/Handler/Static/Static.test.mjs

@@ -0,0 +1,235 @@
+import {describe, it, beforeEach} from 'node:test';
+import assert from 'node:assert/strict';
+import {EventEmitter} from 'node:events';
+import {buildTestContainer} from '../../../common.js';
+
+/** Simple HTTP/2 constants mock */
+const mockHttp2 = {
+    constants: {
+        HTTP2_HEADER_CONTENT_LENGTH: 'content-length',
+        HTTP2_HEADER_CONTENT_TYPE: 'content-type',
+        HTTP2_HEADER_LAST_MODIFIED: 'last-modified',
+        HTTP_STATUS_OK: 200
+    }
+};
+
+/** Minimal path mock for FS key normalization */
+const mockPath = {
+    resolve: (...parts) => parts.join('/').replace(/\/+/g, '/'),
+    join: (...parts) => parts.join('/').replace(/\/+/g, '/'),
+    isAbsolute: p => p.startsWith('/'),
+    extname: p => {
+        const m = p.match(/(\.[^./]+)$/);
+        return m ? m[1] : '';
+    }
+};
+
+/** In-memory FS storage */
+let storage;
+let mockFs;
+
+function resetFs() {
+    storage = new Map();
+}
+
+function addFile(p, content) {
+    const key = mockPath.resolve(p);
+    storage.set(key, {
+        isFile: () => true,
+        isDirectory: () => false,
+        size: Buffer.byteLength(content),
+        mtime: new Date(),
+        content
+    });
+}
+
+function addDir(p) {
+    const key = mockPath.resolve(p);
+    storage.set(key, {
+        isFile: () => false,
+        isDirectory: () => true,
+        size: 0,
+        mtime: new Date(),
+        content: null
+    });
+}
+
+beforeEach(() => {
+    resetFs();
+    mockFs = {
+        promises: {
+            stat: async p => {
+                const key = mockPath.resolve(p);
+                if (!storage.has(key)) throw new Error('ENOENT');
+                const entry = storage.get(key);
+                return {
+                    isFile: entry.isFile,
+                    isDirectory: entry.isDirectory,
+                    size: entry.size,
+                    mtime: entry.mtime
+                };
+            }
+        },
+        createReadStream: p => ({
+            pipe: res => {
+                setImmediate(() => {
+                    const entry = storage.get(mockPath.resolve(p));
+                    if (entry && entry.content != null) res.write(entry.content);
+                    res.end();
+                });
+            }
+        })
+    };
+});
+
+/** Mock response with writable stream semantics */
+class MockRes extends EventEmitter {
+    constructor() {
+        super();
+        this.data = Buffer.alloc(0);
+        this.statusCode = undefined;
+        this.headers = undefined;
+        this._sent = false;
+        this._ended = false;
+    }
+
+    get headersSent() { return this._sent; }
+
+    get writableEnded() { return this._ended; }
+
+    writeHead(status, headers) {
+        this.statusCode = status;
+        this.headers = headers;
+        this._sent = true;
+    }
+
+    write(chunk) {
+        this.data = Buffer.concat([this.data, Buffer.from(chunk)]);
+    }
+
+    end(chunk) {
+        if (chunk) this.write(chunk);
+        this._ended = true;
+        this.emit('finish');
+    }
+}
+
+describe('Fl32_Web_Back_Handler_Static', () => {
+    let container;
+
+    beforeEach(() => {
+        container = buildTestContainer();
+        container.register('node:fs', mockFs);
+        container.register('node:http2', mockHttp2);
+        container.register('node:path', mockPath);
+        container.register('Fl32_Web_Back_Logger$', {
+            warn: () => {},
+            exception: () => {}
+        });
+    });
+
+    it('serves from the most specific source', async () => {
+        addDir('/a');
+        addFile('/a/test.txt', 'A');
+        addDir('/b');
+        addFile('/b/test.txt', 'B');
+
+        /** @type {Fl32_Web_Back_Dto_Handler_Source} */
+        const dtoSource = await container.get('Fl32_Web_Back_Dto_Handler_Source$');
+        /** @type {Fl32_Web_Back_Handler_Static} */
+        const handler = await container.get('Fl32_Web_Back_Handler_Static$');
+
+        await handler.init({
+            sources: [
+                dtoSource.create({prefix: '/files/', root: '/a', allow: {'.': ['.']}, defaults: []}),
+                dtoSource.create({prefix: '/files/special/', root: '/b', allow: {'.': ['.']}, defaults: []})
+            ]
+        });
+
+        const res = new MockRes();
+        const ok = await handler.handle({url: '/files/special/test.txt'}, res);
+        await new Promise(r => res.on('finish', r));
+
+        assert.strictEqual(ok, true);
+        assert.strictEqual(res.data.toString(), 'B');
+    });
+
+    it('enforces allow-list rules', async () => {
+        addFile('src/Back/Server.js', 'class X {}');
+        addFile('src/Back/Handler/Static.js', 'ignore');
+
+        /** @type {Fl32_Web_Back_Dto_Handler_Source} */
+        const dtoSource = await container.get('Fl32_Web_Back_Dto_Handler_Source$');
+        /** @type {Fl32_Web_Back_Handler_Static} */
+        const handler = await container.get('Fl32_Web_Back_Handler_Static$');
+
+        await handler.init({
+            sources: [
+                dtoSource.create({prefix: '/s/', root: 'src', allow: {Back: ['Server.js']}, defaults: []})
+            ]
+        });
+
+        const okRes = new MockRes();
+        const ok = await handler.handle({url: '/s/Back/Server.js'}, okRes);
+        await new Promise(r => okRes.on('finish', r));
+        assert.strictEqual(ok, true);
+
+        const badRes = new MockRes();
+        const bad = await handler.handle({url: '/s/Back/Handler/Static.js'}, badRes);
+        assert.strictEqual(bad, false);
+        assert.strictEqual(badRes.headersSent, false);
+    });
+
+    it('serves index files in directories', async () => {
+        addDir('/dir');
+        addDir('/dir/d');
+        addFile('/dir/d/index.txt', 'INDEX');
+
+        /** @type {Fl32_Web_Back_Dto_Handler_Source} */
+        const dtoSource = await container.get('Fl32_Web_Back_Dto_Handler_Source$');
+        /** @type {Fl32_Web_Back_Handler_Static} */
+        const handler = await container.get('Fl32_Web_Back_Handler_Static$');
+
+        await handler.init({
+            sources: [
+                dtoSource.create({
+                    prefix: '/w/',
+                    root: '/dir',
+                    allow: {'.': ['.']},
+                    defaults: ['index.txt']
+                })
+            ]
+        });
+
+        const res = new MockRes();
+        const ok = await handler.handle({url: '/w/d/'}, res);
+        await new Promise(r => res.on('finish', r));
+
+        assert.strictEqual(ok, true);
+        assert.strictEqual(res.data.toString(), 'INDEX');
+    });
+
+    it('rejects traversal and unmatched prefixes', async () => {
+        addFile('/safe/file.txt', 'ok');
+
+        /** @type {Fl32_Web_Back_Dto_Handler_Source} */
+        const dtoSource = await container.get('Fl32_Web_Back_Dto_Handler_Source$');
+        /** @type {Fl32_Web_Back_Handler_Static} */
+        const handler = await container.get('Fl32_Web_Back_Handler_Static$');
+
+        await handler.init({
+            sources: [
+                dtoSource.create({prefix: '/p/', root: '/safe', allow: {'.': ['.']}, defaults: []})
+            ]
+        });
+
+        const res1 = new MockRes();
+        const bad1 = await handler.handle({url: '/p/../file.txt'}, res1);
+        assert.strictEqual(bad1, false);
+
+        const res2 = new MockRes();
+        const bad2 = await handler.handle({url: '/x/file.txt'}, res2);
+        assert.strictEqual(bad2, false);
+        assert.strictEqual(res2.headersSent, false);
+    });
+});

package/src/Back/Handler/Npm.js

@@ -1,161 +0,0 @@
-/**
- * Serves whitelisted files from ./node_modules directory.
- * @implements Fl32_Web_Back_Api_Handler
- */
-export default class Fl32_Web_Back_Handler_Npm {
-    /* eslint-disable jsdoc/require-param-description,jsdoc/check-param-names */
-    /**
-     * @param {typeof import('node:fs')} fs
-     * @param {typeof import('node:http2')} http2
-     * @param {typeof import('node:path')} path
-     * @param {Fl32_Web_Back_Logger} logger
-     * @param {Fl32_Web_Back_Helper_Mime} helpMime
-     * @param {Fl32_Web_Back_Helper_Respond} respond
-     * @param {Fl32_Web_Back_Dto_Handler_Info} dtoInfo
-     * @param {typeof Fl32_Web_Back_Enum_Stage} STAGE
-     */
-    constructor(
-        {
-            'node:fs': fs,
-            'node:http2': http2,
-            'node:path': path,
-            Fl32_Web_Back_Logger$: logger,
-            Fl32_Web_Back_Helper_Mime$: helpMime,
-            Fl32_Web_Back_Helper_Respond$: respond,
-            Fl32_Web_Back_Dto_Handler_Info$: dtoInfo,
-            Fl32_Web_Back_Enum_Stage$: STAGE,
-        }
-    ) {
-        /* eslint-enable jsdoc/check-param-names */
-        // VARS
-        const {promises: fsp} = fs;
-        const {constants: H2} = http2;
-        const {
-            HTTP2_HEADER_CONTENT_LENGTH,
-            HTTP2_HEADER_CONTENT_TYPE,
-            HTTP2_HEADER_LAST_MODIFIED,
-            HTTP_STATUS_OK,
-        } = H2;
-        const _root = path.resolve('node_modules');
-
-        /** @type {Fl32_Web_Back_Dto_Handler_Info.Dto} */
-        const _info = dtoInfo.create();
-        _info.name = this.constructor.name;
-        _info.stage = STAGE.PROCESS;
-        Object.freeze(_info);
-
-        /** @type {{[key: string]: string[]}} */
-        let _allow = {};
-
-        // MAIN
-        /**
-         * Handles request to serve allowed files from node_modules.
-         *
-         * @param {module:http.IncomingMessage|module:http2.Http2ServerRequest} req
-         * @param {module:http.ServerResponse|module:http2.Http2ServerResponse} res
-         * @returns {Promise<boolean>}
-         */
-        this.handle = async function (req, res) {
-            if (!respond.isWritable(res)) return false;
-
-            const urlPath = decodeURIComponent(req.url.split('?')[0]);
-            const prefix = '/node_modules/';
-            if (!urlPath.startsWith(prefix)) return false;
-
-            const rel = urlPath.slice(prefix.length);
-            if (rel.includes('..') || path.isAbsolute(rel)) {
-                logger.warn(`NPM static access denied: ${rel}`);
-                return false;
-            }
-
-            let pkg; let subPath;
-            for (const key of Object.keys(_allow)) {
-                if (rel === key || rel.startsWith(`${key}/`)) {
-                    pkg = key;
-                    subPath = rel.slice(key.length);
-                    if (subPath.startsWith('/')) subPath = subPath.slice(1);
-                    break;
-                }
-            }
-            if (!pkg) return false;
-
-            const rules = _allow[pkg] || [];
-            let allowed = false;
-            if (rules.includes('.')) {
-                allowed = true;
-            } else {
-                for (const p of rules) {
-                    if (subPath === p || subPath.startsWith(`${p}/`)) {
-                        allowed = true;
-                        break;
-                    }
-                }
-            }
-
-            if (!allowed) {
-                logger.warn(`NPM static access denied: ${rel}`);
-                return false;
-            }
-
-            const fsPath = path.resolve(_root, rel);
-            if (!fsPath.startsWith(_root)) {
-                logger.warn(`NPM static access denied: ${rel}`);
-                return false;
-            }
-
-            let stat;
-            try {
-                stat = await fsp.stat(fsPath);
-            } catch {
-                logger.warn(`NPM static file not found: ${rel}`);
-                return false;
-            }
-            if (!stat.isFile()) {
-                logger.warn(`NPM static file not found: ${rel}`);
-                return false;
-            }
-
-            const stream = fs.createReadStream(fsPath);
-            const ext = path.extname(fsPath).toLowerCase();
-            const headers = {
-                [HTTP2_HEADER_CONTENT_LENGTH]: stat.size,
-                [HTTP2_HEADER_CONTENT_TYPE]: helpMime.getByExt(ext),
-                [HTTP2_HEADER_LAST_MODIFIED]: stat.mtime.toUTCString(),
-            };
-            res.writeHead(HTTP_STATUS_OK, headers);
-            stream.pipe(res);
-            return true;
-        };
-
-        /**
-         * Initialize handler with allow list.
-         *
-         * @param {object} params
-         * @param {{[key: string]: string[]}} params.allow - Map of packages to paths
-         *   that can be served from `node_modules`.
-         * @returns {Promise<void>}
-         *
-         * @example
-         * // Allow a single file from a package
-         * await npmHandler.init({
-         *   allow: {
-         *     vue: ['dist/vue.global.prod.js'],
-         *   },
-         * });
-         *
-         * @example
-         * // Allow all files from a subfolder
-         * await npmHandler.init({
-         *   allow: {
-         *     '@teqfw/di/src': ['.'],
-         *   },
-         * });
-         */
-        this.init = async function ({allow}) {
-            _allow = allow || {};
-        };
-
-        /** @returns {Fl32_Web_Back_Dto_Handler_Info.Dto} */
-        this.getRegistrationInfo = () => _info;
-    }
-}

package/test/unit/Back/Handler/Npm.test.mjs

@@ -1,69 +0,0 @@
-import {describe, it, beforeEach} from 'node:test';
-import assert from 'node:assert/strict';
-import {Writable} from 'node:stream';
-import {buildTestContainer} from '../../common.js';
-
-class MockRes extends Writable {
-    constructor() {
-        super();
-        this.data = Buffer.alloc(0);
-        this.statusCode = undefined;
-        this.headers = undefined;
-        this._headersSent = false;
-        this._ended = false;
-    }
-    get headersSent() { return this._headersSent; }
-    get writableEnded() { return this._ended; }
-    writeHead(status, headers) {
-        this.statusCode = status;
-        this.headers = headers;
-        this._headersSent = true;
-    }
-    _write(chunk, enc, cb) {
-        this.data = Buffer.concat([this.data, chunk]);
-        cb();
-    }
-    end(chunk) {
-        if (chunk) this.data = Buffer.concat([this.data, Buffer.from(chunk)]);
-        this._ended = true;
-        super.end();
-    }
-}
-
-describe('Fl32_Web_Back_Handler_Npm', () => {
-    let container;
-    const log = [];
-
-    beforeEach(() => {
-        container = buildTestContainer();
-        container.register('Fl32_Web_Back_Logger$', {
-            warn: (...args) => log.push(['warn', ...args]),
-            exception: (...args) => log.push(['exception', ...args]),
-        });
-        log.length = 0;
-    });
-
-    it('should serve allowed file', async () => {
-        const handler = await container.get('Fl32_Web_Back_Handler_Npm$');
-        await handler.init({allow: {'@teqfw/di': ['package.json']}});
-        const req = {url: '/node_modules/@teqfw/di/package.json'};
-        const res = new MockRes();
-        const ok = await handler.handle(req, res);
-        await new Promise(resolve => res.on('finish', resolve));
-        assert.strictEqual(ok, true);
-        assert.strictEqual(res.statusCode, 200);
-        assert.match(res.data.toString(), /@teqfw\/di/);
-        assert.strictEqual(log.length, 0);
-    });
-
-    it('should deny disallowed path', async () => {
-        const handler = await container.get('Fl32_Web_Back_Handler_Npm$');
-        await handler.init({allow: {'@teqfw/di': ['package.json']}});
-        const req = {url: '/node_modules/@teqfw/di/secret.js'};
-        const res = new MockRes();
-        const ok = await handler.handle(req, res);
-        assert.strictEqual(ok, false);
-        assert.strictEqual(res.headersSent, false);
-        assert.ok(log[0][0] === 'warn');
-    });
-});