@jrpool/kilotest 48.0.0 → 49.0.0

package/test/dbFixture.ts

@@ -17,5 +17,13 @@ export const fixtureDBDir = fs.mkdtempSync(path.join(os.tmpdir(), 'kilotest-db-'
 // Copy the tracked fixture database to the temporary directory.
 fs.cpSync(path.join(import.meta.dirname, 'fixtures', 'db'), fixtureDBDir, {recursive: true});
 
+// Git does not track empty directories, so the job-state subdirectories are absent
+// from a fresh checkout even though they are part of the fixture layout. Create them
+// here rather than tracking placeholder files, which readdir-based job listing would
+// otherwise pick up as (invalid) job files.
+for (const category of ['queue', 'claimed', 'failed']) {
+  fs.mkdirSync(path.join(fixtureDBDir, 'jobs', category), {recursive: true});
+}
+
 // Remove the copy when the process exits.
 process.on('exit', () => fs.rmSync(fixtureDBDir, {recursive: true, force: true}));

package/util.test.ts

@@ -1127,3 +1127,234 @@ test('getMultiReportWhats returns descriptions that have multiple reports', asyn
   const whats = await getMultiReportWhats();
   assert.ok(whats.includes('Mixed Outcomes Page'));
 });
+
+test('getExclusionCookieValue is deterministic for a given AUTH_CODE', async () => {
+  const savedAuthCode = process.env.AUTH_CODE;
+  process.env.AUTH_CODE = 'test-auth-code';
+  try {
+    const {getExclusionCookieValue} = await import('./util.ts');
+    const first = getExclusionCookieValue();
+    const second = getExclusionCookieValue();
+    assert.equal(first, second);
+    assert.equal(typeof first, 'string');
+    assert.ok(first.length > 0);
+  }
+  finally {
+    process.env.AUTH_CODE = savedAuthCode;
+  }
+});
+
+test('getExclusionCookieValue changes when AUTH_CODE changes', async () => {
+  const savedAuthCode = process.env.AUTH_CODE;
+  try {
+    const {getExclusionCookieValue} = await import('./util.ts');
+    process.env.AUTH_CODE = 'code-one';
+    const first = getExclusionCookieValue();
+    process.env.AUTH_CODE = 'code-two';
+    const second = getExclusionCookieValue();
+    assert.notEqual(first, second);
+  }
+  finally {
+    process.env.AUTH_CODE = savedAuthCode;
+  }
+});
+
+test('getExclusionCookieValue does not throw when AUTH_CODE is unset', async () => {
+  const savedAuthCode = process.env.AUTH_CODE;
+  delete process.env.AUTH_CODE;
+  try {
+    const {getExclusionCookieValue} = await import('./util.ts');
+    assert.equal(typeof getExclusionCookieValue(), 'string');
+  }
+  finally {
+    process.env.AUTH_CODE = savedAuthCode;
+  }
+});
+
+test('recordMetric creates the metrics file and records a first occurrence when the file is missing', async () => {
+  const tmpDir = (await import('node:os')).tmpdir() + '/kilotest-missing-metrics-test';
+  const fsSync = await import('node:fs');
+  fsSync.mkdirSync(tmpDir, {recursive: true});
+  const savedDbDir = process.env.DB_DIR;
+  process.env.DB_DIR = tmpDir;
+  try {
+    const {recordMetric, metricsPath} = await import('./util.ts');
+    await recordMetric('pageViews', 'tutorialWeb.html');
+    const metrics = JSON.parse(fsSync.readFileSync(metricsPath(), 'utf8'));
+    assert.equal(metrics.pageViews['tutorialWeb.html'], 1);
+    assert.equal(metrics.mcpToolCalls['tutorialWeb.html'], undefined);
+    assert.equal(typeof metrics.since, 'string');
+  }
+  finally {
+    process.env.DB_DIR = savedDbDir;
+    fsSync.rmSync(tmpDir, {recursive: true});
+  }
+});
+
+test('recordMetric increments an existing count rather than overwriting it', async () => {
+  const tmpDir = (await import('node:os')).tmpdir() + '/kilotest-existing-metrics-test';
+  const fsSync = await import('node:fs');
+  fsSync.mkdirSync(tmpDir, {recursive: true});
+  const savedDbDir = process.env.DB_DIR;
+  process.env.DB_DIR = tmpDir;
+  try {
+    const {recordMetric, metricsPath} = await import('./util.ts');
+    await recordMetric('mcpToolCalls', 'listReports');
+    await recordMetric('mcpToolCalls', 'listReports');
+    await recordMetric('mcpToolCalls', 'getReport');
+    const metrics = JSON.parse(fsSync.readFileSync(metricsPath(), 'utf8'));
+    assert.equal(metrics.mcpToolCalls.listReports, 2);
+    assert.equal(metrics.mcpToolCalls.getReport, 1);
+  }
+  finally {
+    process.env.DB_DIR = savedDbDir;
+    fsSync.rmSync(tmpDir, {recursive: true});
+  }
+});
+
+test('recordMetric throws when the metrics file is not readable for a reason other than being missing', async () => {
+  const tmpDir = (await import('node:os')).tmpdir() + '/kilotest-metrics-unreadable-test';
+  const fsSync = await import('node:fs');
+  // Create a directory where the metrics file should be, causing EISDIR rather than ENOENT.
+  fsSync.mkdirSync(tmpDir + '/metrics.json', {recursive: true});
+  const savedDbDir = process.env.DB_DIR;
+  process.env.DB_DIR = tmpDir;
+  try {
+    const {recordMetric} = await import('./util.ts');
+    await assert.rejects(recordMetric('pageViews', 'tutorialWeb.html'), /not readable/);
+  }
+  finally {
+    process.env.DB_DIR = savedDbDir;
+    fsSync.rmSync(tmpDir, {recursive: true});
+  }
+});
+
+test('recordMetric throws when the metrics file is not JSON', async () => {
+  const tmpDir = (await import('node:os')).tmpdir() + '/kilotest-metrics-not-json-test';
+  const fsSync = await import('node:fs');
+  fsSync.mkdirSync(tmpDir, {recursive: true});
+  fsSync.writeFileSync(tmpDir + '/metrics.json', 'not json');
+  const savedDbDir = process.env.DB_DIR;
+  process.env.DB_DIR = tmpDir;
+  try {
+    const {recordMetric} = await import('./util.ts');
+    await assert.rejects(recordMetric('pageViews', 'tutorialWeb.html'), /not JSON/);
+  }
+  finally {
+    process.env.DB_DIR = savedDbDir;
+    fsSync.rmSync(tmpDir, {recursive: true});
+  }
+});
+
+test('recordMetric keeps categories independent for the same name', async () => {
+  const tmpDir = (await import('node:os')).tmpdir() + '/kilotest-metrics-categories-test';
+  const fsSync = await import('node:fs');
+  fsSync.mkdirSync(tmpDir, {recursive: true});
+  const savedDbDir = process.env.DB_DIR;
+  process.env.DB_DIR = tmpDir;
+  try {
+    const {recordMetric, metricsPath} = await import('./util.ts');
+    await recordMetric('apiOperations', 'listReports');
+    await recordMetric('mcpToolCalls', 'listReports');
+    const metrics = JSON.parse(fsSync.readFileSync(metricsPath(), 'utf8'));
+    assert.equal(metrics.apiOperations.listReports, 1);
+    assert.equal(metrics.mcpToolCalls.listReports, 1);
+  }
+  finally {
+    process.env.DB_DIR = savedDbDir;
+    fsSync.rmSync(tmpDir, {recursive: true});
+  }
+});
+
+test('recordMetric tracks managerActivity outcomes separately per page', async () => {
+  const tmpDir = (await import('node:os')).tmpdir() + '/kilotest-metrics-manager-activity-test';
+  const fsSync = await import('node:fs');
+  fsSync.mkdirSync(tmpDir, {recursive: true});
+  const savedDbDir = process.env.DB_DIR;
+  process.env.DB_DIR = tmpDir;
+  try {
+    const {recordMetric, metricsPath} = await import('./util.ts');
+    await recordMetric('managerActivity', 'reannotate.html', 'ok');
+    await recordMetric('managerActivity', 'reannotate.html', 'error');
+    await recordMetric('managerActivity', 'reannotate.html', 'error');
+    const metrics = JSON.parse(fsSync.readFileSync(metricsPath(), 'utf8'));
+    assert.deepEqual(metrics.managerActivity['reannotate.html'], {ok: 1, error: 2});
+  }
+  finally {
+    process.env.DB_DIR = savedDbDir;
+    fsSync.rmSync(tmpDir, {recursive: true});
+  }
+});
+
+test('recordMetric keeps managerActivity independent of pageViews for the same name', async () => {
+  const tmpDir = (await import('node:os')).tmpdir() + '/kilotest-metrics-manager-vs-pageviews-test';
+  const fsSync = await import('node:fs');
+  fsSync.mkdirSync(tmpDir, {recursive: true});
+  const savedDbDir = process.env.DB_DIR;
+  process.env.DB_DIR = tmpDir;
+  try {
+    const {recordMetric, metricsPath} = await import('./util.ts');
+    await recordMetric('pageViews', 'hideReportForm.html');
+    await recordMetric('managerActivity', 'hideReportForm.html', 'ok');
+    const metrics = JSON.parse(fsSync.readFileSync(metricsPath(), 'utf8'));
+    assert.equal(metrics.pageViews['hideReportForm.html'], 1);
+    assert.deepEqual(metrics.managerActivity['hideReportForm.html'], {ok: 1, error: 0});
+  }
+  finally {
+    process.env.DB_DIR = savedDbDir;
+    fsSync.rmSync(tmpDir, {recursive: true});
+  }
+});
+
+test('getMetrics backfills categories missing from a metrics.json written before they existed', async () => {
+  const tmpDir = (await import('node:os')).tmpdir() + '/kilotest-metrics-backfill-test';
+  const fsSync = await import('node:fs');
+  fsSync.mkdirSync(tmpDir, {recursive: true});
+  // Simulate a metrics.json written before the managerActivity category was added.
+  fsSync.writeFileSync(tmpDir + '/metrics.json', JSON.stringify({
+    since: '260101T0000',
+    pageViews: {listReports: 1},
+    mcpToolCalls: {},
+    apiOperations: {}
+  }));
+  const savedDbDir = process.env.DB_DIR;
+  process.env.DB_DIR = tmpDir;
+  try {
+    const {recordMetric, metricsPath} = await import('./util.ts');
+    // Recording a managerActivity outcome must not throw despite the file predating that category.
+    await recordMetric('managerActivity', 'metrics', 'ok');
+    const metrics = JSON.parse(fsSync.readFileSync(metricsPath(), 'utf8'));
+    assert.equal(metrics.since, '260101T0000');
+    assert.equal(metrics.pageViews.listReports, 1);
+    assert.deepEqual(metrics.managerActivity.metrics, {ok: 1, error: 0});
+  }
+  finally {
+    process.env.DB_DIR = savedDbDir;
+    fsSync.rmSync(tmpDir, {recursive: true});
+  }
+});
+
+test('getMetrics backfills every category, and generates a since stamp, from a bare empty file', async () => {
+  const tmpDir = (await import('node:os')).tmpdir() + '/kilotest-metrics-backfill-empty-test';
+  const fsSync = await import('node:fs');
+  fsSync.mkdirSync(tmpDir, {recursive: true});
+  // Simulate a metrics.json with none of the known fields (an extreme case of an outdated schema).
+  fsSync.writeFileSync(tmpDir + '/metrics.json', '{}');
+  const savedDbDir = process.env.DB_DIR;
+  process.env.DB_DIR = tmpDir;
+  try {
+    const {recordMetric, metricsPath} = await import('./util.ts');
+    await recordMetric('pageViews', 'tutorialWeb');
+    const metrics = JSON.parse(fsSync.readFileSync(metricsPath(), 'utf8'));
+    assert.equal(typeof metrics.since, 'string');
+    assert.ok(metrics.since.length > 0);
+    assert.equal(metrics.pageViews.tutorialWeb, 1);
+    assert.deepEqual(metrics.mcpToolCalls, {});
+    assert.deepEqual(metrics.apiOperations, {});
+    assert.deepEqual(metrics.managerActivity, {});
+  }
+  finally {
+    process.env.DB_DIR = savedDbDir;
+    fsSync.rmSync(tmpDir, {recursive: true});
+  }
+});

package/util.ts

@@ -11,6 +11,7 @@
 import {sendAlert} from './alerts.ts';
 import {issues as issueSpecs, rules as ruleSpecs} from 'testaro-issues';
 import type {Act, Catalog, Report, StandardInstance} from 'testaro';
+import crypto from 'node:crypto';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import querystring from 'node:querystring';
@@ -29,6 +30,8 @@ export const testRequestsPath = (): string => path.join(jobsPath(), 'testRequest
 export const reportsPath = (): string => path.join(dbPath(), 'reports');
 // Path of the hidden-reports directory.
 export const hiddenReportsPath = (): string => path.join(dbPath(), 'hiddenReports');
+// Path of the usage-metrics file.
+export const metricsPath = (): string => path.join(dbPath(), 'metrics.json');
 // IDs, names, and sponsors of Testaro rule engines.
 const ruleEngines: Record<string, [string, string]> = {
   alfa: ['Alfa', 'Siteimprove'],
@@ -50,6 +53,18 @@ export {ruleEngines};
 
 // TYPES
 
+// Usage-metrics categories, each a map from an event name (page name, MCP tool name, or
+// API operation name) to a count of how many times it has occurred. managerActivity
+// counts manager-only pages separately from pageViews, by outcome, since a spike in
+// failed authCode attempts against a manager page is a signal of suspected abuse.
+export type Metrics = {
+  since: string;
+  pageViews: Record<string, number>;
+  mcpToolCalls: Record<string, number>;
+  apiOperations: Record<string, number>;
+  managerActivity: Record<string, {ok: number; error: number}>;
+};
+
 // Test request.
 export type TestRequest = {
   timeStamp: string;
@@ -1015,3 +1030,85 @@ export const processTestRequest = (
     throw new Error('Failed to process test request', {cause: error});
   }
 });
+
+// METRICS FUNCTIONS
+
+// Name of the cookie that excludes a browser's requests from usage metrics.
+export const metricsExclusionCookieName = 'kilotestExclude';
+// Returns the value that the metrics-exclusion cookie must have to be honored: a SHA-256
+// hash of AUTH_CODE, not AUTH_CODE itself, so the secret is never placed in a long-lived
+// browser cookie, and not a fixed value, since Kilotest's source is public and a fixed
+// value would let anyone read it and exclude themselves from metrics at no cost.
+export const getExclusionCookieValue = (): string =>
+  crypto.createHash('sha256').update(process.env.AUTH_CODE ?? '').digest('hex');
+// Concurrency lock for the `metrics.json` file.
+const metricsLock = createLock();
+// Returns the usage metrics, creating the file with zeroed counts if it does not yet exist.
+export const getMetrics = async (): Promise<Metrics> => {
+  let metricsJSON: string;
+  try {
+    metricsJSON = await fs.readFile(metricsPath(), 'utf8');
+  }
+  catch(error: unknown) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
+      const metrics: Metrics = {
+        since: getNowStamp(), pageViews: {}, mcpToolCalls: {}, apiOperations: {}, managerActivity: {}
+      };
+      await fs.writeFile(metricsPath(), getJSON(metrics));
+      return metrics;
+    }
+    throw new Error(`Metrics file not readable (${errorMessage(error)})`, {cause: error});
+  }
+  let metrics: Partial<Metrics>;
+  try {
+    metrics = JSON.parse(metricsJSON) as Partial<Metrics>;
+  }
+  catch(error: unknown) {
+    throw new Error(`Metrics file not JSON (${errorMessage(error)})`, {cause: error});
+  }
+  // Backfill any category absent from a file written before that category existed,
+  // so an older metrics.json (e.g. from before a schema change) remains readable.
+  return {
+    since: metrics.since ?? getNowStamp(),
+    pageViews: metrics.pageViews ?? {},
+    mcpToolCalls: metrics.mcpToolCalls ?? {},
+    apiOperations: metrics.apiOperations ?? {},
+    managerActivity: metrics.managerActivity ?? {}
+  };
+};
+// Records an occurrence of a named event (a web page view, an MCP tool call, or an API
+// operation call) in the usage metrics, creating the category and name if not yet present.
+export function recordMetric(
+  category: 'pageViews' | 'mcpToolCalls' | 'apiOperations', name: string
+): Promise<void>;
+// Records an outcome of a manager-page visit or submission (a distinct category from
+// pageViews, so a spike in failed authCode attempts against a manager page is visible
+// as a signal of suspected abuse, rather than being folded into ordinary page views).
+export function recordMetric(
+  category: 'managerActivity', name: string, outcome: 'ok' | 'error'
+): Promise<void>;
+export function recordMetric(
+  category: 'pageViews' | 'mcpToolCalls' | 'apiOperations' | 'managerActivity',
+  name: string,
+  outcome?: 'ok' | 'error'
+): Promise<void> {
+  return metricsLock(async (): Promise<void> => {
+    const metrics = await getMetrics();
+    if (category === 'managerActivity') {
+      const entry = metrics.managerActivity[name] ??= {ok: 0, error: 0};
+      entry[outcome!]++;
+    }
+    else {
+      metrics[category][name] = (metrics[category][name] ?? 0) + 1;
+    }
+    await fs.writeFile(metricsPath(), getJSON(metrics));
+  });
+}
+// Resets all usage metrics to empty and since to now.
+export const clearMetrics = (): Promise<Metrics> => metricsLock(async (): Promise<Metrics> => {
+  const metrics: Metrics = {
+    since: getNowStamp(), pageViews: {}, mcpToolCalls: {}, apiOperations: {}, managerActivity: {}
+  };
+  await fs.writeFile(metricsPath(), getJSON(metrics));
+  return metrics;
+});

package/web/ai0BalanceForm/ai0BalanceForm.test.ts

@@ -44,22 +44,28 @@ after(async () => {
 
 // TESTS
 
-test('ai0BalanceForm displays the current balance when no newBalance is submitted', async () => {
-  const result: any = await answer(null, '');
+test('ai0BalanceForm displays the current balance on a GET request', async () => {
+  const result: any = await answer(null, '', 'GET');
   assert.equal(result.status, 'ok');
   assert.ok(result.answerPage);
   const html = parse(result.answerPage);
   assert.ok(html.querySelector('title'));
 });
 
-test('ai0BalanceForm returns an error for an invalid auth code', async () => {
-  const result: any = await answer(null, 'authCode=wrong&newBalance=5.00');
+test('ai0BalanceForm ignores a newBalance query string on a GET request', async () => {
+  const result: any = await answer(null, 'authCode=test-auth-code&newBalance=99.00', 'GET');
+  assert.equal(result.status, 'ok');
+  assert.ok(!result.answerPage.includes('$99 is the'));
+});
+
+test('ai0BalanceForm returns an error for an invalid auth code on a POST request', async () => {
+  const result: any = await answer(null, 'authCode=wrong&newBalance=5.00', 'POST');
   assert.equal(result.status, 'error');
-  assert.equal(result.message, 'Invalid authorization code');
+  assert.equal(result.message, 'Invalid request');
 });
 
-test('ai0BalanceForm records a valid new balance with valid auth code', async () => {
-  const result: any = await answer(null, 'authCode=test-auth-code&newBalance=2.50');
+test('ai0BalanceForm records a valid new balance with valid auth code on a POST request', async () => {
+  const result: any = await answer(null, 'authCode=test-auth-code&newBalance=2.50', 'POST');
   assert.equal(result.status, 'ok');
   assert.ok(result.answerPage.includes('$2.5 is the'));
   // Verify the file was written.
@@ -67,9 +73,9 @@ test('ai0BalanceForm records a valid new balance with valid auth code', async ()
   assert.equal(data.balance, 2.50);
 });
 
-test('ai0BalanceForm does not record an invalid balance', async () => {
+test('ai0BalanceForm does not record an invalid balance on a POST request', async () => {
   // 150 is out of range (>= 100).
-  const result: any = await answer(null, 'authCode=test-auth-code&newBalance=150');
+  const result: any = await answer(null, 'authCode=test-auth-code&newBalance=150', 'POST');
   assert.equal(result.status, 'ok');
   // The oldBalance should not show the new value.
   assert.ok(!result.answerPage.includes('$150 is the'));
@@ -78,7 +84,7 @@ test('ai0BalanceForm does not record an invalid balance', async () => {
 test('ai0BalanceForm shows no-balance message when balance file is missing', async () => {
   await fs.unlink(balancePath).catch(() => {});
   try {
-    const result: any = await answer(null, '');
+    const result: any = await answer(null, '', 'GET');
     assert.equal(result.status, 'ok');
     assert.ok(result.answerPage.includes('There is no'));
   }

package/web/ai0BalanceForm/index.html

@@ -15,7 +15,7 @@
       <h1><a href="/">Kilotest</a>: Record AI service 0 balance</h1>
       <p>__oldBalance__ recorded AI service 0 balance.</p>
       <p>The current AI service 0 balance is available on the <a href="https://platform.claude.com/settings/billing">Claude Platform Billing page</a>.</p>
-      <form action="/ai0BalanceForm.html">
+      <form action="/ai0BalanceForm.html" method="post">
         <p><label>
           Balance (in $):
           <input type="number" size="5" min="0" max="99.99" step="0.01" name="newBalance" required>

package/web/ai0BalanceForm/index.ts

@@ -11,14 +11,16 @@ import {getJSON, populateTemplate} from '../../util.ts';
 
 // FUNCTIONS
 
-// Returns a form for recording the AI service 0 balance.
-export const answer = async (_: any, search: string) => {
+// Returns a form for recording the AI service 0 balance. A GET request never processes a
+// submission, regardless of its query string; only a POST request (the form's own
+// submission) does.
+export const answer = async (_: any, search: string, method: string) => {
   const searchParams = new URLSearchParams(search);
   const authCode = searchParams?.get('authCode');
   const newBalanceString = searchParams?.get('newBalance');
   let oldBalance: any;
-  // If the form displayed itself:
-  if (newBalanceString) {
+  // If the form has been submitted:
+  if (method === 'POST' && newBalanceString) {
     // If the authorization code is valid:
     if (authCode === process.env.AUTH_CODE) {
       const newBalance = Number.parseFloat(newBalanceString);
@@ -40,10 +42,12 @@ export const answer = async (_: any, search: string) => {
     }
     // Otherwise, i.e. if the authorization code is invalid:
     else {
-      // Report the error.
+      // Report the error, deliberately vague so as not to confirm to an attacker that the
+      // authorization code specifically (as opposed to some other part of the request) is
+      // what was wrong.
       return {
         status: 'error',
-        message: 'Invalid authorization code'
+        message: 'Invalid request'
       }
     }
   }

package/web/enqueue/index.ts

@@ -48,9 +48,12 @@ export const answer = async (url: string, description: string, authCode: string)
       answerPage
     };
   }
-  // Otherwise, i.e. if the authorization code is invalid, return an error page.
+  // Otherwise, i.e. if the authorization code is invalid, return an error page. The
+  // message is deliberately vague so as not to confirm to an attacker that the
+  // authorization code specifically (as opposed to some other part of the request) is
+  // what was wrong.
   return {
     status: 'error',
-    message: 'Invalid authorization code'
+    message: 'Invalid request'
   };
 };

package/web/expungeReportsForm/expungeReportsForm.test.ts

@@ -35,32 +35,40 @@ after(async () => {
 
 // TESTS
 
-test('expungeReportsForm displays a list of reports when no submission', async () => {
-  const result: any = await answer(null, '');
+test('expungeReportsForm displays a list of reports on a GET request', async () => {
+  const result: any = await answer(null, '', 'GET');
   assert.equal(result.status, 'ok');
   assert.ok(result.answerPage);
   const html = parse(result.answerPage);
   assert.ok(html.querySelector('title'));
 });
 
-test('expungeReportsForm returns an error for an invalid auth code', async () => {
-  const result: any = await answer(null, 'authCode=wrong&report=260101T0001-ct');
+test('expungeReportsForm ignores a report query string on a GET request', async () => {
+  const reportPath = path.join(reportsPath(), '260101T0001-ct.json');
+  const result: any = await answer(null, 'authCode=test-auth-code&report=260101T0001-ct', 'GET');
+  assert.equal(result.status, 'ok');
+  // The report should NOT have been deleted by a mere GET request.
+  await fs.access(reportPath);
+});
+
+test('expungeReportsForm returns an error for an invalid auth code on a POST request', async () => {
+  const result: any = await answer(null, 'authCode=wrong&report=260101T0001-ct', 'POST');
   assert.equal(result.status, 'error');
-  assert.equal(result.message, 'Invalid authorization code');
+  assert.equal(result.message, 'Invalid request');
 });
 
-test('expungeReportsForm returns an error when deleting a nonexistent report', async () => {
-  const result: any = await answer(null, 'authCode=test-auth-code&report=999999T9999-nope');
+test('expungeReportsForm returns an error when deleting a nonexistent report on a POST request', async () => {
+  const result: any = await answer(null, 'authCode=test-auth-code&report=999999T9999-nope', 'POST');
   assert.equal(result.status, 'error');
   assert.ok(result.message.includes('Deleting sole reports'));
 });
 
-test('expungeReportsForm deletes a sole report with valid auth code', async () => {
+test('expungeReportsForm deletes a sole report with valid auth code on a POST request', async () => {
   // 260101T0001-ct is the only report for its URL (canttell).
   const reportPath = path.join(reportsPath(), '260101T0001-ct.json');
   const backup = await fs.readFile(reportPath, 'utf8');
   try {
-    const result: any = await answer(null, 'authCode=test-auth-code&report=260101T0001-ct');
+    const result: any = await answer(null, 'authCode=test-auth-code&report=260101T0001-ct', 'POST');
     assert.equal(result.status, 'ok');
     await fs.access(reportPath).then(
       () => {throw new Error('Report should have been deleted');},
@@ -77,7 +85,7 @@ test('expungeReportsForm returns an error when a report file is corrupt', async
   const backup = await fs.readFile(reportPath, 'utf8');
   try {
     await fs.writeFile(reportPath, 'not valid json');
-    const result: any = await answer(null, '');
+    const result: any = await answer(null, '', 'GET');
     assert.equal(result.status, 'error');
   }
   finally {
@@ -100,7 +108,7 @@ test('expungeReportsForm shows no-deletable message when every URL has at least
   process.env.DB_DIR = tmpDir;
   try {
     const {answer} = await import('./index.ts');
-    const result: any = await answer(null, '');
+    const result: any = await answer(null, '', 'GET');
     assert.equal(result.status, 'ok');
     assert.ok(result.answerPage.includes('no reports to delete'));
     assert.ok(result.answerPage.includes('disabled'));

package/web/expungeReportsForm/index.html

@@ -14,7 +14,7 @@
     <main>
       <h1><a href="/">Kilotest</a>: Expunge reports</h1>
       <p>__intro__</p>
-      <form action="/expungeReportsForm.html">
+      <form action="/expungeReportsForm.html" method="post">
         <fieldset>
           <legend>Reports</legend>
           __reports__

package/web/expungeReportsForm/index.ts

@@ -10,7 +10,7 @@ import {reportDeletionForm} from '../reportDeletion.ts';
 // FUNCTIONS
 
 // Returns a form for deleting sole reports.
-export const answer = async (_: any, search: string) => reportDeletionForm(import.meta.dirname, search, {
+export const answer = async (_: any, search: string, method: string) => reportDeletionForm(import.meta.dirname, search, method, {
   intro: 'Choose the sole reports to delete.',
   emptyIntro: 'Each target has at least 2 reports, so there are no reports to delete.',
   failurePrefix: 'Deleting sole reports failed',

package/web/hideReportForm/hideReportForm.test.ts

@@ -44,8 +44,8 @@ after(async () => {
 
 // TESTS
 
-test('hideReportForm displays a list of reports when no submission', async () => {
-  const result: any = await answer(null, '');
+test('hideReportForm displays a list of reports on a GET request', async () => {
+  const result: any = await answer(null, '', 'GET');
   assert.equal(result.status, 'ok');
   assert.ok(result.answerPage);
   const html = parse(result.answerPage);
@@ -53,13 +53,28 @@ test('hideReportForm displays a list of reports when no submission', async () =>
   assert.ok(radios.length > 0);
 });
 
-test('hideReportForm returns an error for an invalid auth code', async () => {
-  const result: any = await answer(null, 'authCode=wrong&report=260101T0009-brd');
+test('hideReportForm ignores a report query string on a GET request', async () => {
+  const reportPath = path.join(reportsPath(), '260101T0009-brd.json');
+  const hiddenPath = path.join(hiddenReportsPath(), '260101T0009-brd.json');
+  try {
+    await fs.rename(hiddenPath, reportPath);
+  }
+  catch {
+    // Report may already be in reports.
+  }
+  const result: any = await answer(null, 'authCode=test-auth-code&report=260101T0009-brd', 'GET');
+  assert.equal(result.status, 'ok');
+  // The report should NOT have been hidden by a mere GET request.
+  await fs.access(reportPath);
+});
+
+test('hideReportForm returns an error for an invalid auth code on a POST request', async () => {
+  const result: any = await answer(null, 'authCode=wrong&report=260101T0009-brd', 'POST');
   assert.equal(result.status, 'error');
-  assert.equal(result.message, 'Invalid authorization code');
+  assert.equal(result.message, 'Invalid request');
 });
 
-test('hideReportForm hides a report with valid auth code', async () => {
+test('hideReportForm hides a report with valid auth code on a POST request', async () => {
   const reportPath = path.join(reportsPath(), '260101T0009-brd.json');
   const hiddenPath = path.join(hiddenReportsPath(), '260101T0009-brd.json');
   // Ensure the report exists in reports and not in hidden.
@@ -69,14 +84,14 @@ test('hideReportForm hides a report with valid auth code', async () => {
   catch {
     // Report may already be in reports.
   }
-  const result: any = await answer(null, 'authCode=test-auth-code&report=260101T0009-brd');
+  const result: any = await answer(null, 'authCode=test-auth-code&report=260101T0009-brd', 'POST');
   assert.equal(result.status, 'ok');
   // The report should now be in the hidden directory.
   await fs.access(hiddenPath);
 });
 
-test('hideReportForm returns an error when hiding a nonexistent report', async () => {
-  const result: any = await answer(null, 'authCode=test-auth-code&report=999999T9999-nope');
+test('hideReportForm returns an error when hiding a nonexistent report on a POST request', async () => {
+  const result: any = await answer(null, 'authCode=test-auth-code&report=999999T9999-nope', 'POST');
   assert.equal(result.status, 'error');
   assert.ok(result.message.includes('Hiding report'));
 });

package/web/hideReportForm/index.html

@@ -14,7 +14,7 @@
     <main>
       <h1><a href="/">Kilotest</a>: Classify report as experimental</h1>
       <p>Choose a report to classify as experimental.</p>
-      <form action="/hideReportForm.html">
+      <form action="/hideReportForm.html" method="post">
         <fieldset>
           <legend>Reports</legend>
           __reports__