@jrpool/kilotest 49.0.0 → 51.1.0

package/web/deleteNotesForm/index.ts

@@ -0,0 +1,167 @@
+/*
+  index.ts
+  Serves a form for deleting web tutorial comments, AI tutorial comments, and MCP
+  feature requests, the three kinds of notes that Kilotest records to flat JSON files
+  rather than presenting through any other manager page.
+*/
+
+// IMPORTS
+
+import {errorMessage, getDateTimeString, getJSON, getPlainText, isValidAuthCode, populateTemplate} from '../../util.ts';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+
+// TYPES
+
+// A note (comment or feature request) as stored in one of the note files.
+type Note = {
+  timeStamp: string;
+  content: string;
+};
+
+// The source of a kind of note, identifying its file and how it is labeled.
+type NoteSource = {
+  name: string;
+  label: string;
+  getPath: () => string;
+};
+
+// CONSTANTS
+
+// The note sources, in the order they are listed on the form. Each source's path is
+// read afresh on every call, via its own environment-variable override, exactly as
+// web/tutorialWeb/index.ts and web/tutorialAI/index.ts already do for their own
+// comment files, so that tests can point any of them at a fixture path.
+const noteSources: NoteSource[] = [
+  {
+    name: 'tutorialWeb',
+    label: 'Web tutorial comment',
+    getPath: () => process.env.TUTORIAL_WEB_COMMENTS_PATH ||
+      path.join(import.meta.dirname, '../../db/comments/tutorialWeb.json')
+  },
+  {
+    name: 'tutorialAI',
+    label: 'AI tutorial comment',
+    getPath: () => process.env.TUTORIAL_AI_COMMENTS_PATH ||
+      path.join(import.meta.dirname, '../../db/comments/tutorialAI.json')
+  },
+  {
+    name: 'featureRequest',
+    label: 'MCP feature request',
+    getPath: () => process.env.FEATURE_REQUESTS_PATH ||
+      path.join(import.meta.dirname, '../../db/featureRequests.json')
+  }
+];
+
+// FUNCTIONS (helpers)
+
+// Returns the notes in a source's file, or an empty array if it does not exist.
+const getNotes = async (source: NoteSource): Promise<Note[]> => {
+  try {
+    const existing = await fs.readFile(source.getPath(), 'utf8');
+    return JSON.parse(existing);
+  }
+  catch {
+    return [];
+  }
+};
+
+// FUNCTIONS
+
+// Returns a form for deleting selected notes, or, on a POST request with a valid
+// authorization code, deletes the selected notes and returns the form again. A GET
+// request never processes a submission, regardless of its query string; only a POST
+// request (the form's own submission) does.
+export const answer = async (
+  _: any, search: string, method: string
+): Promise<{status: string; message?: string; answerPage?: string}> => {
+  const searchParams = new URLSearchParams(search);
+  const authCode = searchParams?.get('authCode');
+  // Each selected checkbox's value is `${sourceName}\t${encodeURIComponent(content)}`.
+  // Content, rather than time stamp, identifies a note, because no two notes in the same
+  // source ever share content: checkCommentDuplicate rejects a submission identical to
+  // one already on file. Content is percent-encoded, and split out at the first tab
+  // only, because comment and feature-request content is not stripped of tab characters
+  // (see the sanitize functions in web/tutorialWeb/index.ts and web/tutorialAI/index.ts),
+  // so an unencoded tab within the content itself could otherwise be mistaken for the
+  // delimiter between the source name and the content.
+  const selections = searchParams?.getAll('note');
+  // If the form has been submitted and any notes are to be deleted:
+  if (method === 'POST' && selections?.length) {
+    // If the authorization code is valid:
+    if (isValidAuthCode(authCode)) {
+      try {
+        // Group the selected content by source.
+        const contentBySource = new Map<string, Set<string>>();
+        for (const selection of selections) {
+          const tabIndex = selection.indexOf('\t');
+          const sourceName = selection.slice(0, tabIndex);
+          const content = decodeURIComponent(selection.slice(tabIndex + 1));
+          if (!contentBySource.has(sourceName)) {
+            contentBySource.set(sourceName, new Set());
+          }
+          contentBySource.get(sourceName)!.add(content);
+        }
+        // For each source with any selected notes:
+        for (const source of noteSources) {
+          const contentSet = contentBySource.get(source.name);
+          if (!contentSet) {
+            continue;
+          }
+          // Remove the selected notes and save the rest.
+          const notes = await getNotes(source);
+          const remaining = notes.filter(note => !contentSet.has(note.content));
+          await fs.mkdir(path.dirname(source.getPath()), {recursive: true});
+          await fs.writeFile(source.getPath(), getJSON(remaining));
+        }
+      }
+      // If this failed:
+      catch (error: unknown) {
+        // Return why.
+        return {
+          status: 'error',
+          message: `Deleting notes failed (${errorMessage(error)})`
+        };
+      }
+    }
+    // Otherwise, i.e. if the authorization code is invalid:
+    else {
+      // Report the error, deliberately vague so as not to confirm to an attacker that the
+      // authorization code specifically (as opposed to some other part of the request) is
+      // what was wrong.
+      return {
+        status: 'error',
+        message: 'Invalid request'
+      };
+    }
+  }
+  const lines: string[] = [];
+  const margin = ' '.repeat(12);
+  let anyNotes = false;
+  // For each source, in display order:
+  for (const source of noteSources) {
+    const notes = await getNotes(source);
+    // For each of its notes, oldest first:
+    for (const note of notes) {
+      anyNotes = true;
+      const value = `${source.name}\t${encodeURIComponent(note.content)}`;
+      const when = getDateTimeString(note.timeStamp);
+      lines.push(
+        `${margin}<p><input type="checkbox" name="note" value="${value}"> ` +
+        `<strong>${source.label}</strong> (${when}): ${getPlainText(note.content)}</p>`
+      );
+    }
+  }
+  const query: Record<string, string> = {
+    notes: lines.join('\n'),
+    intro: anyNotes ?
+      'Choose the comments and feature requests to delete.' :
+      'There are no comments or feature requests to delete.',
+    disabled: anyNotes ? '' : ' disabled'
+  };
+  // Return the populated page.
+  return {
+    status: 'ok',
+    answerPage: await populateTemplate(import.meta.dirname, query)
+  };
+};

package/web/enqueue/index.ts

@@ -6,54 +6,45 @@
 // IMPORTS
 
 import {
-  deleteTestRequests, getJSON, getNowStamp, getRandomString, isURL, jobsPath, populateTemplate
+  deleteTestRequests, getJSON, getNowStamp, getRandomString, jobsPath, populateTemplate
 } from '../../util.ts';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 
 // FUNCTIONS
 
-// Implements a test request approval and returns a revised request page.
-export const answer = async (url: string, description: string, authCode: string) => {
-  // If the arguments are valid:
-  if (isURL(url) && description && authCode === process.env.AUTH_CODE) {
-    // Get the job template.
-    const jobTemplateJSON = await fs.readFile(path.join(import.meta.dirname, '..', '..', 'job.json'), 'utf8');
-    const job = JSON.parse(jobTemplateJSON);
-    const nowStamp = getNowStamp();
-    // Populate the template with job properties.
-    const jobIDSuffix = getRandomString(3);
-    const jobName = `${nowStamp}-${jobIDSuffix}`;
-    job.id = jobName;
-    job.creationTimeStamp = nowStamp;
-    job.executionTimeStamp = nowStamp;
-    job.target.what = description;
-    job.target.url = url;
-    const query: Record<string, string> = {
-      target: description,
-      jobName
-    };
-    // Save the job in the queue.
-    await fs.writeFile(
-      path.join(jobsPath(), 'queue', `${jobName}.json`), getJSON(job)
-    );
-    console.log(`Retest queued for ${description} as job ${jobName}`);
-    // Delete the test requests for the target.
-    await deleteTestRequests(url);
-    // Get the populated answer template.
-    const answerPage = await populateTemplate(import.meta.dirname, query);
-    // Return the populated page.
-    return {
-      status: 'ok',
-      answerPage
-    };
-  }
-  // Otherwise, i.e. if the authorization code is invalid, return an error page. The
-  // message is deliberately vague so as not to confirm to an attacker that the
-  // authorization code specifically (as opposed to some other part of the request) is
-  // what was wrong.
+// Implements a test request approval and returns a revised request page. The caller
+// (index.ts, this function's only caller) has already validated the URL and
+// authorization code before invoking this function.
+export const answer = async (url: string, description: string) => {
+  // Get the job template.
+  const jobTemplateJSON = await fs.readFile(path.join(import.meta.dirname, '..', '..', 'job.json'), 'utf8');
+  const job = JSON.parse(jobTemplateJSON);
+  const nowStamp = getNowStamp();
+  // Populate the template with job properties.
+  const jobIDSuffix = getRandomString(3);
+  const jobName = `${nowStamp}-${jobIDSuffix}`;
+  job.id = jobName;
+  job.creationTimeStamp = nowStamp;
+  job.executionTimeStamp = nowStamp;
+  job.target.what = description;
+  job.target.url = url;
+  const query: Record<string, string> = {
+    target: description,
+    jobName
+  };
+  // Save the job in the queue.
+  await fs.writeFile(
+    path.join(jobsPath(), 'queue', `${jobName}.json`), getJSON(job)
+  );
+  console.log(`Retest queued for ${description} as job ${jobName}`);
+  // Delete the test requests for the target.
+  await deleteTestRequests(url);
+  // Get the populated answer template.
+  const answerPage = await populateTemplate(import.meta.dirname, query);
+  // Return the populated page.
   return {
-    status: 'error',
-    message: 'Invalid request'
+    status: 'ok',
+    answerPage
   };
 };

package/web/hideReportForm/index.ts

@@ -5,7 +5,9 @@
 
 // IMPORTS
 
-import {getReportExtracts, hiddenReportsPath, populateTemplate, reportsPath} from '../../util.ts';
+import {
+  getReportExtracts, hiddenReportsPath, isValidAuthCode, populateTemplate, reportsPath
+} from '../../util.ts';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 
@@ -20,7 +22,7 @@ export const answer = async (_: any, search: string, method: string) => {
   // If the form has been submitted and a report is to be hidden:
   if (method === 'POST' && jobName) {
     // If the authorization code is valid:
-    if (authCode === process.env.AUTH_CODE) {
+    if (isValidAuthCode(authCode)) {
       const fileName = `${jobName}.json`;
       try {
         // Move the specified report to the directory of hidden reports.

package/web/manage/index.html

@@ -16,6 +16,7 @@
       <p>Kilotest managers can:</p>
       <ul class="nav">
         <li><a href="/enqueueForm.html">Approve or reject a test recommendation</a></li>
+        <li><a href="/deleteNotesForm.html">Delete a comment or feature request</a></li>
         <li><a href="/reannotateForm.html">
           Reannotate reports to incorporate newly classified and reclassified rules
         </a></li>

package/web/metrics/index.ts

@@ -7,7 +7,8 @@
 // IMPORTS
 
 import {
-  clearMetrics, getDateTimeString, getExclusionCookieValue, getMetrics, metricsExclusionCookieName, populateTemplate
+  clearMetrics, getDateTimeString, getExclusionCookieValue, getMetrics, isValidAuthCode,
+  metricsExclusionCookieName, populateTemplate
 } from '../../util.ts';
 
 // FUNCTIONS
@@ -64,7 +65,7 @@ export const answer = async (_: any, search: string, method: string) => {
   // If the form has been submitted:
   if (method === 'POST') {
     // If the authorization code is invalid:
-    if (authCode !== process.env.AUTH_CODE) {
+    if (!isValidAuthCode(authCode)) {
       // Report the error, deliberately vague so as not to confirm to an attacker that the
       // authorization code specifically (as opposed to some other part of the request) is
       // what was wrong.

package/web/reannotate/index.ts

@@ -11,6 +11,7 @@ import {
   getReport,
   getReportPath,
   isReportError,
+  isValidAuthCode,
   readdirOrCreate,
   reportsPath
 } from '../../util.ts';
@@ -22,7 +23,7 @@ import path from 'node:path';
 // Implements a reannotation order and returns an acknowledgement page.
 export const answer = async (authCode: string) => {
   // If the authorization code is valid:
-  if (authCode === process.env.AUTH_CODE) {
+  if (isValidAuthCode(authCode)) {
     // Get the names of the stored report files.
     const reportFileNames = (await readdirOrCreate(reportsPath(), 'Reports directory'))
     .filter(fileName => fileName.endsWith('.json'));

package/web/renewWCAG/index.ts

@@ -7,14 +7,14 @@
 
 import fs from 'node:fs/promises';
 import path from 'node:path';
-import {getJSON} from '../../util.ts';
+import {getJSON, isValidAuthCode} from '../../util.ts';
 
 // FUNCTIONS
 
 // Renews the WCAG map and serves an acknowledgment.
 export const answer = async (authCode: string) => {
   // If the authorization code is valid:
-  if (authCode === process.env.AUTH_CODE) {
+  if (isValidAuthCode(authCode)) {
     // Get the map source response.
     const mapSourceResponse = await fetch('https://www.w3.org/WAI/WCAG22/Understanding/');
     const mapSourceStatus = mapSourceResponse.status;

package/web/reportDeletion.ts

@@ -6,7 +6,8 @@
 // IMPORTS
 
 import {
-  errorMessage, getReportData, objectSort, populateTemplate, readdirOrCreate, reportsPath
+  errorMessage, getReportData, isValidAuthCode, objectSort, populateTemplate, readdirOrCreate,
+  reportsPath
 } from '../util.ts';
 import fs from 'node:fs/promises';
 import path from 'node:path';
@@ -48,7 +49,7 @@ export const reportDeletionForm = async (
   // If the form has been submitted and any reports are to be deleted:
   if (method === 'POST' && jobNames?.length) {
     // If the authorization code is valid:
-    if (authCode === process.env.AUTH_CODE) {
+    if (isValidAuthCode(authCode)) {
       try {
         // For each report to be deleted:
         for (const jobName of jobNames) {

package/web/showHiddenReportsForm/index.ts

@@ -7,7 +7,7 @@
 
 // IMPORTS
 
-import {populateTemplate} from '../../util.ts';
+import {isValidAuthCode, populateTemplate} from '../../util.ts';
 import {answer as unhideReportForm} from '../unhideReportForm/index.ts';
 
 // FUNCTIONS
@@ -22,7 +22,7 @@ export const answer = async (pathTail: any, search: string, method: string) => {
   // If the form has been submitted:
   if (method === 'POST') {
     // If the authorization code is invalid:
-    if (authCode !== process.env.AUTH_CODE) {
+    if (!isValidAuthCode(authCode)) {
       // Report the error, deliberately vague so as not to confirm to an attacker that the
       // authorization code specifically (as opposed to some other part of the request) is
       // what was wrong.

package/web/tutorialAI/index.ts

@@ -6,7 +6,7 @@
 // IMPORTS
 
 import {sendAlert} from '../../alerts.ts';
-import {checkCommentLength, getJSON} from '../../util.ts';
+import {checkCommentDuplicate, checkCommentLength, getJSON, getNowStamp} from '../../util.ts';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 
@@ -56,18 +56,13 @@ export const handleComment = async (content: unknown) => {
     return {status: 'error', message: 'Comment is empty after sanitization'};
   }
   // Check for duplicate submissions within the last 1000 seconds.
-  const duplicates = comments
-  .filter(comment => new Date(comment.dateTime).getTime() > Date.now() - 1000000)
-  .filter(comment => comment.content === sanitized);
-  if (duplicates.length) {
-    return {
-      status: 'error',
-      message: 'Your comment repeats a recently submitted one, but you are welcome to submit a different comment'
-    };
+  const duplicateCheck = checkCommentDuplicate(comments, sanitized);
+  if (duplicateCheck.status === 'error') {
+    return duplicateCheck;
   }
-  // Add the comment to the existing ones, using dateTime format.
+  // Add the comment to the existing ones.
   comments.push({
-    dateTime: new Date().toISOString(),
+    timeStamp: getNowStamp(),
     content: sanitized
   });
   // Ensure the comments directory exists.

package/web/tutorialAI/tutorialAI.test.ts

@@ -14,6 +14,12 @@ import path from 'node:path';
 
 const testDir = path.join(import.meta.dirname, '../../test/fixtures/comments');
 process.env.TUTORIAL_AI_COMMENTS_PATH = path.join(testDir, 'tutorialAI.json');
+// Blank the alert configuration unconditionally, before index.ts (whose handleComment
+// calls sendAlert for a new comment) is ever imported below, so this file sends no real
+// alert emails even when run directly rather than via `npm test`.
+for (const key of ['MANAGER_EMAIL', 'ALERT_API_HOST', 'ALERT_API_PATH', 'ALERT_API_KEY', 'ALERT_FROM']) {
+  process.env[key] = '';
+}
 
 import {answer, handleComment} from './index.ts';
 
@@ -71,7 +77,7 @@ test('handleComment returns an error for a comment longer than 1000 characters',
   assert.equal(result.message, 'Your comment was longer than 1000 characters');
 });
 
-test('handleComment returns an error for a comment repeating one submitted within the last 1000 seconds', {timeout: 500}, async () => {
+test('handleComment returns an error for a comment identical to one already submitted', {timeout: 500}, async () => {
   await fs.writeFile(getCommentsPath(), '[]\n');
   const content = 'This is a duplicate comment.';
   const firstResult = await handleComment(content);
@@ -80,7 +86,7 @@ test('handleComment returns an error for a comment repeating one submitted withi
   assert.equal(secondResult.status, 'error');
   assert.equal(
     secondResult.message,
-    'Your comment repeats a recently submitted one, but you are welcome to submit a different comment'
+    'Your comment is identical to one already submitted, but you are welcome to submit a different comment'
   );
 });
 
@@ -91,7 +97,7 @@ test('handleComment saves a sanitized comment and returns ok', {timeout: 500}, a
   const comments = JSON.parse(await fs.readFile(getCommentsPath(), 'utf8'));
   assert.equal(comments.length, 1);
   assert.equal(comments[0].content, 'This is a test comment.');
-  assert.ok(comments[0].dateTime);
+  assert.ok(comments[0].timeStamp);
 });
 
 test('handleComment strips HTML tags and control characters', {timeout: 500}, async () => {

package/web/tutorialWeb/tutorialWeb.test.ts

@@ -14,6 +14,12 @@ import path from 'node:path';
 
 const testDir = path.join(import.meta.dirname, '../../test/fixtures/comments');
 process.env.TUTORIAL_WEB_COMMENTS_PATH = path.join(testDir, 'tutorialWeb.json');
+// Blank the alert configuration unconditionally, before index.ts (whose handleComment
+// calls sendAlert for a new comment) is ever imported below, so this file sends no real
+// alert emails even when run directly rather than via `npm test`.
+for (const key of ['MANAGER_EMAIL', 'ALERT_API_HOST', 'ALERT_API_PATH', 'ALERT_API_KEY', 'ALERT_FROM']) {
+  process.env[key] = '';
+}
 
 import {answer, handleComment} from './index.ts';
 
@@ -73,7 +79,7 @@ test('handleComment returns an error for a comment longer than 1000 characters',
   assert.equal(result.message, 'Your comment was longer than 1000 characters');
 });
 
-test('handleComment returns an error for a comment repeating one submitted within the last 1000 seconds', {timeout: 500}, async () => {
+test('handleComment returns an error for a comment identical to one already submitted', {timeout: 500}, async () => {
   await fs.writeFile(getCommentsPath(), '[]\n');
   const content = 'This is a duplicate comment.';
   const firstResult = await handleComment(content);
@@ -82,7 +88,7 @@ test('handleComment returns an error for a comment repeating one submitted withi
   assert.equal(secondResult.status, 'error');
   assert.equal(
     secondResult.message,
-    'Your comment repeats a recently submitted one, but you are welcome to submit a different comment'
+    'Your comment is identical to one already submitted, but you are welcome to submit a different comment'
   );
 });
 

package/web/unhideReportForm/index.ts

@@ -5,7 +5,9 @@
 
 // IMPORTS
 
-import {hiddenReportsPath, populateTemplate, readdirOrCreate, reportsPath} from '../../util.ts';
+import {
+  hiddenReportsPath, isValidAuthCode, populateTemplate, readdirOrCreate, reportsPath
+} from '../../util.ts';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 
@@ -20,7 +22,7 @@ export const answer = async (_: any, search: string, method: string) => {
   // If the form has been submitted and a report is to be unhidden:
   if (method === 'POST' && jobName) {
     // If the authorization code is valid:
-    if (authCode === process.env.AUTH_CODE) {
+    if (isValidAuthCode(authCode)) {
       const fileName = `${jobName}.json`;
       try {
         // Move the report to the reports directory.

package/.claude/scheduled_tasks.lock

@@ -1 +0,0 @@
-{"sessionId":"f44e6b44-375e-4007-879a-19e4e5ed34a0","pid":90042,"procStart":"Sun Sep 20 03:19:03 2026","acquiredAt":1789874948676}