@jrpool/kilotest 50.0.0 → 52.0.0

package/util.ts

@@ -12,7 +12,9 @@ import {sendAlert} from './alerts.ts';
 import {issues as issueSpecs, rules as ruleSpecs} from 'testaro-issues';
 import type {Act, Catalog, Report, StandardInstance} from 'testaro';
 import crypto from 'node:crypto';
+import dns from 'node:dns/promises';
 import fs from 'node:fs/promises';
+import net from 'node:net';
 import path from 'node:path';
 import querystring from 'node:querystring';
 /* c8 ignore stop */
@@ -207,27 +209,22 @@ export const checkCommentLength = (
   }
   return {status: 'ok'};
 };
-// Returns whether a comment repeats, verbatim, one of the given comments submitted
-// within the last 1000 seconds. Comment time stamps use Kilotest's own timeStamp
-// format (see getTimeStamp), not an ISO date-time string, so this integrates with
-// the same comments.json shape that web/tutorial/index.ts already uses. The content
-// passed in should be the content as it will be stored (e.g. after sanitization),
-// so that it is compared on the same basis as the stored comments.
+// Returns whether a comment repeats, verbatim, one of the given comments, regardless
+// of when the earlier one was submitted: a legitimate need to resubmit exactly the
+// same content never arises (the near-term case is a browser "Back" resubmission),
+// so storing a second copy would only ever be redundant. The content passed in
+// should be the content as it will be stored (e.g. after sanitization), so that it
+// is compared on the same basis as the stored comments. Content, not any time
+// stamp, is what this checks and what identifies a comment as unique.
 export const checkCommentDuplicate = (
-  comments: {timeStamp: string; content: string}[], content: string
+  comments: {content: string}[], content: string
 ): {status: 'ok'} | {status: 'error'; message: string} => {
-  // Get the comments submitted within the last 1000 seconds with the same content.
-  // Comment time stamps are always valid, because this codebase is the sole writer
-  // of comments.json.
-  const duplicates = comments
-  .filter(comment => getDateTime(comment.timeStamp)!.getTime() > Date.now() - 1000000)
-  .filter(comment => comment.content === content);
-  // If the comment duplicates a recent one:
-  if (duplicates.length) {
+  // If the comment duplicates one already stored:
+  if (comments.some(comment => comment.content === content)) {
     // Return this.
     return {
       status: 'error',
-      message: 'Your comment repeats a recently submitted one, but you are welcome to submit a different comment'
+      message: 'Your comment is identical to one already submitted, but you are welcome to submit a different comment'
     };
   }
   // Otherwise, the comment is not a duplicate.
@@ -554,6 +551,95 @@ export const isURL = (string: string): boolean => {
     return false;
   }
 };
+// Returns whether an IPv4 address (in dotted-decimal form) is in a private,
+// loopback, link-local, or otherwise non-public range, including the
+// 169.254.169.254 cloud-metadata address (which falls under link-local).
+const isNonPublicIPv4 = (address: string): boolean => {
+  const octets = address.split('.').map(Number);
+  const [a, b = 0] = octets;
+  return (
+    a === 127 || // loopback
+    a === 10 || // private
+    a === 0 || // "this network"
+    (a === 172 && b >= 16 && b <= 31) || // private
+    (a === 192 && b === 168) || // private
+    (a === 169 && b === 254) || // link-local, incl. cloud metadata
+    (a === 100 && b >= 64 && b <= 127) // carrier-grade NAT
+  );
+};
+// Returns whether an IPv6 address is in a loopback, unique-local, or
+// link-local range.
+const isNonPublicIPv6 = (address: string): boolean => {
+  const normalized = address.toLowerCase();
+  return (
+    normalized === '::1' // loopback
+    || normalized === '::' // unspecified
+    || /^::ffff:/.test(normalized) && isNonPublicIPv4(normalized.replace(/^::ffff:/, '')) // IPv4-mapped
+    || /^f[cd][0-9a-f]{2}:/.test(normalized) // unique local (fc00::/7)
+    || /^fe[89ab][0-9a-f]:/.test(normalized) // link-local (fe80::/10)
+  );
+};
+// Returns whether an IP address (v4 or v6) is outside the public address
+// space, i.e. is a loopback, private, link-local, or other reserved address
+// that a public deployment should never intend to test.
+const isNonPublicIP = (address: string): boolean => {
+  const version = net.isIP(address);
+  if (version === 4) {
+    return isNonPublicIPv4(address);
+  }
+  if (version === 6) {
+    return isNonPublicIPv6(address);
+  }
+  // Not a recognizable IP address, so treat it as non-public, i.e. as unsafe.
+  return true;
+};
+// Returns whether ALLOW_INTERNAL_TARGETS opts this deployment in to testing
+// pages at private, loopback, or link-local addresses. A deployment that
+// intentionally runs a Testaro worker inside a private network to test
+// intranet pages sets this to "true"; a public deployment, whose Testaro
+// workers may run on hosts with access to their own cloud metadata service,
+// leaves it unset so private addresses are rejected by default (fail safe).
+const allowsInternalTargets = (): boolean => process.env.ALLOW_INTERNAL_TARGETS === 'true';
+// The signature of dns.lookup with {all: true}, extracted so tests can inject
+// a fake resolver and avoid depending on real network/DNS access.
+type LookupAll = (hostname: string, options: {all: true}) => Promise<{address: string; family: number}[]>;
+// Returns whether the host a URL resolves to consists only of addresses this
+// deployment is configured to allow as testing targets. This governs where
+// the Testaro browser is allowed to navigate, so it is the control against
+// submitting (or, via a redirect, being routed to) an unintended internal
+// target such as a cloud metadata service or another host on a private
+// network. It is deliberately independent of the syntax check that isURL
+// performs, because it requires a DNS lookup, and therefore an internal
+// deployment can use it to check both a requested URL (at submission time)
+// and the actual, possibly redirected, URL of a report (at report-ingestion
+// time). The lookup parameter defaults to the real dns.lookup and exists so
+// tests can inject a fake resolver.
+export const isAllowedTarget = async (url: string, lookup: LookupAll = dns.lookup): Promise<boolean> => {
+  // If this deployment allows internal targets, every syntactically valid URL is allowed.
+  if (allowsInternalTargets()) {
+    return true;
+  }
+  let hostname: string;
+  try {
+    hostname = new URL(url).hostname;
+  } catch {
+    return false;
+  }
+  // If the hostname is itself a literal IP address, check it directly.
+  if (net.isIP(hostname)) {
+    return !isNonPublicIP(hostname);
+  }
+  // Otherwise, resolve the hostname and reject it if any address it resolves
+  // to is non-public, since a hostname can resolve to more than one address
+  // and an attacker need control only one of them.
+  try {
+    const addresses = await lookup(hostname, {all: true});
+    return addresses.length > 0 && addresses.every(({address}) => !isNonPublicIP(address));
+  } catch {
+    // An unresolvable hostname cannot be a usable testing target either way.
+    return false;
+  }
+};
 // Returns whether a string is the authorization code, the shared check every
 // manager-facing page and action uses to gate a submission. Centralized so all call
 // sites compare against process.env.AUTH_CODE the same way.
@@ -606,6 +692,31 @@ export const deleteTestRequests = (url: string) => testRequestsLock(async (): Pr
 // Returns the test acts of a report.
 export const getTestActs = (report: UsableReport): AnnotatedAct[] =>
   report.acts.filter(act => act.type === 'test');
+// Returns whether all URLs actually visited for a report are allowed targets.
+// A URL submitted for testing can pass isAllowedTarget at submission time and
+// still result in a report on a disallowed target, because the browser
+// running in a worker can be redirected (possibly through DNS rebinding, so
+// the same hostname resolves differently at fetch time) to a host this
+// deployment does not allow as a testing target. Since each test act records
+// the URL it actually visited (actualURL, defaulting to the requested URL of
+// the job if a tool did not report one), checking every act here, right
+// before a report is stored or served, is what actually closes that gap,
+// independently of whatever happened during navigation.
+export const isAllowedReport = async (
+  report: Partial<Report>, lookup: LookupAll = dns.lookup
+): Promise<boolean> => {
+  const acts = Array.isArray(report.acts) ? report.acts : [];
+  const testActs = acts.filter((act): act is AnnotatedAct => act?.type === 'test');
+  const urlsVisited = new Set(
+    testActs.map(act => act.actualURL ?? report.target?.url).filter((url): url is string => !!url)
+  );
+  for (const url of urlsVisited) {
+    if (!(await isAllowedTarget(url, lookup))) {
+      return false;
+    }
+  }
+  return true;
+};
 // Returns the standard instances of a report's test acts, optionally filtered.
 export const getTestActInstances = (
   report: UsableReport,

package/web/deleteNotesForm/deleteNotesForm.test.ts

@@ -0,0 +1,237 @@
+/*
+  deleteNotesForm.test.ts
+  Unit tests for web/deleteNotesForm/index.ts.
+*/
+
+// IMPORTS
+
+import {test, before, beforeEach, after} from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+
+// ENVIRONMENT
+
+const testDir = path.join(import.meta.dirname, '../../test/fixtures/deleteNotesForm');
+const tutorialWebPath = path.join(testDir, 'tutorialWeb.json');
+const tutorialAIPath = path.join(testDir, 'tutorialAI.json');
+const featureRequestsPath = path.join(testDir, 'featureRequests.json');
+
+const savedAuthCode = process.env.AUTH_CODE;
+const savedTutorialWebPath = process.env.TUTORIAL_WEB_COMMENTS_PATH;
+const savedTutorialAIPath = process.env.TUTORIAL_AI_COMMENTS_PATH;
+const savedFeatureRequestsPath = process.env.FEATURE_REQUESTS_PATH;
+
+before(async () => {
+  process.env.AUTH_CODE = 'test-auth-code';
+  process.env.TUTORIAL_WEB_COMMENTS_PATH = tutorialWebPath;
+  process.env.TUTORIAL_AI_COMMENTS_PATH = tutorialAIPath;
+  process.env.FEATURE_REQUESTS_PATH = featureRequestsPath;
+  await fs.mkdir(testDir, {recursive: true});
+});
+
+beforeEach(async () => {
+  await fs.writeFile(tutorialWebPath, JSON.stringify([
+    {timeStamp: '260101T0000', content: 'A web tutorial comment'}
+  ]));
+  await fs.writeFile(tutorialAIPath, JSON.stringify([
+    {timeStamp: '260102T0000', content: 'An AI tutorial comment'}
+  ]));
+  await fs.writeFile(featureRequestsPath, JSON.stringify([
+    {timeStamp: '260103T0000', content: 'A feature request'}
+  ]));
+});
+
+import {answer} from './index.ts';
+
+after(async () => {
+  if (savedAuthCode !== undefined) {
+    process.env.AUTH_CODE = savedAuthCode;
+  }
+  if (savedTutorialWebPath !== undefined) {
+    process.env.TUTORIAL_WEB_COMMENTS_PATH = savedTutorialWebPath;
+  } else {
+    delete process.env.TUTORIAL_WEB_COMMENTS_PATH;
+  }
+  if (savedTutorialAIPath !== undefined) {
+    process.env.TUTORIAL_AI_COMMENTS_PATH = savedTutorialAIPath;
+  } else {
+    delete process.env.TUTORIAL_AI_COMMENTS_PATH;
+  }
+  if (savedFeatureRequestsPath !== undefined) {
+    process.env.FEATURE_REQUESTS_PATH = savedFeatureRequestsPath;
+  } else {
+    delete process.env.FEATURE_REQUESTS_PATH;
+  }
+  await fs.rm(testDir, {recursive: true, force: true});
+});
+
+// TESTS
+
+test('deleteNotesForm lists notes from all three sources on a GET request', async () => {
+  const result = await answer(null, '', 'GET');
+  assert.equal(result.status, 'ok');
+  assert.ok(result.answerPage!.includes('A web tutorial comment'));
+  assert.ok(result.answerPage!.includes('An AI tutorial comment'));
+  assert.ok(result.answerPage!.includes('A feature request'));
+});
+
+test('deleteNotesForm ignores a note query string on a GET request', async () => {
+  const result = await answer(
+    null,
+    `authCode=test-auth-code&note=tutorialWeb%09${encodeURIComponent('A web tutorial comment')}`,
+    'GET'
+  );
+  assert.equal(result.status, 'ok');
+  // The note should NOT have been deleted by a mere GET request.
+  const notes = JSON.parse(await fs.readFile(tutorialWebPath, 'utf8'));
+  assert.equal(notes.length, 1);
+});
+
+test('deleteNotesForm returns an error for an invalid auth code on a POST request', async () => {
+  const result = await answer(
+    null,
+    `authCode=wrong&note=tutorialWeb%09${encodeURIComponent('A web tutorial comment')}`,
+    'POST'
+  );
+  assert.equal(result.status, 'error');
+  assert.equal(result.message, 'Invalid request');
+  const notes = JSON.parse(await fs.readFile(tutorialWebPath, 'utf8'));
+  assert.equal(notes.length, 1);
+});
+
+test('deleteNotesForm deletes a selected web tutorial comment with a valid auth code', async () => {
+  const result = await answer(
+    null,
+    `authCode=test-auth-code&note=tutorialWeb%09${encodeURIComponent('A web tutorial comment')}`,
+    'POST'
+  );
+  assert.equal(result.status, 'ok');
+  const notes = JSON.parse(await fs.readFile(tutorialWebPath, 'utf8'));
+  assert.equal(notes.length, 0);
+  // The other sources are untouched.
+  const aiNotes = JSON.parse(await fs.readFile(tutorialAIPath, 'utf8'));
+  assert.equal(aiNotes.length, 1);
+});
+
+test('deleteNotesForm deletes selected notes across multiple sources in one submission', async () => {
+  const result = await answer(
+    null,
+    'authCode=test-auth-code' +
+      `&note=tutorialWeb%09${encodeURIComponent('A web tutorial comment')}` +
+      `&note=tutorialAI%09${encodeURIComponent('An AI tutorial comment')}` +
+      `&note=featureRequest%09${encodeURIComponent('A feature request')}`,
+    'POST'
+  );
+  assert.equal(result.status, 'ok');
+  assert.equal(JSON.parse(await fs.readFile(tutorialWebPath, 'utf8')).length, 0);
+  assert.equal(JSON.parse(await fs.readFile(tutorialAIPath, 'utf8')).length, 0);
+  assert.equal(JSON.parse(await fs.readFile(featureRequestsPath, 'utf8')).length, 0);
+});
+
+test('deleteNotesForm leaves unselected notes in a source intact', async () => {
+  await fs.writeFile(tutorialWebPath, JSON.stringify([
+    {timeStamp: '260101T0000', content: 'Keep this one'},
+    {timeStamp: '260101T0001', content: 'Delete this one'}
+  ]));
+  const result = await answer(
+    null,
+    `authCode=test-auth-code&note=tutorialWeb%09${encodeURIComponent('Delete this one')}`,
+    'POST'
+  );
+  assert.equal(result.status, 'ok');
+  const notes = JSON.parse(await fs.readFile(tutorialWebPath, 'utf8'));
+  assert.equal(notes.length, 1);
+  assert.equal(notes[0].content, 'Keep this one');
+});
+
+test('deleteNotesForm reports no notes to delete when all sources are empty', async () => {
+  await fs.writeFile(tutorialWebPath, '[]');
+  await fs.writeFile(tutorialAIPath, '[]');
+  await fs.writeFile(featureRequestsPath, '[]');
+  const result = await answer(null, '', 'GET');
+  assert.equal(result.status, 'ok');
+  assert.ok(result.answerPage!.includes('There are no comments or feature requests to delete.'));
+});
+
+test('deleteNotesForm treats a missing source file as having no notes', async () => {
+  await fs.rm(featureRequestsPath, {force: true});
+  const result = await answer(null, '', 'GET');
+  assert.equal(result.status, 'ok');
+  assert.ok(result.answerPage!.includes('A web tutorial comment'));
+});
+
+test('deleteNotesForm escapes note content to prevent HTML injection', async () => {
+  await fs.writeFile(tutorialWebPath, JSON.stringify([
+    {timeStamp: '260101T0000', content: '<script>alert(1)</script>'}
+  ]));
+  const result = await answer(null, '', 'GET');
+  assert.equal(result.status, 'ok');
+  assert.ok(!result.answerPage!.includes('<script>'));
+});
+
+test('deleteNotesForm deletes a note whose content contains a literal tab character', async () => {
+  const content = 'Line one\tLine two, after an embedded tab';
+  await fs.writeFile(tutorialWebPath, JSON.stringify([
+    {timeStamp: '260101T0000', content}
+  ]));
+  const result = await answer(
+    null, `authCode=test-auth-code&note=tutorialWeb%09${encodeURIComponent(content)}`, 'POST'
+  );
+  assert.equal(result.status, 'ok');
+  const notes = JSON.parse(await fs.readFile(tutorialWebPath, 'utf8'));
+  assert.equal(notes.length, 0);
+});
+
+test('deleteNotesForm renders a checkbox value that round-trips a note with a literal tab', async () => {
+  const content = 'Has\ta\ttab';
+  await fs.writeFile(tutorialWebPath, JSON.stringify([
+    {timeStamp: '260101T0000', content}
+  ]));
+  const result = await answer(null, '', 'GET');
+  assert.equal(result.status, 'ok');
+  assert.ok(result.answerPage!.includes(`tutorialWeb\t${encodeURIComponent(content)}`));
+});
+
+test('deleteNotesForm returns an error when a note file cannot be written', async () => {
+  // Point the web tutorial comments path at a location whose parent is a file, so that
+  // creating the directory for it fails.
+  const blockerFile = path.join(testDir, 'blocker');
+  const unwritablePath = path.join(blockerFile, 'tutorialWeb.json');
+  await fs.writeFile(blockerFile, 'not a directory');
+  const savedPath = process.env.TUTORIAL_WEB_COMMENTS_PATH;
+  process.env.TUTORIAL_WEB_COMMENTS_PATH = unwritablePath;
+  try {
+    const result = await answer(
+      null,
+      `authCode=test-auth-code&note=tutorialWeb%09${encodeURIComponent('A web tutorial comment')}`,
+      'POST'
+    );
+    assert.equal(result.status, 'error');
+    assert.ok(result.message?.includes('Deleting notes failed'));
+  } finally {
+    process.env.TUTORIAL_WEB_COMMENTS_PATH = savedPath;
+    await fs.unlink(blockerFile).catch(() => {});
+  }
+});
+
+test('deleteNotesForm falls back to default paths when environment variables are not set', async () => {
+  const saved = {
+    tutorialWeb: process.env.TUTORIAL_WEB_COMMENTS_PATH,
+    tutorialAI: process.env.TUTORIAL_AI_COMMENTS_PATH,
+    featureRequest: process.env.FEATURE_REQUESTS_PATH
+  };
+  delete process.env.TUTORIAL_WEB_COMMENTS_PATH;
+  delete process.env.TUTORIAL_AI_COMMENTS_PATH;
+  delete process.env.FEATURE_REQUESTS_PATH;
+  try {
+    // None of the default db/ files exist in this environment, so the form should
+    // still render, treating each missing source as having no notes.
+    const result = await answer(null, '', 'GET');
+    assert.equal(result.status, 'ok');
+  } finally {
+    process.env.TUTORIAL_WEB_COMMENTS_PATH = saved.tutorialWeb;
+    process.env.TUTORIAL_AI_COMMENTS_PATH = saved.tutorialAI;
+    process.env.FEATURE_REQUESTS_PATH = saved.featureRequest;
+  }
+});

package/web/deleteNotesForm/index.html

@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html lang="en-US">
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <meta name="publisher" content="Jonathan Robert Pool">
+    <meta name="creator" content="Jonathan Robert Pool">
+    <meta name="keywords" content="report,accessibility,a11y">
+    <title>Delete notes | Kilotest</title>
+    <link rel="icon" href="/favicon.ico">
+    <link rel="stylesheet" href="/style.css">
+  </head>
+  <body>
+    <main>
+      <h1><a href="/">Kilotest</a>: Delete notes</h1>
+      <p>__intro__</p>
+      <form action="/deleteNotesForm.html" method="post">
+        <fieldset>
+          <legend>Notes</legend>
+          __notes__
+        </fieldset>
+        <p><label>
+          Authorization code: <input size="3" minLength="3" maxlength="3" name="authCode" required__disabled__>
+        </label></p>
+        <p><button type="submit"__disabled__>Submit</button></p>
+      </form>
+    </main>
+  </body>
+</html>

package/web/deleteNotesForm/index.ts

@@ -0,0 +1,167 @@
+/*
+  index.ts
+  Serves a form for deleting web tutorial comments, AI tutorial comments, and MCP
+  feature requests, the three kinds of notes that Kilotest records to flat JSON files
+  rather than presenting through any other manager page.
+*/
+
+// IMPORTS
+
+import {errorMessage, getDateTimeString, getJSON, getPlainText, isValidAuthCode, populateTemplate} from '../../util.ts';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+
+// TYPES
+
+// A note (comment or feature request) as stored in one of the note files.
+type Note = {
+  timeStamp: string;
+  content: string;
+};
+
+// The source of a kind of note, identifying its file and how it is labeled.
+type NoteSource = {
+  name: string;
+  label: string;
+  getPath: () => string;
+};
+
+// CONSTANTS
+
+// The note sources, in the order they are listed on the form. Each source's path is
+// read afresh on every call, via its own environment-variable override, exactly as
+// web/tutorialWeb/index.ts and web/tutorialAI/index.ts already do for their own
+// comment files, so that tests can point any of them at a fixture path.
+const noteSources: NoteSource[] = [
+  {
+    name: 'tutorialWeb',
+    label: 'Web tutorial comment',
+    getPath: () => process.env.TUTORIAL_WEB_COMMENTS_PATH ||
+      path.join(import.meta.dirname, '../../db/comments/tutorialWeb.json')
+  },
+  {
+    name: 'tutorialAI',
+    label: 'AI tutorial comment',
+    getPath: () => process.env.TUTORIAL_AI_COMMENTS_PATH ||
+      path.join(import.meta.dirname, '../../db/comments/tutorialAI.json')
+  },
+  {
+    name: 'featureRequest',
+    label: 'MCP feature request',
+    getPath: () => process.env.FEATURE_REQUESTS_PATH ||
+      path.join(import.meta.dirname, '../../db/featureRequests.json')
+  }
+];
+
+// FUNCTIONS (helpers)
+
+// Returns the notes in a source's file, or an empty array if it does not exist.
+const getNotes = async (source: NoteSource): Promise<Note[]> => {
+  try {
+    const existing = await fs.readFile(source.getPath(), 'utf8');
+    return JSON.parse(existing);
+  }
+  catch {
+    return [];
+  }
+};
+
+// FUNCTIONS
+
+// Returns a form for deleting selected notes, or, on a POST request with a valid
+// authorization code, deletes the selected notes and returns the form again. A GET
+// request never processes a submission, regardless of its query string; only a POST
+// request (the form's own submission) does.
+export const answer = async (
+  _: any, search: string, method: string
+): Promise<{status: string; message?: string; answerPage?: string}> => {
+  const searchParams = new URLSearchParams(search);
+  const authCode = searchParams?.get('authCode');
+  // Each selected checkbox's value is `${sourceName}\t${encodeURIComponent(content)}`.
+  // Content, rather than time stamp, identifies a note, because no two notes in the same
+  // source ever share content: checkCommentDuplicate rejects a submission identical to
+  // one already on file. Content is percent-encoded, and split out at the first tab
+  // only, because comment and feature-request content is not stripped of tab characters
+  // (see the sanitize functions in web/tutorialWeb/index.ts and web/tutorialAI/index.ts),
+  // so an unencoded tab within the content itself could otherwise be mistaken for the
+  // delimiter between the source name and the content.
+  const selections = searchParams?.getAll('note');
+  // If the form has been submitted and any notes are to be deleted:
+  if (method === 'POST' && selections?.length) {
+    // If the authorization code is valid:
+    if (isValidAuthCode(authCode)) {
+      try {
+        // Group the selected content by source.
+        const contentBySource = new Map<string, Set<string>>();
+        for (const selection of selections) {
+          const tabIndex = selection.indexOf('\t');
+          const sourceName = selection.slice(0, tabIndex);
+          const content = decodeURIComponent(selection.slice(tabIndex + 1));
+          if (!contentBySource.has(sourceName)) {
+            contentBySource.set(sourceName, new Set());
+          }
+          contentBySource.get(sourceName)!.add(content);
+        }
+        // For each source with any selected notes:
+        for (const source of noteSources) {
+          const contentSet = contentBySource.get(source.name);
+          if (!contentSet) {
+            continue;
+          }
+          // Remove the selected notes and save the rest.
+          const notes = await getNotes(source);
+          const remaining = notes.filter(note => !contentSet.has(note.content));
+          await fs.mkdir(path.dirname(source.getPath()), {recursive: true});
+          await fs.writeFile(source.getPath(), getJSON(remaining));
+        }
+      }
+      // If this failed:
+      catch (error: unknown) {
+        // Return why.
+        return {
+          status: 'error',
+          message: `Deleting notes failed (${errorMessage(error)})`
+        };
+      }
+    }
+    // Otherwise, i.e. if the authorization code is invalid:
+    else {
+      // Report the error, deliberately vague so as not to confirm to an attacker that the
+      // authorization code specifically (as opposed to some other part of the request) is
+      // what was wrong.
+      return {
+        status: 'error',
+        message: 'Invalid request'
+      };
+    }
+  }
+  const lines: string[] = [];
+  const margin = ' '.repeat(12);
+  let anyNotes = false;
+  // For each source, in display order:
+  for (const source of noteSources) {
+    const notes = await getNotes(source);
+    // For each of its notes, oldest first:
+    for (const note of notes) {
+      anyNotes = true;
+      const value = `${source.name}\t${encodeURIComponent(note.content)}`;
+      const when = getDateTimeString(note.timeStamp);
+      lines.push(
+        `${margin}<p><input type="checkbox" name="note" value="${value}"> ` +
+        `<strong>${source.label}</strong> (${when}): ${getPlainText(note.content)}</p>`
+      );
+    }
+  }
+  const query: Record<string, string> = {
+    notes: lines.join('\n'),
+    intro: anyNotes ?
+      'Choose the comments and feature requests to delete.' :
+      'There are no comments or feature requests to delete.',
+    disabled: anyNotes ? '' : ' disabled'
+  };
+  // Return the populated page.
+  return {
+    status: 'ok',
+    answerPage: await populateTemplate(import.meta.dirname, query)
+  };
+};

package/web/manage/index.html

@@ -16,6 +16,7 @@
       <p>Kilotest managers can:</p>
       <ul class="nav">
         <li><a href="/enqueueForm.html">Approve or reject a test recommendation</a></li>
+        <li><a href="/deleteNotesForm.html">Delete a comment or feature request</a></li>
         <li><a href="/reannotateForm.html">
           Reannotate reports to incorporate newly classified and reclassified rules
         </a></li>

package/web/tutorialAI/index.ts

@@ -6,7 +6,7 @@
 // IMPORTS
 
 import {sendAlert} from '../../alerts.ts';
-import {checkCommentLength, getJSON} from '../../util.ts';
+import {checkCommentDuplicate, checkCommentLength, getJSON, getNowStamp} from '../../util.ts';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 
@@ -56,18 +56,13 @@ export const handleComment = async (content: unknown) => {
     return {status: 'error', message: 'Comment is empty after sanitization'};
   }
   // Check for duplicate submissions within the last 1000 seconds.
-  const duplicates = comments
-  .filter(comment => new Date(comment.dateTime).getTime() > Date.now() - 1000000)
-  .filter(comment => comment.content === sanitized);
-  if (duplicates.length) {
-    return {
-      status: 'error',
-      message: 'Your comment repeats a recently submitted one, but you are welcome to submit a different comment'
-    };
+  const duplicateCheck = checkCommentDuplicate(comments, sanitized);
+  if (duplicateCheck.status === 'error') {
+    return duplicateCheck;
   }
-  // Add the comment to the existing ones, using dateTime format.
+  // Add the comment to the existing ones.
   comments.push({
-    dateTime: new Date().toISOString(),
+    timeStamp: getNowStamp(),
     content: sanitized
   });
   // Ensure the comments directory exists.