@jrpool/kilotest 51.1.0 → 55.0.0

package/util.ts

@@ -12,7 +12,10 @@ import {sendAlert} from './alerts.ts';
 import {issues as issueSpecs, rules as ruleSpecs} from 'testaro-issues';
 import type {Act, Catalog, Report, StandardInstance} from 'testaro';
 import crypto from 'node:crypto';
+import dns from 'node:dns/promises';
 import fs from 'node:fs/promises';
+import ipaddr from 'ipaddr.js';
+import net from 'node:net';
 import path from 'node:path';
 import querystring from 'node:querystring';
 /* c8 ignore stop */
@@ -77,7 +80,7 @@ export type TestRequests = Record<string, TestRequest[]>;
 
 // Test request addition result.
 export type TestRequestResult
-= 'url' | 'description' | 'retest' | 'duplicate' | 'superseded' | 'nonreport' | 'ok';
+= 'url' | 'description' | 'retest' | 'duplicate' | 'superseded' | 'nonreport' | 'queueFull' | 'ok';
 
 // Target of a new-test or retest request: a description and URL for a new-test request,
 // or the timeStamp and jobID of the cited report for a retest request.
@@ -549,6 +552,118 @@ export const isURL = (string: string): boolean => {
     return false;
   }
 };
+// The ipaddr.js range labels, for each address family, that are not part of
+// the public, globally routable address space and so must never be a testing
+// target. Sourced from ipaddr.js's own IPv4/IPv6 SpecialRanges tables, which
+// track the IANA special-purpose address registries (e.g. RFC 1918 private
+// ranges, RFC 5737/3849 documentation ranges, RFC 6598 carrier-grade NAT,
+// RFC 6890 link-local, including the 169.254.169.254 cloud-metadata address).
+// A version bump of ipaddr.js is not pinned or specially reviewed here (this
+// deployment always installs the latest of every dependency); instead, the
+// isAllowedTarget/isAllowedRedirectTarget tests enumerate specific addresses
+// in every one of these ranges, so a future release that narrowed this
+// coverage would fail those tests rather than silently allowing an address
+// that should be rejected.
+const nonPublicIPv4Ranges = new Set([
+  'unspecified', 'broadcast', 'multicast', 'linkLocal', 'loopback', 'carrierGradeNat', 'private', 'reserved'
+]);
+const nonPublicIPv6Ranges = new Set([
+  'unspecified', 'linkLocal', 'multicast', 'loopback', 'uniqueLocal', 'deprecatedSiteLocal', 'discard',
+  'rfc6145', 'rfc6052', '6to4', 'teredo', 'benchmarking', 'amt', 'as112v6', 'deprecatedOrchid', 'orchid2'
+]);
+// Returns whether an IP address (v4 or v6) is outside the public address
+// space, i.e. is a loopback, private, link-local, or other reserved address
+// that a public deployment should never intend to test.
+const isNonPublicIP = (address: string): boolean => {
+  let parsed;
+  try {
+    // process(), rather than parse(), so an IPv4-mapped IPv6 address (e.g.
+    // ::ffff:10.0.0.5) is unwrapped and classified by its embedded IPv4 address.
+    parsed = ipaddr.process(address);
+  }
+  catch {
+    // Not a recognizable IP address, so treat it as non-public, i.e. as unsafe.
+    return true;
+  }
+  const ranges = parsed.kind() === 'ipv4' ? nonPublicIPv4Ranges : nonPublicIPv6Ranges;
+  return ranges.has(parsed.range());
+};
+// Returns whether ALLOW_INTERNAL_TARGETS opts this deployment in to testing
+// pages at private, loopback, or link-local addresses. A deployment that
+// intentionally runs a Testaro worker inside a private network to test
+// intranet pages sets this to "true"; a public deployment, whose Testaro
+// workers may run on hosts with access to their own cloud metadata service,
+// leaves it unset so private addresses are rejected by default (fail safe).
+const allowsInternalTargets = (): boolean => process.env.ALLOW_INTERNAL_TARGETS === 'true';
+// The signature of dns.lookup with {all: true}, extracted so tests can inject
+// a fake resolver and avoid depending on real network/DNS access.
+type LookupAll = (hostname: string, options: {all: true}) => Promise<{address: string; family: number}[]>;
+// Returns whether the host a URL resolves to consists only of addresses this
+// deployment is configured to allow as testing targets. This governs where
+// the Testaro browser is allowed to navigate, so it is the control against
+// submitting (or, via a redirect, being routed to) an unintended internal
+// target such as a cloud metadata service or another host on a private
+// network. It is deliberately independent of the syntax check that isURL
+// performs, because it requires a DNS lookup, and therefore an internal
+// deployment can use it to check both a requested URL (at submission time)
+// and the actual, possibly redirected, URL of a report (at report-ingestion
+// time). The lookup parameter defaults to the real dns.lookup and exists so
+// tests can inject a fake resolver.
+export const isAllowedTarget = async (url: string, lookup: LookupAll = dns.lookup): Promise<boolean> => {
+  // If this deployment allows internal targets, every syntactically valid URL is allowed.
+  if (allowsInternalTargets()) {
+    return true;
+  }
+  let hostname: string;
+  try {
+    // URL.hostname keeps the surrounding brackets of a literal IPv6 host (e.g.
+    // "[::1]"), which net.isIP and dns.lookup both reject, so they are stripped here.
+    hostname = new URL(url).hostname.replace(/^\[(.*)\]$/, '$1');
+  } catch {
+    return false;
+  }
+  // If the hostname is itself a literal IP address, check it directly.
+  if (net.isIP(hostname)) {
+    return !isNonPublicIP(hostname);
+  }
+  // Otherwise, resolve the hostname and reject it if any address it resolves
+  // to is non-public, since a hostname can resolve to more than one address
+  // and an attacker need control only one of them.
+  try {
+    const addresses = await lookup(hostname, {all: true});
+    return addresses.length > 0 && addresses.every(({address}) => !isNonPublicIP(address));
+  } catch {
+    // An unresolvable hostname cannot be a usable testing target either way.
+    return false;
+  }
+};
+// Returns whether a URL, when actually requested, resolves through any
+// redirects to a final response whose URL is an allowed target. isAllowedTarget
+// only resolves DNS, so it cannot see an application-layer redirect (e.g. a
+// legitimately resolving host issuing a 302 to a private address); this
+// check is what can catch that at request time, before a job is ever queued.
+// It cannot catch a redirect introduced after it runs, e.g. an attacker who
+// reconfigures the target host once a request is accepted, so isAllowedReport
+// remains the backstop that re-checks the URL a worker actually visited.
+export const isAllowedRedirectTarget = async (
+  url: string, fetchImpl: typeof fetch = fetch, lookup: LookupAll = dns.lookup
+): Promise<boolean> => {
+  // If this deployment allows internal targets, every syntactically valid URL is
+  // allowed, and no fetch is needed, consistent with isAllowedTarget's own early return.
+  if (allowsInternalTargets()) {
+    return true;
+  }
+  let response: Response;
+  try {
+    // redirect: 'follow' is the default, but named here because observing
+    // where redirects lead is the entire purpose of this request.
+    response = await fetchImpl(url, {redirect: 'follow', signal: AbortSignal.timeout(10000)});
+  } catch {
+    // An unreachable or errored target cannot be verified as safe either way.
+    return false;
+  }
+  return isAllowedTarget(response.url, lookup);
+};
 // Returns whether a string is the authorization code, the shared check every
 // manager-facing page and action uses to gate a submission. Centralized so all call
 // sites compare against process.env.AUTH_CODE the same way.
@@ -601,6 +716,31 @@ export const deleteTestRequests = (url: string) => testRequestsLock(async (): Pr
 // Returns the test acts of a report.
 export const getTestActs = (report: UsableReport): AnnotatedAct[] =>
   report.acts.filter(act => act.type === 'test');
+// Returns whether all URLs actually visited for a report are allowed targets.
+// A URL submitted for testing can pass isAllowedTarget at submission time and
+// still result in a report on a disallowed target, because the browser
+// running in a worker can be redirected (possibly through DNS rebinding, so
+// the same hostname resolves differently at fetch time) to a host this
+// deployment does not allow as a testing target. Since each test act records
+// the URL it actually visited (actualURL, defaulting to the requested URL of
+// the job if a tool did not report one), checking every act here, right
+// before a report is stored or served, is what actually closes that gap,
+// independently of whatever happened during navigation.
+export const isAllowedReport = async (
+  report: Partial<Report>, lookup: LookupAll = dns.lookup
+): Promise<boolean> => {
+  const acts = Array.isArray(report.acts) ? report.acts : [];
+  const testActs = acts.filter((act): act is AnnotatedAct => act?.type === 'test');
+  const urlsVisited = new Set(
+    testActs.map(act => act.actualURL ?? report.target?.url).filter((url): url is string => !!url)
+  );
+  for (const url of urlsVisited) {
+    if (!(await isAllowedTarget(url, lookup))) {
+      return false;
+    }
+  }
+  return true;
+};
 // Returns the standard instances of a report's test acts, optionally filtered.
 export const getTestActInstances = (
   report: UsableReport,
@@ -954,6 +1094,35 @@ const getApprovedJobProperty = async (
 // its addition to testRequests.json are both decided inside the lock, as a single
 // atomic operation, so no caller-visible seam exists where an approvability decision
 // could be based on stale information about testRequests.json.
+// Returns the non-negative-integer value of an environment variable, or a default if the
+// variable is unset, empty, or not a non-negative integer. Read at call time, not cached,
+// so a variable set (e.g. in .env) after this module first loads still takes effect. Used
+// by the "inbox full" caps below (test requests, tutorial comments, feature requests),
+// which different Kilotest deployments' maintainers may reasonably want sized differently.
+// A value of 0 means no limit, mirroring how these caps are checked (never reached).
+export const getEnvMax = (name: string, defaultValue: number): number => {
+  const raw = process.env[name];
+  if (!raw) {
+    return defaultValue;
+  }
+  const parsed = Number(raw);
+  return Number.isInteger(parsed) && parsed >= 0 ? parsed : defaultValue;
+};
+// Maximum number of test/retest requests awaiting approval at once, across all URLs.
+// Once reached, a new, distinct request is rejected rather than added, so the pending
+// queue and the manager alert emails it generates cannot grow without bound (see GitHub
+// issue #3, abuse type 3, repeated/automated test-request submissions). Modeled on a full
+// mailbox rejecting new mail, rather than on a submission rate limit, since it is the
+// backlog itself, not how quickly it grows, that costs the manager review time and risks
+// unbounded storage. Configurable via TEST_REQUEST_QUEUE_MAX, since different Kilotest
+// deployments' maintainers may want a different size; a value of 0 means no limit.
+const testRequestQueueMax = () => getEnvMax('TEST_REQUEST_QUEUE_MAX', 20);
+// Returns a cap for display in an alert message: the cap itself, or "no limit" if the
+// cap is 0.
+export const describeMax = (max: number): string => max === 0 ? 'no limit' : String(max);
+// Returns the total number of test/retest requests awaiting approval, across all URLs.
+const getPendingTestRequestCount = (testRequests: TestRequests): number =>
+  Object.values(testRequests).reduce((total, requests) => total + requests.length, 0);
 export const processTestRequest = (
   reason: string,
   target: TestRequestTarget
@@ -1024,6 +1193,13 @@ export const processTestRequest = (
         return {result: 'retest', description, url};
       }
     }
+    // Otherwise, i.e. if the request is genuinely new, if the queue of requests awaiting
+    // approval is already full (a cap of 0 means no limit, so the queue is never full):
+    const queueMax = testRequestQueueMax();
+    if (queueMax > 0 && getPendingTestRequestCount(requests) >= queueMax) {
+      // Return this.
+      return {result: 'queueFull', description, url};
+    }
     // The request is eligible, so get the requests awaiting approval.
     const testRequests = await getTestRequests();
     // Add the request to them, initializing them with the URL if necessary.
@@ -1036,10 +1212,13 @@ export const processTestRequest = (
     await fs.writeFile(testRequestsPath(), getJSON(testRequests));
     // Get an email-safe version of the reason.
     const plainReason = getPlainText(reason);
-    // Alert a manager.
+    // Alert a manager, including the resulting queue size, so a maintainer who has been
+    // away sees at a glance how urgently the queue needs review (approval or rejection)
+    // rather than learning this only once it is already full.
     await sendAlert(
       `Kilotest: new ${requestType} request awaits approval`,
-      `Page description: ${description}\nURL: ${url}\nReason: ${plainReason}`
+      `Page description: ${description}\nURL: ${url}\nReason: ${plainReason}\n` +
+      `Requests now awaiting approval: ${getPendingTestRequestCount(testRequests)} of ${describeMax(queueMax)}`
     );
     // Return success.
     return {result: 'ok', description, url};

package/web/requestRetest/index.ts

@@ -51,6 +51,15 @@ export const answer = async (pageArgs: string, reason: string) => {
       message: 'A later report about the page is already available'
     }
   }
+  // Otherwise, if the queue of requests awaiting approval is full:
+  else if (result === 'queueFull') {
+    // Report this, with a fallback channel, since this request cannot be queued here.
+    return {
+      status: 'error',
+      message: 'Too many requests are awaiting approval right now. Please try again later, ' +
+        'or post your request at https://github.com/jrpool/kilotest/issues or email info@kilotest.com.'
+    }
+  }
   // Otherwise, i.e. if a request to test a page with the same description or URL is approved:
   else {
     // Report this.

package/web/requestRetest/requestRetest.test.ts

@@ -128,3 +128,17 @@ test('answer returns an error when a matching job is already claimed or queued',
   }
 });
 
+test('answer returns an error with a fallback channel when the request queue is full', async () => {
+  const {answer} = await import('./index.ts');
+  // Fill testRequests.json with 20 pending requests, all for one URL, to reach the cap.
+  const filler = Array.from({length: 20}, (_, i) => ({
+    timeStamp: '260101T0000', description: `Filler Page ${i}`, reason: 'Because filler'
+  }));
+  await fs.writeFile(testRequestsPath, JSON.stringify({'https://example.com/filler': filler}));
+  const result: any = await answer('260101T0001/ct', 'Because changes were made');
+  assert.equal(result.status, 'error');
+  assert.ok(result.message.startsWith('Too many requests are awaiting approval right now.'));
+  assert.ok(result.message.includes('https://github.com/jrpool/kilotest/issues'));
+  assert.ok(result.message.includes('info@kilotest.com'));
+});
+

package/web/requestTest/index.ts

@@ -41,6 +41,15 @@ export const answer = async (description: string, url: string, reason: string) =
       message: 'A report about the page is already available'
     }
   }
+  // Otherwise, if the queue of requests awaiting approval is full:
+  else if (result === 'queueFull') {
+    // Report this, with a fallback channel, since this request cannot be queued here.
+    return {
+      status: 'error',
+      message: 'Too many requests are awaiting approval right now. Please try again later, ' +
+        'or post your request at https://github.com/jrpool/kilotest/issues or email info@kilotest.com.'
+    }
+  }
   // Otherwise, i.e. if a request to test a page with the same description or URL is approved:
   else {
     // Report this.

package/web/requestTest/requestTest.test.ts

@@ -128,3 +128,19 @@ test('answer returns an error when a report already exists for the page', {timeo
   assert.equal(result.status, 'error');
   assert.equal(result.message, 'A report about the page is already available');
 });
+
+test('answer returns an error with a fallback channel when the request queue is full', {timeout: 500}, async () => {
+  const {answer} = await import('./index.ts');
+  // Fill testRequests.json with 20 pending requests, all for one URL, to reach the cap.
+  const filler = Array.from({length: 20}, (_, i) => ({
+    timeStamp: '260101T0000', description: `Filler Page ${i}`, reason: 'Because filler'
+  }));
+  await fs.writeFile(testRequestsPath, JSON.stringify({'https://example.com/filler': filler}));
+  const result: any = await answer(
+    'One Too Many Page', 'https://example.com/one-too-many', 'Because accessibility'
+  );
+  assert.equal(result.status, 'error');
+  assert.ok(result.message.startsWith('Too many requests are awaiting approval right now.'));
+  assert.ok(result.message.includes('https://github.com/jrpool/kilotest/issues'));
+  assert.ok(result.message.includes('info@kilotest.com'));
+});

package/web/tutorialAI/index.ts

@@ -6,13 +6,20 @@
 // IMPORTS
 
 import {sendAlert} from '../../alerts.ts';
-import {checkCommentDuplicate, checkCommentLength, getJSON, getNowStamp} from '../../util.ts';
+import {checkCommentDuplicate, checkCommentLength, describeMax, getEnvMax, getJSON, getNowStamp} from '../../util.ts';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 
 // FUNCTIONS (helpers)
 
 const getCommentsPath = () => process.env.TUTORIAL_AI_COMMENTS_PATH || path.join(import.meta.dirname, '../../db/comments/tutorialAI.json');
+// Maximum number of comments held at once. Once reached, a new, distinct comment is
+// rejected rather than stored, so the comments file and the manager alert emails it
+// generates cannot grow without bound (modeled on a full mailbox rejecting new mail; see
+// GitHub issue #3, abuse type 3). Configurable via TUTORIAL_AI_COMMENTS_MAX, since
+// different Kilotest deployments' maintainers may want a different size; a value of 0
+// means no limit.
+const getCommentsMax = () => getEnvMax('TUTORIAL_AI_COMMENTS_MAX', 20);
 
 // FUNCTIONS
 
@@ -60,6 +67,17 @@ export const handleComment = async (content: unknown) => {
   if (duplicateCheck.status === 'error') {
     return duplicateCheck;
   }
+  // If the comments already on file have reached the cap (a cap of 0 means no limit, so
+  // the comments are never full):
+  const commentsMax = getCommentsMax();
+  if (commentsMax > 0 && comments.length >= commentsMax) {
+    // Report this, with a fallback channel, since this comment cannot be stored here.
+    return {
+      status: 'error',
+      message: 'Too many comments are awaiting review right now. Please try again later, ' +
+        'or post your comment at https://github.com/jrpool/kilotest/issues or email info@kilotest.com.'
+    };
+  }
   // Add the comment to the existing ones.
   comments.push({
     timeStamp: getNowStamp(),
@@ -69,7 +87,11 @@ export const handleComment = async (content: unknown) => {
   await fs.mkdir(path.dirname(commentsPath), {recursive: true});
   // Save the revised comments.
   await fs.writeFile(commentsPath, getJSON(comments));
-  // Send an alert to the manager.
-  await sendAlert('Kilotest: New AI tutorial comment received', 'A new AI tutorial comment has been received.');
+  // Send an alert to the manager, including the resulting count, so a maintainer who has
+  // been away sees at a glance how urgently the comments need review.
+  await sendAlert(
+    'Kilotest: New AI tutorial comment received',
+    `A new AI tutorial comment has been received.\nComments now awaiting review: ${comments.length} of ${describeMax(commentsMax)}`
+  );
   return {status: 'ok'};
 };

package/web/tutorialAI/tutorialAI.test.ts

@@ -100,6 +100,38 @@ test('handleComment saves a sanitized comment and returns ok', {timeout: 500}, a
   assert.ok(comments[0].timeStamp);
 });
 
+test('handleComment returns an error with a fallback channel when the comments cap is reached', {timeout: 500}, async () => {
+  // Fill comments.json with 20 distinct comments, reaching the cap.
+  const filler = Array.from({length: 20}, (_, i) => ({
+    timeStamp: '260101T0000', content: `Filler comment number ${i}, long enough to pass the length check.`
+  }));
+  await fs.writeFile(getCommentsPath(), JSON.stringify(filler));
+  const result = await handleComment('One comment too many, long enough to pass the length check.');
+  assert.equal(result.status, 'error');
+  assert.ok(result.message?.startsWith('Too many comments are awaiting review right now.'));
+  assert.ok(result.message?.includes('https://github.com/jrpool/kilotest/issues'));
+  assert.ok(result.message?.includes('info@kilotest.com'));
+  // Clean up.
+  await fs.writeFile(getCommentsPath(), '[]\n');
+});
+
+test('handleComment never rejects for a full inbox when TUTORIAL_AI_COMMENTS_MAX is 0 (no limit)', {timeout: 500}, async () => {
+  process.env.TUTORIAL_AI_COMMENTS_MAX = '0';
+  try {
+    // Fill comments.json past the default cap.
+    const filler = Array.from({length: 25}, (_, i) => ({
+      timeStamp: '260101T0000', content: `Filler comment number ${i}, long enough to pass the length check.`
+    }));
+    await fs.writeFile(getCommentsPath(), JSON.stringify(filler));
+    const result = await handleComment('One more comment, long enough to pass the length check.');
+    assert.equal(result.status, 'ok');
+  }
+  finally {
+    delete process.env.TUTORIAL_AI_COMMENTS_MAX;
+    await fs.writeFile(getCommentsPath(), '[]\n');
+  }
+});
+
 test('handleComment strips HTML tags and control characters', {timeout: 500}, async () => {
   await fs.writeFile(getCommentsPath(), '[]\n');
   const result = await handleComment('<img src=x onerror=alert(1)>\x00\x07Hello');

package/web/tutorialWeb/index.ts

@@ -6,13 +6,20 @@
 // IMPORTS
 
 import {sendAlert} from '../../alerts.ts';
-import {checkCommentDuplicate, checkCommentLength, getJSON, getNowStamp} from '../../util.ts';
+import {checkCommentDuplicate, checkCommentLength, describeMax, getEnvMax, getJSON, getNowStamp} from '../../util.ts';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 
 // FUNCTIONS (helpers)
 
 const getCommentsPath = () => process.env.TUTORIAL_WEB_COMMENTS_PATH || path.join(import.meta.dirname, '../../db/comments/tutorialWeb.json');
+// Maximum number of comments held at once. Once reached, a new, distinct comment is
+// rejected rather than stored, so the comments file and the manager alert emails it
+// generates cannot grow without bound (modeled on a full mailbox rejecting new mail; see
+// GitHub issue #3, abuse type 3). Configurable via TUTORIAL_WEB_COMMENTS_MAX, since
+// different Kilotest deployments' maintainers may want a different size; a value of 0
+// means no limit.
+const getCommentsMax = () => getEnvMax('TUTORIAL_WEB_COMMENTS_MAX', 20);
 
 // FUNCTIONS
 
@@ -63,6 +70,17 @@ export const handleComment = async (content: unknown) => {
     // Report this.
     return duplicateCheck;
   }
+  // If the comments already on file have reached the cap (a cap of 0 means no limit, so
+  // the comments are never full):
+  const commentsMax = getCommentsMax();
+  if (commentsMax > 0 && comments.length >= commentsMax) {
+    // Report this, with a fallback channel, since this comment cannot be stored here.
+    return {
+      status: 'error',
+      message: 'Too many comments are awaiting review right now. Please try again later, ' +
+        'or post your comment at https://github.com/jrpool/kilotest/issues or email info@kilotest.com.'
+    };
+  }
   // Add the comment to the existing ones.
   comments.push({
     timeStamp: getNowStamp(),
@@ -72,7 +90,11 @@ export const handleComment = async (content: unknown) => {
   await fs.mkdir(path.dirname(commentsPath), {recursive: true});
   // Save the revised comments.
   await fs.writeFile(commentsPath, getJSON(comments));
-  // Send an alert to the manager.
-  await sendAlert('Kilotest: New web tutorial comment received', 'A new web tutorial comment has been received.');
+  // Send an alert to the manager, including the resulting count, so a maintainer who has
+  // been away sees at a glance how urgently the comments need review.
+  await sendAlert(
+    'Kilotest: New web tutorial comment received',
+    `A new web tutorial comment has been received.\nComments now awaiting review: ${comments.length} of ${describeMax(commentsMax)}`
+  );
   return {status: 'ok'};
 };

package/web/tutorialWeb/tutorialWeb.test.ts

@@ -103,6 +103,38 @@ test('handleComment saves a sanitized comment and returns ok', {timeout: 500}, a
   assert.ok(comments[0].timeStamp);
 });
 
+test('handleComment returns an error with a fallback channel when the comments cap is reached', {timeout: 500}, async () => {
+  // Fill comments.json with 20 distinct comments, reaching the cap.
+  const filler = Array.from({length: 20}, (_, i) => ({
+    timeStamp: '260101T0000', content: `Filler comment number ${i}, long enough to pass the length check.`
+  }));
+  await fs.writeFile(getCommentsPath(), JSON.stringify(filler));
+  const result = await handleComment('One comment too many, long enough to pass the length check.');
+  assert.equal(result.status, 'error');
+  assert.ok(result.message?.startsWith('Too many comments are awaiting review right now.'));
+  assert.ok(result.message?.includes('https://github.com/jrpool/kilotest/issues'));
+  assert.ok(result.message?.includes('info@kilotest.com'));
+  // Clean up.
+  await fs.writeFile(getCommentsPath(), '[]\n');
+});
+
+test('handleComment never rejects for a full inbox when TUTORIAL_WEB_COMMENTS_MAX is 0 (no limit)', {timeout: 500}, async () => {
+  process.env.TUTORIAL_WEB_COMMENTS_MAX = '0';
+  try {
+    // Fill comments.json past the default cap.
+    const filler = Array.from({length: 25}, (_, i) => ({
+      timeStamp: '260101T0000', content: `Filler comment number ${i}, long enough to pass the length check.`
+    }));
+    await fs.writeFile(getCommentsPath(), JSON.stringify(filler));
+    const result = await handleComment('One more comment, long enough to pass the length check.');
+    assert.equal(result.status, 'ok');
+  }
+  finally {
+    delete process.env.TUTORIAL_WEB_COMMENTS_MAX;
+    await fs.writeFile(getCommentsPath(), '[]\n');
+  }
+});
+
 test('handleComment strips HTML tags and control characters', {timeout: 500}, async () => {
   await fs.writeFile(getCommentsPath(), '[]\n');
   const result = await handleComment('<img src=x onerror=alert(1)>\x00\x07Hello');