@jrpool/kilotest 52.0.0 → 57.0.1

package/web/tutorialAI/tutorialAI.test.ts

@@ -100,6 +100,38 @@ test('handleComment saves a sanitized comment and returns ok', {timeout: 500}, a
   assert.ok(comments[0].timeStamp);
 });
 
+test('handleComment returns an error with a fallback channel when the comments cap is reached', {timeout: 500}, async () => {
+  // Fill comments.json with 20 distinct comments, reaching the cap.
+  const filler = Array.from({length: 20}, (_, i) => ({
+    timeStamp: '260101T0000', content: `Filler comment number ${i}, long enough to pass the length check.`
+  }));
+  await fs.writeFile(getCommentsPath(), JSON.stringify(filler));
+  const result = await handleComment('One comment too many, long enough to pass the length check.');
+  assert.equal(result.status, 'error');
+  assert.ok(result.message?.startsWith('Too many comments are awaiting review right now.'));
+  assert.ok(result.message?.includes('https://github.com/jrpool/kilotest/issues'));
+  assert.ok(result.message?.includes('info@kilotest.com'));
+  // Clean up.
+  await fs.writeFile(getCommentsPath(), '[]\n');
+});
+
+test('handleComment never rejects for a full inbox when TUTORIAL_AI_COMMENTS_MAX is 0 (no limit)', {timeout: 500}, async () => {
+  process.env.TUTORIAL_AI_COMMENTS_MAX = '0';
+  try {
+    // Fill comments.json past the default cap.
+    const filler = Array.from({length: 25}, (_, i) => ({
+      timeStamp: '260101T0000', content: `Filler comment number ${i}, long enough to pass the length check.`
+    }));
+    await fs.writeFile(getCommentsPath(), JSON.stringify(filler));
+    const result = await handleComment('One more comment, long enough to pass the length check.');
+    assert.equal(result.status, 'ok');
+  }
+  finally {
+    delete process.env.TUTORIAL_AI_COMMENTS_MAX;
+    await fs.writeFile(getCommentsPath(), '[]\n');
+  }
+});
+
 test('handleComment strips HTML tags and control characters', {timeout: 500}, async () => {
   await fs.writeFile(getCommentsPath(), '[]\n');
   const result = await handleComment('<img src=x onerror=alert(1)>\x00\x07Hello');

package/web/tutorialWeb/index.ts

@@ -6,13 +6,20 @@
 // IMPORTS
 
 import {sendAlert} from '../../alerts.ts';
-import {checkCommentDuplicate, checkCommentLength, getJSON, getNowStamp} from '../../util.ts';
+import {checkCommentDuplicate, checkCommentLength, describeMax, getEnvMax, getJSON, getNowStamp} from '../../util.ts';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 
 // FUNCTIONS (helpers)
 
 const getCommentsPath = () => process.env.TUTORIAL_WEB_COMMENTS_PATH || path.join(import.meta.dirname, '../../db/comments/tutorialWeb.json');
+// Maximum number of comments held at once. Once reached, a new, distinct comment is
+// rejected rather than stored, so the comments file and the manager alert emails it
+// generates cannot grow without bound (modeled on a full mailbox rejecting new mail; see
+// GitHub issue #3, abuse type 3). Configurable via TUTORIAL_WEB_COMMENTS_MAX, since
+// different Kilotest deployments' maintainers may want a different size; a value of 0
+// means no limit.
+const getCommentsMax = () => getEnvMax('TUTORIAL_WEB_COMMENTS_MAX', 20);
 
 // FUNCTIONS
 
@@ -63,6 +70,17 @@ export const handleComment = async (content: unknown) => {
     // Report this.
     return duplicateCheck;
   }
+  // If the comments already on file have reached the cap (a cap of 0 means no limit, so
+  // the comments are never full):
+  const commentsMax = getCommentsMax();
+  if (commentsMax > 0 && comments.length >= commentsMax) {
+    // Report this, with a fallback channel, since this comment cannot be stored here.
+    return {
+      status: 'error',
+      message: 'Too many comments are awaiting review right now. Please try again later, ' +
+        'or post your comment at https://github.com/jrpool/kilotest/issues or email info@kilotest.com.'
+    };
+  }
   // Add the comment to the existing ones.
   comments.push({
     timeStamp: getNowStamp(),
@@ -72,7 +90,11 @@ export const handleComment = async (content: unknown) => {
   await fs.mkdir(path.dirname(commentsPath), {recursive: true});
   // Save the revised comments.
   await fs.writeFile(commentsPath, getJSON(comments));
-  // Send an alert to the manager.
-  await sendAlert('Kilotest: New web tutorial comment received', 'A new web tutorial comment has been received.');
+  // Send an alert to the manager, including the resulting count, so a maintainer who has
+  // been away sees at a glance how urgently the comments need review.
+  await sendAlert(
+    'Kilotest: New web tutorial comment received',
+    `A new web tutorial comment has been received.\nComments now awaiting review: ${comments.length} of ${describeMax(commentsMax)}`
+  );
   return {status: 'ok'};
 };

package/web/tutorialWeb/tutorialWeb.test.ts

@@ -103,6 +103,38 @@ test('handleComment saves a sanitized comment and returns ok', {timeout: 500}, a
   assert.ok(comments[0].timeStamp);
 });
 
+test('handleComment returns an error with a fallback channel when the comments cap is reached', {timeout: 500}, async () => {
+  // Fill comments.json with 20 distinct comments, reaching the cap.
+  const filler = Array.from({length: 20}, (_, i) => ({
+    timeStamp: '260101T0000', content: `Filler comment number ${i}, long enough to pass the length check.`
+  }));
+  await fs.writeFile(getCommentsPath(), JSON.stringify(filler));
+  const result = await handleComment('One comment too many, long enough to pass the length check.');
+  assert.equal(result.status, 'error');
+  assert.ok(result.message?.startsWith('Too many comments are awaiting review right now.'));
+  assert.ok(result.message?.includes('https://github.com/jrpool/kilotest/issues'));
+  assert.ok(result.message?.includes('info@kilotest.com'));
+  // Clean up.
+  await fs.writeFile(getCommentsPath(), '[]\n');
+});
+
+test('handleComment never rejects for a full inbox when TUTORIAL_WEB_COMMENTS_MAX is 0 (no limit)', {timeout: 500}, async () => {
+  process.env.TUTORIAL_WEB_COMMENTS_MAX = '0';
+  try {
+    // Fill comments.json past the default cap.
+    const filler = Array.from({length: 25}, (_, i) => ({
+      timeStamp: '260101T0000', content: `Filler comment number ${i}, long enough to pass the length check.`
+    }));
+    await fs.writeFile(getCommentsPath(), JSON.stringify(filler));
+    const result = await handleComment('One more comment, long enough to pass the length check.');
+    assert.equal(result.status, 'ok');
+  }
+  finally {
+    delete process.env.TUTORIAL_WEB_COMMENTS_MAX;
+    await fs.writeFile(getCommentsPath(), '[]\n');
+  }
+});
+
 test('handleComment strips HTML tags and control characters', {timeout: 500}, async () => {
   await fs.writeFile(getCommentsPath(), '[]\n');
   const result = await handleComment('<img src=x onerror=alert(1)>\x00\x07Hello');