@rubytech/create-maxy-code 0.1.457 → 0.1.459

package/payload/platform/lib/storage-broker/src/__tests__/cf-exec.test.ts

@@ -26,15 +26,54 @@ const throwingRun: RunFn = async () => {
 function recordingFetch(response: { ok: boolean; status: number; body: string }) {
   const calls: Array<{
     url: string;
-    init: { method: string; headers: Record<string, string>; body?: string };
+    init: { method: string; headers: Record<string, string>; body?: string | Uint8Array };
   }> = [];
   const fetchFn: FetchFn = async (url, init) => {
     calls.push({ url, init });
-    return { ok: response.ok, status: response.status, text: async () => response.body };
+    return {
+      ok: response.ok,
+      status: response.status,
+      text: async () => response.body,
+      // Task 1691 — r2ObjectGet reads the raw object body, so the seam carries
+      // arrayBuffer alongside text. The fake derives it from the same body.
+      arrayBuffer: async () => new TextEncoder().encode(response.body).buffer as ArrayBuffer,
+    };
   };
   return { fetchFn, calls };
 }
 
+// r2List follows the R2 pagination cursor, so its tests need a fetch that
+// returns a different response per call. recordingFetch returns one fixed
+// response for every call and stays as-is for the single-request paths.
+function sequenceFetch(responses: Array<{ ok: boolean; status: number; body: string }>) {
+  const calls: Array<{
+    url: string;
+    init: { method: string; headers: Record<string, string>; body?: string | Uint8Array };
+  }> = [];
+  const fetchFn: FetchFn = async (url, init) => {
+    calls.push({ url, init });
+    const r = responses[calls.length - 1];
+    if (!r) throw new Error(`unexpected fetch call #${calls.length} to ${url}`);
+    return {
+      ok: r.ok,
+      status: r.status,
+      text: async () => r.body,
+      arrayBuffer: async () => new TextEncoder().encode(r.body).buffer as ArrayBuffer,
+    };
+  };
+  return { fetchFn, calls };
+}
+
+function bucketPage(names: string[], cursor?: string) {
+  return JSON.stringify({
+    success: true,
+    errors: [],
+    messages: [],
+    result: { buckets: names.map((name) => ({ name, creation_date: "2026-01-01T00:00:00Z" })) },
+    result_info: cursor === undefined ? {} : { cursor, per_page: 20 },
+  });
+}
+
 test("d1List parses --json output and injects the house token", async () => {
   const { run, calls } = recordingRun(JSON.stringify([{ name: "gls-leads", uuid: "u1" }]));
   const cf = makeCfExec(cred, run);
@@ -72,7 +111,9 @@ test("d1Create creates the database via the D1 API with the house token, never w
   assert.equal(calls[0].init.method, "POST");
   assert.equal(calls[0].init.headers.Authorization, "Bearer cfat_x");
   assert.equal(calls[0].init.headers["Content-Type"], "application/json");
-  assert.deepEqual(JSON.parse(calls[0].init.body ?? ""), { name: "gls-new" });
+  // init.body widened to string | Uint8Array for the object-put path (Task
+  // 1691); d1Create still sends a JSON string.
+  assert.deepEqual(JSON.parse(String(calls[0].init.body ?? "")), { name: "gls-new" });
 });
 
 test("d1Create throws with the API error body on a non-2xx response", async () => {
@@ -156,12 +197,138 @@ test("r2List throws on a 200 whose body is not a success envelope, retaining the
   await assert.rejects(() => cf.r2List(), /unexpected/);
 });
 
+// `null` is valid JSON, so it survives parseJson and reaches the envelope
+// guard as a null parsed value. It must still surface its body like every other
+// malformed 2xx shape, never a bare TypeError with the body dropped.
+test("a 2xx body of JSON null throws with the body, not a TypeError", async () => {
+  const { fetchFn } = recordingFetch({ ok: true, status: 200, body: "null" });
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  await assert.rejects(() => cf.r2List(), {
+    message: "storage-broker: r2 bucket list API error: null",
+  });
+});
+
 test("non-JSON output throws with the raw body", async () => {
   const { run } = recordingRun("not json");
   const cf = makeCfExec(cred, run);
   await assert.rejects(() => cf.d1List(), /not json/);
 });
 
+// Task 1665 — the R2 List-Buckets endpoint paginates by cursor. A single
+// unpaginated request silently truncates the bucket set on a large house
+// account, and the audit reads a truncated list as "those buckets are absent",
+// under-reporting strays. per_page is never sent: its default and cap are
+// unconfirmed, and omitting it makes the loop correct without guessing.
+test("r2List follows the pagination cursor and assembles every page", async () => {
+  const { fetchFn, calls } = sequenceFetch([
+    { ok: true, status: 200, body: bucketPage(["gls-assets", "gls-docs"], "cur-1") },
+    { ok: true, status: 200, body: bucketPage(["acme-assets"]) },
+  ]);
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  assert.deepEqual(await cf.r2List(), [
+    { name: "gls-assets" },
+    { name: "gls-docs" },
+    { name: "acme-assets" },
+  ]);
+  assert.equal(calls.length, 2);
+  // The first request carries no query string; only follow-ups carry the cursor.
+  assert.equal(calls[0].url, "https://api.cloudflare.com/client/v4/accounts/acc-h/r2/buckets");
+  assert.equal(
+    calls[1].url,
+    "https://api.cloudflare.com/client/v4/accounts/acc-h/r2/buckets?cursor=cur-1",
+  );
+  assert.equal(calls[1].init.headers.Authorization, "Bearer cfat_x");
+});
+
+test("r2List never sends per_page", async () => {
+  const { fetchFn, calls } = sequenceFetch([
+    { ok: true, status: 200, body: bucketPage(["gls-assets"], "cur-1") },
+    { ok: true, status: 200, body: bucketPage(["gls-docs"]) },
+  ]);
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  await cf.r2List();
+  for (const c of calls) assert.equal(c.url.includes("per_page"), false);
+});
+
+test("r2List stops on an empty-string cursor", async () => {
+  const { fetchFn, calls } = sequenceFetch([
+    { ok: true, status: 200, body: bucketPage(["gls-assets"], "") },
+  ]);
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  assert.deepEqual(await cf.r2List(), [{ name: "gls-assets" }]);
+  assert.equal(calls.length, 1);
+});
+
+test("r2List percent-encodes the cursor", async () => {
+  const { fetchFn, calls } = sequenceFetch([
+    { ok: true, status: 200, body: bucketPage(["gls-assets"], "a b+c/d=") },
+    { ok: true, status: 200, body: bucketPage([]) },
+  ]);
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  await cf.r2List();
+  assert.equal(
+    calls[1].url,
+    "https://api.cloudflare.com/client/v4/accounts/acc-h/r2/buckets?cursor=a%20b%2Bc%2Fd%3D",
+  );
+});
+
+test("r2List stops on a null cursor", async () => {
+  const { fetchFn, calls } = sequenceFetch([
+    {
+      ok: true,
+      status: 200,
+      body: JSON.stringify({
+        success: true,
+        errors: [],
+        messages: [],
+        result: { buckets: [{ name: "gls-assets" }] },
+        result_info: { cursor: null },
+      }),
+    },
+  ]);
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  assert.deepEqual(await cf.r2List(), [{ name: "gls-assets" }]);
+  assert.equal(calls.length, 1);
+});
+
+test("r2List throws on a repeated cursor instead of looping forever", async () => {
+  const { fetchFn } = sequenceFetch([
+    { ok: true, status: 200, body: bucketPage(["gls-assets"], "cur-1") },
+    { ok: true, status: 200, body: bucketPage(["gls-docs"], "cur-1") },
+  ]);
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  await assert.rejects(() => cf.r2List(), /repeated pagination cursor: cur-1/);
+});
+
+// A cursor cycle of period >= 2 never repeats the immediately-previous cursor,
+// so it would spin forever — re-appending the same buckets each pass — under a
+// guard that only compares against the last cursor seen.
+test("r2List throws on a cursor cycle that does not repeat consecutively", async () => {
+  const { fetchFn } = sequenceFetch([
+    { ok: true, status: 200, body: bucketPage(["gls-assets"], "cur-a") },
+    { ok: true, status: 200, body: bucketPage(["gls-docs"], "cur-b") },
+    { ok: true, status: 200, body: bucketPage(["gls-assets"], "cur-a") },
+  ]);
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  await assert.rejects(() => cf.r2List(), /repeated pagination cursor: cur-a/);
+});
+
+test("r2List surfaces a mid-loop failure with its body, never a partial list", async () => {
+  const { fetchFn } = sequenceFetch([
+    { ok: true, status: 200, body: bucketPage(["gls-assets"], "cur-1") },
+    {
+      ok: false,
+      status: 403,
+      body: JSON.stringify({
+        success: false,
+        errors: [{ code: 10000, message: "Authentication error" }],
+      }),
+    },
+  ]);
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  await assert.rejects(() => cf.r2List(), /403[\s\S]*Authentication error/);
+});
+
 // Task 1670 — makeHouseCfExec resolves a scoped storage token from the house
 // minter via cf-token.sh and uses THAT token (never the minter) for wrangler.
 test("makeHouseCfExec runs wrangler with the scoped token, not the minter", async () => {
@@ -185,3 +352,195 @@ test("makeHouseCfExec runs wrangler with the scoped token, not the minter", asyn
   await cf.d1List();
   assert.equal(sawToken, "scoped_tok", "wrangler saw the scoped token, not the minter");
 });
+
+// ---------------------------------------------------------------------------
+// Task 1691 — R2 object operations. Same discipline as r2List/d1Create: the
+// Cloudflare API behind an injectable fetch, wrangler never shelled (throwingRun
+// proves it), and every failure keeps its body.
+// ---------------------------------------------------------------------------
+
+function objectPage(keys: string[], opts: { cursor?: string; truncated?: boolean } = {}) {
+  return JSON.stringify({
+    success: true,
+    errors: [],
+    messages: [],
+    result: keys.map((key) => ({
+      key,
+      size: 10,
+      etag: "e1",
+      last_modified: "2026-01-01T00:00:00Z",
+    })),
+    result_info: { cursor: opts.cursor ?? "", is_truncated: opts.truncated ?? false },
+  });
+}
+
+test("r2ObjectList returns a single page and never shells wrangler", async () => {
+  const { fetchFn, calls } = recordingFetch({ ok: true, status: 200, body: objectPage(["a.jpg"]) });
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  assert.deepEqual(await cf.r2ObjectList("acc-a-portal"), [
+    { key: "a.jpg", size: 10, etag: "e1", lastModified: "2026-01-01T00:00:00Z" },
+  ]);
+  assert.equal(calls.length, 1);
+  assert.equal(
+    calls[0].url,
+    "https://api.cloudflare.com/client/v4/accounts/acc-h/r2/buckets/acc-a-portal/objects",
+  );
+  assert.equal(calls[0].init.headers.Authorization, "Bearer cfat_x");
+});
+
+test("r2ObjectList never sends per_page", async () => {
+  const { fetchFn, calls } = recordingFetch({ ok: true, status: 200, body: objectPage([]) });
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  await cf.r2ObjectList("b");
+  assert.equal(calls[0].url.includes("per_page"), false);
+});
+
+test("r2ObjectList passes prefix through, encoded", async () => {
+  const { fetchFn, calls } = recordingFetch({ ok: true, status: 200, body: objectPage([]) });
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  await cf.r2ObjectList("b", "person a/");
+  assert.ok(calls[0].url.endsWith("/objects?prefix=person+a%2F"), calls[0].url);
+});
+
+test("r2ObjectList follows the cursor to exhaustion", async () => {
+  const { fetchFn, calls } = sequenceFetch([
+    { ok: true, status: 200, body: objectPage(["a.jpg"], { cursor: "c1", truncated: true }) },
+    { ok: true, status: 200, body: objectPage(["b.jpg"]) },
+  ]);
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  assert.deepEqual((await cf.r2ObjectList("b")).map((o) => o.key), ["a.jpg", "b.jpg"]);
+  assert.equal(calls.length, 2);
+  assert.ok(calls[1].url.includes("cursor=c1"));
+});
+
+// is_truncated is the authoritative continuation signal, not the presence of a
+// cursor: a last page may still carry one.
+test("r2ObjectList stops when is_truncated is false even if a cursor is present", async () => {
+  const { fetchFn, calls } = sequenceFetch([
+    { ok: true, status: 200, body: objectPage(["a.jpg"], { cursor: "c1", truncated: false }) },
+  ]);
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  await cf.r2ObjectList("b");
+  assert.equal(calls.length, 1);
+});
+
+// The response shape is doc-confirmed but never measured against a live account.
+// If it is not what we understand, that must be loud: a partial list is exactly
+// the bug this loop exists to prevent.
+test("r2ObjectList throws when truncated but no cursor is given, never a partial list", async () => {
+  const { fetchFn } = recordingFetch({
+    ok: true,
+    status: 200,
+    body: objectPage(["a.jpg"], { truncated: true }),
+  });
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  await assert.rejects(() => cf.r2ObjectList("b"), /truncated but gave no pagination cursor/);
+});
+
+test("r2ObjectList throws on a repeated cursor", async () => {
+  const { fetchFn } = sequenceFetch([
+    { ok: true, status: 200, body: objectPage(["a"], { cursor: "c1", truncated: true }) },
+    { ok: true, status: 200, body: objectPage(["b"], { cursor: "c1", truncated: true }) },
+  ]);
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  await assert.rejects(() => cf.r2ObjectList("b"), /repeated pagination cursor/);
+});
+
+test("r2ObjectList retains the body on a non-2xx", async () => {
+  const { fetchFn } = recordingFetch({ ok: false, status: 403, body: '{"errors":[{"code":10000}]}' });
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  await assert.rejects(() => cf.r2ObjectList("b"), /10000/);
+});
+
+test("r2ObjectGet returns exact bytes and encodes the key segment-wise", async () => {
+  // Binary that is not valid UTF-8: proves the body never round-trips through
+  // text(), which would corrupt it.
+  const bytes = new Uint8Array([0x89, 0x50, 0x4e, 0x47, 0x00, 0xff]);
+  const calls: string[] = [];
+  const fetchFn: FetchFn = async (url) => {
+    calls.push(url);
+    return {
+      ok: true,
+      status: 200,
+      text: async () => "unused",
+      arrayBuffer: async () => bytes.buffer.slice(0) as ArrayBuffer,
+    };
+  };
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  const got = await cf.r2ObjectGet("b", "person a/photo 1.jpg");
+  assert.deepEqual(Array.from(got), Array.from(bytes));
+  // Separators stay separators; spaces are escaped.
+  assert.ok(calls[0].endsWith("/objects/person%20a/photo%201.jpg"), calls[0]);
+});
+
+test("r2ObjectGet retains the body on a non-2xx", async () => {
+  const { fetchFn } = recordingFetch({ ok: false, status: 404, body: "no such key" });
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  await assert.rejects(() => cf.r2ObjectGet("b", "k"), /no such key/);
+});
+
+test("r2ObjectPut sends the bytes as the request body", async () => {
+  const { fetchFn, calls } = recordingFetch({
+    ok: true,
+    status: 200,
+    body: JSON.stringify({ success: true, errors: [], messages: [], result: {} }),
+  });
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  const bytes = new Uint8Array([1, 2, 3]);
+  await cf.r2ObjectPut("b", "k.bin", bytes);
+  assert.equal(calls[0].init.method, "PUT");
+  assert.deepEqual(calls[0].init.body, bytes);
+  assert.equal(calls[0].init.headers.Authorization, "Bearer cfat_x");
+});
+
+test("r2ObjectPut retains the body on a non-success envelope", async () => {
+  const { fetchFn } = recordingFetch({
+    ok: true,
+    status: 200,
+    body: '{"success":false,"errors":[{"code":10001}]}',
+  });
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  await assert.rejects(() => cf.r2ObjectPut("b", "k", new Uint8Array([1])), /10001/);
+});
+
+test("r2ObjectDelete issues a DELETE", async () => {
+  const { fetchFn, calls } = recordingFetch({
+    ok: true,
+    status: 200,
+    body: JSON.stringify({ success: true, errors: [], messages: [], result: {} }),
+  });
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  await cf.r2ObjectDelete("b", "k");
+  assert.equal(calls[0].init.method, "DELETE");
+  assert.equal(calls[0].init.headers.Authorization, "Bearer cfat_x");
+});
+
+test("r2ObjectDelete retains the body on a non-2xx", async () => {
+  const { fetchFn } = recordingFetch({ ok: false, status: 500, body: "boom" });
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  await assert.rejects(() => cf.r2ObjectDelete("b", "k"), /boom/);
+});
+
+// Code review — is_truncated is itself an unmeasured fact (no live credential
+// exists to confirm the envelope). Driving the loop solely on it means a
+// response that omits it while still paginating truncates SILENTLY, which is
+// the exact failure this loop exists to prevent, and it would also make
+// r2ObjectList disagree with r2List directly above it, which drives the same
+// envelope on cursor presence alone.
+test("r2ObjectList follows a cursor when is_truncated is absent, rather than truncating silently", async () => {
+  const pageWithoutTruncatedFlag = (keys: string[], cursor: string | null) =>
+    JSON.stringify({
+      success: true,
+      errors: [],
+      messages: [],
+      result: keys.map((key) => ({ key, size: 1, etag: "e", last_modified: "t" })),
+      result_info: cursor === null ? {} : { cursor },
+    });
+  const { fetchFn, calls } = sequenceFetch([
+    { ok: true, status: 200, body: pageWithoutTruncatedFlag(["a.jpg"], "c1") },
+    { ok: true, status: 200, body: pageWithoutTruncatedFlag(["b.jpg"], null) },
+  ]);
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  assert.deepEqual((await cf.r2ObjectList("b")).map((o) => o.key), ["a.jpg", "b.jpg"]);
+  assert.equal(calls.length, 2);
+});

package/payload/platform/lib/storage-broker/src/__tests__/object-limits.test.ts

@@ -0,0 +1,76 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import {
+  R2_OBJECT_MAX_BYTES,
+  R2_OBJECT_PUT_MAX_BODY_BYTES,
+  base64Ceiling,
+  tooLargeMessage,
+} from "../object-limits.js";
+
+test("the cap is 100 MiB", () => {
+  assert.equal(R2_OBJECT_MAX_BYTES, 100 * 1024 * 1024);
+});
+
+// The cap is set independently of email's 25 MiB. This pins that they are not
+// the same number, so a future edit that "unifies" them fails here and has to
+// read the design note rather than silently coupling two unrelated limits.
+test("the cap is not email's attachment cap", () => {
+  assert.notEqual(R2_OBJECT_MAX_BYTES, 25 * 1024 * 1024);
+});
+
+test("base64Ceiling matches base64's 4-out-per-3-in expansion, rounded up", () => {
+  assert.equal(base64Ceiling(0), 0);
+  assert.equal(base64Ceiling(1), 4);
+  assert.equal(base64Ceiling(3), 4);
+  assert.equal(base64Ceiling(4), 8);
+  assert.equal(base64Ceiling(6), 8);
+});
+
+// The ceiling must never sit below what a legal at-cap object actually encodes
+// to, or a legitimate put would be rejected by its own encoding.
+test("base64Ceiling is never below Node's own base64 length", () => {
+  for (const n of [0, 1, 2, 3, 4, 5, 100, 1023, 4096]) {
+    const encoded = Buffer.alloc(n).toString("base64").length;
+    assert.ok(
+      base64Ceiling(n) >= encoded,
+      `base64Ceiling(${n}) = ${base64Ceiling(n)} < ${encoded}`,
+    );
+  }
+});
+
+test("the put body ceiling admits a cap-sized object plus an envelope allowance", () => {
+  assert.equal(
+    R2_OBJECT_PUT_MAX_BODY_BYTES,
+    base64Ceiling(R2_OBJECT_MAX_BYTES) + 64 * 1024,
+  );
+  assert.ok(R2_OBJECT_PUT_MAX_BODY_BYTES > base64Ceiling(R2_OBJECT_MAX_BYTES));
+});
+
+// The allowance is for a key and JSON punctuation, not for smuggling a bigger
+// object: it must stay far below the cap it guards.
+test("the envelope allowance is negligible against the cap", () => {
+  const allowance = R2_OBJECT_PUT_MAX_BODY_BYTES - base64Ceiling(R2_OBJECT_MAX_BYTES);
+  assert.ok(allowance < R2_OBJECT_MAX_BYTES / 1000);
+});
+
+test("the over-cap message names the object and the limit", () => {
+  const msg = tooLargeMessage("photo.jpg", 150 * 1024 * 1024);
+  assert.match(msg, /photo\.jpg/);
+  assert.match(msg, /150\.0 MiB/);
+  assert.match(msg, /100\.0 MiB/);
+});
+
+// Code review — MiB alone rounds, so an object one byte over the cap rendered as
+// "100.0 MiB, which exceeds the 100.0 MiB limit": a message that contradicts
+// itself and reads as a bug rather than a rejection. The exact bytes are what
+// disambiguate it, so they are pinned rather than left to formatting taste.
+test("the message stays legible for an object one byte over the cap", () => {
+  const msg = tooLargeMessage("photo.jpg", R2_OBJECT_MAX_BYTES + 1);
+  assert.match(msg, /104857601 bytes/);
+  assert.match(msg, /104857600 bytes/);
+  assert.notEqual(
+    msg.match(/100\.0 MiB \(104857601 bytes\)/),
+    null,
+    "the actual size must carry its exact byte count",
+  );
+});