@rubytech/create-maxy-code 0.1.488 → 0.1.490

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-upload-multipart.test.ts

@@ -0,0 +1,211 @@
+import { describe, expect, it } from 'vitest'
+import {
+  MAX_PART_BYTES,
+  MAX_TOTAL_BYTES,
+  processMultipartComplete,
+  processMultipartCreate,
+  processMultipartPart,
+} from '../../skills/data-portal/template/functions/api/upload'
+import type { PortalEnv } from '../../skills/data-portal/template/functions/api/_lib/types'
+
+function harness(opts: { folders?: string[] } = {}) {
+  const folders = opts.folders ?? ['jobs']
+  const uploads = new Map<string, { key: string; parts: Map<number, number>; aborted: boolean }>()
+  const objects = new Map<string, number>()
+  const rows = new Map<string, Record<string, unknown>>()
+  const lines: string[] = []
+  let seq = 0
+
+  function session(id: string) {
+    const rec = uploads.get(id)!
+    return {
+      uploadId: id,
+      async uploadPart(n: number, body: Uint8Array) {
+        rec.parts.set(n, body.length)
+        return { partNumber: n, etag: `etag-${n}` }
+      },
+      async complete(parts: { partNumber: number; etag: string }[]) {
+        let total = 0
+        for (const p of parts) total += rec.parts.get(p.partNumber) ?? 0
+        objects.set(rec.key, total)
+        return { size: total }
+      },
+      async abort() {
+        rec.aborted = true
+      },
+    }
+  }
+
+  const env = {
+    BUCKET: {
+      async createMultipartUpload(key: string) {
+        const id = `r2-${++seq}`
+        uploads.set(id, { key, parts: new Map(), aborted: false })
+        return session(id)
+      },
+      resumeMultipartUpload(_key: string, id: string) {
+        return session(id)
+      },
+      async head(key: string) {
+        const s = objects.get(key)
+        return s === undefined ? null : { size: s }
+      },
+    },
+    DB: {
+      prepare(sql: string) {
+        return {
+          bind(...args: unknown[]) {
+            return {
+              async first() {
+                if (sql.includes('FROM sessions')) {
+                  return { ownerId: 'alice', accountId: 'acct', folders: '' }
+                }
+                if (sql.includes('isDir = 1')) {
+                  return folders.includes(String(args[1])) ? { relPath: args[1] } : null
+                }
+                if (sql.includes('SELECT fileId FROM manifest')) {
+                  return rows.get(String(args[0])) ?? null
+                }
+                return null
+              },
+              async run() {
+                rows.set(String(args[3]), { fileId: args[0], size: args[4] })
+              },
+            }
+          },
+        }
+      },
+    },
+  } as unknown as PortalEnv
+
+  let n = 0
+  return {
+    env, uploads, objects, rows, lines,
+    newId: () => `uid-${++n}`,
+    log: (l: string) => lines.push(l),
+  }
+}
+
+describe('multipart create', () => {
+  it('refuses a declared size over the total cap without opening a session', async () => {
+    // Checked before createMultipartUpload: an over-cap declaration must not
+    // leave an orphan multipart session accruing storage in R2 forever.
+    const h = harness()
+    const res = await processMultipartCreate(
+      's', 'big.zip', '', MAX_TOTAL_BYTES + 1, h.env, h.log, h.newId, () => 1,
+    )
+    expect(res.status).toBe(413)
+    expect(h.uploads.size).toBe(0)
+  })
+
+  it('opens a session under the cap and returns its ids', async () => {
+    const h = harness()
+    const res = await processMultipartCreate(
+      's', 'big.zip', '', 200 * 1024 * 1024, h.env, h.log, h.newId, () => 1,
+    )
+    expect(res.status).toBe(200)
+    expect(res.payload.r2UploadId).toBe('r2-1')
+    expect(res.payload.key).toBe('alice/big.zip')
+  })
+
+  it('applies the same target rule as a single-shot upload', async () => {
+    const h = harness({ folders: [] })
+    const res = await processMultipartCreate(
+      's', 'big.zip', 'jobs', 1024, h.env, h.log, h.newId, () => 1,
+    )
+    expect(res.status).toBe(403)
+    expect(h.uploads.size).toBe(0)
+  })
+
+  it('keys a targeted session under its folder', async () => {
+    const h = harness()
+    const res = await processMultipartCreate(
+      's', 'big.zip', 'jobs', 1024, h.env, h.log, h.newId, () => 1,
+    )
+    expect(res.payload.key).toBe('alice/jobs/big.zip')
+  })
+})
+
+describe('multipart part', () => {
+  it('refuses a part over the per-part gate', async () => {
+    const h = harness()
+    await processMultipartCreate('s', 'big.zip', '', 200 * 1024 * 1024, h.env, h.log, h.newId, () => 1)
+    const res = await processMultipartPart(
+      's', 'alice/big.zip', 'r2-1', 1, new Uint8Array(MAX_PART_BYTES + 1), h.env, h.log,
+    )
+    expect(res.status).toBe(413)
+  })
+
+  it('refuses a part whose key is not the caller own', async () => {
+    // The key arrives on EVERY part request, so it is re-authorized every time.
+    // A session that may write alice/ must not be able to append to bob/.
+    const h = harness()
+    const res = await processMultipartPart(
+      's', 'bob/big.zip', 'r2-1', 1, new Uint8Array(4), h.env, h.log,
+    )
+    expect(res.status).toBe(403)
+  })
+
+  it('accepts a part within the gate and returns its etag', async () => {
+    const h = harness()
+    await processMultipartCreate('s', 'big.zip', '', 200 * 1024 * 1024, h.env, h.log, h.newId, () => 1)
+    const res = await processMultipartPart(
+      's', 'alice/big.zip', 'r2-1', 1, new Uint8Array(8), h.env, h.log,
+    )
+    expect(res.status).toBe(200)
+    expect(res.payload.etag).toBe('etag-1')
+  })
+})
+
+describe('multipart complete', () => {
+  it('assembles the object and writes one manifest row', async () => {
+    const h = harness()
+    await processMultipartCreate('s', 'big.zip', '', 100, h.env, h.log, h.newId, () => 1)
+    await processMultipartPart('s', 'alice/big.zip', 'r2-1', 1, new Uint8Array(60), h.env, h.log)
+    await processMultipartPart('s', 'alice/big.zip', 'r2-1', 2, new Uint8Array(40), h.env, h.log)
+    const res = await processMultipartComplete(
+      's', 'alice/big.zip', 'r2-1', '',
+      [{ partNumber: 1, etag: 'etag-1' }, { partNumber: 2, etag: 'etag-2' }],
+      h.env, h.log, h.newId, () => 1,
+    )
+    expect(res.status).toBe(200)
+    expect(h.objects.get('alice/big.zip')).toBe(100)
+    expect(h.rows.size).toBe(1)
+  })
+
+  it('aborts rather than assembling when the summed parts exceed the cap', async () => {
+    // The declared size is a claim; the summed parts are the measurement. A
+    // client that under-declares must not get a 1 GiB+ object stored anyway.
+    const h = harness()
+    await processMultipartCreate('s', 'big.zip', '', 100, h.env, h.log, h.newId, () => 1)
+    const res = await processMultipartComplete(
+      's', 'alice/big.zip', 'r2-1', '',
+      [{ partNumber: 1, etag: 'e', size: MAX_TOTAL_BYTES }, { partNumber: 2, etag: 'e', size: 1 }],
+      h.env, h.log, h.newId, () => 1,
+    )
+    expect(res.status).toBe(413)
+    expect(h.uploads.get('r2-1')!.aborted).toBe(true)
+    expect(h.rows.size).toBe(0)
+  })
+
+  it('refuses a complete for a key that is not the caller own', async () => {
+    const h = harness()
+    const res = await processMultipartComplete(
+      's', 'bob/big.zip', 'r2-1', '', [{ partNumber: 1, etag: 'e' }], h.env, h.log, h.newId, () => 1,
+    )
+    expect(res.status).toBe(403)
+  })
+
+  it('logs op=complete with a re-read post-condition', async () => {
+    const h = harness()
+    await processMultipartCreate('s', 'big.zip', '', 10, h.env, h.log, h.newId, () => 1)
+    await processMultipartPart('s', 'alice/big.zip', 'r2-1', 1, new Uint8Array(10), h.env, h.log)
+    await processMultipartComplete(
+      's', 'alice/big.zip', 'r2-1', '', [{ partNumber: 1, etag: 'etag-1' }],
+      h.env, h.log, h.newId, () => 1,
+    )
+    expect(
+      h.lines.some((l) => l.includes('op=complete') && l.includes('objectPresent=true')),
+    ).toBe(true)
+  })
+})

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-upload-target.test.ts

@@ -0,0 +1,168 @@
+import { describe, expect, it } from 'vitest'
+import { processUpload } from '../../skills/data-portal/template/functions/api/upload'
+import type { PortalEnv } from '../../skills/data-portal/template/functions/api/_lib/types'
+
+/**
+ * The manifest is a Map keyed on objectKey, so the schema's `objectKey UNIQUE`
+ * is real rather than assumed. Task 1704's lesson: a fake that accepts what the
+ * store rejects passes a test the production path fails.
+ */
+function harness(opts: { folders?: string[]; grant?: string[] } = {}) {
+  const folders = opts.folders ?? ['jobs']
+  const objects = new Map<string, Uint8Array>()
+  const rows = new Map<string, Record<string, unknown>>()
+  const lines: string[] = []
+
+  const env = {
+    BUCKET: {
+      async put(key: string, body: Uint8Array) {
+        objects.set(key, body)
+      },
+      async head(key: string) {
+        const b = objects.get(key)
+        return b ? { size: b.length } : null
+      },
+    },
+    DB: {
+      prepare(sql: string) {
+        return {
+          bind(...args: unknown[]) {
+            return {
+              async first() {
+                if (sql.includes('FROM sessions')) {
+                  return {
+                    ownerId: 'alice',
+                    accountId: 'acct',
+                    folders: (opts.grant ?? []).join(','),
+                  }
+                }
+                if (sql.includes('isDir = 1')) {
+                  return folders.includes(String(args[1])) ? { relPath: args[1] } : null
+                }
+                if (sql.includes('SELECT fileId FROM manifest')) {
+                  return rows.get(String(args[0])) ?? null
+                }
+                return null
+              },
+              async run() {
+                // The upsert: conflict on objectKey replaces in place, which is
+                // what the real ON CONFLICT (objectKey) does.
+                const key = String(args[3])
+                rows.set(key, {
+                  fileId: args[0],
+                  ownerId: args[1],
+                  filename: args[2],
+                  objectKey: key,
+                  size: args[4],
+                  ingested: 0,
+                  targetPath: args[7],
+                })
+              },
+            }
+          },
+        }
+      },
+    },
+  } as unknown as PortalEnv
+
+  let n = 0
+  return {
+    env,
+    objects,
+    rows,
+    lines,
+    newId: () => `id-${++n}`,
+    log: (l: string) => lines.push(l),
+  }
+}
+
+describe('targeted upload', () => {
+  it('stores under the target and records it on the row', async () => {
+    const h = harness()
+    const res = await processUpload(
+      's', 'a.pdf', 'jobs', new Uint8Array([1, 2]), h.env, h.log, h.newId, () => 1000,
+    )
+    expect(res.status).toBe(200)
+    expect([...h.objects.keys()]).toEqual(['alice/jobs/a.pdf'])
+    expect(h.rows.get('alice/jobs/a.pdf')!.targetPath).toBe('jobs')
+  })
+
+  it('stores at the owner root when untargeted', async () => {
+    const h = harness()
+    const res = await processUpload(
+      's', 'a.pdf', '', new Uint8Array([1]), h.env, h.log, h.newId, () => 1000,
+    )
+    expect(res.status).toBe(200)
+    expect([...h.objects.keys()]).toEqual(['alice/a.pdf'])
+  })
+
+  it('keeps the same filename in two folders as two distinct objects', async () => {
+    // The reason the target is in the key. A flat key would collide these and
+    // the upsert would destroy the first upload.
+    const h = harness({ folders: ['jobs', 'output'] })
+    await processUpload('s', 'a.pdf', 'jobs', new Uint8Array([1]), h.env, h.log, h.newId, () => 1000)
+    await processUpload('s', 'a.pdf', 'output', new Uint8Array([2]), h.env, h.log, h.newId, () => 1000)
+    expect([...h.objects.keys()].sort()).toEqual(['alice/jobs/a.pdf', 'alice/output/a.pdf'])
+    expect(h.rows.size).toBe(2)
+  })
+
+  it('replaces on the same owner, folder and filename', async () => {
+    const h = harness()
+    await processUpload('s', 'a.pdf', 'jobs', new Uint8Array([1]), h.env, h.log, h.newId, () => 1000)
+    await processUpload('s', 'a.pdf', 'jobs', new Uint8Array([2, 2]), h.env, h.log, h.newId, () => 2000)
+    expect(h.rows.size).toBe(1)
+    expect(h.rows.get('alice/jobs/a.pdf')!.size).toBe(2)
+  })
+
+  it('refuses an out-of-grant target and stores nothing', async () => {
+    const h = harness({ grant: ['output'] })
+    const res = await processUpload(
+      's', 'a.pdf', 'jobs', new Uint8Array([1]), h.env, h.log, h.newId, () => 1000,
+    )
+    expect(res.status).toBe(403)
+    expect(h.objects.size).toBe(0)
+    expect(h.rows.size).toBe(0)
+    expect(
+      h.lines.some((l) => l.includes('op=target-check') && l.includes('result=denied-grant')),
+    ).toBe(true)
+  })
+
+  it('refuses a target the index does not publish', async () => {
+    const h = harness({ folders: [] })
+    const res = await processUpload(
+      's', 'a.pdf', 'jobs', new Uint8Array([1]), h.env, h.log, h.newId, () => 1000,
+    )
+    expect(res.status).toBe(403)
+    expect(h.objects.size).toBe(0)
+    expect(h.lines.some((l) => l.includes('result=denied-index'))).toBe(true)
+  })
+
+  it('refuses a traversal target and stores nothing', async () => {
+    const h = harness()
+    const res = await processUpload(
+      's', 'a.pdf', 'jobs/../..', new Uint8Array([1]), h.env, h.log, h.newId, () => 1000,
+    )
+    expect(res.status).toBe(403)
+    expect(h.objects.size).toBe(0)
+    expect(h.lines.some((l) => l.includes('result=denied-segment'))).toBe(true)
+  })
+
+  it('logs op=target-check result=allowed on the happy path', async () => {
+    const h = harness()
+    await processUpload('s', 'a.pdf', 'jobs', new Uint8Array([1]), h.env, h.log, h.newId, () => 1000)
+    expect(
+      h.lines.some((l) => l.includes('op=target-check') && l.includes('result=allowed')),
+    ).toBe(true)
+  })
+
+  it('checks the target before any store write', async () => {
+    // Ordering is the point: a denied caller must not be able to cause an R2
+    // put, the same rule the owner gate already follows.
+    const h = harness({ folders: [] })
+    await processUpload('s', 'a.pdf', 'jobs', new Uint8Array([1]), h.env, h.log, h.newId, () => 1000)
+    const targetAt = h.lines.findIndex((l) => l.includes('op=target-check'))
+    const putAt = h.lines.findIndex((l) => l.includes('op=r2-put'))
+    expect(targetAt).toBeGreaterThanOrEqual(0)
+    expect(putAt).toBe(-1)
+  })
+})

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-uploads-listing.test.ts

@@ -0,0 +1,138 @@
+import { describe, expect, it } from 'vitest'
+import { processFiles, shouldListUpload } from '../../skills/data-portal/template/functions/api/files'
+import type { PortalEnv } from '../../skills/data-portal/template/functions/api/_lib/types'
+
+const visible = new Set(['jobs', 'output'])
+
+/**
+ * A directory fake that HONOURS the generation pointer, unlike the older
+ * listing fake which matches `FROM directory` and returns every row whatever
+ * the query says.
+ *
+ * The distinction is the whole atomicity guarantee: rows staged at a generation
+ * the pointer does not name must be invisible. A fake that ignores the join
+ * would pass whether or not files.ts actually reads through it — Task 1704's
+ * lesson, that a fake modelling only the happy path proves nothing.
+ */
+function envWithGenerations(
+  rows: { relPath: string; isDir: number; generation: number }[],
+  currentGeneration: number | null,
+  manifest: Record<string, unknown>[] = [],
+) {
+  return {
+    DB: {
+      prepare(sql: string) {
+        return {
+          bind(...bound: unknown[]) {
+            return {
+              async first() {
+                if (sql.includes('FROM sessions')) {
+                  return { ownerId: 'alice', accountId: 'acct', folders: '' }
+                }
+                return null
+              },
+              async all() {
+                if (/FROM manifest/i.test(sql)) return { results: manifest }
+                if (/FROM directory/i.test(sql)) {
+                  // The JOIN: no pointer row means nothing is live at all.
+                  if (currentGeneration === null) return { results: [] }
+                  if (!/JOIN\s+directory_state/i.test(sql)) {
+                    throw new Error('directory read must join the generation pointer')
+                  }
+                  return {
+                    results: rows.filter(
+                      (r) => bound[0] === 'acct' && r.generation === currentGeneration,
+                    ),
+                  }
+                }
+                return { results: [] }
+              },
+            }
+          },
+        }
+      },
+    },
+  } as unknown as PortalEnv
+}
+
+describe('the listing reads through the generation pointer', () => {
+  it('shows only the generation the pointer names', async () => {
+    const env = envWithGenerations(
+      [
+        { relPath: 'jobs', isDir: 1, generation: 1 },
+        { relPath: 'output', isDir: 1, generation: 2 },
+      ],
+      1,
+    )
+    const res = await processFiles('s', env, () => {}, 1000)
+    const entries = (res.payload as { entries: { name: string }[] }).entries
+    expect(entries.map((e) => e.name)).toEqual(['jobs'])
+  })
+
+  it('shows the whole new tree the instant the pointer flips, never a mixture', async () => {
+    const rows = [
+      { relPath: 'jobs', isDir: 1, generation: 1 },
+      { relPath: 'output', isDir: 1, generation: 2 },
+      { relPath: 'quotes', isDir: 1, generation: 2 },
+    ]
+    const before = await processFiles('s', envWithGenerations(rows, 1), () => {}, 1000)
+    const after = await processFiles('s', envWithGenerations(rows, 2), () => {}, 1000)
+    expect((before.payload as { entries: unknown[] }).entries.length).toBe(1)
+    expect((after.payload as { entries: unknown[] }).entries.length).toBe(2)
+  })
+
+  it('shows nothing for an account that has never completed a publish', async () => {
+    const env = envWithGenerations([{ relPath: 'jobs', isDir: 1, generation: 1 }], null)
+    const res = await processFiles('s', env, () => {}, 1000)
+    expect((res.payload as { entries: unknown[] }).entries).toEqual([])
+  })
+})
+
+describe('the uploads panel and the tree agree on what is reachable', () => {
+  it('hides a moved row whose folder is live and lists one whose folder is not', async () => {
+    const env = envWithGenerations(
+      [{ relPath: 'jobs', isDir: 1, generation: 1 }],
+      1,
+      [
+        { fileId: 'f1', filename: 'a.pdf', devicePath: 'jobs/a.pdf', deleted: 0 },
+        { fileId: 'f2', filename: 'b.pdf', devicePath: 'uploads/alice/b.pdf', deleted: 0 },
+        { fileId: 'f3', filename: 'c.pdf', devicePath: '', deleted: 0 },
+      ],
+    )
+    const res = await processFiles('s', env, () => {}, 1000)
+    const files = (res.payload as { files: { fileId: string }[] }).files
+    expect(files.map((f) => f.fileId)).toEqual(['f2', 'f3'])
+  })
+})
+
+describe('shouldListUpload', () => {
+  it('lists a row still in transit', () => {
+    expect(shouldListUpload({ devicePath: '', deleted: 0 }, visible)).toBe(true)
+  })
+
+  it('hides a moved row whose folder the client can browse', () => {
+    // It is not gone, it is shown where it now lives. Listing it here too
+    // would put the same file on the page twice.
+    expect(shouldListUpload({ devicePath: 'jobs/a.pdf', deleted: 0 }, visible)).toBe(false)
+  })
+
+  it('lists a moved row the client cannot reach in the tree', () => {
+    // An untargeted upload lands in uploads/, which is never exposed. Hiding
+    // it here would make the file the client just sent unreachable entirely.
+    expect(shouldListUpload({ devicePath: 'uploads/alice/a.pdf', deleted: 0 }, visible)).toBe(true)
+  })
+
+  it('hides a withdrawn row while the device removal is pending', () => {
+    expect(shouldListUpload({ devicePath: 'uploads/alice/a.pdf', deleted: 1 }, visible)).toBe(false)
+  })
+
+  it('hides a withdrawn row that has not moved either', () => {
+    expect(shouldListUpload({ devicePath: '', deleted: 1 }, visible)).toBe(false)
+  })
+
+  it('matches on the whole top segment, never a prefix', () => {
+    // `job` must not satisfy a visible `jobs`, the same whole-segment rule
+    // grantAllows follows.
+    expect(shouldListUpload({ devicePath: 'job/a.pdf', deleted: 0 }, visible)).toBe(true)
+  })
+})