@rubytech/create-maxy-code 0.1.489 → 0.1.491

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-moved-download.test.ts

@@ -0,0 +1,83 @@
+import { describe, expect, it } from 'vitest'
+import { processDownload } from '../../skills/data-portal/template/functions/api/download'
+import type { PortalEnv } from '../../skills/data-portal/template/functions/api/_lib/types'
+
+const ACC = '098a18a3-1741-447f-9778-65470645d57d'
+
+function harness(row: { devicePath: string } | null, opts: { configured?: boolean } = {}) {
+  const configured = opts.configured ?? true
+  const lines: string[] = []
+  const env = {
+    BUCKET: {
+      async get(key: string) {
+        // Only an in-transit object exists. A moved row's bytes are gone from
+        // R2 entirely, which is what makes reading them here the wrong move.
+        return row && !row.devicePath ? { body: null, size: 4, key } : null
+      },
+    },
+    DB: {
+      prepare(sql: string) {
+        return {
+          bind() {
+            return {
+              async first() {
+                if (sql.includes('FROM sessions')) {
+                  return { ownerId: 'alice', accountId: ACC, folders: '' }
+                }
+                if (sql.includes('devicePath')) return row
+                return null
+              },
+            }
+          },
+        }
+      },
+    },
+    PORTAL_FETCH_SECRET: configured ? 'test-secret-value' : undefined,
+    PORTAL_INSTALL_ORIGIN: configured ? 'https://install.example' : undefined,
+  } as unknown as PortalEnv
+  return { env, lines, log: (l: string) => lines.push(l) }
+}
+
+describe('downloading an upload that has moved to the device', () => {
+  it('streams R2 bytes while the row is still in transit', async () => {
+    const h = harness({ devicePath: '' })
+    const res = await processDownload('s', 'alice/a.pdf', h.env, h.log, 1000)
+    expect(res.status).toBe(200)
+    expect(res.body).not.toBeNull()
+    expect(res.url).toBeUndefined()
+  })
+
+  it('mints an own-upload link once the row has moved', async () => {
+    // The object is gone from R2. Without this branch the client's own upload
+    // would 404 the moment the device collected it.
+    const h = harness({ devicePath: 'uploads/alice/a.pdf' })
+    const res = await processDownload('s', 'alice/a.pdf', h.env, h.log, 1000)
+    expect(res.status).toBe(200)
+    expect(res.url).toContain('/api/portal/fetch')
+    expect(new URL(res.url!).searchParams.get('owner')).toBe('alice')
+    expect(new URL(res.url!).searchParams.get('path')).toBe('uploads/alice/a.pdf')
+    expect(h.lines.some((l) => l.includes('op=download') && l.includes('result=moved'))).toBe(true)
+  })
+
+  it('refuses another person key before anything is minted', async () => {
+    const h = harness({ devicePath: 'uploads/bob/a.pdf' })
+    const res = await processDownload('s', 'bob/a.pdf', h.env, h.log, 1000)
+    expect(res.status).toBe(403)
+    expect(res.url).toBeUndefined()
+  })
+
+  it('reports device-offline rather than a server error when unconfigured', async () => {
+    // Same reasoning as the indexed path: from the client's side the file
+    // genuinely is unreachable, and the operator's signal is the log line.
+    const h = harness({ devicePath: 'uploads/alice/a.pdf' }, { configured: false })
+    const res = await processDownload('s', 'alice/a.pdf', h.env, h.log, 1000)
+    expect(res.status).toBe(503)
+    expect(h.lines.some((l) => l.includes('result=unconfigured'))).toBe(true)
+  })
+
+  it('reports absent for a key with no manifest row at all', async () => {
+    const h = harness(null)
+    const res = await processDownload('s', 'alice/gone.pdf', h.env, h.log, 1000)
+    expect(res.status).toBe(404)
+  })
+})

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-schema-shape.test.ts

@@ -0,0 +1,48 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+
+// The schema is applied by the skill, not by any code this suite can call, so
+// its shape is asserted textually. A missing column here is not a test failure
+// in some other file — it is an upload naming a column D1 does not have.
+const SQL = readFileSync(
+  join(__dirname, '../../skills/data-portal/schema.sql'),
+  'utf8',
+)
+
+describe('portal schema shape', () => {
+  it('carries the manifest lifecycle columns', () => {
+    expect(SQL).toMatch(/targetPath\s+TEXT\s+NOT NULL\s+DEFAULT\s+''/)
+    expect(SQL).toMatch(/devicePath\s+TEXT\s+NOT NULL\s+DEFAULT\s+''/)
+    expect(SQL).toMatch(/deleted\s+INTEGER\s+NOT NULL\s+DEFAULT\s+0/)
+  })
+
+  it('carries the directory generation and its pointer table', () => {
+    expect(SQL).toMatch(/generation\s+INTEGER\s+NOT NULL\s+DEFAULT\s+0/)
+    expect(SQL).toMatch(/CREATE TABLE IF NOT EXISTS directory_state/)
+    expect(SQL).toMatch(/currentGeneration\s+INTEGER\s+NOT NULL/)
+  })
+
+  it('keeps objectKey UNIQUE, which the upsert conflict target still needs', () => {
+    // objectKey is now ownerId/targetPath/filename. The upsert still conflicts
+    // on it, so this pins that the constraint was not dropped by accident while
+    // the key shape changed underneath it.
+    expect(SQL).toMatch(/objectKey\s+TEXT\s+UNIQUE\s+NOT NULL/)
+  })
+
+  it('scopes the directory uniqueness by generation', () => {
+    // Two generations hold the same relPath at once between the write and the
+    // flip. UNIQUE (accountId, relPath) would reject the second write and the
+    // push could never stage a new generation at all.
+    expect(SQL).toMatch(/UNIQUE\s*\(\s*accountId,\s*relPath,\s*generation\s*\)/)
+  })
+
+  it('documents the hand-run ALTER for every added column', () => {
+    // IF NOT EXISTS adds no column to an existing table, so a portal deployed
+    // before this needs each one by hand. An undocumented column is an operator
+    // reading "no such column" with nothing telling them what to run.
+    for (const col of ['targetPath', 'devicePath', 'deleted', 'generation']) {
+      expect(SQL).toMatch(new RegExp(`ALTER TABLE \\w+ ADD COLUMN ${col}\\b`))
+    }
+  })
+})

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-sign.test.ts

@@ -4,6 +4,9 @@ import {
   signPath,
   verifyPath,
   buildSignedUrl,
+  signOwnUpload,
+  verifyOwnUpload,
+  buildOwnUploadUrl,
 } from '../../skills/data-portal/template/functions/api/_lib/portal-sign.mjs'
 
 const SECRET = 'test-secret-value'
@@ -66,3 +69,62 @@ describe('portal-sign', () => {
     expect(url.searchParams.get('sig')).toMatch(/^[0-9a-f]{64}$/)
   })
 })
+
+// The second link type (Task 1910). An untargeted upload moves to
+// `uploads/<ownerId>/`, which the exposed set never contains, so the ordinary
+// signature cannot reach it and the device has no way to know whose folder is
+// being asked for. Binding the owner INSIDE the HMAC is what makes that safe.
+describe('own-upload signatures', () => {
+  const OWNER = 'alice'
+  const PATH = 'uploads/alice/invoice.pdf'
+
+  it('verifies a link minted for the same owner', async () => {
+    const exp = NOW + 1000
+    const sig = await signOwnUpload(SECRET, ACC, OWNER, PATH, exp)
+    expect(await verifyOwnUpload(SECRET, ACC, OWNER, PATH, exp, sig, NOW)).toBe(true)
+  })
+
+  it('refuses the same path claimed under a different owner', async () => {
+    // The whole point: bob must not be able to present alice's link, and a
+    // portal must not be able to mint one into her folder.
+    const exp = NOW + 1000
+    const sig = await signOwnUpload(SECRET, ACC, OWNER, PATH, exp)
+    expect(await verifyOwnUpload(SECRET, ACC, 'bob', PATH, exp, sig, NOW)).toBe(false)
+  })
+
+  it('is a DIFFERENT message from the exposed-folder signature', async () => {
+    // If the two shapes collided, an ordinary signed link would admit an
+    // uploads path and the owner binding would be decorative.
+    const exp = NOW + 1000
+    const own = await signOwnUpload(SECRET, ACC, OWNER, PATH, exp)
+    const plain = await signPath(SECRET, ACC, PATH, exp)
+    expect(own).not.toBe(plain)
+  })
+
+  it('does not verify under the ordinary scheme', async () => {
+    const exp = NOW + 1000
+    const own = await signOwnUpload(SECRET, ACC, OWNER, PATH, exp)
+    expect(await verifyPath(SECRET, ACC, PATH, exp, own, NOW)).toBe(false)
+  })
+
+  it('refuses an expired link', async () => {
+    const exp = NOW - 1
+    const sig = await signOwnUpload(SECRET, ACC, OWNER, PATH, exp)
+    expect(await verifyOwnUpload(SECRET, ACC, OWNER, PATH, exp, sig, NOW)).toBe(false)
+  })
+
+  it('refuses a wrong secret', async () => {
+    const exp = NOW + 1000
+    const sig = await signOwnUpload(SECRET, ACC, OWNER, PATH, exp)
+    expect(await verifyOwnUpload('other-secret', ACC, OWNER, PATH, exp, sig, NOW)).toBe(false)
+  })
+
+  it('carries the owner as a query parameter so the device can name it', async () => {
+    const raw = await buildOwnUploadUrl('https://install.example', SECRET, ACC, OWNER, PATH, NOW + 1000)
+    const url = new URL(raw)
+    expect(url.pathname).toBe('/api/portal/fetch')
+    expect(url.searchParams.get('owner')).toBe(OWNER)
+    expect(url.searchParams.get('path')).toBe(PATH)
+    expect(url.searchParams.get('sig')).toMatch(/^[0-9a-f]{64}$/)
+  })
+})

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-target.test.ts

@@ -0,0 +1,103 @@
+import { describe, expect, it } from 'vitest'
+import {
+  checkTarget,
+  isSafeTargetSegment,
+  uploadKey,
+} from '../../skills/data-portal/template/functions/api/_lib/target'
+
+/** A D1 fake whose `first()` answers from a set of published folder rows. It
+ *  models the real query's constraint rather than its happy path: a row is a
+ *  folder only when isDir = 1, so a fake that ignored the filter would let a
+ *  file path pass as an upload target. */
+function fakeDb(folders: string[]) {
+  return {
+    prepare(sql: string) {
+      return {
+        bind(_accountId: string, relPath: string) {
+          return {
+            async first() {
+              if (!sql.includes('isDir = 1')) throw new Error('query must filter isDir')
+              return folders.includes(relPath) ? { relPath } : null
+            },
+          }
+        },
+      }
+    },
+  } as never
+}
+
+/** Any query at all is a failure for the cases that must refuse before the
+ *  index is read. Refusing early is not an optimisation here: it is what keeps
+ *  an out-of-grant probe from costing a database round trip. */
+const noQueryDb = {
+  prepare() {
+    throw new Error('must not query')
+  },
+} as never
+
+describe('isSafeTargetSegment', () => {
+  it('rejects traversal, separators, empties and NUL', () => {
+    for (const bad of ['', '.', '..', 'a/b', 'a\\b', 'a\0b']) {
+      expect(isSafeTargetSegment(bad)).toBe(false)
+    }
+  })
+
+  it('accepts an ordinary folder name', () => {
+    expect(isSafeTargetSegment('jobs')).toBe(true)
+  })
+})
+
+describe('uploadKey', () => {
+  it('collapses to owner/filename when untargeted', () => {
+    expect(uploadKey('alice', '', 'a.pdf')).toBe('alice/a.pdf')
+  })
+
+  it('carries the target so two folders never collide', () => {
+    expect(uploadKey('alice', 'jobs', 'a.pdf')).toBe('alice/jobs/a.pdf')
+    expect(uploadKey('alice', 'jobs/2026', 'a.pdf')).toBe('alice/jobs/2026/a.pdf')
+  })
+})
+
+describe('checkTarget', () => {
+  it('admits the empty target without touching the index', async () => {
+    expect(await checkTarget(noQueryDb, 'acct', [], '')).toEqual({ ok: true })
+  })
+
+  it('admits a granted folder that the index publishes', async () => {
+    expect(await checkTarget(fakeDb(['jobs']), 'acct', [], 'jobs')).toEqual({ ok: true })
+  })
+
+  it('admits a nested path under a granted top-level folder', async () => {
+    expect(await checkTarget(fakeDb(['jobs/2026']), 'acct', ['jobs'], 'jobs/2026')).toEqual({
+      ok: true,
+    })
+  })
+
+  it('refuses a folder outside the grant before reading the index', async () => {
+    expect(await checkTarget(noQueryDb, 'acct', ['output'], 'jobs')).toEqual({
+      ok: false,
+      reason: 'grant',
+    })
+  })
+
+  it('refuses a folder the index does not publish', async () => {
+    expect(await checkTarget(fakeDb(['jobs']), 'acct', [], 'output')).toEqual({
+      ok: false,
+      reason: 'index',
+    })
+  })
+
+  it('refuses a traversal segment before any lookup', async () => {
+    expect(await checkTarget(noQueryDb, 'acct', [], 'jobs/../secrets')).toEqual({
+      ok: false,
+      reason: 'segment',
+    })
+  })
+
+  it('refuses a trailing separator, which is an empty segment', async () => {
+    expect(await checkTarget(noQueryDb, 'acct', [], 'jobs/')).toEqual({
+      ok: false,
+      reason: 'segment',
+    })
+  })
+})

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-upload-multipart.test.ts

@@ -0,0 +1,211 @@
+import { describe, expect, it } from 'vitest'
+import {
+  MAX_PART_BYTES,
+  MAX_TOTAL_BYTES,
+  processMultipartComplete,
+  processMultipartCreate,
+  processMultipartPart,
+} from '../../skills/data-portal/template/functions/api/upload'
+import type { PortalEnv } from '../../skills/data-portal/template/functions/api/_lib/types'
+
+function harness(opts: { folders?: string[] } = {}) {
+  const folders = opts.folders ?? ['jobs']
+  const uploads = new Map<string, { key: string; parts: Map<number, number>; aborted: boolean }>()
+  const objects = new Map<string, number>()
+  const rows = new Map<string, Record<string, unknown>>()
+  const lines: string[] = []
+  let seq = 0
+
+  function session(id: string) {
+    const rec = uploads.get(id)!
+    return {
+      uploadId: id,
+      async uploadPart(n: number, body: Uint8Array) {
+        rec.parts.set(n, body.length)
+        return { partNumber: n, etag: `etag-${n}` }
+      },
+      async complete(parts: { partNumber: number; etag: string }[]) {
+        let total = 0
+        for (const p of parts) total += rec.parts.get(p.partNumber) ?? 0
+        objects.set(rec.key, total)
+        return { size: total }
+      },
+      async abort() {
+        rec.aborted = true
+      },
+    }
+  }
+
+  const env = {
+    BUCKET: {
+      async createMultipartUpload(key: string) {
+        const id = `r2-${++seq}`
+        uploads.set(id, { key, parts: new Map(), aborted: false })
+        return session(id)
+      },
+      resumeMultipartUpload(_key: string, id: string) {
+        return session(id)
+      },
+      async head(key: string) {
+        const s = objects.get(key)
+        return s === undefined ? null : { size: s }
+      },
+    },
+    DB: {
+      prepare(sql: string) {
+        return {
+          bind(...args: unknown[]) {
+            return {
+              async first() {
+                if (sql.includes('FROM sessions')) {
+                  return { ownerId: 'alice', accountId: 'acct', folders: '' }
+                }
+                if (sql.includes('isDir = 1')) {
+                  return folders.includes(String(args[1])) ? { relPath: args[1] } : null
+                }
+                if (sql.includes('SELECT fileId FROM manifest')) {
+                  return rows.get(String(args[0])) ?? null
+                }
+                return null
+              },
+              async run() {
+                rows.set(String(args[3]), { fileId: args[0], size: args[4] })
+              },
+            }
+          },
+        }
+      },
+    },
+  } as unknown as PortalEnv
+
+  let n = 0
+  return {
+    env, uploads, objects, rows, lines,
+    newId: () => `uid-${++n}`,
+    log: (l: string) => lines.push(l),
+  }
+}
+
+describe('multipart create', () => {
+  it('refuses a declared size over the total cap without opening a session', async () => {
+    // Checked before createMultipartUpload: an over-cap declaration must not
+    // leave an orphan multipart session accruing storage in R2 forever.
+    const h = harness()
+    const res = await processMultipartCreate(
+      's', 'big.zip', '', MAX_TOTAL_BYTES + 1, h.env, h.log, h.newId, () => 1,
+    )
+    expect(res.status).toBe(413)
+    expect(h.uploads.size).toBe(0)
+  })
+
+  it('opens a session under the cap and returns its ids', async () => {
+    const h = harness()
+    const res = await processMultipartCreate(
+      's', 'big.zip', '', 200 * 1024 * 1024, h.env, h.log, h.newId, () => 1,
+    )
+    expect(res.status).toBe(200)
+    expect(res.payload.r2UploadId).toBe('r2-1')
+    expect(res.payload.key).toBe('alice/big.zip')
+  })
+
+  it('applies the same target rule as a single-shot upload', async () => {
+    const h = harness({ folders: [] })
+    const res = await processMultipartCreate(
+      's', 'big.zip', 'jobs', 1024, h.env, h.log, h.newId, () => 1,
+    )
+    expect(res.status).toBe(403)
+    expect(h.uploads.size).toBe(0)
+  })
+
+  it('keys a targeted session under its folder', async () => {
+    const h = harness()
+    const res = await processMultipartCreate(
+      's', 'big.zip', 'jobs', 1024, h.env, h.log, h.newId, () => 1,
+    )
+    expect(res.payload.key).toBe('alice/jobs/big.zip')
+  })
+})
+
+describe('multipart part', () => {
+  it('refuses a part over the per-part gate', async () => {
+    const h = harness()
+    await processMultipartCreate('s', 'big.zip', '', 200 * 1024 * 1024, h.env, h.log, h.newId, () => 1)
+    const res = await processMultipartPart(
+      's', 'alice/big.zip', 'r2-1', 1, new Uint8Array(MAX_PART_BYTES + 1), h.env, h.log,
+    )
+    expect(res.status).toBe(413)
+  })
+
+  it('refuses a part whose key is not the caller own', async () => {
+    // The key arrives on EVERY part request, so it is re-authorized every time.
+    // A session that may write alice/ must not be able to append to bob/.
+    const h = harness()
+    const res = await processMultipartPart(
+      's', 'bob/big.zip', 'r2-1', 1, new Uint8Array(4), h.env, h.log,
+    )
+    expect(res.status).toBe(403)
+  })
+
+  it('accepts a part within the gate and returns its etag', async () => {
+    const h = harness()
+    await processMultipartCreate('s', 'big.zip', '', 200 * 1024 * 1024, h.env, h.log, h.newId, () => 1)
+    const res = await processMultipartPart(
+      's', 'alice/big.zip', 'r2-1', 1, new Uint8Array(8), h.env, h.log,
+    )
+    expect(res.status).toBe(200)
+    expect(res.payload.etag).toBe('etag-1')
+  })
+})
+
+describe('multipart complete', () => {
+  it('assembles the object and writes one manifest row', async () => {
+    const h = harness()
+    await processMultipartCreate('s', 'big.zip', '', 100, h.env, h.log, h.newId, () => 1)
+    await processMultipartPart('s', 'alice/big.zip', 'r2-1', 1, new Uint8Array(60), h.env, h.log)
+    await processMultipartPart('s', 'alice/big.zip', 'r2-1', 2, new Uint8Array(40), h.env, h.log)
+    const res = await processMultipartComplete(
+      's', 'alice/big.zip', 'r2-1', '',
+      [{ partNumber: 1, etag: 'etag-1' }, { partNumber: 2, etag: 'etag-2' }],
+      h.env, h.log, h.newId, () => 1,
+    )
+    expect(res.status).toBe(200)
+    expect(h.objects.get('alice/big.zip')).toBe(100)
+    expect(h.rows.size).toBe(1)
+  })
+
+  it('aborts rather than assembling when the summed parts exceed the cap', async () => {
+    // The declared size is a claim; the summed parts are the measurement. A
+    // client that under-declares must not get a 1 GiB+ object stored anyway.
+    const h = harness()
+    await processMultipartCreate('s', 'big.zip', '', 100, h.env, h.log, h.newId, () => 1)
+    const res = await processMultipartComplete(
+      's', 'alice/big.zip', 'r2-1', '',
+      [{ partNumber: 1, etag: 'e', size: MAX_TOTAL_BYTES }, { partNumber: 2, etag: 'e', size: 1 }],
+      h.env, h.log, h.newId, () => 1,
+    )
+    expect(res.status).toBe(413)
+    expect(h.uploads.get('r2-1')!.aborted).toBe(true)
+    expect(h.rows.size).toBe(0)
+  })
+
+  it('refuses a complete for a key that is not the caller own', async () => {
+    const h = harness()
+    const res = await processMultipartComplete(
+      's', 'bob/big.zip', 'r2-1', '', [{ partNumber: 1, etag: 'e' }], h.env, h.log, h.newId, () => 1,
+    )
+    expect(res.status).toBe(403)
+  })
+
+  it('logs op=complete with a re-read post-condition', async () => {
+    const h = harness()
+    await processMultipartCreate('s', 'big.zip', '', 10, h.env, h.log, h.newId, () => 1)
+    await processMultipartPart('s', 'alice/big.zip', 'r2-1', 1, new Uint8Array(10), h.env, h.log)
+    await processMultipartComplete(
+      's', 'alice/big.zip', 'r2-1', '', [{ partNumber: 1, etag: 'etag-1' }],
+      h.env, h.log, h.newId, () => 1,
+    )
+    expect(
+      h.lines.some((l) => l.includes('op=complete') && l.includes('objectPresent=true')),
+    ).toBe(true)
+  })
+})

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-upload-target.test.ts

@@ -0,0 +1,168 @@
+import { describe, expect, it } from 'vitest'
+import { processUpload } from '../../skills/data-portal/template/functions/api/upload'
+import type { PortalEnv } from '../../skills/data-portal/template/functions/api/_lib/types'
+
+/**
+ * The manifest is a Map keyed on objectKey, so the schema's `objectKey UNIQUE`
+ * is real rather than assumed. Task 1704's lesson: a fake that accepts what the
+ * store rejects passes a test the production path fails.
+ */
+function harness(opts: { folders?: string[]; grant?: string[] } = {}) {
+  const folders = opts.folders ?? ['jobs']
+  const objects = new Map<string, Uint8Array>()
+  const rows = new Map<string, Record<string, unknown>>()
+  const lines: string[] = []
+
+  const env = {
+    BUCKET: {
+      async put(key: string, body: Uint8Array) {
+        objects.set(key, body)
+      },
+      async head(key: string) {
+        const b = objects.get(key)
+        return b ? { size: b.length } : null
+      },
+    },
+    DB: {
+      prepare(sql: string) {
+        return {
+          bind(...args: unknown[]) {
+            return {
+              async first() {
+                if (sql.includes('FROM sessions')) {
+                  return {
+                    ownerId: 'alice',
+                    accountId: 'acct',
+                    folders: (opts.grant ?? []).join(','),
+                  }
+                }
+                if (sql.includes('isDir = 1')) {
+                  return folders.includes(String(args[1])) ? { relPath: args[1] } : null
+                }
+                if (sql.includes('SELECT fileId FROM manifest')) {
+                  return rows.get(String(args[0])) ?? null
+                }
+                return null
+              },
+              async run() {
+                // The upsert: conflict on objectKey replaces in place, which is
+                // what the real ON CONFLICT (objectKey) does.
+                const key = String(args[3])
+                rows.set(key, {
+                  fileId: args[0],
+                  ownerId: args[1],
+                  filename: args[2],
+                  objectKey: key,
+                  size: args[4],
+                  ingested: 0,
+                  targetPath: args[7],
+                })
+              },
+            }
+          },
+        }
+      },
+    },
+  } as unknown as PortalEnv
+
+  let n = 0
+  return {
+    env,
+    objects,
+    rows,
+    lines,
+    newId: () => `id-${++n}`,
+    log: (l: string) => lines.push(l),
+  }
+}
+
+describe('targeted upload', () => {
+  it('stores under the target and records it on the row', async () => {
+    const h = harness()
+    const res = await processUpload(
+      's', 'a.pdf', 'jobs', new Uint8Array([1, 2]), h.env, h.log, h.newId, () => 1000,
+    )
+    expect(res.status).toBe(200)
+    expect([...h.objects.keys()]).toEqual(['alice/jobs/a.pdf'])
+    expect(h.rows.get('alice/jobs/a.pdf')!.targetPath).toBe('jobs')
+  })
+
+  it('stores at the owner root when untargeted', async () => {
+    const h = harness()
+    const res = await processUpload(
+      's', 'a.pdf', '', new Uint8Array([1]), h.env, h.log, h.newId, () => 1000,
+    )
+    expect(res.status).toBe(200)
+    expect([...h.objects.keys()]).toEqual(['alice/a.pdf'])
+  })
+
+  it('keeps the same filename in two folders as two distinct objects', async () => {
+    // The reason the target is in the key. A flat key would collide these and
+    // the upsert would destroy the first upload.
+    const h = harness({ folders: ['jobs', 'output'] })
+    await processUpload('s', 'a.pdf', 'jobs', new Uint8Array([1]), h.env, h.log, h.newId, () => 1000)
+    await processUpload('s', 'a.pdf', 'output', new Uint8Array([2]), h.env, h.log, h.newId, () => 1000)
+    expect([...h.objects.keys()].sort()).toEqual(['alice/jobs/a.pdf', 'alice/output/a.pdf'])
+    expect(h.rows.size).toBe(2)
+  })
+
+  it('replaces on the same owner, folder and filename', async () => {
+    const h = harness()
+    await processUpload('s', 'a.pdf', 'jobs', new Uint8Array([1]), h.env, h.log, h.newId, () => 1000)
+    await processUpload('s', 'a.pdf', 'jobs', new Uint8Array([2, 2]), h.env, h.log, h.newId, () => 2000)
+    expect(h.rows.size).toBe(1)
+    expect(h.rows.get('alice/jobs/a.pdf')!.size).toBe(2)
+  })
+
+  it('refuses an out-of-grant target and stores nothing', async () => {
+    const h = harness({ grant: ['output'] })
+    const res = await processUpload(
+      's', 'a.pdf', 'jobs', new Uint8Array([1]), h.env, h.log, h.newId, () => 1000,
+    )
+    expect(res.status).toBe(403)
+    expect(h.objects.size).toBe(0)
+    expect(h.rows.size).toBe(0)
+    expect(
+      h.lines.some((l) => l.includes('op=target-check') && l.includes('result=denied-grant')),
+    ).toBe(true)
+  })
+
+  it('refuses a target the index does not publish', async () => {
+    const h = harness({ folders: [] })
+    const res = await processUpload(
+      's', 'a.pdf', 'jobs', new Uint8Array([1]), h.env, h.log, h.newId, () => 1000,
+    )
+    expect(res.status).toBe(403)
+    expect(h.objects.size).toBe(0)
+    expect(h.lines.some((l) => l.includes('result=denied-index'))).toBe(true)
+  })
+
+  it('refuses a traversal target and stores nothing', async () => {
+    const h = harness()
+    const res = await processUpload(
+      's', 'a.pdf', 'jobs/../..', new Uint8Array([1]), h.env, h.log, h.newId, () => 1000,
+    )
+    expect(res.status).toBe(403)
+    expect(h.objects.size).toBe(0)
+    expect(h.lines.some((l) => l.includes('result=denied-segment'))).toBe(true)
+  })
+
+  it('logs op=target-check result=allowed on the happy path', async () => {
+    const h = harness()
+    await processUpload('s', 'a.pdf', 'jobs', new Uint8Array([1]), h.env, h.log, h.newId, () => 1000)
+    expect(
+      h.lines.some((l) => l.includes('op=target-check') && l.includes('result=allowed')),
+    ).toBe(true)
+  })
+
+  it('checks the target before any store write', async () => {
+    // Ordering is the point: a denied caller must not be able to cause an R2
+    // put, the same rule the owner gate already follows.
+    const h = harness({ folders: [] })
+    await processUpload('s', 'a.pdf', 'jobs', new Uint8Array([1]), h.env, h.log, h.newId, () => 1000)
+    const targetAt = h.lines.findIndex((l) => l.includes('op=target-check'))
+    const putAt = h.lines.findIndex((l) => l.includes('op=r2-put'))
+    expect(targetAt).toBeGreaterThanOrEqual(0)
+    expect(putAt).toBe(-1)
+  })
+})