@sleep2agi/commhub-server 0.9.0-preview.28 → 0.9.0-preview.29

package/src/file-download-authz-dev-open.test.ts

@@ -27,7 +27,7 @@ const UPLOADS_DIR = mkdtempSync(join(tmpdir(), "anet-495-devopen-fs-"));
 
 // Set env BEFORE importing anything that touches db-adapter.ts or
 // server.ts (both capture env at module load).
-process.env.COMMHUB_DB = SERVER_DB;
+process.env.COMMHUB_DB ||= SERVER_DB;
 process.env.COMMHUB_UPLOADS_DIR = UPLOADS_DIR;
 process.env.HOST = "127.0.0.1";
 process.env.COMMHUB_DEV_OPEN = "1";

package/src/file-download-authz.test.ts

@@ -34,7 +34,7 @@ const MASTER_TOKEN = process.env.COMMHUB_AUTH_TOKEN ?? `master-495-${Date.now()}
 // Set env BEFORE importing anything that pulls in db-adapter.ts (which
 // refuses to open a default DB under NODE_ENV=test) or server.ts (which
 // captures DEV_OPEN + AUTH_TOKEN at module load).
-process.env.COMMHUB_DB = SERVER_DB;
+process.env.COMMHUB_DB ||= SERVER_DB;
 process.env.COMMHUB_UPLOADS_DIR = UPLOADS_DIR;
 process.env.HOST = "127.0.0.1";
 process.env.COMMHUB_AUTH_TOKEN = MASTER_TOKEN;
@@ -168,6 +168,10 @@ async function downloadAs(token: string | null, fileId: string): Promise<Respons
   return fetch(`${BASE}/api/files/${fileId}`, { headers });
 }
 
+async function downloadWithQueryToken(token: string, fileId: string): Promise<Response> {
+  return fetch(`${BASE}/api/files/${fileId}?token=${encodeURIComponent(token)}`);
+}
+
 describe.skipIf(!isProdMode)("#495 — GET /api/files/:file_id authorization (owner-only staged)", () => {
   let userBFileId = "";
 
@@ -238,6 +242,13 @@ describe.skipIf(!isProdMode)("#495 — GET /api/files/:file_id authorization (ow
     expect(res.status).toBe(401);
   });
 
+  test("🔴 valid query token is refused on file GET (credential must stay out of URLs)", async () => {
+    const res = await downloadWithQueryToken(userBToken, userBFileId);
+    expect(res.status).toBe(401);
+    const body: any = await res.json();
+    expect(body.error).toBe("unauthorized");
+  });
+
   test("non-owner request for an UNKNOWN file_id → 404 with same shape as owner-denied (no enumeration signal)", async () => {
     const res = await downloadAs(userAToken, "0123456789abcdef0123456789abcdef");
     expect(res.status).toBe(404);
@@ -257,6 +268,10 @@ async function headAs(token: string | null, fileId: string): Promise<Response> {
   return fetch(`${BASE}/api/files/${fileId}`, { method: "HEAD", headers });
 }
 
+async function headWithQueryToken(token: string, fileId: string): Promise<Response> {
+  return fetch(`${BASE}/api/files/${fileId}?token=${encodeURIComponent(token)}`, { method: "HEAD" });
+}
+
 describe.skipIf(!isProdMode)("#500 CR2 — HEAD /api/files/:file_id authorization (parity with GET)", () => {
   let userBFileId = "";
 
@@ -296,6 +311,11 @@ describe.skipIf(!isProdMode)("#500 CR2 — HEAD /api/files/:file_id authorizatio
     expect(res.status).toBe(401);
   });
 
+  test("🔴 valid query token is refused on file HEAD (same gate as GET)", async () => {
+    const res = await headWithQueryToken(userBToken, userBFileId);
+    expect(res.status).toBe(401);
+  });
+
   test("admin HEAD any file → 200 (operational access preserved on HEAD)", async () => {
     const res = await headAs(adminToken, userBFileId);
     expect(res.status).toBe(200);

package/src/file-download-date-bucket.test.ts

@@ -34,7 +34,7 @@ const UPLOADS_DIR = mkdtempSync(join(tmpdir(), "anet-509-fs-"));
 
 // Set env BEFORE importing anything that pulls in db-adapter.ts or
 // server.ts (which capture DEV_OPEN + AUTH_TOKEN at module load).
-process.env.COMMHUB_DB = SERVER_DB;
+process.env.COMMHUB_DB ||= SERVER_DB;
 process.env.COMMHUB_UPLOADS_DIR = UPLOADS_DIR;
 process.env.HOST = "127.0.0.1";
 delete process.env.COMMHUB_DEV_OPEN;

package/src/file-network-scope-dev-open.test.ts

@@ -20,7 +20,7 @@ import { tmpdir } from "os";
 const SERVER_DB = mkdtempSync(join(tmpdir(), "anet-503-devopen-db-")) + "/commhub.db";
 const UPLOADS_DIR = mkdtempSync(join(tmpdir(), "anet-503-devopen-fs-"));
 
-process.env.COMMHUB_DB = SERVER_DB;
+process.env.COMMHUB_DB ||= SERVER_DB;
 process.env.COMMHUB_UPLOADS_DIR = UPLOADS_DIR;
 process.env.HOST = "127.0.0.1";
 process.env.COMMHUB_DEV_OPEN = "1";

package/src/file-network-scope.test.ts

@@ -39,7 +39,7 @@ const MASTER_TOKEN = `master-503-${Date.now()}-${Math.floor(Math.random() * 1000
 // Env must be set before anything pulls in db-adapter.ts (which refuses
 // the default DB under NODE_ENV=test) or server.ts (which freezes
 // DEV_OPEN + AUTH_TOKEN at module load).
-process.env.COMMHUB_DB = SERVER_DB;
+process.env.COMMHUB_DB ||= SERVER_DB;
 process.env.COMMHUB_UPLOADS_DIR = UPLOADS_DIR;
 process.env.HOST = "127.0.0.1";
 process.env.COMMHUB_AUTH_TOKEN = MASTER_TOKEN;

package/src/health-redaction.test.ts

@@ -17,6 +17,7 @@ import { join } from "path";
 import { tmpdir } from "os";
 import { register, addNetworkMember, removeNetworkMember } from "./auth.js";
 import { db } from "./db.js";
+import { MAX_REQUEST_CONTENT_LENGTH, MAX_UPLOAD_BYTES } from "./uploads.js";
 
 const SERVER_DB = mkdtempSync(join(tmpdir(), "anet-health-red-db-")) + "/commhub.db";
 
@@ -91,6 +92,17 @@ describe("#473 anonymous /health — watchdog contract intact, no topology leak"
     expect(body.sse_connections).toBeGreaterThanOrEqual(1);
   });
 
+  test("exposes stable upload limits anonymously without exposing topology", async () => {
+    const res = await fetch(`${BASE}/health`);
+    expect(res.status).toBe(200);
+    const body = await res.json() as any;
+    expect(body.limits).toEqual({
+      max_upload_bytes: MAX_UPLOAD_BYTES,
+      max_request_content_length: MAX_REQUEST_CONTENT_LENGTH,
+    });
+    expect(body.limits.max_request_content_length).toBeGreaterThan(body.limits.max_upload_bytes);
+  });
+
   test("CLI count source stays truthful: health.sse_connections == /api/stats/sse total (no fake 0)", async () => {
     // The CLI's `anet doctor` line reads health.sse_connections now
     // (was Object.keys(sse_sessions).length). This pins that aggregate to

package/src/index.ts

@@ -6,6 +6,10 @@
 // tests and tooling import "./server.js" and get bootServer/startHub
 // without binding any port. Do NOT add logic here, and do NOT import
 // this module to "get at the server" — that starts one.
-import { startHub } from "./server.js";
-
+// The default production DB path is deliberately unavailable to ordinary
+// imports / bun -e probes. This run-entry is one of the two canonical places
+// allowed to opt in, and it must do so before dynamically importing server.ts
+// (whose dependency graph constructs the DB adapter at module evaluation).
+process.env.COMMHUB_SERVER = "1";
+const { startHub } = await import("./server.js");
 startHub();

package/src/network-name-http.test.ts

@@ -0,0 +1,71 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+import { createNetworkTokenForNode, register } from "./auth.js";
+import { db } from "./db.js";
+
+const PRIVATE_DB_DIR = mkdtempSync(join(tmpdir(), "anet-network-name-http-"));
+let server: any;
+let base = "";
+let userToken = "";
+let nodeToken = "";
+let networkId = "";
+let username = "";
+
+beforeAll(async () => {
+  process.env.COMMHUB_DB = process.env.COMMHUB_DB || join(PRIVATE_DB_DIR, "hub.db");
+  username = `network_name_${Date.now()}_${process.pid}`;
+  const registered = register(username, "NetworkName123!", undefined, "seed");
+  expect(registered.ok).toBe(true);
+  userToken = registered.token!;
+  networkId = registered.network_id!;
+  const userId = db.get<{ user_id: string }>(
+    "SELECT user_id FROM users WHERE username = ?1",
+    [username],
+  )!.user_id;
+  const minted = createNetworkTokenForNode(userId, networkId, "network-name-node");
+  expect(minted.ok).toBe(true);
+  nodeToken = minted.token!;
+  const mod: any = await import("./server.js");
+  server = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  base = `http://127.0.0.1:${server.port}`;
+});
+
+afterAll(() => {
+  try { server?.stop?.(true); } catch {}
+  try { rmSync(PRIVATE_DB_DIR, { recursive: true, force: true }); } catch {}
+});
+
+async function networks(token: string): Promise<any[]> {
+  const response = await fetch(`${base}/api/networks`, {
+    headers: { Authorization: `Bearer ${token}` },
+  });
+  expect(response.status).toBe(200);
+  const body = await response.json() as any;
+  expect(body.ok).toBe(true);
+  return body.networks;
+}
+
+describe("GET /api/networks name compatibility (#449)", () => {
+  test("utok rows expose equal non-null name and network_name", async () => {
+    const rows = await networks(userToken);
+    expect(rows).toHaveLength(1);
+    expect(rows[0].network_id).toBe(networkId);
+    // #449 is about `name` and `network_name` agreeing and being non-null.
+    // Pin them to the registered username rather than the literal "default":
+    // the auto-created network is named after its owner, so hardcoding the
+    // old literal would test the naming scheme instead of the compat shim.
+    expect(rows[0].network_name).toBe(username);
+    expect(rows[0].name).toBe(username);
+  });
+
+  test("network-bound ntok rows expose the same alias", async () => {
+    const rows = await networks(nodeToken);
+    expect(rows).toHaveLength(1);
+    expect(rows[0].network_id).toBe(networkId);
+    expect(rows[0].network_name).toBe(username);
+    expect(rows[0].name).toBe(rows[0].network_name);
+    expect(rows[0].name).not.toBeNull();
+  });
+});

package/src/network-scope.ts

@@ -72,6 +72,26 @@ export function singleNetworkId(scope: RestNetworkScope): string | null {
   return null;
 }
 
+/**
+ * Resolve one unambiguous network for a REST write.
+ *
+ * Admin read scope is intentionally global (`networkIds=null`), so it cannot
+ * by itself express that an admin happens to have exactly one membership.
+ * Writes must not inherit that ambiguity: use the sole real membership when
+ * one exists, and keep requiring an explicit network for zero or 2+.
+ */
+export function resolveRestWriteNetworkId(
+  scope: RestNetworkScope,
+  authCtx: { userId: string; networkId: string | null } | null,
+  isAdmin: boolean,
+): string | null {
+  const scoped = singleNetworkId(scope);
+  if (scoped) return scoped;
+  if (!authCtx || !isAdmin) return null;
+  const memberships = getUserNetworkIds(authCtx.userId);
+  return memberships.length === 1 ? memberships[0] : null;
+}
+
 export function canRestWriteNetwork(authCtx: { userId: string; networkId: string | null } | null, networkId: string | null, isAdmin: boolean): boolean {
   if (!authCtx) return true; // legacy global token or open dev mode
   if (isAdmin) return true;

package/src/node-attrs.test.ts

@@ -25,7 +25,7 @@ import { tmpdir } from "os";
 import { join } from "path";
 
 const tmpDb = join(mkdtempSync(join(tmpdir(), "anet-attrs-")), "commhub.db");
-process.env.COMMHUB_DB = tmpDb;
+process.env.COMMHUB_DB ||= tmpDb;
 const PORT = 23000 + Math.floor(Math.random() * 1500);
 process.env.PORT = String(PORT);
 process.env.HOST = "127.0.0.1";