@sleep2agi/commhub-server 0.9.0-preview.8 → 0.9.0-preview.81

package/src/dm-file-scope-http.test.ts

@@ -0,0 +1,178 @@
+// 人与人私信的文件只给私信里的人看(owner 2026-09-30「给人好像发不了图片」的后续)。
+//
+// 规则:文件上传时带 `?purpose=dm`(App 私信输入框这么传)= 它第一次用途就是私信 → 私信文件(index scope=dm)。
+// 私信文件只有上传者、带着它的私信的收发双方、管理员能下载;同网络的其他成员和节点令牌(Agent)都 404
+// (与其它拒绝同一个形状,不泄露文件存在)。不带 purpose 上传的文件 —— 例如先在 agent 会话里发过 —— 永远不会
+// 变成私信文件,之后转进私信也照旧全网成员可见。私信文件只能由看得见它的人再转发。
+
+import { describe, expect, test, beforeAll, afterAll } from "bun:test";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+import { register, addNetworkMember } from "./auth.js";
+import { db } from "./db.js";
+
+const DIR = mkdtempSync(join(tmpdir(), "anet-dm-file-scope-"));
+const PW = "DmFileScopePassw0rd!";
+let BASE = "";
+let hub: any = null;
+let NET = "";
+type U = { token: string; id: string };
+let admin: U, alice: U, bob: U, carol: U, dave: U;
+let adminNtok = "";
+
+const auth = (t: string) => ({ Authorization: `Bearer ${t}` });
+async function upload(token: string, body: string, query: string) {
+  const form = new FormData();
+  form.append("file", new Blob([new TextEncoder().encode(body)], { type: "image/png" }), "shot.png");
+  const res = await fetch(`${BASE}/api/upload?network_id=${NET}${query}`, { method: "POST", body: form, headers: auth(token) });
+  return { status: res.status, body: await res.json().catch(() => null) as any };
+}
+async function uploadId(token: string, body: string, query = "") {
+  const r = await upload(token, body, query);
+  expect(r.status).toBe(200);
+  return r.body.file_id as string;
+}
+async function dm(from: U, to: U, fileId: string, message = "") {
+  const res = await fetch(`${BASE}/api/dm`, {
+    method: "POST",
+    headers: { ...auth(from.token), "Content-Type": "application/json" },
+    body: JSON.stringify({ network_id: NET, to_user_id: to.id, message, attachments: [{ type: "file", file_id: fileId, name: "shot.png", mime: "image/png" }] }),
+  });
+  return { status: res.status, body: await res.json().catch(() => null) as any };
+}
+const fileStatus = async (token: string, fileId: string, method = "GET") =>
+  (await fetch(`${BASE}/api/files/${fileId}`, { method, headers: auth(token) })).status;
+const entry = (fileId: string) => JSON.parse(readFileSync(join(DIR, "uploads", ".index", `${fileId}.json`), "utf8"));
+
+beforeAll(async () => {
+  process.env.COMMHUB_DB ||= join(DIR, "hub.db");
+  process.env.COMMHUB_UPLOADS_DIR = join(DIR, "uploads");
+  process.env.HOST = "127.0.0.1";
+  const stamp = Date.now();
+  const a = register(`dmfs_admin_${stamp}`, PW);
+  db.run("UPDATE users SET role = 'admin' WHERE user_id = ?1", [a.user!.user_id]);
+  admin = { token: a.token!, id: a.user!.user_id };
+  adminNtok = a.network_token!;
+  NET = a.network_id!;
+  // alice / bob / carol see every agent (agent_access=all) — the members for whom a network-scoped file was readable
+  // before, i.e. where the gap was. dave is a restricted member (only granted agents).
+  const mk = (name: string, agentAccess: "all" | "granted"): U => {
+    const r = register(`${name}_${stamp}`, PW);
+    expect(addNetworkMember(NET, r.user!.user_id, "member", admin.id, { agentAccess }).ok).toBe(true);
+    return { token: r.token!, id: r.user!.user_id };
+  };
+  alice = mk("dmfs_alice", "all"); bob = mk("dmfs_bob", "all"); carol = mk("dmfs_carol", "all"); dave = mk("dmfs_dave", "granted");
+  const mod: any = await import("./server.js");
+  hub = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  BASE = `http://127.0.0.1:${hub.port}`;
+}, 30_000);
+
+afterAll(() => {
+  try { hub?.stop?.(true); } catch {}
+  try { rmSync(DIR, { recursive: true, force: true }); } catch {}
+});
+
+describe("upload ?purpose=dm", () => {
+  test("marks the index entry; absent purpose writes no scope key (old shape)", async () => {
+    expect(entry(await uploadId(alice.token, "p1", "&purpose=dm")).scope).toBe("dm");
+    expect("scope" in entry(await uploadId(alice.token, "p2"))).toBe(false);
+  });
+  test("an unknown purpose is refused, not silently treated as network scope", async () => {
+    const r = await upload(alice.token, "p3", "&purpose=DM");
+    expect(r.status).toBe(400);
+    expect(r.body.error).toBe("bad_purpose");
+  });
+});
+
+describe("a DM file is readable only by the people in the DM", () => {
+  test("alice → bob: alice and bob read it; carol (same network, not in the DM) and agents get 404; admin reads", async () => {
+    const fid = await uploadId(alice.token, "alice-to-bob", "&purpose=dm");
+    expect((await dm(alice, bob, fid)).status).toBe(200);
+    expect(await fileStatus(alice.token, fid)).toBe(200);
+    expect(await fileStatus(bob.token, fid)).toBe(200);
+    expect(await fileStatus(carol.token, fid)).toBe(404);
+    expect(await fileStatus(carol.token, fid, "HEAD")).toBe(404);
+    expect(await fileStatus(adminNtok, fid)).toBe(404);
+    expect(await fileStatus(admin.token, fid)).toBe(200);
+  });
+  test("bob → alice (other direction): same rule", async () => {
+    const fid = await uploadId(bob.token, "bob-to-alice", "&purpose=dm");
+    expect((await dm(bob, alice, fid)).status).toBe(200);
+    expect(await fileStatus(bob.token, fid)).toBe(200);
+    expect(await fileStatus(alice.token, fid)).toBe(200);
+    expect(await fileStatus(carol.token, fid)).toBe(404);
+  });
+  test("a restricted member in the DM reads it both ways; out of it, not", async () => {
+    const toDave = await uploadId(alice.token, "alice-to-dave", "&purpose=dm");
+    expect((await dm(alice, dave, toDave)).status).toBe(200);
+    expect(await fileStatus(dave.token, toDave)).toBe(200);
+    const fromDave = await uploadId(dave.token, "dave-to-alice", "&purpose=dm");
+    expect((await dm(dave, alice, fromDave)).status).toBe(200);
+    expect(await fileStatus(alice.token, fromDave)).toBe(200);
+    expect(await fileStatus(bob.token, fromDave)).toBe(404);
+    const other = await uploadId(alice.token, "alice-to-bob-2", "&purpose=dm");
+    await dm(alice, bob, other);
+    expect(await fileStatus(dave.token, other)).toBe(404);
+  });
+  test("before it is sent, only the uploader reads it", async () => {
+    const fid = await uploadId(alice.token, "draft", "&purpose=dm");
+    expect(await fileStatus(alice.token, fid)).toBe(200);
+    expect(await fileStatus(bob.token, fid)).toBe(404);
+  });
+  test("the DM thread still returns the attachment to both sides", async () => {
+    const fid = await uploadId(alice.token, "thread", "&purpose=dm");
+    await dm(alice, bob, fid, "看图");
+    const t = await (await fetch(`${BASE}/api/dm?network_id=${NET}&with=${alice.id}`, { headers: auth(bob.token) })).json() as any;
+    expect(JSON.parse(t.messages[0].meta_json).attachments[0].file_id).toBe(fid);
+  });
+});
+
+describe("nobody unlocks a DM file by putting its id into their own DM", () => {
+  test("carol DMs alice's DM file to bob → 403, and she still can't read it", async () => {
+    const fid = await uploadId(alice.token, "secret", "&purpose=dm");
+    expect((await dm(alice, bob, fid)).status).toBe(200);
+    const r = await dm(carol, bob, fid);
+    expect(r.status).toBe(403);
+    expect(r.body.error).toBe("attachment_not_accessible");
+    expect(await fileStatus(carol.token, fid)).toBe(404);
+  });
+  test("bob (who received it) may forward it to carol, and then carol reads it", async () => {
+    const fid = await uploadId(alice.token, "forwardable", "&purpose=dm");
+    expect((await dm(alice, bob, fid)).status).toBe(200);
+    expect((await dm(bob, carol, fid)).status).toBe(200);
+    expect(await fileStatus(carol.token, fid)).toBe(200);
+  });
+});
+
+describe("files whose first use was not a DM keep their scope", () => {
+  test("uploaded in an agent chat, then forwarded into a DM → still readable by every member", async () => {
+    const fid = await uploadId(alice.token, "agent-chat-first");
+    // first use: an agent task (what ChatScreen does: upload without purpose, send_task with the file id)
+    db.run(
+      `INSERT INTO tasks (task_id, from_name, to_name, status, content, network_id, meta_json) VALUES (?1, ?2, 'dmfs-agent', 'delivered', 'see image', ?3, ?4)`,
+      [`t_dmfs_${Date.now()}`, "dmfs_alice", NET, JSON.stringify({ attachments: [{ type: "file", file_id: fid }] })],
+    );
+    expect(await fileStatus(carol.token, fid)).toBe(200);
+    expect((await dm(alice, bob, fid)).status).toBe(200);
+    expect("scope" in entry(fid)).toBe(false);
+    expect(await fileStatus(carol.token, fid)).toBe(200);
+    expect(await fileStatus(bob.token, fid)).toBe(200);
+    expect(await fileStatus(adminNtok, fid)).toBe(200);
+  });
+  test("an old app's DM upload (no purpose) behaves exactly as before", async () => {
+    const fid = await uploadId(alice.token, "old-app");
+    expect((await dm(alice, bob, fid)).status).toBe(200);
+    expect(await fileStatus(carol.token, fid)).toBe(200);
+  });
+});
+
+describe("index entry integrity", () => {
+  test("a hand-edited unknown scope makes the entry invalid (404), never network-wide", async () => {
+    const fid = await uploadId(alice.token, "tamper", "&purpose=dm");
+    const path = join(DIR, "uploads", ".index", `${fid}.json`);
+    writeFileSync(path, JSON.stringify({ ...entry(fid), scope: "public" }));
+    expect(await fileStatus(alice.token, fid)).toBe(404);
+    expect(await fileStatus(carol.token, fid)).toBe(404);
+  });
+});

package/src/ext-token-shared.test.ts

@@ -0,0 +1,60 @@
+import { describe, expect, test } from "bun:test";
+import {
+  buildStoragePath,
+  pathForExistingBlob,
+  validateIndexEntry,
+} from "./uploads.js";
+
+const fileId = "0123456789abcdef0123456789abcdef";
+const dateBucket = "2026-08-09";
+const uploadsRoot = "/srv/uploads";
+
+const malicious = [
+  "../x",
+  "/abs/x",
+  ".png/../../y",
+  ".p ng",
+  ".p\0ng",
+  ".\\..\\x",
+  "." + "a".repeat(17),
+  ".tar.gz",
+];
+
+const legal = ["", ".png", ".PNG", ".mp4", "." + "a".repeat(16)];
+
+describe("#527 shared extension-token invariant", () => {
+  test("new-upload path rejects every malformed token and accepts the shared legal set", () => {
+    for (const ext of malicious) {
+      expect(() => buildStoragePath(fileId, ext, { uploadsRoot })).toThrow(/ext .* is invalid/);
+    }
+    for (const ext of legal) {
+      expect(buildStoragePath(fileId, ext, { uploadsRoot }).ext).toBe(ext);
+    }
+  });
+
+  test("existing-blob path rejects every malformed token and accepts the shared legal set", () => {
+    for (const ext of malicious) {
+      expect(() => pathForExistingBlob(dateBucket, fileId, ext, { uploadsRoot })).toThrow(/ext .* is invalid/);
+    }
+    for (const ext of legal) {
+      expect(pathForExistingBlob(dateBucket, fileId, ext, { uploadsRoot }).ext).toBe(ext);
+    }
+  });
+
+  test("stored-index gate rejects every malformed token and accepts the shared legal set", () => {
+    for (const ext of malicious) {
+      expect(validateIndexEntry({ file_id: fileId, date_bucket: dateBucket, ext, size: 0 })).toBe(false);
+    }
+    for (const ext of legal) {
+      expect(validateIndexEntry({ file_id: fileId, date_bucket: dateBucket, ext, size: 0 })).toBe(true);
+    }
+  });
+
+  test("all three boundaries fail closed on non-string runtime values", () => {
+    for (const ext of [undefined, null, 7, {}, []]) {
+      expect(() => buildStoragePath(fileId, ext as never, { uploadsRoot })).toThrow(/ext .* is invalid/);
+      expect(() => pathForExistingBlob(dateBucket, fileId, ext as never, { uploadsRoot })).toThrow(/ext .* is invalid/);
+      expect(validateIndexEntry({ file_id: fileId, date_bucket: dateBucket, ext, size: 0 })).toBe(false);
+    }
+  });
+});

package/src/ext-validation-regression.test.ts

@@ -0,0 +1,131 @@
+// Task #25 — regression pins for ext validation in validateIndexEntry.
+//
+// 🔴 SCOPE: this suite exercises the stored-index boundary through
+// `validateIndexEntry`. Issue #527 removed the three independent copies
+// of the stored extension-token grammar: buildStoragePath,
+// pathForExistingBlob and validateIndexEntry now use one shared private
+// validator. `ext-token-shared.test.ts` separately pins all three call
+// sites. sanitizeExt remains intentionally independent because it parses
+// a client filename rather than validating an already-extracted token.
+//
+// Background (通信龙 d01bb8ce): the stored extension-token grammar
+// `/^\.[A-Za-z0-9]{1,16}$/` correctly rejects 11 known malicious ext
+// values (path-escape, traversal, absolute paths, doubles, NUL bytes,
+// backslash forms, over-length, whitespace). Verified via real-run on
+// origin/main by lead — 11/11 malicious values → false.
+//
+// But NO test locked that behavior. Anyone who widens the regex in the
+// future (accidentally or on purpose) would not hit a red test — the
+// live protection would degrade silently. This suite pins current
+// behavior in two directions:
+//
+//   1. SAFETY  (欠修 direction) — 11 malicious values → false, one row
+//      per value with the exact literal. If regex is widened to accept
+//      any of them, that row turns red.
+//   2. NON-REGRESSION (过修 direction) — a set of common legitimate
+//      extensions → true. If regex is tightened to reject any of them
+//      (e.g. someone locks down to a whitelist), that row turns red.
+//
+// Witnessed-red for the SAFETY rows: temporarily widen the regex to
+// `/./` (or comment it out) in validateIndexEntry, run this suite,
+// confirm all 11 malicious rows turn red, then revert. The mutation
+// itself is not committed; the assertion IS the mutation-red proof
+// for the reader. Recording the mutation output in the followup PR
+// body (per Constraint 3 discipline established in #503).
+//
+// Pure unit test — no server setup, no DB, no filesystem. The regex
+// lives in a pure function, so the guard is testable at that level.
+
+import { describe, expect, test } from "bun:test";
+import { validateIndexEntry } from "./uploads.js";
+
+// A structurally-valid base entry — file_id / date_bucket / size all
+// pass their own checks — so `ext` is the only field a test row varies.
+// This isolates the ext regex as the deciding factor.
+const validBase = {
+  file_id: "0123456789abcdef0123456789abcdef",
+  date_bucket: "2026-07-30",
+  size: 0,
+};
+
+describe("Task #25 (#503 followup) — ext validation regression pins", () => {
+  describe("SAFETY: the 11 malicious ext values from lead d01bb8ce all return false", () => {
+    // Each row uses the exact literal from lead's verification list so
+    // a widening regex catches on the same value the manual audit did.
+    const malicious: Array<{ label: string; ext: string }> = [
+      { label: "path-escape prefix",          ext: "../x" },
+      { label: "deep traversal to /etc",       ext: "../../etc/passwd" },
+      { label: "absolute path",               ext: "/abs/x" },
+      { label: "double-dot alone",            ext: ".." },
+      { label: "single-dot alone",            ext: "." },
+      { label: "chained after legit prefix",  ext: ".png/../../y" },
+      { label: "embedded whitespace",         ext: ".p ng" },
+      { label: "over-length (>16 chars)",     ext: "." + "a".repeat(17) },
+      { label: "embedded NUL byte",           ext: ".p\x00ng" },
+      { label: "backslash traversal",         ext: ".\\..\\x" },
+      { label: "double-backslash prefix",     ext: "..\\x" },
+    ];
+    for (const { label, ext } of malicious) {
+      test(`rejects: ${label} — ext=${JSON.stringify(ext)}`, () => {
+        expect(validateIndexEntry({ ...validBase, ext })).toBe(false);
+      });
+    }
+
+    test("precondition: 11 malicious cases enumerated (defends against silent test-shrink)", () => {
+      // If someone deletes rows from the malicious list, this fails
+      // instead of the deletion silently narrowing the guard. Number
+      // matches lead's verification list — bump only when lead adds a
+      // case and confirms it via real-run.
+      expect(malicious.length).toBe(11);
+    });
+  });
+
+  describe("NON-REGRESSION: common legitimate extensions all return true (防过修)", () => {
+    // These are the extensions the live upload path actually produces
+    // via sanitizeExt / mime-typed multipart uploads. If someone
+    // tightens the regex to a stricter whitelist, any of these turning
+    // red flags a break in a normal user path.
+    const legal = [".png", ".pdf", ".pptx", ".jpg", ".jpeg", ".txt", ".mp4", ".zip", ".json", ".md"];
+    for (const ext of legal) {
+      test(`accepts: ext=${JSON.stringify(ext)}`, () => {
+        expect(validateIndexEntry({ ...validBase, ext })).toBe(true);
+      });
+    }
+
+    test("empty ext is accepted (file with no extension is a legitimate upload)", () => {
+      expect(validateIndexEntry({ ...validBase, ext: "" })).toBe(true);
+    });
+
+    test("precondition: at least 10 legitimate ext values pinned", () => {
+      // Same discipline as the malicious side — reject silent shrink.
+      expect(legal.length).toBeGreaterThanOrEqual(10);
+    });
+  });
+
+  describe("regex shape assumptions (documented, not enforced by the function)", () => {
+    // These rows document facts the current regex enforces beyond the
+    // 11 malicious literals. They are close to the boundary and would
+    // be the first things to move if someone reworked the regex.
+    test("upper-case extensions accepted (regex is case-insensitive by [A-Za-z])", () => {
+      expect(validateIndexEntry({ ...validBase, ext: ".PNG" })).toBe(true);
+    });
+    test("mixed-case extensions accepted", () => {
+      expect(validateIndexEntry({ ...validBase, ext: ".PdF" })).toBe(true);
+    });
+    test("digits after dot accepted (e.g. .mp4, .mp3)", () => {
+      expect(validateIndexEntry({ ...validBase, ext: ".mp4" })).toBe(true);
+    });
+    test("exactly 16 chars after dot is accepted (upper bound of {1,16})", () => {
+      expect(validateIndexEntry({ ...validBase, ext: "." + "a".repeat(16) })).toBe(true);
+    });
+    test("exactly 17 chars after dot is rejected (immediately past upper bound)", () => {
+      expect(validateIndexEntry({ ...validBase, ext: "." + "a".repeat(17) })).toBe(false);
+    });
+    test("compound extensions like .tar.gz are rejected (contains inner dot)", () => {
+      // Documented: the current regex does not support compound
+      // extensions. If we ever want .tar.gz support, it needs its
+      // own explicit design + this row updated with lead sign-off.
+      expect(validateIndexEntry({ ...validBase, ext: ".tar.gz" })).toBe(false);
+    });
+  });
+});