@tak-ps/node-tak 12.23.1 → 12.25.0

package/lib/utils/html-error.ts

@@ -0,0 +1,208 @@
+import Err from '@openaddresses/batch-error';
+import xmljs from '@tak-ps/xml-js';
+import type { Element } from '@tak-ps/xml-js';
+
+/**
+ * TAK Server (Tomcat) returns HTML "Exception Report" pages on failure.
+ * Parse them into a human readable message + plain-text details
+ * so clients don't render raw HTML.
+ */
+export interface HTMLErrorDetails {
+    /** <title> or <h1> */
+    title?: string;
+    /** <p><b>Label</b> value</p> pairs - ie: Type, Message, Description */
+    fields: Record<string, string>;
+    /** <pre> stack traces */
+    exception?: string;
+    /** Visible text fallback */
+    text: string;
+}
+
+const HIDDEN = new Set(['style', 'script', 'head']);
+
+function collapse(input: string): string {
+    return input.replace(/\s+/g, ' ').trim();
+}
+
+/** Linear-time tag stripper for malformed HTML - drops the contents of HIDDEN elements */
+function stripTags(html: string): string {
+    const lower = html.toLowerCase();
+    let out = '';
+    let i = 0;
+
+    while (i < html.length) {
+        const open = html.indexOf('<', i);
+        if (open === -1) {
+            out += html.slice(i);
+            break;
+        }
+
+        out += html.slice(i, open) + ' ';
+
+        const close = html.indexOf('>', open);
+        if (close === -1) break;
+
+        const tag = lower.slice(open + 1, close).trim().split(/\s/, 1)[0];
+        i = close + 1;
+
+        if (HIDDEN.has(tag)) {
+            const end = lower.indexOf(`</${tag}`, i);
+            if (end === -1) break;
+            i = html.indexOf('>', end);
+            if (i === -1) break;
+            i += 1;
+        }
+    }
+
+    return collapse(out);
+}
+
+function textOf(el: Element, opts: { skipPre?: boolean } = {}): string {
+    if (el.type === 'text') return String(el.text ?? '');
+    if (el.type !== 'element' || !el.elements) return '';
+    if (opts.skipPre && el.name === 'pre') return '';
+
+    return el.elements.map((child) => textOf(child, opts)).join('');
+}
+
+function* walk(el: Element, skipHidden = true): Generator<Element> {
+    if (el.type === 'element' && el.name && skipHidden && HIDDEN.has(el.name.toLowerCase())) return;
+
+    if (el.type === 'element') yield el;
+
+    for (const child of el.elements || []) yield* walk(child, skipHidden);
+}
+
+function find(root: Element, name: string): Element | undefined {
+    for (const el of walk(root, false)) {
+        if (el.name?.toLowerCase() === name) return el;
+    }
+}
+
+export function isHTML(body: unknown): body is string {
+    if (typeof body !== 'string') return false;
+
+    const head = body.slice(0, 512).trimStart().toLowerCase();
+
+    return head.startsWith('<!doctype html')
+        || head.startsWith('<html')
+        || /^<(head|body|title|h1)[\s>]/.test(head);
+}
+
+/** Returns null if body is not HTML */
+export function parseHTMLError(body: unknown): HTMLErrorDetails | null {
+    if (!isHTML(body)) return null;
+
+    const details: HTMLErrorDetails = {
+        fields: {},
+        text: '',
+    };
+
+    let root: Element;
+    try {
+        root = xmljs.xml2js(body, { compact: false }) as Element;
+    } catch {
+        // Not well-formed XHTML - fall back to visible text
+        details.text = stripTags(body);
+
+        return details;
+    }
+
+    const title = find(root, 'title') || find(root, 'h1');
+    if (title && collapse(textOf(title))) details.title = collapse(textOf(title));
+
+    const pres: string[] = [];
+    let text = '';
+
+    for (const el of walk(root)) {
+        const name = el.name?.toLowerCase();
+
+        if (name === 'p' && el.elements?.[0]?.name?.toLowerCase() === 'b') {
+            const label = collapse(textOf(el.elements[0]));
+            const value = collapse(el.elements.slice(1).map((child) => textOf(child)).join(''));
+
+            if (label && value) details.fields[label] = value;
+        } else if (name === 'pre') {
+            const value = textOf(el)
+                .split('\n')
+                .map((line) => line.trimEnd())
+                .join('\n')
+                .trim();
+
+            if (value) pres.push(value);
+        } else if (name === 'body') {
+            text = collapse(textOf(el, { skipPre: true }));
+        }
+    }
+
+    if (pres.length) details.exception = pres.join('\n\n');
+
+    details.text = text || collapse(textOf(root, { skipPre: true }));
+
+    return details;
+}
+
+/** Most useful human readable line from the page */
+export function summarizeHTMLError(details: HTMLErrorDetails, status?: number): string {
+    const message = details.fields.Message
+        || details.fields.message
+        || details.fields.Description
+        || details.fields.description;
+
+    if (message) return message;
+
+    if (details.exception) {
+        // "<ExceptionClass>: <message>"
+        const first = details.exception.split('\n')[0].trim();
+        const colon = first.indexOf(': ');
+        if (colon !== -1 && colon < first.length - 2) return first.slice(colon + 2).trim();
+    }
+
+    if (details.title) return details.title;
+
+    if (details.text) return details.text.length > 200 ? details.text.slice(0, 197) + '...' : details.text;
+
+    return status ? `Status Code: ${status}` : 'Unknown TAK Server Error';
+}
+
+/** Plain-text breakdown for an "Advanced" details pane */
+export function formatHTMLError(details: HTMLErrorDetails): string {
+    const lines: string[] = [];
+
+    if (details.title) lines.push(details.title);
+
+    for (const [label, value] of Object.entries(details.fields)) {
+        if (value) lines.push(`${label}: ${value}`);
+    }
+
+    if (details.exception) {
+        if (lines.length) lines.push('');
+        lines.push(details.exception);
+    }
+
+    if (!lines.length && details.text) lines.push(details.text);
+
+    return lines.join('\n');
+}
+
+/**
+ * TAK Server HTML error page - `safe` is the summary, `details` the full breakdown
+ */
+export class TAKServerError extends Err {
+    details: string;
+    html: string;
+    parsed: HTMLErrorDetails;
+
+    constructor(status: number, html: string, parsed?: HTMLErrorDetails) {
+        const details = parsed || parseHTMLError(html) || {
+            fields: {},
+            text: stripTags(html)
+        };
+
+        super(status, null, summarizeHTMLError(details, status));
+
+        this.parsed = details;
+        this.details = formatHTMLError(details);
+        this.html = html;
+    }
+}

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@tak-ps/node-tak",
     "type": "module",
-    "version": "12.23.1",
+    "version": "12.25.0",
     "description": "Lightweight JavaScript library for communicating with TAK Server",
     "author": "Nick Ingalls <nick@ingalls.ca>",
     "main": "dist/index.js",
@@ -37,14 +37,14 @@
         "@tak-ps/xml-js": "^2.0.3"
     },
     "peerDependencies": {
-        "@tak-ps/node-cot": "^v14.30.1"
+        "@tak-ps/node-cot": "^14.52.0"
     },
     "devDependencies": {
         "@eslint/js": "^10.0.1",
         "@inquirer/prompts": "^8.0.1",
         "@types/node": "^26.0.0",
         "@types/pem": "^1.14.4",
-        "c8": "^11.0.0",
+        "c8": "^12.0.0",
         "eslint": "^10.0.0",
         "tsx": "^4.19.4",
         "typedoc": "^0.28.1",

package/test/html-error.test.ts

@@ -0,0 +1,139 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import Err from '@openaddresses/batch-error';
+import {
+    TAKServerError,
+    isHTML,
+    parseHTMLError,
+    summarizeHTMLError,
+    formatHTMLError,
+} from '../lib/utils/html-error.js';
+
+const TOMCAT = `<!doctype html><html lang="en"><head><title>HTTP Status 500 &ndash; Internal Server Error</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 500 &ndash; Internal Server Error</h1><hr class="line" /><p><b>Type</b> Exception Report</p><p><b>Message</b> Exception performing TAK Server authentication</p><p><b>Description</b> The server encountered an unexpected condition that prevented it from fulfilling the request.</p><p><b>Exception</b></p><pre>org.springframework.security.authentication.BadCredentialsException: Exception performing TAK Server authentication
+\tcom.bbn.marti.util.spring.TakAuthenticationProvider.authenticateCore(TakAuthenticationProvider.java:190)
+\tcom.bbn.marti.util.spring.TakAuthenticationProvider.authenticate(TakAuthenticationProvider.java:244)
+\torg.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:181)
+</pre><p><b>Note</b> The full stack trace of the root cause is available in the server logs.</p><hr class="line" /><h3>Apache Tomcat/9.0.86</h3></body></html>`;
+
+test('html-error: isHTML', () => {
+    assert.equal(isHTML(TOMCAT), true);
+    assert.equal(isHTML('  <html><body>x</body></html>'), true);
+    assert.equal(isHTML('<h1>HTTP Status 404 – Not Found</h1>'), true);
+    assert.equal(isHTML('{"message":"nope"}'), false);
+    assert.equal(isHTML('Plain text failure'), false);
+    assert.equal(isHTML(null), false);
+    assert.equal(isHTML({}), false);
+});
+
+test('html-error: entities are decoded', () => {
+    const parsed = parseHTMLError('<html><body><p><b>Message</b> a &ndash; b &amp; &lt;c&gt; &#39;d&#39; &#x41;</p></body></html>');
+    assert.ok(parsed);
+    assert.equal(parsed.fields.Message, 'a – b & <c> \'d\' A');
+});
+
+test('html-error: malformed HTML strips hidden blocks & unterminated tags', () => {
+    const parsed = parseHTMLError('<html><script>let a = "<b>";</script><body><STYLE>b {x:y}</STYLE><p class="x">Gateway <b>Timeout</b><script>never closed');
+    assert.ok(parsed);
+    assert.equal(parsed.text, 'Gateway Timeout');
+    assert.equal(parseHTMLError('<html><body>Broken <tag')?.text, 'Broken');
+
+    // Pathological input scales linearly (CodeQL polynomial regex finding)
+    const time = (n: number) => {
+        const big = '<html>' + '<head\t'.repeat(n) + '<'.repeat(n);
+        const start = performance.now();
+        assert.ok(parseHTMLError(big));
+        return performance.now() - start;
+    };
+    time(1000); // warm up
+    const small = time(10000);
+    const large = time(40000);
+    assert.ok(large < Math.max(small * 10, 50), `4x input took ${large}ms vs ${small}ms`);
+});
+
+test('html-error: TAKServerError from non-HTML body', () => {
+    const err = new TAKServerError(502, 'upstream <b>down</b>');
+    assert.equal(err.message, 'upstream down');
+    assert.equal(err.details, 'upstream down');
+});
+
+test('html-error: malformed HTML falls back to visible text', () => {
+    const parsed = parseHTMLError('<html><head><style>b {x:y}</style></head><body><p>Bad Gateway<br>upstream unavailable</body></html>');
+    assert.ok(parsed);
+    assert.equal(parsed.title, undefined);
+    assert.equal(parsed.text, 'Bad Gateway upstream unavailable');
+    assert.equal(summarizeHTMLError(parsed, 502), 'Bad Gateway upstream unavailable');
+});
+
+test('html-error: parseHTMLError - Tomcat Exception Report', () => {
+    const parsed = parseHTMLError(TOMCAT);
+    assert.ok(parsed);
+
+    assert.equal(parsed.title, 'HTTP Status 500 – Internal Server Error');
+    assert.deepEqual(parsed.fields, {
+        Type: 'Exception Report',
+        Message: 'Exception performing TAK Server authentication',
+        Description: 'The server encountered an unexpected condition that prevented it from fulfilling the request.',
+        Note: 'The full stack trace of the root cause is available in the server logs.',
+    });
+
+    assert.ok(parsed.exception);
+    assert.ok(parsed.exception.startsWith('org.springframework.security.authentication.BadCredentialsException: Exception performing TAK Server authentication\n'));
+    assert.ok(parsed.exception.includes('TakAuthenticationProvider.java:244'));
+    assert.ok(!parsed.exception.endsWith('\n'));
+
+    // Styles & exception body are excluded from the text fallback
+    assert.ok(!parsed.text.includes('font-family'));
+    assert.ok(!parsed.text.includes('TakAuthenticationProvider'));
+    assert.ok(parsed.text.includes('Apache Tomcat/9.0.86'));
+
+    assert.equal(summarizeHTMLError(parsed), 'Exception performing TAK Server authentication');
+
+    const formatted = formatHTMLError(parsed);
+    assert.equal(formatted.split('\n').slice(0, 6).join('\n'), [
+        'HTTP Status 500 – Internal Server Error',
+        'Type: Exception Report',
+        'Message: Exception performing TAK Server authentication',
+        'Description: The server encountered an unexpected condition that prevented it from fulfilling the request.',
+        'Note: The full stack trace of the root cause is available in the server logs.',
+        '',
+    ].join('\n'));
+    assert.ok(formatted.endsWith('ProviderManager.authenticate(ProviderManager.java:181)'));
+});
+
+test('html-error: parseHTMLError - status page without Message', () => {
+    const parsed = parseHTMLError('<!doctype html><html><head><title>HTTP Status 404 &ndash; Not Found</title></head><body><h1>HTTP Status 404 &ndash; Not Found</h1><p><b>Type</b> Status Report</p><p><b>Description</b> The origin server did not find a current representation for the target resource.</p></body></html>');
+    assert.ok(parsed);
+    assert.equal(summarizeHTMLError(parsed, 404), 'The origin server did not find a current representation for the target resource.');
+});
+
+test('html-error: parseHTMLError - exception only', () => {
+    const parsed = parseHTMLError('<html><body><pre>java.lang.IllegalStateException: Mission already exists</pre></body></html>');
+    assert.ok(parsed);
+    assert.equal(summarizeHTMLError(parsed), 'Mission already exists');
+    assert.equal(formatHTMLError(parsed), 'java.lang.IllegalStateException: Mission already exists');
+});
+
+test('html-error: parseHTMLError - unstructured HTML', () => {
+    const parsed = parseHTMLError('<html><body><div>Service Unavailable</div></body></html>');
+    assert.ok(parsed);
+    assert.equal(parsed.title, undefined);
+    assert.equal(summarizeHTMLError(parsed, 503), 'Service Unavailable');
+    assert.equal(formatHTMLError(parsed), 'Service Unavailable');
+
+    assert.equal(parseHTMLError('not html'), null);
+});
+
+test('html-error: TAKServerError', () => {
+    const err = new TAKServerError(500, TOMCAT);
+
+    assert.ok(err instanceof Err);
+    assert.ok(err instanceof Error);
+    assert.equal(err.name, 'PublicError');
+    assert.equal(err.status, 500);
+    assert.equal(err.message, 'Exception performing TAK Server authentication');
+    assert.equal(err.safe, 'Exception performing TAK Server authentication');
+    assert.ok(err.details.startsWith('HTTP Status 500 – Internal Server Error\nType: Exception Report\n'));
+    assert.ok(err.details.includes('BadCredentialsException'));
+    assert.equal(err.html, TOMCAT);
+    assert.equal(err.parsed.fields.Type, 'Exception Report');
+});

package/test/mission-layer.test.ts

@@ -0,0 +1,137 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { Readable } from 'node:stream';
+import { Client } from 'undici';
+import type { Dispatcher } from 'undici';
+import TAKAPI from '../lib/api.js';
+import { APIAuthCertificate } from '../lib/auth.js';
+
+type RequestArgs = Parameters<Client['request']>[0];
+
+function mockResponse(statusCode: number, contentType: string, body: string): Dispatcher.ResponseData {
+    return {
+        statusCode,
+        headers: { 'content-type': contentType },
+        body: Readable.from([Buffer.from(body)]),
+        trailers: {}
+    } as unknown as Dispatcher.ResponseData;
+}
+
+test('MissionLayer.attachUids files UIDs under a layer via the contents paths body', async () => {
+    const originalRequest = Client.prototype.request;
+
+    let captured: RequestArgs | undefined;
+
+    Client.prototype.request = async function(opts: RequestArgs): Promise<Dispatcher.ResponseData> {
+        captured = opts;
+        return mockResponse(200, 'text/plain', '');
+    };
+
+    try {
+        const api = new TAKAPI(new URL('https://tak.example.com'), new APIAuthCertificate('cert', 'key'));
+
+        await api.MissionLayer.attachUids('mission-1', 'layer-1', {
+            uids: ['uid-1', 'uid-2'],
+            creatorUid: 'alice'
+        });
+
+        assert.ok(captured);
+        assert.equal(captured.method, 'PUT');
+        assert.equal(captured.path, '/Marti/api/missions/mission-1/contents?creatorUid=alice');
+        assert.deepEqual(JSON.parse(String(captured.body)), {
+            paths: {
+                'layer-1': [{ uids: ['uid-1', 'uid-2'] }]
+            }
+        });
+    } finally {
+        Client.prototype.request = originalRequest;
+    }
+});
+
+test('MissionLayer.attachUids uses the guid contents endpoint for GUID missions', async () => {
+    const originalRequest = Client.prototype.request;
+
+    let captured: RequestArgs | undefined;
+
+    Client.prototype.request = async function(opts: RequestArgs): Promise<Dispatcher.ResponseData> {
+        captured = opts;
+        return mockResponse(200, 'text/plain', '');
+    };
+
+    try {
+        const api = new TAKAPI(new URL('https://tak.example.com'), new APIAuthCertificate('cert', 'key'));
+
+        await api.MissionLayer.attachUids('11111111-2222-3333-4444-555555555555', 'layer-1', {
+            uids: ['uid-1'],
+            creatorUid: 'alice'
+        });
+
+        assert.ok(captured);
+        assert.equal(captured.method, 'PUT');
+        assert.equal(
+            captured.path,
+            '/Marti/api/missions/guid/11111111-2222-3333-4444-555555555555/contents?creatorUid=alice'
+        );
+    } finally {
+        Client.prototype.request = originalRequest;
+    }
+});
+
+test('MissionLayer.setParent re-parents layers via query params', async () => {
+    const originalRequest = Client.prototype.request;
+
+    let captured: RequestArgs | undefined;
+
+    Client.prototype.request = async function(opts: RequestArgs): Promise<Dispatcher.ResponseData> {
+        captured = opts;
+        return mockResponse(200, 'text/plain', '');
+    };
+
+    try {
+        const api = new TAKAPI(new URL('https://tak.example.com'), new APIAuthCertificate('cert', 'key'));
+
+        await api.MissionLayer.setParent('mission-1', {
+            layerUids: ['uid-1', 'uid-2'],
+            parentUid: 'layer-2',
+            creatorUid: 'alice'
+        });
+
+        assert.ok(captured);
+        assert.equal(captured.method, 'PUT');
+        assert.equal(
+            captured.path,
+            '/Marti/api/missions/mission-1/layers/parent?layerUid=uid-1&layerUid=uid-2&parentUid=layer-2&creatorUid=alice'
+        );
+    } finally {
+        Client.prototype.request = originalRequest;
+    }
+});
+
+test('MissionLayer.setParent omits parentUid to move a layer to the mission root', async () => {
+    const originalRequest = Client.prototype.request;
+
+    let captured: RequestArgs | undefined;
+
+    Client.prototype.request = async function(opts: RequestArgs): Promise<Dispatcher.ResponseData> {
+        captured = opts;
+        return mockResponse(200, 'text/plain', '');
+    };
+
+    try {
+        const api = new TAKAPI(new URL('https://tak.example.com'), new APIAuthCertificate('cert', 'key'));
+
+        await api.MissionLayer.setParent('11111111-2222-3333-4444-555555555555', {
+            layerUids: ['uid-1'],
+            creatorUid: 'alice'
+        });
+
+        assert.ok(captured);
+        assert.equal(captured.method, 'PUT');
+        assert.equal(
+            captured.path,
+            '/Marti/api/missions/guid/11111111-2222-3333-4444-555555555555/layers/parent?layerUid=uid-1&creatorUid=alice'
+        );
+    } finally {
+        Client.prototype.request = originalRequest;
+    }
+});

package/test/mission.test.ts

@@ -0,0 +1,173 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { Readable } from 'node:stream';
+import { Client } from 'undici';
+import type { Dispatcher } from 'undici';
+import TAKAPI from '../lib/api.js';
+import { APIAuthCertificate } from '../lib/auth.js';
+import { MissionSubscriberRole } from '../lib/api/mission.js';
+
+type RequestArgs = Parameters<Client['request']>[0];
+
+function mockResponse(statusCode: number, contentType: string, body: string): Dispatcher.ResponseData {
+    return {
+        statusCode,
+        headers: { 'content-type': contentType },
+        body: Readable.from([Buffer.from(body)]),
+        trailers: {}
+    } as unknown as Dispatcher.ResponseData;
+}
+
+test('Mission.setRole sends role as a bare query param and returns void', async () => {
+    const originalRequest = Client.prototype.request;
+
+    let captured: RequestArgs | undefined;
+
+    Client.prototype.request = async function(opts: RequestArgs): Promise<Dispatcher.ResponseData> {
+        captured = opts;
+        return mockResponse(200, 'text/plain', '');
+    };
+
+    try {
+        const api = new TAKAPI(new URL('https://tak.example.com'), new APIAuthCertificate('cert', 'key'));
+
+        const res = await api.Mission.setRole('mission-1', {
+            clientUid: 'client-1',
+            username: 'alice',
+            role: MissionSubscriberRole.MISSION_OWNER
+        });
+
+        assert.equal(res, undefined);
+        assert.ok(captured);
+        assert.equal(captured.method, 'PUT');
+        assert.equal(
+            captured.path,
+            '/Marti/api/missions/mission-1/role?clientUid=client-1&username=alice&role=MISSION_OWNER'
+        );
+    } finally {
+        Client.prototype.request = originalRequest;
+    }
+});
+
+test('Mission.subscriptionRoles parses a list of subscribers with roles', async () => {
+    const originalRequest = Client.prototype.request;
+
+    Client.prototype.request = async function(): Promise<Dispatcher.ResponseData> {
+        return mockResponse(200, 'application/json', JSON.stringify({
+            data: [{
+                clientUid: 'client-1',
+                username: 'alice',
+                createTime: '2026-01-01T00:00:00.000Z',
+                role: {
+                    permissions: ['MISSION_READ', 'MISSION_WRITE'],
+                    type: 'MISSION_SUBSCRIBER'
+                }
+            }]
+        }));
+    };
+
+    try {
+        const api = new TAKAPI(new URL('https://tak.example.com'), new APIAuthCertificate('cert', 'key'));
+
+        const res = await api.Mission.subscriptionRoles('mission-1');
+
+        assert.equal(res.data.length, 1);
+        assert.equal(res.data[0].username, 'alice');
+        assert.equal(res.data[0].role.type, 'MISSION_SUBSCRIBER');
+    } finally {
+        Client.prototype.request = originalRequest;
+    }
+});
+
+test('Mission.unsubscribe issues a DELETE with uid query param', async () => {
+    const originalRequest = Client.prototype.request;
+
+    let captured: RequestArgs | undefined;
+
+    Client.prototype.request = async function(opts: RequestArgs): Promise<Dispatcher.ResponseData> {
+        captured = opts;
+        return mockResponse(200, 'text/plain', '');
+    };
+
+    try {
+        const api = new TAKAPI(new URL('https://tak.example.com'), new APIAuthCertificate('cert', 'key'));
+
+        await api.Mission.unsubscribe('mission-1', { uid: 'client-1' });
+
+        assert.ok(captured);
+        assert.equal(captured.method, 'DELETE');
+        assert.equal(captured.path, '/Marti/api/missions/mission-1/subscription?uid=client-1');
+    } finally {
+        Client.prototype.request = originalRequest;
+    }
+});
+
+test('Mission.latestFeats parses each CoT individually and isolates invalid CoTs', async () => {
+    const originalRequest = Client.prototype.request;
+
+    let captured: RequestArgs | undefined;
+
+    Client.prototype.request = async function(opts: RequestArgs): Promise<Dispatcher.ResponseData> {
+        captured = opts;
+        return mockResponse(200, 'application/xml', `
+            <events>
+                <event version="2.0" uid="uid-valid" type="a-f-G" time="2026-08-11T00:00:00.000Z" start="2026-08-11T00:00:00.000Z" stale="2026-08-11T00:05:00.000Z" how="h-g-i-g-o">
+                    <point lat="1.1" lon="2.2" hae="0.0" ce="9999999.0" le="9999999.0"/>
+                    <detail>
+                        <contact callsign="ALPHA"/>
+                    </detail>
+                </event>
+                <event version="2.0" uid="uid-poisoned" type="a-f-G" time="2026-08-11T00:00:00.000Z" start="2026-08-11T00:00:00.000Z" stale="2026-08-11T00:05:00.000Z" how="h-g-i-g-o">
+                    <detail>
+                        <contact callsign="BRAVO"/>
+                    </detail>
+                </event>
+            </events>
+        `);
+    };
+
+    try {
+        const api = new TAKAPI(new URL('https://tak.example.com'), new APIAuthCertificate('cert', 'key'));
+
+        const res = await api.Mission.latestFeats('mission-1');
+
+        assert.ok(captured);
+        assert.equal(captured.method, 'GET');
+        assert.equal(captured.path, '/Marti/api/missions/mission-1/cot');
+
+        assert.equal(res.features.length, 1);
+        assert.equal(res.features[0].id, 'uid-valid');
+        assert.equal(res.features[0].properties.callsign, 'ALPHA');
+
+        assert.equal(res.invalid.length, 1);
+        assert.ok(res.invalid[0].error.length > 0);
+
+        const event = res.invalid[0].feature as {
+            _attributes?: Record<string, unknown>;
+            detail?: { contact?: { _attributes?: Record<string, unknown> } };
+        };
+
+        assert.equal(event._attributes?.uid, 'uid-poisoned');
+        assert.equal(event.detail?.contact?._attributes?.callsign, 'BRAVO');
+    } finally {
+        Client.prototype.request = originalRequest;
+    }
+});
+
+test('Mission.latestFeats returns empty results for an empty document', async () => {
+    const originalRequest = Client.prototype.request;
+
+    Client.prototype.request = async function(): Promise<Dispatcher.ResponseData> {
+        return mockResponse(200, 'application/xml', '<events></events>');
+    };
+
+    try {
+        const api = new TAKAPI(new URL('https://tak.example.com'), new APIAuthCertificate('cert', 'key'));
+
+        const res = await api.Mission.latestFeats('mission-1');
+
+        assert.deepEqual(res, { features: [], invalid: [] });
+    } finally {
+        Client.prototype.request = originalRequest;
+    }
+});