@tuturuuu/utils 0.0.3 → 0.6.0

package/src/__tests__/permissions.test.tsx

@@ -0,0 +1,81 @@
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { describe, expect, it } from 'vitest';
+import { permissions } from '../permissions';
+
+describe('workspace permission catalog', () => {
+  const workspaceId = '11111111-1111-4111-8111-111111111111';
+  const repoRoot = process.cwd().endsWith('/packages/utils')
+    ? resolve(process.cwd(), '../..')
+    : process.cwd();
+  const invoiceProductPermissionIds = [
+    'adjust_inventory_stock',
+    'create_inventory_sales',
+    'manage_inventory_catalog',
+    'manage_inventory_setup',
+    'view_inventory_analytics',
+    'view_inventory_audit_logs',
+    'view_inventory_catalog',
+    'view_inventory_dashboard',
+    'view_inventory_sales',
+    'view_inventory_stock',
+  ];
+
+  it('keeps workspace role forms scoped by default', () => {
+    const permissionIds = permissions({
+      wsId: workspaceId,
+      user: null,
+    }).map((permission) => permission.id);
+
+    expect(permissionIds).toContain('admin');
+    expect(permissionIds).not.toContain('view_infrastructure');
+    expect(permissionIds).not.toContain('manage_infrastructure_stress_tests');
+    expect(permissionIds).not.toContain('manage_workspace_secrets');
+  });
+
+  it('exposes the full shared catalog for typed defaults', () => {
+    const permissionIds = permissions({
+      catalog: 'full',
+      wsId: workspaceId,
+      user: null,
+    }).map((permission) => permission.id);
+
+    expect(permissionIds).toContain('admin');
+    expect(permissionIds).toContain('view_infrastructure');
+    expect(permissionIds).toContain('manage_infrastructure_stress_tests');
+    expect(permissionIds).toContain('manage_external_migrations');
+    expect(permissionIds).toContain('manage_workspace_secrets');
+    expect(new Set(permissionIds).size).toBe(permissionIds.length);
+  });
+
+  it('exposes invoice product troubleshooting permissions in workspace roles', () => {
+    const permissionIds = permissions({
+      wsId: workspaceId,
+      user: null,
+    }).map((permission) => permission.id);
+
+    for (const permissionId of invoiceProductPermissionIds) {
+      expect(permissionIds).toContain(permissionId);
+    }
+  });
+
+  it('keeps Finance app role translations for invoice product permissions', () => {
+    const locales = ['en', 'vi'];
+
+    for (const locale of locales) {
+      const messages = JSON.parse(
+        readFileSync(
+          resolve(repoRoot, `apps/finance/messages/${locale}.json`),
+          'utf8'
+        )
+      ) as { 'ws-roles': Record<string, string> };
+
+      for (const permissionId of invoiceProductPermissionIds) {
+        expect(messages['ws-roles'][permissionId]?.length).toBeGreaterThan(0);
+        expect(
+          messages['ws-roles'][`${permissionId}_description`]?.length
+        ).toBeGreaterThan(0);
+      }
+    }
+  });
+});

package/src/__tests__/request-emoji-limit.test.ts

@@ -0,0 +1,172 @@
+import { NextRequest } from 'next/server';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import {
+  countEmojisInString,
+  findRequestContentViolation,
+  getRequestContentViolationForRequest,
+  isTrustedEmojiBypassRequest,
+  MAX_EMOJIS_PER_FIELD,
+  MAX_SHORT_TEXT_FIELD_GRAPHEMES,
+  shouldValidateEmojiLimit,
+} from '../request-emoji-limit';
+
+function makeRequest(
+  body: string,
+  options?: {
+    contentType?: string;
+    headers?: Record<string, string>;
+    method?: string;
+  }
+) {
+  return new NextRequest('http://localhost/api/test', {
+    method: options?.method ?? 'POST',
+    headers: {
+      'Content-Type': options?.contentType ?? 'application/json',
+      ...(options?.headers ?? {}),
+    },
+    body,
+  });
+}
+
+afterEach(() => {
+  vi.unstubAllEnvs();
+});
+
+describe('request emoji limit', () => {
+  it('counts pictographic emojis without counting plain numbers', () => {
+    expect(countEmojisInString('wallet 123')).toBe(0);
+    expect(countEmojisInString(`wallet ${'🎉'.repeat(3)}`)).toBe(3);
+  });
+
+  it('counts flag emoji graphemes correctly', () => {
+    expect(countEmojisInString('🇻🇳'.repeat(2))).toBe(2);
+  });
+
+  it('finds the first nested field over the limit', () => {
+    const violation = findRequestContentViolation({
+      wallet: {
+        name: '🎉'.repeat(MAX_EMOJIS_PER_FIELD + 1),
+      },
+    });
+
+    expect(violation).toEqual({
+      code: 'EMOJI_LIMIT_EXCEEDED',
+      path: 'body.wallet.name',
+      count: MAX_EMOJIS_PER_FIELD + 1,
+      limit: MAX_EMOJIS_PER_FIELD,
+      message: 'Field "body.wallet.name" cannot contain more than 10 emojis',
+    });
+  });
+
+  it('rejects text bombs in short-form metadata fields', () => {
+    const violation = findRequestContentViolation({
+      wallet: {
+        name: '漢字仮名交響曲'.repeat(
+          Math.ceil(
+            (MAX_SHORT_TEXT_FIELD_GRAPHEMES + 1) / '漢字仮名交響曲'.length
+          )
+        ),
+      },
+    });
+
+    expect(violation).toEqual({
+      code: 'TEXT_BOMB_DETECTED',
+      path: 'body.wallet.name',
+      count: 287,
+      limit: MAX_SHORT_TEXT_FIELD_GRAPHEMES,
+      message:
+        'Field "body.wallet.name" exceeds the maximum short-field length',
+    });
+  });
+
+  it('allows repeated-character runs in description fields', () => {
+    const violation = findRequestContentViolation({
+      wallet: {
+        description: `legit ${'文'.repeat(195)}`,
+      },
+    });
+
+    expect(violation).toBeNull();
+  });
+
+  it('can skip validation for machine-generated snapshot fields', () => {
+    const violation = findRequestContentViolation(
+      {
+        snapshot: `{"elements":[{"text":"${'🎉'.repeat(
+          MAX_EMOJIS_PER_FIELD + 20
+        )}"}]}`,
+        title: 'Board',
+      },
+      'body',
+      { skipValidationForFields: ['snapshot'] }
+    );
+
+    expect(violation).toBeNull();
+  });
+
+  it('skips validation for non-json requests', () => {
+    const request = makeRequest('name=test', {
+      contentType: 'application/x-www-form-urlencoded',
+    });
+
+    expect(shouldValidateEmojiLimit(request)).toBe(false);
+  });
+
+  it('detects trusted cron or service-role callers', () => {
+    vi.stubEnv('CRON_SECRET', 'cron-secret');
+    const request = makeRequest(JSON.stringify({ name: '🎉'.repeat(20) }), {
+      headers: { Authorization: 'Bearer cron-secret' },
+    });
+
+    expect(isTrustedEmojiBypassRequest(request)).toBe(true);
+  });
+
+  it('returns null for trusted callers even when payload exceeds the limit', async () => {
+    vi.stubEnv('SUPABASE_SERVICE_ROLE_KEY', 'service-role-secret');
+    const request = makeRequest(JSON.stringify({ name: '🎉'.repeat(20) }), {
+      headers: { Authorization: 'Bearer service-role-secret' },
+    });
+
+    await expect(
+      getRequestContentViolationForRequest(request)
+    ).resolves.toBeNull();
+  });
+
+  it('returns the offending field for untrusted JSON mutations', async () => {
+    const request = makeRequest(
+      JSON.stringify({
+        wallets: [
+          { name: 'ok' },
+          { name: '🎉'.repeat(MAX_EMOJIS_PER_FIELD + 2) },
+        ],
+      })
+    );
+
+    await expect(
+      getRequestContentViolationForRequest(request)
+    ).resolves.toEqual({
+      code: 'EMOJI_LIMIT_EXCEEDED',
+      path: 'body.wallets[1].name',
+      count: MAX_EMOJIS_PER_FIELD + 2,
+      limit: MAX_EMOJIS_PER_FIELD,
+      message:
+        'Field "body.wallets[1].name" cannot contain more than 10 emojis',
+    });
+  });
+
+  it('skips whiteboard snapshot validation when configured for the request', async () => {
+    const request = makeRequest(
+      JSON.stringify({
+        snapshot: `{"elements":[{"text":"${'🎉'.repeat(
+          MAX_EMOJIS_PER_FIELD + 20
+        )}"}]}`,
+      })
+    );
+
+    await expect(
+      getRequestContentViolationForRequest(request, {
+        skipValidationForFields: ['snapshot'],
+      })
+    ).resolves.toBeNull();
+  });
+});

package/src/__tests__/search-helper.test.ts

@@ -0,0 +1,51 @@
+import { describe, expect, it } from 'vitest';
+import { escapeLikePattern, sanitizeSearchQuery } from '../search-helper';
+
+describe('search-helper', () => {
+  describe('sanitizeSearchQuery', () => {
+    it('should return null for null, undefined, or empty strings', () => {
+      expect(sanitizeSearchQuery(null)).toBeNull();
+      expect(sanitizeSearchQuery(undefined)).toBeNull();
+      expect(sanitizeSearchQuery('')).toBeNull();
+      expect(sanitizeSearchQuery('   ')).toBeNull();
+    });
+
+    it('should trim whitespace', () => {
+      expect(sanitizeSearchQuery('  hello  ')).toBe('hello');
+    });
+
+    it('should remove control characters', () => {
+      // \x00 is a control character (NULL)
+      // \x1F is a control character (INFORMATION SEPARATOR ONE)
+      // \x7F is a control character (DELETE)
+      const input = 'hello\x00world\x1F!\x7F';
+      expect(sanitizeSearchQuery(input)).toBe('helloworld!');
+    });
+
+    it('should return null if the string only contains control characters and whitespace', () => {
+      expect(sanitizeSearchQuery(' \x00 \x1F ')).toBeNull();
+    });
+  });
+
+  describe('escapeLikePattern', () => {
+    it('should escape backslashes', () => {
+      expect(escapeLikePattern('a\\b')).toBe('a\\\\b');
+    });
+
+    it('should escape percent signs', () => {
+      expect(escapeLikePattern('a%b')).toBe('a\\%b');
+    });
+
+    it('should escape underscores', () => {
+      expect(escapeLikePattern('a_b')).toBe('a\\_b');
+    });
+
+    it('should escape multiple special characters', () => {
+      expect(escapeLikePattern('a%b_c\\d')).toBe('a\\%b\\_c\\\\d');
+    });
+
+    it('should leave normal characters unchanged', () => {
+      expect(escapeLikePattern('hello world 123')).toBe('hello world 123');
+    });
+  });
+});

package/src/__tests__/storage-display-name.test.ts

@@ -0,0 +1,37 @@
+import { describe, expect, it } from 'vitest';
+import {
+  getStorageObjectDisplayName,
+  getStoragePathSegmentDisplayName,
+  stripGeneratedStorageNamePrefix,
+} from '../storage-display-name';
+
+describe('storage display names', () => {
+  it('hides generated single and double UUID prefixes', () => {
+    expect(
+      stripGeneratedStorageNamePrefix(
+        'e602ce48-3fa5-4b07-8508-befb78c41819_Mine Blast WebGL.zip'
+      )
+    ).toBe('Mine Blast WebGL.zip');
+    expect(
+      stripGeneratedStorageNamePrefix(
+        'e602ce48-3fa5-4b07-8508-befb78c41819-49f380d5-b07d-4fa8-8087-6a5f63d3e5a8_Mine Blast WebGL.zip'
+      )
+    ).toBe('Mine Blast WebGL.zip');
+  });
+
+  it('hides generated UUID prefixes from URL-encoded path segments', () => {
+    expect(
+      getStoragePathSegmentDisplayName(
+        '9ba40a0d-8550-4ef0-8e21-ac333301ec5a-05cbb174-034d-4897-bdb4-3caea67e446b_Mine%20Blast%20WebGL'
+      )
+    ).toBe('Mine Blast WebGL');
+  });
+
+  it('returns a display name for storage objects', () => {
+    expect(
+      getStorageObjectDisplayName({
+        name: 'e602ce48-3fa5-4b07-8508-befb78c41819_receipt.pdf',
+      })
+    ).toBe('receipt.pdf');
+  });
+});

package/src/__tests__/storage-path.test.ts

@@ -0,0 +1,238 @@
+import { describe, expect, it } from 'vitest';
+import {
+  sanitizeFilename,
+  sanitizeFolderName,
+  sanitizePath,
+} from '../storage-path';
+
+describe('Storage Path Sanitization', () => {
+  describe('sanitizePath', () => {
+    it('returns empty string for empty input', () => {
+      expect(sanitizePath('')).toBe('');
+    });
+
+    it('handles simple paths', () => {
+      expect(sanitizePath('folder/subfolder')).toBe('folder/subfolder');
+    });
+
+    it('handles single segment paths', () => {
+      expect(sanitizePath('folder')).toBe('folder');
+    });
+
+    it('normalizes backslashes to forward slashes', () => {
+      expect(sanitizePath('folder\\subfolder')).toBe('folder/subfolder');
+      expect(sanitizePath('folder\\sub\\deep')).toBe('folder/sub/deep');
+    });
+
+    it('removes leading slashes', () => {
+      expect(sanitizePath('/folder/subfolder')).toBe('folder/subfolder');
+      expect(sanitizePath('///folder/subfolder')).toBe('folder/subfolder');
+    });
+
+    it('removes trailing slashes', () => {
+      expect(sanitizePath('folder/subfolder/')).toBe('folder/subfolder');
+      expect(sanitizePath('folder/subfolder///')).toBe('folder/subfolder');
+    });
+
+    it('trims whitespace', () => {
+      expect(sanitizePath('  folder/subfolder  ')).toBe('folder/subfolder');
+    });
+
+    it('rejects path traversal with double dots', () => {
+      expect(sanitizePath('../../../etc/passwd')).toBeNull();
+      expect(sanitizePath('folder/../other')).toBeNull();
+      expect(sanitizePath('folder/..hidden')).toBeNull();
+    });
+
+    it('rejects single dot segments', () => {
+      expect(sanitizePath('./folder')).toBeNull();
+      expect(sanitizePath('folder/./subfolder')).toBeNull();
+    });
+
+    it('rejects standalone double dots', () => {
+      expect(sanitizePath('..')).toBeNull();
+    });
+
+    it('rejects standalone single dot', () => {
+      expect(sanitizePath('.')).toBeNull();
+    });
+
+    it('handles paths with multiple consecutive slashes', () => {
+      expect(sanitizePath('folder//subfolder')).toBe('folder/subfolder');
+      expect(sanitizePath('folder///sub///deep')).toBe('folder/sub/deep');
+    });
+
+    it('handles mixed separators', () => {
+      expect(sanitizePath('folder\\sub/deep\\deeper')).toBe(
+        'folder/sub/deep/deeper'
+      );
+    });
+
+    it('handles complex valid paths', () => {
+      expect(sanitizePath('users/uploads/documents/2024')).toBe(
+        'users/uploads/documents/2024'
+      );
+    });
+
+    it('handles paths with underscores and hyphens', () => {
+      expect(sanitizePath('my-folder/sub_folder')).toBe('my-folder/sub_folder');
+    });
+
+    it('handles paths with numbers', () => {
+      expect(sanitizePath('folder1/2024/files123')).toBe(
+        'folder1/2024/files123'
+      );
+    });
+  });
+
+  describe('sanitizeFolderName', () => {
+    it('returns null for empty input', () => {
+      expect(sanitizeFolderName('')).toBeNull();
+    });
+
+    it('handles simple folder names', () => {
+      expect(sanitizeFolderName('my-folder')).toBe('my-folder');
+    });
+
+    it('handles folder names with underscores', () => {
+      expect(sanitizeFolderName('my_folder')).toBe('my_folder');
+    });
+
+    it('trims whitespace', () => {
+      expect(sanitizeFolderName('  folder  ')).toBe('folder');
+    });
+
+    it('strips leading slashes and returns folder name', () => {
+      expect(sanitizeFolderName('/folder')).toBe('folder');
+    });
+
+    it('strips trailing slashes and returns folder name', () => {
+      expect(sanitizeFolderName('folder/')).toBe('folder');
+    });
+
+    it('rejects folder names containing slashes', () => {
+      expect(sanitizeFolderName('folder/subfolder')).toBeNull();
+    });
+
+    it('rejects folder names containing backslashes', () => {
+      expect(sanitizeFolderName('folder\\subfolder')).toBeNull();
+    });
+
+    it('rejects double dot path traversal', () => {
+      expect(sanitizeFolderName('..')).toBeNull();
+    });
+
+    it('rejects single dot', () => {
+      expect(sanitizeFolderName('.')).toBeNull();
+    });
+
+    it('rejects folder names containing double dots', () => {
+      expect(sanitizeFolderName('folder..name')).toBeNull();
+      expect(sanitizeFolderName('..hidden')).toBeNull();
+    });
+
+    it('handles folder names with spaces', () => {
+      expect(sanitizeFolderName('my folder')).toBe('my folder');
+    });
+
+    it('handles folder names with numbers', () => {
+      expect(sanitizeFolderName('folder123')).toBe('folder123');
+      expect(sanitizeFolderName('2024')).toBe('2024');
+    });
+  });
+
+  describe('sanitizeFilename', () => {
+    it('returns null for empty input', () => {
+      expect(sanitizeFilename('')).toBeNull();
+    });
+
+    it('handles simple filenames', () => {
+      expect(sanitizeFilename('document.pdf')).toBe('document.pdf');
+    });
+
+    it('handles filenames without extensions', () => {
+      expect(sanitizeFilename('README')).toBe('README');
+    });
+
+    it('handles filenames with multiple dots', () => {
+      expect(sanitizeFilename('file.backup.txt')).toBe('file.backup.txt');
+    });
+
+    it('handles filenames with underscores and hyphens', () => {
+      expect(sanitizeFilename('my-file_name.txt')).toBe('my-file_name.txt');
+    });
+
+    it('handles filenames with spaces', () => {
+      expect(sanitizeFilename('my file.txt')).toBe('my file.txt');
+    });
+
+    it('handles filenames with numbers', () => {
+      expect(sanitizeFilename('file123.txt')).toBe('file123.txt');
+      expect(sanitizeFilename('2024-01-01.log')).toBe('2024-01-01.log');
+    });
+
+    it('rejects path traversal attempts', () => {
+      expect(sanitizeFilename('../../../etc/passwd')).toBeNull();
+      expect(sanitizeFilename('folder/file.txt')).toBeNull();
+    });
+
+    it('rejects backslash paths', () => {
+      expect(sanitizeFilename('folder\\file.txt')).toBeNull();
+    });
+
+    it('rejects control characters', () => {
+      expect(sanitizeFilename('file\x00name.txt')).toBeNull();
+      expect(sanitizeFilename('file\x1fname.txt')).toBeNull();
+    });
+
+    it('rejects filenames starting with space', () => {
+      expect(sanitizeFilename(' hidden.txt')).toBeNull();
+    });
+
+    it('rejects filenames ending with space', () => {
+      expect(sanitizeFilename('file.txt ')).toBeNull();
+    });
+
+    it('rejects filenames starting with dot', () => {
+      expect(sanitizeFilename('.hidden')).toBeNull();
+      expect(sanitizeFilename('.gitignore')).toBeNull();
+    });
+
+    it('rejects filenames ending with dot', () => {
+      expect(sanitizeFilename('file.')).toBeNull();
+    });
+
+    it('rejects filenames exceeding 255 characters', () => {
+      const longName = `${'a'.repeat(256)}.txt`;
+      expect(sanitizeFilename(longName)).toBeNull();
+    });
+
+    it('accepts filenames at exactly 255 characters', () => {
+      const maxName = `${'a'.repeat(251)}.txt`;
+      expect(sanitizeFilename(maxName)).toBe(maxName);
+    });
+
+    it('rejects non-ASCII characters', () => {
+      expect(sanitizeFilename('файл.txt')).toBeNull();
+      expect(sanitizeFilename('文件.txt')).toBeNull();
+      expect(sanitizeFilename('résumé.pdf')).toBeNull();
+    });
+
+    it('rejects special characters not in allowlist', () => {
+      expect(sanitizeFilename('file@name.txt')).toBeNull();
+      expect(sanitizeFilename('file#name.txt')).toBeNull();
+      expect(sanitizeFilename('file$name.txt')).toBeNull();
+      expect(sanitizeFilename('file%name.txt')).toBeNull();
+      expect(sanitizeFilename('file&name.txt')).toBeNull();
+      expect(sanitizeFilename('file*name.txt')).toBeNull();
+    });
+
+    it('handles uppercase filenames', () => {
+      expect(sanitizeFilename('DOCUMENT.PDF')).toBe('DOCUMENT.PDF');
+    });
+
+    it('handles mixed case filenames', () => {
+      expect(sanitizeFilename('MyDocument.Pdf')).toBe('MyDocument.Pdf');
+    });
+  });
+});