claw-dashboard 1.8.4 → 2.0.0

package/tests/widget-integration.test.js

@@ -0,0 +1,1147 @@
+/**
+ * Widget Integration Tests
+ * Tests for plugin loading, manifest validation, and config sanitization
+ */
+
+import { jest } from '@jest/globals';
+import { join } from 'path';
+import { mkdtemp, rm, mkdir, writeFile } from 'fs/promises';
+import { existsSync } from 'fs';
+import { tmpdir } from 'os';
+
+// Import modules under test
+import { WidgetLoader } from '../src/widgets/widget-loader.js';
+import { validateManifest, BaseWidget, PluginAPI } from '../src/widgets/plugin-api.js';
+import { sanitizeWidgetConfig, validateWidgetConfig, WidgetConfigValidator, validatePluginPath, validatePluginName } from '../src/security.js';
+
+describe('WidgetLoader', () => {
+  let loader;
+  let tempDir;
+
+  beforeEach(async () => {
+    // Create temp directory for test plugins
+    tempDir = await mkdtemp(join(tmpdir(), 'widget-test-'));
+    loader = new WidgetLoader({ pluginsDir: tempDir });
+  });
+
+  afterEach(async () => {
+    // Cleanup
+    if (loader) {
+      await loader.clear();
+    }
+    if (tempDir) {
+      await rm(tempDir, { recursive: true, force: true });
+    }
+  });
+
+  describe('register() and load()', () => {
+    test('should register a widget without loading it', () => {
+      const loader = new WidgetLoader();
+      const metadata = { name: 'Test Widget', version: '1.0.0' };
+      const loaderFn = jest.fn().mockResolvedValue({ render: jest.fn(), getData: jest.fn() });
+
+      loader.register('test-widget', metadata, loaderFn);
+
+      const meta = loader.getMetadata('test-widget');
+      expect(meta).toBeDefined();
+      expect(meta.name).toBe('Test Widget');
+      expect(loaderFn).not.toHaveBeenCalled();
+    });
+
+    test('should load a registered widget', async () => {
+      const loader = new WidgetLoader();
+      const instance = {
+        render: jest.fn(),
+        getData: jest.fn(),
+        destroy: jest.fn(),
+      };
+      const loaderFn = jest.fn().mockResolvedValue(instance);
+
+      loader.register('test-widget', { name: 'Test' }, loaderFn);
+      const loaded = await loader.load('test-widget');
+
+      expect(loaderFn).toHaveBeenCalled();
+      expect(loaded).toBe(instance);
+    });
+
+    test('should cache loaded widgets', async () => {
+      const loader = new WidgetLoader();
+      const loaderFn = jest.fn().mockResolvedValue({
+        render: jest.fn(),
+        getData: jest.fn(),
+      });
+
+      loader.register('test-widget', { name: 'Test' }, loaderFn);
+
+      await loader.load('test-widget');
+      await loader.load('test-widget');
+
+      expect(loaderFn).toHaveBeenCalledTimes(1);
+    });
+
+    test('should throw for unregistered widget', async () => {
+      const loader = new WidgetLoader();
+
+      await expect(loader.load('nonexistent')).rejects.toThrow("Widget 'nonexistent' not registered");
+    });
+
+    test('should loadAndRegister in one call', async () => {
+      const loader = new WidgetLoader();
+      const instance = {
+        render: jest.fn(),
+        getData: jest.fn(),
+        destroy: jest.fn(),
+      };
+      const loaderFn = jest.fn().mockResolvedValue(instance);
+
+      const loaded = await loader.loadAndRegister('test-widget', { name: 'Test' }, loaderFn);
+
+      expect(loaderFn).toHaveBeenCalled();
+      expect(loaded).toBe(instance);
+
+      // Verify it's registered
+      const meta = loader.getMetadata('test-widget');
+      expect(meta).toBeDefined();
+      expect(meta.name).toBe('Test');
+
+      // Verify it's loaded
+      expect(loader.isLoaded('test-widget')).toBe(true);
+    });
+
+    test('should loadAndRegister with lazyLoad option', async () => {
+      const loader = new WidgetLoader();
+      const instance = {
+        render: jest.fn(),
+        getData: jest.fn(),
+      };
+      const loaderFn = jest.fn().mockResolvedValue(instance);
+
+      // Register with lazyLoad: true (default)
+      await loader.loadAndRegister('lazy-widget', { name: 'Lazy', lazyLoad: true }, loaderFn);
+
+      // Should be registered
+      expect(loader.getMetadata('lazy-widget')).toBeDefined();
+
+      // With lazyLoad, the loader shouldn't be called immediately
+      // (Note: loadAndRegister always loads, regardless of lazyLoad setting)
+      expect(loader.isLoaded('lazy-widget')).toBe(true);
+    });
+
+    test('should handle loadAndRegister failure', async () => {
+      const loader = new WidgetLoader();
+      const loaderFn = jest.fn().mockRejectedValue(new Error('Load failed'));
+
+      await expect(loader.loadAndRegister('failing-widget', { name: 'Failing' }, loaderFn)).rejects.toThrow('Load failed');
+
+      // Widget should be registered even if load failed
+      expect(loader.getMetadata('failing-widget')).toBeDefined();
+      expect(loader.isLoaded('failing-widget')).toBe(false);
+    });
+
+    test('should validate widget has required methods', async () => {
+      const loader = new WidgetLoader();
+      const invalidWidget = { someMethod: jest.fn() };
+
+      loader.register('invalid-widget', {}, () => Promise.resolve(invalidWidget));
+
+      await expect(loader.load('invalid-widget')).rejects.toThrow(/missing required methods/);
+    });
+  });
+
+  describe('loadMany()', () => {
+    test('should load multiple widgets in parallel', async () => {
+      const loader = new WidgetLoader();
+      const instances = {};
+
+      for (let i = 0; i < 3; i++) {
+        instances[`widget-${i}`] = {
+          render: jest.fn(),
+          getData: jest.fn(),
+        };
+        loader.register(`widget-${i}`, { name: `Widget ${i}` }, () => Promise.resolve(instances[`widget-${i}`]));
+      }
+
+      const loaded = await loader.loadMany(['widget-0', 'widget-1', 'widget-2']);
+
+      expect(loaded.size).toBe(3);
+      expect(loaded.get('widget-0')).toBe(instances['widget-0']);
+    });
+
+    test('should handle partial failures', async () => {
+      const loader = new WidgetLoader();
+
+      loader.register('good-widget', {}, () => Promise.resolve({
+        render: jest.fn(),
+        getData: jest.fn(),
+      }));
+
+      loader.register('bad-widget', {}, () => Promise.resolve({ invalid: true }));
+
+      const loaded = await loader.loadMany(['good-widget', 'bad-widget']);
+
+      // Good widget should load, bad widget should fail validation
+      expect(loaded.size).toBe(1);
+      expect(loaded.has('good-widget')).toBe(true);
+    });
+  });
+
+  describe('hooks', () => {
+    test('should call beforeLoad and afterLoad hooks', async () => {
+      const loader = new WidgetLoader();
+      const beforeLoad = jest.fn();
+      const afterLoad = jest.fn();
+
+      loader.addHook('beforeLoad', beforeLoad);
+      loader.addHook('afterLoad', afterLoad);
+
+      loader.register('test-widget', {}, () => Promise.resolve({
+        render: jest.fn(),
+        getData: jest.fn(),
+      }));
+
+      await loader.load('test-widget');
+
+      expect(beforeLoad).toHaveBeenCalled();
+      expect(afterLoad).toHaveBeenCalled();
+    });
+
+    test('should call beforeUnload hook', async () => {
+      const loader = new WidgetLoader();
+      const beforeUnload = jest.fn();
+
+      loader.addHook('beforeUnload', beforeUnload);
+
+      loader.register('test-widget', {}, () => Promise.resolve({
+        render: jest.fn(),
+        getData: jest.fn(),
+        destroy: jest.fn(),
+      }));
+
+      await loader.load('test-widget');
+      await loader.unload('test-widget');
+
+      expect(beforeUnload).toHaveBeenCalled();
+    });
+  });
+});
+
+describe('loadAllPluginsWithFallback()', () => {
+  let loader;
+  let tempDir;
+
+  beforeEach(async () => {
+    tempDir = await mkdtemp(join(tmpdir(), 'plugin-test-'));
+    loader = new WidgetLoader({ pluginsDir: tempDir });
+  });
+
+  afterEach(async () => {
+    if (loader) {
+      await loader.clear();
+    }
+    if (tempDir) {
+      await rm(tempDir, { recursive: true, force: true });
+    }
+  });
+
+  test('should load valid plugins successfully', async () => {
+    // Create valid plugin
+    const pluginDir = join(tempDir, 'valid-plugin');
+    await mkdir(pluginDir);
+
+    // Add package.json to mark as ESM module
+    await writeFile(join(pluginDir, 'package.json'), JSON.stringify({
+      type: 'module'
+    }));
+
+    await writeFile(join(pluginDir, 'plugin.json'), JSON.stringify({
+      id: 'valid-plugin',
+      name: 'Valid Plugin',
+      version: '1.0.0',
+      type: 'widget',
+      config: { message: 'test' },
+    }));
+
+    await writeFile(join(pluginDir, 'index.js'), `
+export default {
+  render: () => {},
+  getData: async () => ({ data: 'test' })
+};
+`);
+
+    const results = await loader.loadAllPluginsWithFallback();
+
+    expect(results.successful).toContain('valid-plugin');
+    expect(results.failed).toHaveLength(0);
+  });
+
+  test('should handle malformed plugin.json gracefully', async () => {
+    // Create plugin with malformed JSON
+    const pluginDir = join(tempDir, 'malformed-plugin');
+    await mkdir(pluginDir);
+
+    await writeFile(join(pluginDir, 'plugin.json'), '{ invalid json }');
+    await writeFile(join(pluginDir, 'index.js'), 'export default { render: () => {}, getData: async () => ({}) };');
+
+    const results = await loader.loadAllPluginsWithFallback();
+
+    // Should skip or fail gracefully - malformed JSON should not crash
+    expect(results.successful).not.toContain('malformed-plugin');
+    // The plugin should either fail or be skipped, not succeed
+    const wasHandled = results.failed.some(f => f.id === 'malformed-plugin') ||
+                       results.skipped.includes('malformed-plugin') ||
+                       results.successful.length === 0; // If nothing loaded, that's also acceptable
+    expect(wasHandled).toBe(true);
+  });
+
+  test('should handle missing plugin.json', async () => {
+    // Create plugin directory without manifest
+    const pluginDir = join(tempDir, 'no-manifest');
+    await mkdir(pluginDir);
+    await writeFile(join(pluginDir, 'index.js'), 'export default {}');
+
+    const results = await loader.loadAllPluginsWithFallback();
+
+    // Should skip directories without plugin.json
+    expect(results.successful).not.toContain('no-manifest');
+  });
+
+  test('should handle missing index.js', async () => {
+    // Create plugin with manifest but no entry point
+    const pluginDir = join(tempDir, 'no-entry');
+    await mkdir(pluginDir);
+
+    await writeFile(join(pluginDir, 'plugin.json'), JSON.stringify({
+      id: 'no-entry',
+      name: 'No Entry',
+      version: '1.0.0',
+      type: 'widget',
+    }));
+
+    const results = await loader.loadAllPluginsWithFallback();
+
+    // Should skip directories without index.js
+    expect(results.successful).not.toContain('no-entry');
+  });
+
+  test('should continue loading after plugin error with continueOnError', async () => {
+    // Create one valid and one invalid plugin
+    const validDir = join(tempDir, 'valid-plugin');
+    await mkdir(validDir);
+    await writeFile(join(validDir, 'plugin.json'), JSON.stringify({
+      id: 'valid-plugin',
+      name: 'Valid',
+      version: '1.0.0',
+      type: 'widget',
+    }));
+    await writeFile(join(validDir, 'index.js'), `
+export default { render: () => {}, getData: async () => ({}) };
+`);
+
+    const invalidDir = join(tempDir, 'invalid-plugin');
+    await mkdir(invalidDir);
+    await writeFile(join(invalidDir, 'plugin.json'), JSON.stringify({
+      id: 'invalid-plugin',
+      name: 'Invalid',
+      version: '1.0.0',
+      type: 'widget',
+    }));
+    await writeFile(join(invalidDir, 'index.js'), 'export default { invalid: true };'); // Missing required methods
+
+    const results = await loader.loadAllPluginsWithFallback({ continueOnError: true });
+
+    // Valid plugin should load despite invalid one failing
+    expect(results.successful).toContain('valid-plugin');
+  });
+
+  test('should handle plugin that throws during load', async () => {
+    const pluginDir = join(tempDir, 'throwing-plugin');
+    await mkdir(pluginDir);
+
+    // Set lazyLoad: false to force immediate loading which will trigger the error
+    await writeFile(join(pluginDir, 'plugin.json'), JSON.stringify({
+      id: 'throwing-plugin',
+      name: 'Throwing',
+      version: '1.0.0',
+      type: 'widget',
+      lazyLoad: false,  // Force immediate load
+    }));
+
+    await writeFile(join(pluginDir, 'index.js'), `
+throw new Error('Plugin failed to initialize');
+export default {};
+`);
+
+    // With fallbackOnError: false, errors propagate and are caught
+    const results = await loader.loadAllPluginsWithFallback({
+      continueOnError: true,
+      fallbackOnError: false,
+    });
+
+    // The plugin should fail during auto-load
+    expect(results.failed.some(f => f.id === 'throwing-plugin')).toBe(true);
+  });
+});
+
+describe('validateManifest()', () => {
+  test('should validate required fields', () => {
+    const validManifest = {
+      name: 'Test Plugin',
+      version: '1.0.0',
+      entryPoint: 'index.js',
+    };
+
+    expect(() => validateManifest(validManifest)).not.toThrow();
+  });
+
+  test('should reject missing name', () => {
+    const manifest = {
+      version: '1.0.0',
+      entryPoint: 'index.js',
+    };
+
+    expect(() => validateManifest(manifest)).toThrow(/Missing required fields/);
+  });
+
+  test('should reject missing version', () => {
+    const manifest = {
+      name: 'Test',
+      entryPoint: 'index.js',
+    };
+
+    expect(() => validateManifest(manifest)).toThrow(/Missing required fields/);
+  });
+
+  test('should reject missing entryPoint', () => {
+    const manifest = {
+      name: 'Test',
+      version: '1.0.0',
+    };
+
+    expect(() => validateManifest(manifest)).toThrow(/Missing required fields/);
+  });
+
+  test('should reject invalid semver format', () => {
+    const manifest = {
+      name: 'Test',
+      version: 'v1',  // Invalid semver
+      entryPoint: 'index.js',
+    };
+
+    expect(() => validateManifest(manifest)).toThrow(/semver/);
+  });
+
+  test('should accept valid semver formats', () => {
+    const versions = ['1.0.0', '0.0.1', '10.20.30', '1.0.0-beta', '1.0.0-beta.1'];
+
+    for (const version of versions) {
+      const manifest = {
+        name: 'Test',
+        version,
+        entryPoint: 'index.js',
+      };
+
+      expect(() => validateManifest(manifest)).not.toThrow();
+    }
+  });
+});
+
+describe('WidgetConfigValidator', () => {
+  let validator;
+
+  beforeEach(() => {
+    validator = new WidgetConfigValidator();
+  });
+
+  describe('basic sanitization', () => {
+    test('should return empty object for null/undefined', () => {
+      expect(validator.validate(null)).toEqual({});
+      expect(validator.validate(undefined)).toEqual({});
+    });
+
+    test('should reject non-object config', () => {
+      expect(() => validator.validate('string')).toThrow('must be an object');
+      expect(() => validator.validate(123)).toThrow('must be an object');
+    });
+
+    test('should pass through valid objects', () => {
+      const config = { name: 'test', count: 5, enabled: true };
+      expect(validator.validate(config)).toEqual(config);
+    });
+  });
+
+  describe('string handling', () => {
+    test('should strip null bytes from strings', () => {
+      const config = { message: 'hello\0world' };
+      const sanitized = validator.validate(config);
+
+      expect(sanitized.message).toBe('helloworld');
+    });
+
+    test('should truncate long strings', () => {
+      const longString = 'a'.repeat(2000);
+      const config = { message: longString };
+      const sanitized = validator.validate(config);
+
+      expect(sanitized.message.length).toBe(1000);
+    });
+  });
+
+  describe('number handling', () => {
+    test('should reject NaN', () => {
+      const config = { value: NaN };
+      const sanitized = validator.validate(config);
+
+      expect(sanitized.value).toBe(0);
+    });
+
+    test('should reject Infinity', () => {
+      const config = { value: Infinity };
+      const sanitized = validator.validate(config);
+
+      expect(sanitized.value).toBe(0);
+    });
+
+    test('should accept valid numbers', () => {
+      const config = { int: 42, float: 3.14, negative: -10 };
+      const sanitized = validator.validate(config);
+
+      expect(sanitized).toEqual(config);
+    });
+  });
+
+  describe('array handling', () => {
+    test('should limit array length', () => {
+      const validator = new WidgetConfigValidator({ maxArrayLength: 5 });
+      const config = { items: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10] };
+      const sanitized = validator.validate(config);
+
+      expect(sanitized.items.length).toBe(5);
+    });
+
+    test('should sanitize array items', () => {
+      const config = { items: ['normal', 'with\0null', 123] };
+      const sanitized = validator.validate(config);
+
+      expect(sanitized.items).toEqual(['normal', 'withnull', 123]);
+    });
+  });
+
+  describe('depth limiting', () => {
+    test('should handle deeply nested objects gracefully', () => {
+      // The validator catches depth errors and returns null for values that exceed depth
+      const validator = new WidgetConfigValidator({ maxDepth: 3 });
+      const config = {
+        level1: {
+          level2: {
+            level3: {
+              level4: {
+                level5: 'too deep',
+              },
+            },
+          },
+        },
+      };
+
+      // Should not throw; instead deep values become null
+      const sanitized = validator.validate(config);
+      expect(sanitized).toBeDefined();
+      expect(sanitized.level1).toBeDefined();
+    });
+  });
+
+  describe('schema validation', () => {
+    test('should only allow whitelisted keys with schema', () => {
+      const schema = {
+        properties: {
+          name: { type: 'string' },
+          count: { type: 'number' },
+        },
+      };
+
+      const config = { name: 'test', count: 5, malicious: 'hack' };
+      const sanitized = validator.validate(config, schema);
+
+      expect(sanitized).toEqual({ name: 'test', count: 5 });
+      expect(sanitized.malicious).toBeUndefined();
+    });
+
+    test('should handle schema-based validation', () => {
+      const schema = {
+        properties: {
+          timeout: { type: 'number', default: 5000 },
+          name: { type: 'string' },
+        },
+      };
+
+      const config = { timeout: 'invalid', name: 'test' };
+      const sanitized = validator.validate(config, schema);
+
+      // Strings are valid, so 'invalid' stays as-is (string type is in allowedTypes)
+      expect(sanitized.timeout).toBe('invalid');
+      expect(sanitized.name).toBe('test');
+    });
+  });
+});
+
+describe('sanitizeWidgetConfig()', () => {
+  test('should sanitize malicious inputs', () => {
+    const malicious = {
+      __proto__: { polluted: true },
+      constructor: { prototype: { polluted: true } },
+      message: 'normal string',
+    };
+
+    const sanitized = sanitizeWidgetConfig(malicious);
+
+    // Should not have polluted prototype
+    expect(sanitized.message).toBe('normal string');
+    expect({}.polluted).toBeUndefined();
+  });
+
+  test('should handle special string values', () => {
+    const config = {
+      script: '<script>alert("xss")</script>',
+      sql: "'; DROP TABLE users; --",
+      path: '../../../etc/passwd',
+      unicode: '\u0000\u0001\u0002', // null byte + two control chars
+    };
+
+    const sanitized = sanitizeWidgetConfig(config);
+
+    // Should sanitize null bytes but keep other content
+    expect(sanitized.script).toBe('<script>alert("xss")</script>');
+    expect(sanitized.sql).toBe("'; DROP TABLE users; --");
+    expect(sanitized.path).toBe('../../../etc/passwd');
+    // Only null byte (\u0000) is stripped; \u0001 and \u0002 remain
+    expect(sanitized.unicode).toBe('\u0001\u0002');
+  });
+
+  test('should handle edge cases', () => {
+    expect(sanitizeWidgetConfig(null)).toEqual({});
+    expect(sanitizeWidgetConfig(undefined)).toEqual({});
+    expect(sanitizeWidgetConfig({})).toEqual({});
+  });
+});
+
+describe('validateWidgetConfig()', () => {
+  test('should return valid result for valid config', () => {
+    const schema = {
+      properties: {
+        name: { type: 'string' },
+      },
+    };
+
+    const result = validateWidgetConfig({ name: 'test' }, schema);
+
+    expect(result.valid).toBe(true);
+    expect(result.errors).toEqual([]);
+  });
+
+  test('should handle deeply nested config gracefully', () => {
+    // Default maxDepth is 10, so 11 levels should be handled gracefully
+    const config = {
+      level1: {
+        level2: {
+          level3: {
+            level4: {
+              level5: {
+                level6: {
+                  level7: {
+                    level8: {
+                      level9: {
+                        level10: {
+                          level11: 'too deep',
+                        },
+                      },
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+    };
+
+    // The validator handles depth errors gracefully by returning null for deep values
+    const result = validateWidgetConfig(config);
+
+    // Should either pass (with deep values nulled) or return errors
+    // depending on implementation details
+    expect(result).toBeDefined();
+    expect(result).toHaveProperty('valid');
+    expect(result).toHaveProperty('errors');
+  });
+});
+
+describe('BaseWidget', () => {
+  test('should initialize with default values', () => {
+    const widget = new BaseWidget();
+
+    expect(widget.id).toBeDefined();
+    expect(widget.name).toBe('Unnamed Widget');
+    expect(widget.loaded).toBe(false);
+  });
+
+  test('should accept options', () => {
+    const widget = new BaseWidget({
+      id: 'test-widget',
+      name: 'Test Widget',
+      config: { setting: 'value' },
+    });
+
+    expect(widget.id).toBe('test-widget');
+    expect(widget.name).toBe('Test Widget');
+    expect(widget.config).toEqual({ setting: 'value' });
+  });
+
+  test('should throw on create() by default', async () => {
+    const widget = new BaseWidget();
+
+    await expect(widget.create()).rejects.toThrow('create() must be implemented');
+  });
+
+  test('should provide lifecycle methods', async () => {
+    const widget = new BaseWidget();
+
+    await widget.init();
+    expect(widget.loaded).toBe(true);
+
+    await widget.destroy();
+    expect(widget.loaded).toBe(false);
+  });
+
+  test('should provide getMetadata()', () => {
+    const widget = new BaseWidget({
+      id: 'test',
+      name: 'Test',
+      description: 'A test widget',
+    });
+
+    const metadata = widget.getMetadata();
+
+    expect(metadata.id).toBe('test');
+    expect(metadata.name).toBe('Test');
+    expect(metadata.description).toBe('A test widget');
+    expect(metadata.loaded).toBe(false);
+  });
+});
+
+describe('PluginAPI', () => {
+  let api;
+
+  beforeEach(() => {
+    api = new PluginAPI();
+  });
+
+  describe('extension points', () => {
+    test('should register extension points', () => {
+      api.registerExtensionPoint('myExtension', { description: 'Test extension' });
+
+      expect(api.extensions.has('myExtension')).toBe(true);
+    });
+
+    test('should add handlers to extension points', () => {
+      api.registerExtensionPoint('myExtension');
+      const handler = jest.fn();
+
+      api.extend('myExtension', handler);
+      api.executeExtension('myExtension', 'arg1', 'arg2');
+
+      expect(handler).toHaveBeenCalledWith('arg1', 'arg2');
+    });
+
+    test('should throw for non-existent extension point', () => {
+      expect(() => api.extend('nonexistent', jest.fn())).toThrow(/not found/);
+    });
+
+    test('should enforce single handler when multiple is false', () => {
+      api.registerExtensionPoint('single', { multiple: false });
+      api.extend('single', jest.fn());
+
+      expect(() => api.extend('single', jest.fn())).toThrow(/only allows one handler/);
+    });
+
+    test('should sort handlers by priority', async () => {
+      api.registerExtensionPoint('ordered');
+      const order = [];
+
+      api.extend('ordered', () => order.push(2), { priority: 100 });
+      api.extend('ordered', () => order.push(1), { priority: 1 });
+      api.extend('ordered', () => order.push(3), { priority: 200 });
+
+      await api.executeExtension('ordered');
+
+      expect(order).toEqual([1, 2, 3]);
+    });
+  });
+
+  describe('data providers', () => {
+    test('should register and call data providers', async () => {
+      const provider = jest.fn().mockResolvedValue({ data: 'test' });
+      api.registerDataProvider('myData', provider);
+
+      const result = await api.getData('myData');
+
+      expect(provider).toHaveBeenCalled();
+      expect(result).toEqual({ data: 'test' });
+    });
+
+    test('should check if provider exists', () => {
+      api.registerDataProvider('exists', jest.fn());
+
+      expect(api.hasDataProvider('exists')).toBe(true);
+      expect(api.hasDataProvider('nonexistent')).toBe(false);
+    });
+
+    test('should throw for non-existent provider', async () => {
+      await expect(api.getData('nonexistent')).rejects.toThrow(/not found/);
+    });
+
+    test('should require provider to be a function', () => {
+      expect(() => api.registerDataProvider('invalid', 'not a function')).toThrow(/must be a function/);
+    });
+  });
+
+  describe('hooks', () => {
+    test('should add and execute hooks', async () => {
+      const hook = jest.fn();
+      api.addHook('init', hook);
+
+      await api.executeHooks('init', { value: 1 });
+
+      expect(hook).toHaveBeenCalledWith({ value: 1 });
+    });
+
+    test('should remove one-time hooks after execution', async () => {
+      const hook = jest.fn();
+      api.addHook('once', hook, { once: true });
+
+      await api.executeHooks('once', {});
+      await api.executeHooks('once', {});
+
+      expect(hook).toHaveBeenCalledTimes(1);
+    });
+
+    test('should sort hooks by priority', async () => {
+      const order = [];
+
+      api.addHook('ordered', () => order.push(2), { priority: 100 });
+      api.addHook('ordered', () => order.push(1), { priority: 1 });
+      api.addHook('ordered', () => order.push(3), { priority: 200 });
+
+      await api.executeHooks('ordered', {});
+
+      expect(order).toEqual([1, 2, 3]);
+    });
+
+    test('should return modified context', async () => {
+      api.addHook('transform', (ctx) => { ctx.value *= 2; });
+      api.addHook('transform', (ctx) => { ctx.value += 10; });
+
+      const result = await api.executeHooks('transform', { value: 5 });
+
+      expect(result.value).toBe(20);
+    });
+  });
+
+  describe('getInfo()', () => {
+    test('should return API information', () => {
+      api.registerExtensionPoint('ext1');
+      api.registerDataProvider('data1', jest.fn());
+      api.addHook('hook1', jest.fn());
+
+      const info = api.getInfo();
+
+      expect(info.version).toBe('1.0.0');
+      expect(info.extensionPoints).toContain('ext1');
+      expect(info.dataProviders).toContain('data1');
+      expect(info.hooks).toContain('hook1');
+    });
+  });
+});
+
+describe('Path Validation', () => {
+  let tempDir;
+
+  beforeEach(async () => {
+    tempDir = await mkdtemp(join(tmpdir(), 'path-validation-test-'));
+  });
+
+  afterEach(async () => {
+    if (tempDir) {
+      await rm(tempDir, { recursive: true, force: true });
+    }
+  });
+
+  describe('validatePluginName()', () => {
+    test('should accept valid plugin names', () => {
+      const validNames = ['my-widget', 'test_plugin', 'widget123', 'MyWidget', 'my-widget-v2'];
+
+      for (const name of validNames) {
+        const result = validatePluginName(name);
+        expect(result.valid).toBe(true);
+        expect(result.error).toBeNull();
+      }
+    });
+
+    test('should reject empty names', () => {
+      const result = validatePluginName('');
+      expect(result.valid).toBe(false);
+      expect(result.error).toContain('empty');
+    });
+
+    test('should reject null/undefined names', () => {
+      expect(validatePluginName(null).valid).toBe(false);
+      expect(validatePluginName(undefined).valid).toBe(false);
+    });
+
+    test('should reject names starting with non-alphanumeric', () => {
+      const result = validatePluginName('-widget');
+      expect(result.valid).toBe(false);
+      expect(result.error).toContain('must start with alphanumeric');
+    });
+
+    test('should reject names with invalid characters', () => {
+      const result = validatePluginName('my@widget');
+      expect(result.valid).toBe(false);
+      expect(result.error).toContain('alphanumeric');
+    });
+
+    test('should reject reserved names', () => {
+      const reserved = ['node_modules', '.git', 'package.json'];
+
+      for (const name of reserved) {
+        const result = validatePluginName(name);
+        expect(result.valid).toBe(false);
+        expect(result.error).toContain('reserved');
+      }
+    });
+
+    test('should reject names over 100 characters', () => {
+      const longName = 'a'.repeat(101);
+      const result = validatePluginName(longName);
+      expect(result.valid).toBe(false);
+      expect(result.error).toContain('too long');
+    });
+
+    test('should trim whitespace from names', () => {
+      const result = validatePluginName('  my-widget  ');
+      expect(result.valid).toBe(true);
+    });
+  });
+
+  describe('validatePluginPath()', () => {
+    test('should validate simple paths within allowed directory', () => {
+      const result = validatePluginPath('my-widget', {
+        allowedDirs: ['/plugins'],
+        allowAbsolute: false,
+      });
+
+      expect(result.valid).toBe(true);
+      expect(result.path).toBe('/plugins/my-widget');
+      expect(result.error).toBeNull();
+    });
+
+    test('should reject paths with traversal attempts', () => {
+      const traversalPaths = ['../etc/passwd', 'widget/../../etc', '..', 'widget/../..'];
+
+      for (const testPath of traversalPaths) {
+        const result = validatePluginPath(testPath, {
+          allowedDirs: ['/plugins'],
+          allowAbsolute: false,
+        });
+        expect(result.valid).toBe(false);
+        expect(result.error).toContain('traversal');
+      }
+    });
+
+    test('should reject absolute paths when not allowed', () => {
+      const result = validatePluginPath('/etc/passwd', {
+        allowedDirs: ['/plugins'],
+        allowAbsolute: false,
+      });
+
+      expect(result.valid).toBe(false);
+      expect(result.error).toContain('Absolute paths');
+    });
+
+    test('should accept absolute paths when allowed', () => {
+      const result = validatePluginPath('/plugins/my-widget', {
+        allowedDirs: ['/plugins'],
+        allowAbsolute: true,
+        mustExist: false,
+      });
+
+      expect(result.valid).toBe(true);
+      expect(result.path).toBe('/plugins/my-widget');
+    });
+
+    test('should reject paths outside allowed directories', () => {
+      const result = validatePluginPath('/etc/passwd', {
+        allowedDirs: ['/plugins'],
+        allowAbsolute: true,
+        mustExist: false,
+      });
+
+      expect(result.valid).toBe(false);
+      expect(result.error).toContain('outside allowed');
+    });
+
+    test('should reject paths with null bytes', () => {
+      const result = validatePluginPath('widget\0/exploit', {
+        allowedDirs: ['/plugins'],
+      });
+
+      expect(result.valid).toBe(false);
+      expect(result.error).toContain('null bytes');
+    });
+
+    test('should reject paths with invalid characters', () => {
+      const result = validatePluginPath('my@widget', {
+        allowedDirs: ['/plugins'],
+      });
+
+      expect(result.valid).toBe(false);
+      expect(result.error).toContain('Invalid characters');
+    });
+
+    test('should reject hidden files/directories', () => {
+      const result = validatePluginPath('.hidden-widget', {
+        allowedDirs: ['/plugins'],
+      });
+
+      expect(result.valid).toBe(false);
+      expect(result.error).toContain('Hidden files');
+    });
+
+    test('should handle missing allowedDirs', () => {
+      const result = validatePluginPath('my-widget', {});
+
+      expect(result.valid).toBe(true);
+      expect(result.path).toBeDefined();
+    });
+
+    test('should validate existing directories', () => {
+      // This test uses the actual temp directory
+      const result = validatePluginPath('.', {
+        allowedDirs: [tempDir],
+        allowAbsolute: false,
+        mustExist: true,
+        expectedType: 'directory',
+      });
+
+      // The test should pass since tempDir exists
+      if (result.valid) {
+        expect(result.path).toBeDefined();
+      }
+    });
+
+    test('should return error for non-existent paths when mustExist is true', () => {
+      const result = validatePluginPath('non-existent-path-xyz', {
+        allowedDirs: ['/tmp'],
+        mustExist: true,
+      });
+
+      expect(result.valid).toBe(false);
+      expect(result.error).toContain('does not exist');
+    });
+
+    test('should check file type when expectedType is set', () => {
+      // Test with a file that exists (tempDir itself)
+      const fileResult = validatePluginPath('.', {
+        allowedDirs: [tempDir],
+        mustExist: true,
+        expectedType: 'file',
+      });
+
+      // Should fail because . is a directory, not a file
+      expect(fileResult.valid).toBe(false);
+      expect(fileResult.error).toContain('not a file');
+    });
+  });
+});
+
+describe('WidgetLoader with path validation', () => {
+  let loader;
+  let tempDir;
+
+  beforeEach(async () => {
+    tempDir = await mkdtemp(join(tmpdir(), 'path-validation-test-'));
+    loader = new WidgetLoader({ pluginsDir: tempDir });
+  });
+
+  afterEach(async () => {
+    if (loader) {
+      await loader.clear();
+    }
+    if (tempDir) {
+      await rm(tempDir, { recursive: true, force: true });
+    }
+  });
+
+  test('should skip plugins with invalid directory names during discovery', async () => {
+    // Create a plugin with an invalid name (contains path traversal attempt)
+    const invalidDir = join(tempDir, '..invalid');
+    // Can't actually create a directory starting with .. on most systems
+    // So we'll test with a different invalid character
+    const badDir = join(tempDir, 'bad@name');
+    await mkdir(badDir).catch(() => {});
+
+    if (existsSync(badDir)) {
+      await writeFile(join(badDir, 'plugin.json'), JSON.stringify({
+        id: 'bad-name',
+        name: 'Bad Name',
+        version: '1.0.0',
+        type: 'widget',
+      }));
+      await writeFile(join(badDir, 'index.js'), 'export default { render: () => {}, getData: async () => ({}) };');
+
+      const discovered = await loader.discoverPlugins();
+      expect(discovered.some(p => p.id === 'bad-name')).toBe(false);
+    }
+  });
+
+  test('should load valid plugins with sanitized names', async () => {
+    const validDir = join(tempDir, 'valid-widget');
+    await mkdir(validDir);
+
+    await writeFile(join(validDir, 'plugin.json'), JSON.stringify({
+      id: 'valid-widget',
+      name: 'Valid Widget',
+      version: '1.0.0',
+      type: 'widget',
+    }));
+
+    await writeFile(join(validDir, 'index.js'), `
+export default {
+  render: () => {},
+  getData: async () => ({ data: 'test' })
+};
+`);
+
+    const discovered = await loader.discoverPlugins();
+    expect(discovered.some(p => p.id === 'valid-widget')).toBe(true);
+  });
+
+  test('should reject loading plugin from outside plugins directory', async () => {
+    // Attempt to load a plugin from /tmp or similar
+    const outsideDir = join(tmpdir(), 'outside-plugin');
+    await mkdir(outsideDir, { recursive: true });
+
+    await writeFile(join(outsideDir, 'plugin.json'), JSON.stringify({
+      id: 'outside-plugin',
+      name: 'Outside Plugin',
+      version: '1.0.0',
+      type: 'widget',
+    }));
+
+    await writeFile(join(outsideDir, 'index.js'), 'export default { render: () => {}, getData: async () => ({}) };');
+
+    // Try to load from outside the plugins directory
+    await expect(loader.loadPlugin(outsideDir)).rejects.toThrow(/outside allowed directories/);
+
+    // Cleanup
+    await rm(outsideDir, { recursive: true, force: true });
+  });
+});