cursedbelt-server 1.0.0

package/src/server/storage/files/fileRoutes.spec.ts

@@ -0,0 +1,327 @@
+import { Database } from 'bun:sqlite';
+import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { Hono } from 'hono';
+import { MAX_SINGLE_UPLOAD_BYTES } from 'cursedbelt-core/media/upload-limits';
+import { runMigrations } from '../../migration/runner';
+import { generateUserSalt } from '../../private-media/crypto';
+import { createUnlockService } from '../../private-media/unlock';
+import { createDiskStore } from '../diskStore';
+import { createStreamTokenService } from '../streamToken';
+import type { MediaCtx } from '../types';
+import { createSqliteFileCatalogue } from './catalogue';
+import { mountFileRoutes, SINGLE_UPLOAD_TOO_LARGE } from './fileRoutes';
+import { FILE_CATALOGUE_MIGRATIONS } from './migrations';
+import type { FileCatalogue, FilePage, PrivateFileCatalogue, PrivateKeyMode } from './types';
+
+const CTX: MediaCtx = { userId: 'u1', tenantId: 't1' };
+const unlock = createUnlockService({ serverSecret: 'srv', unlockSecret: 'unl' });
+const streamToken = createStreamTokenService({ secret: 'stream' });
+const salt = generateUserSalt();
+
+describe('fileRoutes — private upload key derivation (password vs unlock token)', () => {
+  // ingestPrivate runs the ffmpeg pipeline — fake the catalogue and capture the key/mode the
+  // route derived. The derivation logic IS what this route owns.
+  let captured: { setKey: Buffer; keyMode: PrivateKeyMode } | null = null;
+  /*
+   * Read through a function, not the variable.
+   *
+   * Each test opens with `captured = null`, which narrows the binding to `null`
+   * for the rest of the block — TypeScript cannot see the assignment inside
+   * `fakeCatalogue.ingestPrivate`, so `captured?.keyMode` had type `never` and
+   * every assertion below was unchecked. A call boundary resets the narrowing,
+   * so the descriptor's fields are type-checked again.
+   */
+  const derived = (): { setKey: Buffer; keyMode: PrivateKeyMode } | null => captured;
+  const fakeCatalogue = {
+    async ingestPrivate(_ctx: MediaCtx, _upload: unknown, cfg: unknown) {
+      captured = cfg as { setKey: Buffer; keyMode: PrivateKeyMode };
+      return {
+        id: 'p1',
+        size: 1,
+        createdAt: 1,
+        processingStatus: 'ready',
+        processingProgress: 100,
+        hasHls: false,
+      };
+    },
+  } as unknown as FileCatalogue & PrivateFileCatalogue;
+
+  const app = new Hono();
+  mountFileRoutes(app, {
+    store: createDiskStore('/tmp/unused-fr'),
+    token: streamToken,
+    catalogue: fakeCatalogue,
+    privateUpload: {
+      unlock,
+      authorize: async () => ({ userId: 'u1', userSalt: salt }),
+    },
+  });
+
+  const put = (headers: Record<string, string>) =>
+    app.request('/_files/upload-private', {
+      method: 'PUT',
+      headers: { 'content-type': 'video/mp4', 'x-filename': 'clip.mp4', ...headers },
+      body: 'bytes',
+    });
+
+  test('password header → deniable key derived from the password', async () => {
+    captured = null;
+    const res = await put({ 'x-private-password': 'pw1' });
+    expect(res.status).toBe(200);
+    expect(derived()?.keyMode).toBe('deniable');
+    const expected = unlock.deriveSetKey({ userId: 'u1', userSalt: salt, password: 'pw1' });
+    expect(derived()?.setKey.equals(expected)).toBe(true);
+  });
+
+  test('no password, no token → standard server key', async () => {
+    captured = null;
+    const res = await put({});
+    expect(res.status).toBe(200);
+    expect(derived()?.keyMode).toBe('standard');
+    const expected = unlock.deriveSetKey({ userId: 'u1', userSalt: salt });
+    expect(derived()?.setKey.equals(expected)).toBe(true);
+  });
+
+  test('x-unlock-token → setKey + keyMode recovered from the grant', async () => {
+    captured = null;
+    const { token } = await unlock.unlock({ userId: 'u1', userSalt: salt, password: 'pw2' });
+    const res = await put({ 'x-unlock-token': token });
+    expect(res.status).toBe(200);
+    expect(derived()?.keyMode).toBe('deniable');
+    const expected = unlock.deriveSetKey({ userId: 'u1', userSalt: salt, password: 'pw2' });
+    expect(derived()?.setKey.equals(expected)).toBe(true);
+  });
+
+  test('a standard-mode token carries keyMode standard', async () => {
+    captured = null;
+    const { token } = await unlock.unlock({ userId: 'u1', userSalt: salt });
+    await put({ 'x-unlock-token': token });
+    expect(derived()?.keyMode).toBe('standard');
+  });
+
+  test('invalid or other-user tokens are rejected (401), password path unaffected', async () => {
+    expect((await put({ 'x-unlock-token': 'garbage' })).status).toBe(401);
+    const { token: foreign } = await unlock.unlock({ userId: 'u2', userSalt: salt });
+    expect((await put({ 'x-unlock-token': foreign })).status).toBe(401);
+    // Password path still works after token rejections.
+    expect((await put({ 'x-private-password': 'pw1' })).status).toBe(200);
+  });
+});
+
+describe('fileRoutes — GET list route (filters + sort passthrough)', () => {
+  let db: Database;
+  let root: string;
+  let cat: FileCatalogue & PrivateFileCatalogue;
+  const app = new Hono();
+  let clock = 9000;
+
+  beforeAll(async () => {
+    db = new Database(':memory:');
+    runMigrations(db, FILE_CATALOGUE_MIGRATIONS);
+    root = await mkdtemp(path.join(tmpdir(), 'fr-list-'));
+    cat = createSqliteFileCatalogue({
+      db,
+      store: createDiskStore(root),
+      workDir: path.join(root, 'work'),
+      now: () => ++clock,
+    });
+    mountFileRoutes(app, {
+      store: createDiskStore(root),
+      token: streamToken,
+      catalogue: cat,
+      authorizeUpload: () => CTX,
+    });
+    const mk = (name: string, size: number) =>
+      cat.ingest(CTX, {
+        name,
+        mime: 'image/png',
+        body: new Response('x'.repeat(size)).body as ReadableStream<Uint8Array>,
+      });
+    await mk('bbb.png', 30);
+    await mk('aaa.png', 10);
+    await mk('ccc.png', 20);
+  });
+  afterAll(async () => {
+    db.close();
+    await rm(root, { recursive: true, force: true });
+  });
+
+  const list = async (qs: string): Promise<FilePage> => {
+    const res = await app.request(`/_files/list${qs}`);
+    expect(res.status).toBe(200);
+    return (await res.json()) as FilePage;
+  };
+
+  test('default lists newest-first', async () => {
+    const page = await list('');
+    expect(page.items.map((f) => f.name)).toEqual(['ccc.png', 'aaa.png', 'bbb.png']);
+  });
+
+  test('?sort=name and ?sort=size order accordingly', async () => {
+    expect((await list('?sort=name')).items.map((f) => f.name)).toEqual([
+      'aaa.png',
+      'bbb.png',
+      'ccc.png',
+    ]);
+    expect((await list('?sort=size')).items.map((f) => f.size)).toEqual([30, 20, 10]);
+  });
+
+  test('?sort with cursor paginates under that sort', async () => {
+    const p1 = await list('?sort=name&limit=2');
+    expect(p1.items.map((f) => f.name)).toEqual(['aaa.png', 'bbb.png']);
+    expect(p1.nextCursor).toBeDefined();
+    const p2 = await list(`?sort=name&limit=2&cursor=${encodeURIComponent(p1.nextCursor ?? '')}`);
+    expect(p2.items.map((f) => f.name)).toEqual(['ccc.png']);
+  });
+
+  test('?sort=random shuffles yet returns the whole pool with a stable cursor', async () => {
+    const p1 = await list('?sort=random&limit=2');
+    expect(p1.items).toHaveLength(2);
+    expect(p1.nextCursor).toBeDefined();
+    const p2 = await list(`?sort=random&limit=2&cursor=${encodeURIComponent(p1.nextCursor ?? '')}`);
+    const walked = [...p1.items, ...p2.items].map((f) => f.id);
+    expect(new Set(walked).size).toBe(3); // no repeats across the seeded pages
+  });
+
+  test('POST /view records a watch-open that ?sort=lastViewed then orders by', async () => {
+    const all = await list('');
+    const target = all.items[2].id; // the newest-first tail — not first under any other sort
+    const res = await app.request('/_files/view', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ fileId: target }),
+    });
+    expect(res.status).toBe(200);
+    const viewed = await list('?sort=lastViewed');
+    expect(viewed.items[0].id).toBe(target); // the viewed file floats to the front
+    expect(viewed.items).toHaveLength(3);
+  });
+
+  test('POST /view without a fileId is a 400', async () => {
+    const res = await app.request('/_files/view', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({}),
+    });
+    expect(res.status).toBe(400);
+  });
+
+  test('?favorite=1 filters to favorites', async () => {
+    const all = await list('');
+    await cat.setFavorite(CTX, all.items[0].id, true);
+    const favs = await list('?favorite=1');
+    expect(favs.items.map((f) => f.id)).toEqual([all.items[0].id]);
+    expect(favs.items[0].favorite).toBe(true);
+  });
+
+  test('?collectionId + includeUnlockable gate flows through', async () => {
+    const coll = await cat.createCollection(CTX, { name: 'Hidden', visibility: 'unlock' });
+    const all = await list('');
+    await cat.addToCollection(CTX, coll.id, [all.items[0].id]);
+    expect((await list(`?collectionId=${coll.id}`)).items).toHaveLength(0);
+    expect((await list(`?collectionId=${coll.id}&includeUnlockable=1`)).items).toHaveLength(1);
+  });
+
+  test('unauthorized without a ctx', async () => {
+    const denied = new Hono();
+    mountFileRoutes(denied, {
+      store: createDiskStore(root),
+      token: streamToken,
+      catalogue: cat,
+      authorizeUpload: () => null,
+    });
+    expect((await denied.request('/_files/list')).status).toBe(401);
+  });
+});
+
+describe('fileRoutes — single-PUT upload cap (MAX_SINGLE_UPLOAD_BYTES → 413)', () => {
+  // The law: no single request may carry more than the cap; larger files must chunk. The guard
+  // fails fast on Content-Length. A fake catalogue captures whether ingest was even reached.
+  let ingested = 0;
+  const fakeCatalogue = {
+    async ingest(_ctx: MediaCtx, upload: { body: ReadableStream<Uint8Array> }) {
+      // Drain the body so the guard's streaming byte-cap transform actually runs (a real
+      // catalogue writes it to the store; here we just discard it). Over the cap, the transform
+      // errors the stream and this read rejects.
+      const reader = upload.body.getReader();
+      let done = false;
+      while (!done) {
+        done = (await reader.read()).done;
+      }
+      ingested++;
+      return {
+        id: 'f1',
+        name: 'x',
+        mime: 'application/octet-stream',
+        size: 1,
+        fileType: 'other',
+        tags: [],
+        processingStatus: 'ready',
+      };
+    },
+  } as unknown as FileCatalogue & PrivateFileCatalogue;
+
+  const app = new Hono();
+  mountFileRoutes(app, {
+    store: createDiskStore('/tmp/unused-cap'),
+    token: streamToken,
+    catalogue: fakeCatalogue,
+    authorizeUpload: () => CTX,
+  });
+
+  const putWithLength = (len: number) =>
+    app.request('/_files/upload', {
+      method: 'PUT',
+      headers: {
+        'content-type': 'application/octet-stream',
+        'x-filename': 'big.bin',
+        'content-length': String(len),
+      },
+      body: 'x',
+    });
+
+  test('Content-Length over the cap → 413 before ingest', async () => {
+    ingested = 0;
+    const res = await putWithLength(MAX_SINGLE_UPLOAD_BYTES + 1);
+    expect(res.status).toBe(413);
+    expect(((await res.json()) as { error: string }).error).toBe(SINGLE_UPLOAD_TOO_LARGE);
+    expect(ingested).toBe(0); // fail-fast: never touched the catalogue
+  });
+
+  test('Content-Length at the cap → allowed', async () => {
+    ingested = 0;
+    const res = await putWithLength(MAX_SINGLE_UPLOAD_BYTES);
+    expect(res.status).toBe(200);
+    expect(ingested).toBe(1);
+  });
+
+  test('a length-less stream exceeding the cap is aborted (not a clean 200)', async () => {
+    ingested = 0;
+    // A ReadableStream body with no Content-Length forces the streaming-cap branch. The guard
+    // errors the stream past the cap; the request must not succeed.
+    const big = Math.ceil(MAX_SINGLE_UPLOAD_BYTES / (1024 * 1024)) + 2;
+    const stream = new ReadableStream<Uint8Array>({
+      start(ctrl) {
+        for (let i = 0; i < big; i++) ctrl.enqueue(new Uint8Array(1024 * 1024));
+        ctrl.close();
+      },
+    });
+    let status = 0;
+    try {
+      const res = await app.request('/_files/upload', {
+        method: 'PUT',
+        headers: { 'content-type': 'application/octet-stream', 'x-filename': 'big.bin' },
+        body: stream,
+        // @ts-expect-error duplex is required for a stream body in undici/Bun
+        duplex: 'half',
+      });
+      status = res.status;
+    } catch {
+      status = -1; // the aborted stream surfaced as a fetch/stream error — also acceptable
+    }
+    expect(status).not.toBe(200);
+  });
+});