dsh-offwork 1.1.2 → 1.2.2

package/tests/settings-api.test.mjs

@@ -0,0 +1,130 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, writeFile, readFile, stat, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createServer } from 'node:http';
+import { createOperations, DEFAULT_SETTINGS, installOperations } from '../index.js';
+import { createSettingsAccess, createSettingsHandler } from '../settings-api.js';
+async function fixture(t) {
+  const dir = await mkdtemp(join(tmpdir(), 'offwork-settings-api-'));
+  t.after(() => rm(dir, { recursive: true, force: true }));
+  return dir;
+}
+test('stable migration preserves original bytes and never overwrites an existing target', async (t) => {
+  const dir = await fixture(t),
+    legacy = join(dir, 'legacy.json'),
+    target = join(dir, 'storage', 'settings.json');
+  const bytes = JSON.stringify({ ...DEFAULT_SETTINGS, monthlySalary: 12345 });
+  await writeFile(legacy, bytes);
+  const operate = createOperations(target, { legacyFile: legacy });
+  const result = await operate('get');
+  assert.equal(result.ok, true);
+  assert.equal(result.settings.monthlySalary, 12345);
+  assert.equal(await readFile(legacy, 'utf8'), bytes);
+  assert.equal((await stat(target)).mode & 0o777, 0o600);
+  await operate('set', { monthlySalary: 444 });
+  await writeFile(legacy, JSON.stringify(DEFAULT_SETTINGS));
+  assert.equal(
+    (await createOperations(target, { legacyFile: legacy })('get')).settings.monthlySalary,
+    444,
+  );
+});
+test('corrupt legacy data fails closed without creating a defaults file', async (t) => {
+  const dir = await fixture(t),
+    legacy = join(dir, 'legacy.json'),
+    target = join(dir, 'storage', 'settings.json');
+  await writeFile(legacy, '{broken');
+  const result = await createOperations(target, { legacyFile: legacy })('get');
+  assert.equal(result.ok, false);
+  await assert.rejects(readFile(target), { code: 'ENOENT' });
+  assert.equal(await readFile(legacy, 'utf8'), '{broken');
+});
+test('UI settings API rejects cross-origin, missing header and non-JSON writes', async (t) => {
+  const dir = await fixture(t),
+    operate = createOperations(join(dir, 'settings.json')),
+    access = createSettingsAccess(dir);
+  const server = createServer(createSettingsHandler(operate, access, () => undefined));
+  await new Promise((r) => server.listen(0, '127.0.0.1', r));
+  t.after(() => new Promise((r) => server.close(r)));
+  const url = `http://127.0.0.1:${server.address().port}/offwork-clock/settings`;
+  assert.equal((await fetch(url)).status, 403);
+  assert.equal(
+    (await fetch(url, { headers: { 'x-offwork-client': '1', 'sec-fetch-site': 'cross-site' } }))
+      .status,
+    403,
+  );
+  assert.equal(
+    (await fetch(url, { headers: { 'x-offwork-client': '1', origin: 'https://evil.example' } }))
+      .status,
+    403,
+  );
+  const headers = { 'x-offwork-client': '1', 'content-type': 'application/json' };
+  assert.equal((await (await fetch(url, { headers })).json()).agentAccess, false);
+  assert.equal(
+    (await fetch(url, { method: 'POST', headers: { 'x-offwork-client': '1' }, body: '{}' })).status,
+    415,
+  );
+  const saved = await (
+    await fetch(url, {
+      method: 'POST',
+      headers,
+      body: JSON.stringify({ action: 'set', settings: { dailySalary: 234 } }),
+    })
+  ).json();
+  assert.equal(saved.settings.dailySalary, 234);
+  await fetch(url, {
+    method: 'POST',
+    headers,
+    body: JSON.stringify({ action: 'access', allowed: true }),
+  });
+  assert.equal(await access.get(), true);
+  assert.equal(
+    (await fetch(url, { method: 'POST', headers, body: 'x'.repeat(17000) })).status,
+    413,
+  );
+});
+test('private settings default to unauthenticated denial before reading data', async (t) => {
+  const dir = await fixture(t);
+  let reads = 0;
+  const server = createServer(
+    createSettingsHandler(async () => {
+      reads++;
+      return { ok: true };
+    }, createSettingsAccess(dir)),
+  );
+  await new Promise((r) => server.listen(0, '127.0.0.1', r));
+  t.after(() => new Promise((r) => server.close(r)));
+  const response = await fetch(`http://127.0.0.1:${server.address().port}/offwork-clock/settings`, {
+    headers: { 'x-offwork-client': '1' },
+  });
+  assert.equal(response.status, 401);
+  assert.equal(reads, 0);
+});
+
+test('agent salary access defaults off, can be explicitly enabled and revoked', async (t) => {
+  const dir = await fixture(t),
+    operate = createOperations(join(dir, 'settings.json')),
+    access = createSettingsAccess(dir);
+  let tool;
+  installOperations(
+    {
+      effect: (fn) => fn(),
+      commands: { register: () => () => {} },
+      tools: {
+        register: (t) => {
+          tool = t;
+          return () => {};
+        },
+      },
+    },
+    operate,
+    access,
+  );
+  assert.equal((await tool.execute({ action: 'get' })).ok, false);
+  await access.set(true);
+  assert.equal((await tool.execute({ action: 'get' })).ok, true);
+  await access.set(false);
+  assert.equal((await tool.execute({ action: 'set', settings: { monthlySalary: 777 } })).ok, false);
+  assert.equal((await operate('get')).configured, false);
+});

package/tests/ui.test.mjs

@@ -125,7 +125,10 @@ test('Client uses the exact tested engine and a single surface', async () => {
   assert.match(source, /removeEventListener\('storage'/);
   assert.match(source, /ro\?\.disconnect/);
   assert.match(source, /generation\.current/);
-  assert.doesNotMatch(source, /document\.body|window\.open|fetch\(/);
+  assert.doesNotMatch(source, /document\.body|window\.open/);
+  assert.match(source, /offwork-clock\/settings/);
+  assert.match(source, /credentials: 'same-origin'/);
+  assert.doesNotMatch(source, /remote\.commands\.execute/);
   assert.match(source, /money\(safeState\.earned\)/);
   assert.match(source, /owc-glass/);
   assert.match(source, /--owc-alpha/);

package/tools/build.mjs

@@ -16,6 +16,9 @@ const moduleNames = [
   'hydration.js',
   'hydration-store.js',
   'countdown.js',
+  'companion-state.js',
+  'companion-image.js',
+  'companion-app.js',
 ];
 const [entry, ...modules] = await Promise.all(
   moduleNames.map((name) => readFile(new URL(name, root), 'utf8')),
@@ -30,7 +33,10 @@ if (entry.split(marker).length !== 2) {
 const pure = modules
   .map((source) =>
     source
-      .replace(/^import\s+\{[^}]+\}\s+from '\.\/(?:hydration|clock)\.js';\n/gm, '')
+      .replace(
+        /^import\s+\{[^}]+\}\s+from '\.\/(?:hydration|clock|countdown|ui-utils)\.js';\n/gm,
+        '',
+      )
       .replace(/^export /gm, ''),
   )
   .join('\n');

package/tools/check-package.mjs

@@ -71,6 +71,10 @@ assert.equal(packed.version, pkg.version);
 for (const path of [
   'package.json',
   'index.js',
+  'settings-api.js',
+  'companion-state.js',
+  'companion-image.js',
+  'companion-app.js',
   'media-server.js',
   'media-manifest.js',
   'client.js',