odac 1.4.14 → 1.4.16

package/test/Request/multipart.test.js

@@ -0,0 +1,164 @@
+const fs = require('fs')
+const os = require('os')
+const path = require('path')
+const {PassThrough} = require('stream')
+const OdacRequest = require('../../src/Request')
+
+const BOUNDARY = '----odacmultiparttest'
+
+// Build a raw multipart/form-data body as a Buffer so binary parts (with \r\n
+// and null bytes inside) survive intact — the regression case the old
+// string-splitting parser corrupted.
+function buildBody(parts) {
+  const chunks = []
+  for (const p of parts) {
+    chunks.push(Buffer.from(`--${BOUNDARY}\r\n`))
+    if (p.filename !== undefined) {
+      chunks.push(Buffer.from(`Content-Disposition: form-data; name="${p.name}"; filename="${p.filename}"\r\n`))
+      chunks.push(Buffer.from(`Content-Type: ${p.contentType || 'application/octet-stream'}\r\n\r\n`))
+      chunks.push(p.data)
+      chunks.push(Buffer.from('\r\n'))
+    } else {
+      chunks.push(Buffer.from(`Content-Disposition: form-data; name="${p.name}"\r\n\r\n`))
+      chunks.push(Buffer.from(`${p.value}\r\n`))
+    }
+  }
+  chunks.push(Buffer.from(`--${BOUNDARY}--\r\n`))
+  return Buffer.concat(chunks)
+}
+
+function makeReq() {
+  const req = new PassThrough()
+  req.method = 'POST'
+  req.url = '/upload'
+  req.headers = {
+    host: 'www.example.com',
+    'content-type': `multipart/form-data; boundary=${BOUNDARY}`
+  }
+  req.connection = {remoteAddress: '127.0.0.1', destroy: jest.fn()}
+  return req
+}
+
+function makeRes() {
+  return {writeHead: jest.fn(), end: jest.fn(), finished: false, on: jest.fn()}
+}
+
+// Temp-file cleanup in Request.js uses fire-and-forget fs.unlink(), which
+// completes via libuv's thread pool. A single event-loop tick isn't a
+// reliable signal that it finished, especially under CI I/O contention, so
+// poll for the expected end-state instead of assuming a fixed number of ticks.
+async function waitUntil(conditionFn, {timeoutMs = 2000, intervalMs = 10} = {}) {
+  const start = Date.now()
+  while (!conditionFn()) {
+    if (Date.now() - start > timeoutMs) return false
+    await new Promise(resolve => setTimeout(resolve, intervalMs))
+  }
+  return true
+}
+
+describe('Request multipart parsing', () => {
+  let tmpDir, request
+
+  beforeEach(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'odac-mp-'))
+    global.Odac = {
+      Config: {request: {timeout: 5000, maxBodySize: 1e6, maxFileSize: 5 * 1024 * 1024, maxFiles: 10, uploadDir: tmpDir}},
+      Route: {routes: {www: {}}},
+      Request: {}
+    }
+    global.__dir = tmpDir
+  })
+
+  afterEach(() => {
+    if (request) request.clearTimeout()
+    request = null
+    delete global.Odac
+    delete global.__dir
+    fs.rmSync(tmpDir, {recursive: true, force: true})
+  })
+
+  function run(body) {
+    const req = makeReq()
+    const res = makeRes()
+    request = new OdacRequest('id', req, res, {setTimeout: (fn, ms) => setTimeout(fn, ms)})
+    req.end(body)
+    return request
+  }
+
+  it('parses text fields into data.post', async () => {
+    const r = run(buildBody([{name: 'title', value: 'hello world'}]))
+    const val = await r.request('title')
+    expect(val).toBe('hello world')
+  })
+
+  it('round-trips binary file content byte-for-byte', async () => {
+    // Contains a PNG header, an embedded CRLF, and null bytes — exactly what the
+    // old toString()-based parser mangled.
+    const binary = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0x00, 0x00, 0xff, 0x0d, 0x0a, 0x42])
+    const r = run(buildBody([{name: 'avatar', filename: 'photo.png', contentType: 'image/png', data: binary}]))
+
+    const file = await r.file('avatar')
+    expect(file).toBeTruthy()
+    expect(file.name).toBe('photo.png')
+    expect(file.ext).toBe('png')
+    expect(file.mimetype).toBe('image/png')
+    expect(file.size).toBe(binary.length)
+    expect(file.truncated).toBe(false)
+
+    const written = fs.readFileSync(file.path)
+    expect(Buffer.compare(written, binary)).toBe(0)
+  })
+
+  it('mixes text fields and a file in one request', async () => {
+    const r = run(
+      buildBody([
+        {name: 'name', value: 'Ada'},
+        {name: 'doc', filename: 'a.txt', contentType: 'text/plain', data: Buffer.from('content')}
+      ])
+    )
+    expect(await r.request('name')).toBe('Ada')
+    const file = await r.file('doc')
+    expect(file.name).toBe('a.txt')
+  })
+
+  it('returns null for an untouched (empty filename) file input', async () => {
+    const r = run(buildBody([{name: 'avatar', filename: '', contentType: 'application/octet-stream', data: Buffer.alloc(0)}]))
+    expect(await r.file('avatar')).toBeNull()
+  })
+
+  it('returns an array when the same field has multiple files', async () => {
+    const r = run(
+      buildBody([
+        {name: 'docs', filename: '1.txt', contentType: 'text/plain', data: Buffer.from('one')},
+        {name: 'docs', filename: '2.txt', contentType: 'text/plain', data: Buffer.from('two')}
+      ])
+    )
+    const files = await r.file('docs')
+    expect(Array.isArray(files)).toBe(true)
+    expect(files).toHaveLength(2)
+    expect(files.map(f => f.name).sort()).toEqual(['1.txt', '2.txt'])
+  })
+
+  it('flags an oversize file as truncated with no leftover temp file', async () => {
+    global.Odac.Config.request.maxFileSize = 10 // bytes
+    const big = Buffer.alloc(1000, 0x41)
+    const r = run(buildBody([{name: 'avatar', filename: 'big.bin', contentType: 'application/octet-stream', data: big}]))
+
+    const file = await r.file('avatar')
+    expect(file.truncated).toBe(true)
+    expect(file.path).toBeNull()
+    // No orphaned odac-* temp file remains in the upload dir.
+    const noLeftovers = await waitUntil(() => fs.readdirSync(tmpDir).filter(n => n.startsWith('odac-')).length === 0)
+    expect(noLeftovers).toBe(true)
+  })
+
+  it('cleans up unstored temp files after the response ends', async () => {
+    const r = run(buildBody([{name: 'avatar', filename: 'x.bin', contentType: 'application/octet-stream', data: Buffer.from('abc')}]))
+    const file = await r.file('avatar')
+    expect(fs.existsSync(file.path)).toBe(true)
+
+    r.end('ok')
+    const removed = await waitUntil(() => !fs.existsSync(file.path))
+    expect(removed).toBe(true)
+  })
+})

package/test/Validator/file.test.js

@@ -0,0 +1,172 @@
+const fs = require('fs')
+const os = require('os')
+const path = require('path')
+const Validator = require('../../src/Validator')
+
+// Minimal Odac stub — file rules never touch Var()/Auth(), but other rules do,
+// so provide a small shim to keep the constructor happy.
+const odacStub = {
+  Var: () => ({is: () => false})
+}
+
+function mockRequest(filesByField) {
+  return {
+    file: async name => {
+      const arr = filesByField[name]
+      if (!arr) return null
+      return arr.length === 1 ? arr[0] : arr
+    }
+  }
+}
+
+function fileObj(overrides = {}) {
+  return {
+    field: 'upload',
+    name: 'file.bin',
+    ext: 'bin',
+    mimetype: 'application/octet-stream',
+    size: 1000,
+    path: null,
+    truncated: false,
+    stored: false,
+    ...overrides
+  }
+}
+
+describe('Validator file rules', () => {
+  let tmpDir
+
+  beforeAll(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'odac-file-test-'))
+  })
+
+  afterAll(() => {
+    fs.rmSync(tmpDir, {recursive: true, force: true})
+  })
+
+  function writeTmp(name, buf) {
+    const p = path.join(tmpDir, name)
+    fs.writeFileSync(p, buf)
+    return p
+  }
+
+  describe('required', () => {
+    it('fails when no file is present', async () => {
+      const v = new Validator(mockRequest({}), odacStub)
+      v.file('avatar').check('required').message('Avatar required')
+      expect(await v.error()).toBe(true)
+    })
+
+    it('passes when a file is present', async () => {
+      const v = new Validator(mockRequest({avatar: [fileObj()]}), odacStub)
+      v.file('avatar').check('required').message('Avatar required')
+      expect(await v.error()).toBe(false)
+    })
+  })
+
+  describe('maxsize / minsize', () => {
+    it('rejects a file above maxsize', async () => {
+      const v = new Validator(mockRequest({doc: [fileObj({size: 3 * 1024 * 1024})]}), odacStub)
+      v.file('doc').check('maxsize:2MB').message('Too large')
+      expect(await v.error()).toBe(true)
+    })
+
+    it('accepts a file at/below maxsize', async () => {
+      const v = new Validator(mockRequest({doc: [fileObj({size: 1024 * 1024})]}), odacStub)
+      v.file('doc').check('maxsize:2MB').message('Too large')
+      expect(await v.error()).toBe(false)
+    })
+
+    it('rejects a file below minsize', async () => {
+      const v = new Validator(mockRequest({doc: [fileObj({size: 500})]}), odacStub)
+      v.file('doc').check('minsize:1KB').message('Too small')
+      expect(await v.error()).toBe(true)
+    })
+  })
+
+  describe('ext', () => {
+    it('rejects a disallowed extension', async () => {
+      const v = new Validator(mockRequest({img: [fileObj({ext: 'gif'})]}), odacStub)
+      v.file('img').check('ext:jpg,png').message('Bad ext')
+      expect(await v.error()).toBe(true)
+    })
+
+    it('accepts an allowed extension', async () => {
+      const v = new Validator(mockRequest({img: [fileObj({ext: 'png'})]}), odacStub)
+      v.file('img').check('ext:jpg,png').message('Bad ext')
+      expect(await v.error()).toBe(false)
+    })
+  })
+
+  describe('maxfiles', () => {
+    it('rejects too many files', async () => {
+      const files = [fileObj(), fileObj(), fileObj()]
+      const v = new Validator(mockRequest({docs: files}), odacStub)
+      v.file('docs').check('maxfiles:2').message('Too many')
+      expect(await v.error()).toBe(true)
+    })
+
+    it('accepts within the limit', async () => {
+      const files = [fileObj(), fileObj()]
+      const v = new Validator(mockRequest({docs: files}), odacStub)
+      v.file('docs').check('maxfiles:2').message('Too many')
+      expect(await v.error()).toBe(false)
+    })
+  })
+
+  describe('mimetype', () => {
+    const PNG = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0, 0, 0, 0])
+
+    it('accepts a genuine PNG matching the whitelist', async () => {
+      const p = writeTmp('real.png', PNG)
+      const file = fileObj({ext: 'png', mimetype: 'image/png', path: p})
+      const v = new Validator(mockRequest({avatar: [file]}), odacStub)
+      v.file('avatar').check('mimetype:image/png,image/jpeg').message('Bad type')
+      expect(await v.error()).toBe(false)
+    })
+
+    it('rejects a spoofed .png whose bytes are not PNG', async () => {
+      const p = writeTmp('fake.png', Buffer.from('<script>alert(1)</script>'))
+      const file = fileObj({ext: 'png', mimetype: 'image/png', path: p})
+      const v = new Validator(mockRequest({avatar: [file]}), odacStub)
+      v.file('avatar').check('mimetype:image/png,image/jpeg').message('Bad type')
+      expect(await v.error()).toBe(true)
+    })
+
+    it('rejects a type outside the whitelist', async () => {
+      const file = fileObj({ext: 'pdf', mimetype: 'application/pdf'})
+      const v = new Validator(mockRequest({avatar: [file]}), odacStub)
+      v.file('avatar').check('mimetype:image/png,image/jpeg').message('Bad type')
+      expect(await v.error()).toBe(true)
+    })
+
+    it('supports image/* wildcard', async () => {
+      const p = writeTmp('w.png', PNG)
+      const file = fileObj({ext: 'png', mimetype: 'image/png', path: p})
+      const v = new Validator(mockRequest({avatar: [file]}), odacStub)
+      v.file('avatar').check('accept:image/*').message('Bad type')
+      expect(await v.error()).toBe(false)
+    })
+  })
+
+  describe('truncated files', () => {
+    it('always fails, even with only a size rule that it would pass', async () => {
+      const file = fileObj({truncated: true, path: null, size: 0})
+      const v = new Validator(mockRequest({big: [file]}), odacStub)
+      v.file('big').check('maxsize:2MB').message('File too large')
+      expect(await v.error()).toBe(true)
+    })
+  })
+
+  describe('parameterized-rule split regression', () => {
+    it('parses maxsize suffix correctly via split(/:(.+)/)', async () => {
+      const under = new Validator(mockRequest({d: [fileObj({size: 1024})]}), odacStub)
+      under.file('d').check('maxsize:2KB').message('x')
+      expect(await under.error()).toBe(false)
+
+      const over = new Validator(mockRequest({d: [fileObj({size: 4096})]}), odacStub)
+      over.file('d').check('maxsize:2KB').message('x')
+      expect(await over.error()).toBe(true)
+    })
+  })
+})

package/test/View/Form/generateFieldHtml.test.js

@@ -34,4 +34,60 @@ describe('Form.generateFieldHtml()', () => {
     expect(html).toContain('value="a&b"c<d>e'f"')
     expect(html).not.toContain('value="a&b"c<d>e\'f"')
   })
+
+  test('should render a file input without value/placeholder attributes', () => {
+    const html = Form.generateFieldHtml({
+      name: 'avatar',
+      type: 'file',
+      placeholder: 'ignored',
+      label: null,
+      class: '',
+      id: null,
+      value: null,
+      validations: [],
+      extraAttributes: {}
+    })
+
+    expect(html).toContain('type="file"')
+    expect(html).toContain('name="avatar"')
+    expect(html).not.toContain('value=')
+    expect(html).not.toContain('placeholder=')
+  })
+
+  test('should map file validation rules to accept/multiple/data-* attributes', () => {
+    const html = Form.generateFieldHtml({
+      name: 'photos',
+      type: 'file',
+      placeholder: '',
+      label: null,
+      class: '',
+      id: null,
+      value: null,
+      validations: [{rule: 'required|maxsize:2MB|mimetype:image/png,image/jpeg|maxfiles:3', message: 'Bad file'}],
+      extraAttributes: {}
+    })
+
+    expect(html).toContain('required')
+    expect(html).toContain('accept="image/png,image/jpeg"')
+    expect(html).toContain(`data-maxsize="${2 * 1024 * 1024}"`)
+    expect(html).toContain('multiple')
+    expect(html).toContain('data-maxfiles="3"')
+    expect(html).toContain('data-error-maxsize="Bad file"')
+  })
+
+  test('should convert ext rule to a dot-prefixed accept list', () => {
+    const html = Form.generateFieldHtml({
+      name: 'doc',
+      type: 'file',
+      placeholder: '',
+      label: null,
+      class: '',
+      id: null,
+      value: null,
+      validations: [{rule: 'ext:pdf,docx', message: null}],
+      extraAttributes: {}
+    })
+
+    expect(html).toContain('accept=".pdf,.docx"')
+  })
 })

package/test/View/Image/serve.test.js

@@ -1,21 +1,26 @@
 const fs = require('fs')
 const fsPromises = fs.promises
+const os = require('os')
 const path = require('path')
 const Image = require('../../../src/View/Image')
 
-const IMG_CACHE_DIR = './storage/.cache/img'
-
 describe('Image.serve()', () => {
   const testFilename = 'testserve1234567.webp'
-  const testFilePath = path.join(IMG_CACHE_DIR, testFilename)
+  let tmpDir, IMG_CACHE_DIR, testFilePath
 
   beforeAll(async () => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'odac-image-serve-'))
+    global.__dir = tmpDir
+    IMG_CACHE_DIR = path.join(tmpDir, 'storage/.cache/img')
+    testFilePath = path.join(IMG_CACHE_DIR, testFilename)
+
     await fsPromises.mkdir(IMG_CACHE_DIR, {recursive: true})
     await fsPromises.writeFile(testFilePath, Buffer.from('fake-image-data'))
   })
 
   afterAll(async () => {
-    await fsPromises.unlink(testFilePath).catch(() => {})
+    delete global.__dir
+    await fsPromises.rm(tmpDir, {recursive: true, force: true})
   })
 
   test('should return stream, type, and size for a cached file', async () => {

package/test/View/Image/url.test.js

@@ -1,20 +1,26 @@
 const fs = require('fs')
 const fsPromises = fs.promises
+const os = require('os')
 const path = require('path')
 const Image = require('../../../src/View/Image')
 
 describe('Image.url()', () => {
-  const publicDir = path.join(process.cwd(), 'public')
-  const testImageDir = path.join(publicDir, 'images')
-  const testImagePath = path.join(testImageDir, 'url-test.jpg')
+  let tmpDir, testImagePath
 
   beforeAll(async () => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'odac-image-url-'))
+    global.__dir = tmpDir
+
+    const testImageDir = path.join(tmpDir, 'public', 'images')
+    testImagePath = path.join(testImageDir, 'url-test.jpg')
+
     await fsPromises.mkdir(testImageDir, {recursive: true})
     await fsPromises.writeFile(testImagePath, Buffer.from('fake-jpg-data'))
   })
 
   afterAll(async () => {
-    await fsPromises.unlink(testImagePath).catch(() => {})
+    delete global.__dir
+    await fsPromises.rm(tmpDir, {recursive: true, force: true})
   })
 
   test('should return empty string for empty src', async () => {

package/test/View/addNavigateAttribute.test.js

@@ -1,13 +1,20 @@
 const fs = require('fs').promises
+const fsSync = require('fs')
+const os = require('os')
 const path = require('path')
 const View = require('../../src/View')
 
 describe('View.#addNavigateAttribute()', () => {
   let view
   let mockOdac
+  let tmpDir
+  let originalCwd
 
   beforeEach(() => {
-    global.__dir = path.resolve(__dirname, '../../')
+    tmpDir = fsSync.mkdtempSync(path.join(os.tmpdir(), 'odac-view-navattr-'))
+    global.__dir = tmpDir
+    originalCwd = process.cwd()
+    process.chdir(tmpDir)
     mockOdac = {
       Config: {view: {earlyHints: {enabled: false}}},
       View: {},
@@ -28,6 +35,8 @@ describe('View.#addNavigateAttribute()', () => {
   afterEach(() => {
     jest.restoreAllMocks()
     delete global.__dir
+    process.chdir(originalCwd)
+    fsSync.rmSync(tmpDir, {recursive: true, force: true})
   })
 
   it('should not wrap placeholder in display:contents if it is the first child of an element', async () => {

package/test/View/print.test.js

@@ -1,13 +1,20 @@
 const fs = require('fs').promises
+const fsSync = require('fs')
+const os = require('os')
 const path = require('path')
 const View = require('../../src/View')
 
 describe('View.print()', () => {
   let view
   let mockOdac
+  let tmpDir
+  let originalCwd
 
   beforeEach(() => {
-    global.__dir = path.resolve(__dirname, '../../')
+    tmpDir = fsSync.mkdtempSync(path.join(os.tmpdir(), 'odac-view-print-'))
+    global.__dir = tmpDir
+    originalCwd = process.cwd()
+    process.chdir(tmpDir)
     mockOdac = {
       Config: {view: {earlyHints: {enabled: false}}},
       View: {},
@@ -28,6 +35,8 @@ describe('View.print()', () => {
   afterEach(() => {
     jest.restoreAllMocks()
     delete global.__dir
+    process.chdir(originalCwd)
+    fsSync.rmSync(tmpDir, {recursive: true, force: true})
   })
 
   it('should be a function', () => {