tower-studio 0.1.2 → 0.1.3

package/src/lib/__tests__/file-utils.test.ts

@@ -0,0 +1,177 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+// Mock tower-dir to return a predictable path instead of touching ~/.tower
+vi.mock("../tower-dir", () => ({
+  getStorageDir: () => "/mock/tower/storage",
+}));
+
+// Mock node:fs so mkdirSync doesn't create real directories
+vi.mock("node:fs", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("node:fs")>();
+  return {
+    ...actual,
+    mkdirSync: vi.fn(),
+    existsSync: vi.fn(() => false),
+  };
+});
+
+import * as fs from "node:fs";
+import {
+  getAssistantCacheDir,
+  buildCacheFilename,
+  stripCacheUuidSuffix,
+  isAssistantCachePath,
+} from "../file-utils";
+
+describe("getAssistantCacheDir", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("DIR-01: returns path ending with YYYY-MM/images when called with 'images'", () => {
+    const now = new Date();
+    const ym = `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, "0")}`;
+    const result = getAssistantCacheDir("images");
+    expect(result).toMatch(new RegExp(`assistant[\\/\\\\]${ym}[\\/\\\\]images$`));
+  });
+
+  it("DIR-02: returns path ending with YYYY-MM/files when called with 'files'", () => {
+    const now = new Date();
+    const ym = `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, "0")}`;
+    const result = getAssistantCacheDir("files");
+    expect(result).toMatch(new RegExp(`assistant[\\/\\\\]${ym}[\\/\\\\]files$`));
+  });
+
+  it("DIR-02: defaults to 'images' type when called with no arguments", () => {
+    const now = new Date();
+    const ym = `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, "0")}`;
+    const result = getAssistantCacheDir();
+    expect(result).toMatch(new RegExp(`assistant[\\/\\\\]${ym}[\\/\\\\]images$`));
+  });
+
+  it("DIR-03: calls fs.mkdirSync with { recursive: true }", () => {
+    getAssistantCacheDir("images");
+    expect(fs.mkdirSync).toHaveBeenCalledWith(
+      expect.any(String),
+      { recursive: true }
+    );
+  });
+
+  it("DIR-03: mkdirSync receives the same path returned by the function", () => {
+    const result = getAssistantCacheDir("images");
+    expect(fs.mkdirSync).toHaveBeenCalledWith(result, { recursive: true });
+  });
+
+  it("DIR-04: path is rooted under the mocked storage dir", () => {
+    const result = getAssistantCacheDir("images");
+    expect(result).toContain("/mock/tower/storage");
+  });
+});
+
+describe("buildCacheFilename", () => {
+  it("NAME-01: preserves Chinese characters in filename", () => {
+    const result = buildCacheFilename("设计稿.png", ".png");
+    expect(result).toMatch(/^设计稿-[0-9a-f]{8}\.png$/);
+  });
+
+  it("NAME-01 + NAME-03: replaces spaces with underscore, keeps alphanumeric", () => {
+    const result = buildCacheFilename("my report.pdf", ".pdf");
+    expect(result).toMatch(/^my_report-[0-9a-f]{8}\.pdf$/);
+  });
+
+  it("NAME-02: returns tower_image prefix for meaningless name 'image'", () => {
+    const result = buildCacheFilename("image.png", ".png");
+    expect(result).toMatch(/^tower_image-[0-9a-f]{8}\.png$/);
+  });
+
+  it("NAME-02: returns tower_image prefix for Screenshot-style names", () => {
+    const result = buildCacheFilename("Screenshot 2026-04-20 at 12.34.56.png", ".png");
+    expect(result).toMatch(/^tower_image-[0-9a-f]{8}\.png$/);
+  });
+
+  it("NAME-02: returns tower_image prefix for empty original name", () => {
+    const result = buildCacheFilename("", ".png");
+    expect(result).toMatch(/^tower_image-[0-9a-f]{8}\.png$/);
+  });
+
+  it("NAME-03: replaces special characters with underscore", () => {
+    const result = buildCacheFilename("hello world!@#.png", ".png");
+    expect(result).toMatch(/^hello_world-[0-9a-f]{8}\.png$/);
+  });
+
+  it("NAME-03: preserves Chinese characters and replaces spaces with underscore", () => {
+    const result = buildCacheFilename("中文 文件名.png", ".png");
+    expect(result).toMatch(/^中文_文件名-[0-9a-f]{8}\.png$/);
+  });
+
+  it("NAME-03: falls back to 'file' prefix when stem is all special chars", () => {
+    const result = buildCacheFilename("!!!.png", ".png");
+    expect(result).toMatch(/^file-[0-9a-f]{8}\.png$/);
+  });
+
+  it("appends exactly 8 hex characters as UUID suffix", () => {
+    const result = buildCacheFilename("test.png", ".png");
+    const match = result.match(/-([0-9a-f]{8})\./);
+    expect(match).not.toBeNull();
+    expect(match![1]).toHaveLength(8);
+  });
+
+  it("uses the provided extension correctly", () => {
+    const result = buildCacheFilename("document.pdf", ".pdf");
+    expect(result).toMatch(/\.pdf$/);
+  });
+
+  it("NAME-02: 'img' is also a meaningless name", () => {
+    const result = buildCacheFilename("img.jpg", ".jpg");
+    expect(result).toMatch(/^tower_image-[0-9a-f]{8}\.jpg$/);
+  });
+
+  it("NAME-02: 'photo' is also a meaningless name", () => {
+    const result = buildCacheFilename("photo.jpg", ".jpg");
+    expect(result).toMatch(/^tower_image-[0-9a-f]{8}\.jpg$/);
+  });
+});
+
+describe("stripCacheUuidSuffix", () => {
+  it("ASSET-01: strips 8-hex UUID suffix from Chinese filename", () => {
+    expect(stripCacheUuidSuffix("设计稿-a1b2c3d4.png")).toBe("设计稿.png");
+  });
+
+  it("ASSET-01: strips 8-hex UUID suffix from tower_image filename", () => {
+    expect(stripCacheUuidSuffix("tower_image-a1b2c3d4.png")).toBe("tower_image.png");
+  });
+
+  it("ASSET-01: returns filename unchanged when no 8-hex suffix present", () => {
+    expect(stripCacheUuidSuffix("already-clean.png")).toBe("already-clean.png");
+  });
+
+  it("ASSET-01: does not strip when hex part is 12 chars (not 8)", () => {
+    expect(stripCacheUuidSuffix("report-a1b2c3d4e5f6.png")).toBe("report-a1b2c3d4e5f6.png");
+  });
+
+  it("ASSET-01: strips case-insensitive hex suffix (uppercase)", () => {
+    expect(stripCacheUuidSuffix("my_doc-AABB1122.pdf")).toBe("my_doc.pdf");
+  });
+
+  it("ASSET-01: handles different file extensions correctly", () => {
+    expect(stripCacheUuidSuffix("document-deadbeef.pdf")).toBe("document.pdf");
+  });
+});
+
+describe("isAssistantCachePath", () => {
+  it("ASSET-01: returns true for path inside assistant cache root", () => {
+    const path = require("path");
+    const filePath = path.join("/mock/tower/storage", "cache", "assistant", "2026-04", "images", "foo.png");
+    expect(isAssistantCachePath(filePath)).toBe(true);
+  });
+
+  it("ASSET-01: returns false for path outside assistant cache (in assets)", () => {
+    const path = require("path");
+    const assetsPath = path.join("/mock/tower/storage", "assets", "proj123", "foo.png");
+    expect(isAssistantCachePath(assetsPath)).toBe(false);
+  });
+
+  it("ASSET-01: returns false for arbitrary non-cache path", () => {
+    expect(isAssistantCachePath("/tmp/some/random/file.png")).toBe(false);
+  });
+});

package/src/lib/__tests__/internal-api-guard.test.ts

@@ -0,0 +1,151 @@
+import { describe, it, expect } from "vitest";
+import { requireLocalhost, validateTaskId, validateProjectId } from "../internal-api-guard";
+import { NextRequest } from "next/server";
+
+function makeRequest(host: string, headers?: Record<string, string>): NextRequest {
+  const url = `http://${host}/api/internal/test`;
+  return new NextRequest(url, {
+    headers: { host, ...headers },
+  });
+}
+
+describe("requireLocalhost", () => {
+  it("allows request from localhost:3000 (no x-forwarded-for)", () => {
+    const req = makeRequest("localhost:3000");
+    expect(requireLocalhost(req)).toBeNull();
+  });
+
+  it("allows request from 127.0.0.1:3000 (no x-forwarded-for)", () => {
+    const req = makeRequest("127.0.0.1:3000");
+    expect(requireLocalhost(req)).toBeNull();
+  });
+
+  it("allows request from [::1]:3000 (IPv6 loopback, no x-forwarded-for)", () => {
+    const req = makeRequest("[::1]:3000");
+    expect(requireLocalhost(req)).toBeNull();
+  });
+
+  it("blocks request from evil.com (403)", async () => {
+    const req = makeRequest("evil.com");
+    const res = requireLocalhost(req);
+    expect(res).not.toBeNull();
+    expect(res!.status).toBe(403);
+    const body = await res!.json();
+    expect(body.error).toBe("Forbidden");
+  });
+
+  it("blocks request from 10.0.0.5 (non-loopback host, 403)", async () => {
+    const req = makeRequest("10.0.0.5");
+    const res = requireLocalhost(req);
+    expect(res).not.toBeNull();
+    expect(res!.status).toBe(403);
+  });
+
+  it("allows request with x-forwarded-for 127.0.0.1 from localhost", () => {
+    const req = makeRequest("localhost:3000", { "x-forwarded-for": "127.0.0.1" });
+    expect(requireLocalhost(req)).toBeNull();
+  });
+
+  it("blocks request with spoofed x-forwarded-for 192.168.1.100 from localhost (403)", async () => {
+    const req = makeRequest("localhost:3000", { "x-forwarded-for": "192.168.1.100" });
+    const res = requireLocalhost(req);
+    expect(res).not.toBeNull();
+    expect(res!.status).toBe(403);
+    const body = await res!.json();
+    expect(body.error).toBe("Forbidden");
+  });
+
+  it("blocks request with mixed x-forwarded-for chain containing a non-loopback IP (403)", async () => {
+    const req = makeRequest("localhost:3000", {
+      "x-forwarded-for": "127.0.0.1, 192.168.1.1",
+    });
+    const res = requireLocalhost(req);
+    expect(res).not.toBeNull();
+    expect(res!.status).toBe(403);
+  });
+
+  it("allows request with x-forwarded-for ::1 (IPv6 loopback) from localhost", () => {
+    const req = makeRequest("localhost:3000", { "x-forwarded-for": "::1" });
+    expect(requireLocalhost(req)).toBeNull();
+  });
+
+  it("allows request with x-forwarded-for ::ffff:127.0.0.1 (IPv4-mapped) from localhost", () => {
+    const req = makeRequest("localhost:3000", {
+      "x-forwarded-for": "::ffff:127.0.0.1",
+    });
+    expect(requireLocalhost(req)).toBeNull();
+  });
+
+  it("allows request with empty x-forwarded-for header (empty string is falsy, treated as absent)", () => {
+    const req = makeRequest("localhost:3000", { "x-forwarded-for": "" });
+    // Empty string is falsy in JS, so the forwarded-IP check is skipped entirely.
+    // The host header check then passes for localhost:3000.
+    const res = requireLocalhost(req);
+    expect(res).toBeNull();
+  });
+
+  it("blocks request with no host header (403)", async () => {
+    // Create a request with an explicit empty host
+    const url = "http://127.0.0.1/api/internal/test";
+    const req = new NextRequest(url, {
+      headers: { host: "unknown-host.example.com" },
+    });
+    const res = requireLocalhost(req);
+    expect(res).not.toBeNull();
+    expect(res!.status).toBe(403);
+  });
+});
+
+describe("validateTaskId", () => {
+  it("accepts a valid CUID", () => {
+    expect(validateTaskId("clh1234567890abcdefghij")).toBeNull();
+  });
+
+  it("rejects 'not-a-cuid' with 400", async () => {
+    const res = validateTaskId("not-a-cuid");
+    expect(res).not.toBeNull();
+    expect(res!.status).toBe(400);
+    const body = await res!.json();
+    expect(body.error).toContain("Invalid taskId");
+  });
+
+  it("rejects empty string with 400", async () => {
+    const res = validateTaskId("");
+    expect(res).not.toBeNull();
+    expect(res!.status).toBe(400);
+  });
+
+  it("rejects uppercase CUID-like string with 400 (regex is lowercase-only)", async () => {
+    const res = validateTaskId("CLH1234567890ABCDEFGHIJ");
+    expect(res).not.toBeNull();
+    expect(res!.status).toBe(400);
+  });
+});
+
+describe("validateProjectId", () => {
+  it("accepts a valid CUID", () => {
+    expect(validateProjectId("clh1234567890abcdefghij")).toBeNull();
+  });
+
+  it("rejects 'not-a-cuid' with 400 and 'Invalid projectId format'", async () => {
+    const res = validateProjectId("not-a-cuid");
+    expect(res).not.toBeNull();
+    expect(res!.status).toBe(400);
+    const body = await res!.json();
+    expect(body.error).toBe("Invalid projectId format");
+  });
+
+  it("rejects path traversal string '../../../etc' with 400", async () => {
+    const res = validateProjectId("../../../etc");
+    expect(res).not.toBeNull();
+    expect(res!.status).toBe(400);
+    const body = await res!.json();
+    expect(body.error).toBe("Invalid projectId format");
+  });
+
+  it("rejects empty string with 400", async () => {
+    const res = validateProjectId("");
+    expect(res).not.toBeNull();
+    expect(res!.status).toBe(400);
+  });
+});

package/src/lib/__tests__/logger.test.ts

@@ -0,0 +1,181 @@
+// @vitest-environment node
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { logger } from "../logger";
+
+describe("logger", () => {
+  let logSpy: ReturnType<typeof vi.spyOn>;
+  let warnSpy: ReturnType<typeof vi.spyOn>;
+  let errorSpy: ReturnType<typeof vi.spyOn>;
+
+  beforeEach(() => {
+    logSpy = vi.spyOn(console, "log").mockImplementation(() => {});
+    warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
+    errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    logSpy.mockRestore();
+    warnSpy.mockRestore();
+    errorSpy.mockRestore();
+  });
+
+  describe("logger.info", () => {
+    it("calls console.log once with INFO level and [app] context", () => {
+      logger.info("hello");
+      expect(logSpy).toHaveBeenCalledTimes(1);
+      const output = logSpy.mock.calls[0][0] as string;
+      expect(output).toMatch(/INFO/);
+      expect(output).toMatch(/\[app\]/);
+      expect(output).toContain("hello");
+    });
+
+    it("output contains ISO-format timestamp", () => {
+      logger.info("timestamp test");
+      const output = logSpy.mock.calls[0][0] as string;
+      expect(output).toMatch(/\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}/);
+    });
+
+    it("output format is [TIMESTAMP] INFO [app] message", () => {
+      logger.info("format check");
+      const output = logSpy.mock.calls[0][0] as string;
+      // Pattern: [ISO] INFO [app] format check
+      expect(output).toMatch(/^\[.*?\] INFO \[app\] format check$/);
+    });
+
+    it("includes JSON-stringified meta when meta object is provided", () => {
+      logger.info("data", { userId: "abc" });
+      const output = logSpy.mock.calls[0][0] as string;
+      expect(output).toContain("userId");
+      expect(output).toContain("abc");
+    });
+
+    it("does not include meta section when meta is omitted", () => {
+      logger.info("no meta");
+      const output = logSpy.mock.calls[0][0] as string;
+      // Should not end with a JSON object
+      expect(output).not.toContain("{");
+    });
+  });
+
+  describe("logger.warn", () => {
+    it("calls console.warn once (not console.log) with WARN level", () => {
+      logger.warn("caution");
+      expect(warnSpy).toHaveBeenCalledTimes(1);
+      expect(logSpy).not.toHaveBeenCalled();
+      const output = warnSpy.mock.calls[0][0] as string;
+      expect(output).toMatch(/WARN/);
+      expect(output).toContain("caution");
+    });
+
+    it("warn output contains [app] context", () => {
+      logger.warn("context check");
+      const output = warnSpy.mock.calls[0][0] as string;
+      expect(output).toContain("[app]");
+    });
+  });
+
+  describe("logger.error", () => {
+    it("calls console.error once (not log or warn) with ERROR level", () => {
+      logger.error("fail");
+      expect(errorSpy).toHaveBeenCalledTimes(1);
+      expect(logSpy).not.toHaveBeenCalled();
+      expect(warnSpy).not.toHaveBeenCalled();
+      const output = errorSpy.mock.calls[0][0] as string;
+      expect(output).toMatch(/ERROR/);
+      expect(output).toContain("fail");
+    });
+
+    it("error with Error object includes error.message in meta", () => {
+      const err = new Error("boom");
+      logger.error("fail", err);
+      const output = errorSpy.mock.calls[0][0] as string;
+      expect(output).toContain("boom");
+    });
+
+    it("error with Error object includes stack in meta JSON", () => {
+      const err = new Error("stack test");
+      logger.error("fail", err);
+      const output = errorSpy.mock.calls[0][0] as string;
+      expect(output).toContain("stack");
+    });
+
+    it("error with string argument includes string in meta", () => {
+      logger.error("oops", "string-error");
+      const output = errorSpy.mock.calls[0][0] as string;
+      expect(output).toContain("string-error");
+    });
+
+    it("error with non-Error object converts to string in meta", () => {
+      logger.error("oops", 42);
+      const output = errorSpy.mock.calls[0][0] as string;
+      expect(output).toContain("42");
+    });
+  });
+
+  describe("logger.create (scoped logger)", () => {
+    it("uses custom context name in output instead of [app]", () => {
+      const scopedLogger = logger.create("myModule");
+      scopedLogger.info("test");
+      const output = logSpy.mock.calls[0][0] as string;
+      expect(output).toContain("[myModule]");
+      expect(output).not.toContain("[app]");
+    });
+
+    it("scoped logger.warn uses console.warn with custom context", () => {
+      const scopedLogger = logger.create("payments");
+      scopedLogger.warn("limit hit");
+      const output = warnSpy.mock.calls[0][0] as string;
+      expect(output).toContain("[payments]");
+      expect(output).toContain("limit hit");
+    });
+
+    it("scoped logger.error with Error includes context and error details", () => {
+      const scopedLogger = logger.create("auth");
+      const err = new Error("token expired");
+      scopedLogger.error("access denied", err);
+      const output = errorSpy.mock.calls[0][0] as string;
+      expect(output).toContain("[auth]");
+      expect(output).toContain("token expired");
+    });
+  });
+
+  describe("sensitive field behavior (COV-23 documentation)", () => {
+    it("logger does NOT scrub sensitive fields — password value IS present in output (current behavior)", () => {
+      // COV-23: Documenting current logger behavior — no field scrubbing.
+      // The logger outputs sensitive fields as-is. This test documents
+      // the current behavior. Future work could add scrubbing.
+      logger.info("user action", { password: "secret123", userId: "u1" });
+      const output = logSpy.mock.calls[0][0] as string;
+      // Current behavior: sensitive fields are NOT scrubbed
+      expect(output).toContain("secret123");
+      expect(output).toContain("password");
+    });
+
+    it("logger does NOT scrub token field — token value is present in output (current behavior)", () => {
+      // COV-23: Documenting current logger behavior for API tokens
+      logger.info("api call", { token: "sk-abc123", action: "list" });
+      const output = logSpy.mock.calls[0][0] as string;
+      // Current behavior: token is not scrubbed
+      expect(output).toContain("sk-abc123");
+    });
+  });
+
+  describe("structured output format", () => {
+    it("full format matches [ISO] LEVEL [context] message {meta}", () => {
+      logger.info("structured", { key: "val" });
+      const output = logSpy.mock.calls[0][0] as string;
+      // Full pattern: [2026-04-20T...] INFO [app] structured {"key":"val"}
+      expect(output).toMatch(/^\[\d{4}-\d{2}-\d{2}T[\d:.]+Z\] INFO \[app\] structured \{"key":"val"\}$/);
+    });
+
+    it("error with Error includes both message and stack in meta JSON", () => {
+      const err = new Error("test error");
+      logger.error("detailed error", err, { requestId: "req-1" });
+      const output = errorSpy.mock.calls[0][0] as string;
+      // Should contain requestId in meta along with error details
+      expect(output).toContain("requestId");
+      expect(output).toContain("req-1");
+      expect(output).toContain("test error");
+    });
+  });
+});