tower-studio 0.1.2 → 0.1.3

package/src/lib/__tests__/schemas.test.ts

@@ -0,0 +1,377 @@
+import { describe, it, expect } from "vitest";
+import {
+  createWorkspaceSchema,
+  updateWorkspaceSchema,
+  createProjectSchema,
+  updateProjectSchema,
+  createTaskSchema,
+  updateTaskSchema,
+  taskStatusSchema,
+  createLabelSchema,
+} from "../schemas";
+
+// ── createWorkspaceSchema ──
+
+describe("createWorkspaceSchema", () => {
+  it("accepts valid name only", () => {
+    const result = createWorkspaceSchema.safeParse({ name: "My Workspace" });
+    expect(result.success).toBe(true);
+  });
+
+  it("accepts valid name with description", () => {
+    const result = createWorkspaceSchema.safeParse({
+      name: "My Workspace",
+      description: "A description",
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it("rejects empty name", () => {
+    const result = createWorkspaceSchema.safeParse({ name: "" });
+    expect(result.success).toBe(false);
+  });
+
+  it("rejects name over 100 chars", () => {
+    const result = createWorkspaceSchema.safeParse({ name: "a".repeat(101) });
+    expect(result.success).toBe(false);
+  });
+
+  it("accepts name exactly 100 chars", () => {
+    const result = createWorkspaceSchema.safeParse({ name: "a".repeat(100) });
+    expect(result.success).toBe(true);
+  });
+
+  it("rejects description over 500 chars", () => {
+    const result = createWorkspaceSchema.safeParse({
+      name: "Test",
+      description: "a".repeat(501),
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it("accepts description exactly 500 chars", () => {
+    const result = createWorkspaceSchema.safeParse({
+      name: "Test",
+      description: "a".repeat(500),
+    });
+    expect(result.success).toBe(true);
+  });
+});
+
+// ── updateWorkspaceSchema ──
+
+describe("updateWorkspaceSchema", () => {
+  it("accepts empty object (all fields optional)", () => {
+    const result = updateWorkspaceSchema.safeParse({});
+    expect(result.success).toBe(true);
+  });
+
+  it("accepts partial update with name only", () => {
+    const result = updateWorkspaceSchema.safeParse({ name: "New Name" });
+    expect(result.success).toBe(true);
+  });
+
+  it("rejects name empty string (min 1 when provided)", () => {
+    const result = updateWorkspaceSchema.safeParse({ name: "" });
+    expect(result.success).toBe(false);
+  });
+
+  it("rejects name over 100 chars", () => {
+    const result = updateWorkspaceSchema.safeParse({ name: "a".repeat(101) });
+    expect(result.success).toBe(false);
+  });
+});
+
+// ── createProjectSchema ──
+
+describe("createProjectSchema", () => {
+  const validBase = {
+    name: "My Project",
+    workspaceId: "clh1234567890abcdefghij",
+  };
+
+  it("accepts valid minimal project", () => {
+    const result = createProjectSchema.safeParse(validBase);
+    expect(result.success).toBe(true);
+  });
+
+  it("rejects empty name", () => {
+    const result = createProjectSchema.safeParse({ ...validBase, name: "" });
+    expect(result.success).toBe(false);
+  });
+
+  it("rejects name over 100 chars", () => {
+    const result = createProjectSchema.safeParse({
+      ...validBase,
+      name: "a".repeat(101),
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it("accepts valid projectType FRONTEND", () => {
+    const result = createProjectSchema.safeParse({
+      ...validBase,
+      projectType: "FRONTEND",
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it("accepts valid projectType BACKEND", () => {
+    const result = createProjectSchema.safeParse({
+      ...validBase,
+      projectType: "BACKEND",
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it("rejects invalid projectType FULLSTACK", () => {
+    const result = createProjectSchema.safeParse({
+      ...validBase,
+      projectType: "FULLSTACK",
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it("accepts empty string for gitUrl", () => {
+    const result = createProjectSchema.safeParse({ ...validBase, gitUrl: "" });
+    expect(result.success).toBe(true);
+  });
+
+  it("accepts valid gitUrl", () => {
+    const result = createProjectSchema.safeParse({
+      ...validBase,
+      gitUrl: "https://github.com/user/repo",
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it("rejects empty workspaceId", () => {
+    const result = createProjectSchema.safeParse({ name: "Test", workspaceId: "" });
+    expect(result.success).toBe(false);
+  });
+});
+
+// ── createTaskSchema ──
+
+describe("createTaskSchema", () => {
+  const validBase = {
+    title: "Fix the bug",
+    projectId: "clh1234567890abcdefghij",
+  };
+
+  it("accepts valid minimal task", () => {
+    const result = createTaskSchema.safeParse(validBase);
+    expect(result.success).toBe(true);
+  });
+
+  it("rejects empty title", () => {
+    const result = createTaskSchema.safeParse({ ...validBase, title: "" });
+    expect(result.success).toBe(false);
+  });
+
+  it("rejects title over 200 chars", () => {
+    const result = createTaskSchema.safeParse({
+      ...validBase,
+      title: "a".repeat(201),
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it("accepts title exactly 200 chars", () => {
+    const result = createTaskSchema.safeParse({
+      ...validBase,
+      title: "a".repeat(200),
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it("accepts valid priority LOW", () => {
+    const result = createTaskSchema.safeParse({ ...validBase, priority: "LOW" });
+    expect(result.success).toBe(true);
+  });
+
+  it("accepts valid priority MEDIUM", () => {
+    const result = createTaskSchema.safeParse({ ...validBase, priority: "MEDIUM" });
+    expect(result.success).toBe(true);
+  });
+
+  it("accepts valid priority HIGH", () => {
+    const result = createTaskSchema.safeParse({ ...validBase, priority: "HIGH" });
+    expect(result.success).toBe(true);
+  });
+
+  it("accepts valid priority CRITICAL", () => {
+    const result = createTaskSchema.safeParse({ ...validBase, priority: "CRITICAL" });
+    expect(result.success).toBe(true);
+  });
+
+  it("rejects invalid priority URGENT", () => {
+    const result = createTaskSchema.safeParse({ ...validBase, priority: "URGENT" });
+    expect(result.success).toBe(false);
+  });
+
+  it("accepts valid status TODO", () => {
+    const result = createTaskSchema.safeParse({ ...validBase, status: "TODO" });
+    expect(result.success).toBe(true);
+  });
+
+  it("accepts valid status IN_PROGRESS", () => {
+    const result = createTaskSchema.safeParse({ ...validBase, status: "IN_PROGRESS" });
+    expect(result.success).toBe(true);
+  });
+
+  it("accepts valid status IN_REVIEW", () => {
+    const result = createTaskSchema.safeParse({ ...validBase, status: "IN_REVIEW" });
+    expect(result.success).toBe(true);
+  });
+
+  it("accepts valid status DONE", () => {
+    const result = createTaskSchema.safeParse({ ...validBase, status: "DONE" });
+    expect(result.success).toBe(true);
+  });
+
+  it("accepts valid status CANCELLED", () => {
+    const result = createTaskSchema.safeParse({ ...validBase, status: "CANCELLED" });
+    expect(result.success).toBe(true);
+  });
+
+  it("rejects invalid status UNKNOWN", () => {
+    const result = createTaskSchema.safeParse({ ...validBase, status: "UNKNOWN" });
+    expect(result.success).toBe(false);
+  });
+
+  it("rejects empty projectId", () => {
+    const result = createTaskSchema.safeParse({ title: "Test", projectId: "" });
+    expect(result.success).toBe(false);
+  });
+});
+
+// ── updateTaskSchema ──
+
+describe("updateTaskSchema", () => {
+  it("accepts empty object (all fields optional)", () => {
+    const result = updateTaskSchema.safeParse({});
+    expect(result.success).toBe(true);
+  });
+
+  it("rejects title empty string when provided (min 1)", () => {
+    const result = updateTaskSchema.safeParse({ title: "" });
+    expect(result.success).toBe(false);
+  });
+
+  it("accepts valid partial update", () => {
+    const result = updateTaskSchema.safeParse({ title: "New title", priority: "HIGH" });
+    expect(result.success).toBe(true);
+  });
+
+  it("rejects title over 200 chars", () => {
+    const result = updateTaskSchema.safeParse({ title: "a".repeat(201) });
+    expect(result.success).toBe(false);
+  });
+
+  it("rejects invalid priority when provided", () => {
+    const result = updateTaskSchema.safeParse({ priority: "URGENT" });
+    expect(result.success).toBe(false);
+  });
+});
+
+// ── taskStatusSchema ──
+
+describe("taskStatusSchema", () => {
+  it("accepts TODO", () => {
+    expect(taskStatusSchema.safeParse("TODO").success).toBe(true);
+  });
+
+  it("accepts IN_PROGRESS", () => {
+    expect(taskStatusSchema.safeParse("IN_PROGRESS").success).toBe(true);
+  });
+
+  it("accepts IN_REVIEW", () => {
+    expect(taskStatusSchema.safeParse("IN_REVIEW").success).toBe(true);
+  });
+
+  it("accepts DONE", () => {
+    expect(taskStatusSchema.safeParse("DONE").success).toBe(true);
+  });
+
+  it("accepts CANCELLED", () => {
+    expect(taskStatusSchema.safeParse("CANCELLED").success).toBe(true);
+  });
+
+  it("rejects UNKNOWN", () => {
+    expect(taskStatusSchema.safeParse("UNKNOWN").success).toBe(false);
+  });
+
+  it("rejects empty string", () => {
+    expect(taskStatusSchema.safeParse("").success).toBe(false);
+  });
+
+  it("rejects lowercase todo", () => {
+    expect(taskStatusSchema.safeParse("todo").success).toBe(false);
+  });
+});
+
+// ── createLabelSchema ──
+
+describe("createLabelSchema", () => {
+  const validBase = {
+    name: "Bug",
+    color: "#aabbcc",
+    workspaceId: "clh1234567890abcdefghij",
+  };
+
+  it("accepts valid label with lowercase hex", () => {
+    const result = createLabelSchema.safeParse(validBase);
+    expect(result.success).toBe(true);
+  });
+
+  it("accepts valid label with uppercase hex #AABBCC", () => {
+    const result = createLabelSchema.safeParse({ ...validBase, color: "#AABBCC" });
+    expect(result.success).toBe(true);
+  });
+
+  it("accepts mixed-case hex #AaBbCc", () => {
+    const result = createLabelSchema.safeParse({ ...validBase, color: "#AaBbCc" });
+    expect(result.success).toBe(true);
+  });
+
+  it("rejects color without # prefix (plain 'red')", () => {
+    const result = createLabelSchema.safeParse({ ...validBase, color: "red" });
+    expect(result.success).toBe(false);
+  });
+
+  it("rejects color with invalid hex chars '#GGG000'", () => {
+    const result = createLabelSchema.safeParse({ ...validBase, color: "#GGG000" });
+    expect(result.success).toBe(false);
+  });
+
+  it("rejects short hex '#aabb' (only 4 hex chars)", () => {
+    const result = createLabelSchema.safeParse({ ...validBase, color: "#aabb" });
+    expect(result.success).toBe(false);
+  });
+
+  it("rejects 3-char hex '#abc' (shorthand not allowed)", () => {
+    const result = createLabelSchema.safeParse({ ...validBase, color: "#abc" });
+    expect(result.success).toBe(false);
+  });
+
+  it("rejects name over 50 chars", () => {
+    const result = createLabelSchema.safeParse({ ...validBase, name: "a".repeat(51) });
+    expect(result.success).toBe(false);
+  });
+
+  it("accepts name exactly 50 chars", () => {
+    const result = createLabelSchema.safeParse({ ...validBase, name: "a".repeat(50) });
+    expect(result.success).toBe(true);
+  });
+
+  it("rejects empty name", () => {
+    const result = createLabelSchema.safeParse({ ...validBase, name: "" });
+    expect(result.success).toBe(false);
+  });
+
+  it("rejects empty workspaceId", () => {
+    const result = createLabelSchema.safeParse({ name: "Bug", color: "#aabbcc", workspaceId: "" });
+    expect(result.success).toBe(false);
+  });
+});

package/src/lib/__tests__/terminal-link-provider.test.ts

@@ -0,0 +1,160 @@
+import { describe, it, expect } from "vitest";
+import { parseFileLinks } from "../terminal-link-provider";
+
+describe("parseFileLinks", () => {
+  describe("path detection", () => {
+    it("detects relative path with ./", () => {
+      const links = parseFileLinks("error in ./src/foo.ts");
+      expect(links).toHaveLength(1);
+      expect(links[0].path).toBe("./src/foo.ts");
+    });
+
+    it("detects relative path with ../", () => {
+      const links = parseFileLinks("see ../lib/utils.ts");
+      expect(links).toHaveLength(1);
+      expect(links[0].path).toBe("../lib/utils.ts");
+    });
+
+    it("detects path starting with directory name", () => {
+      const links = parseFileLinks("FAIL src/components/button.tsx");
+      expect(links).toHaveLength(1);
+      expect(links[0].path).toBe("src/components/button.tsx");
+    });
+
+    it("detects path with @ scope", () => {
+      const links = parseFileLinks("import from @/lib/utils.ts");
+      expect(links).toHaveLength(1);
+      expect(links[0].path).toBe("@/lib/utils.ts");
+    });
+
+    it("detects multiple paths in one line", () => {
+      const links = parseFileLinks("src/a.ts → src/b.ts");
+      expect(links).toHaveLength(2);
+      expect(links[0].path).toBe("src/a.ts");
+      expect(links[1].path).toBe("src/b.ts");
+    });
+
+    it("ignores bare filenames without directory", () => {
+      const links = parseFileLinks("error in foo.ts");
+      expect(links).toHaveLength(0);
+    });
+
+    it("returns empty array for text with no paths", () => {
+      const links = parseFileLinks("hello world 123");
+      expect(links).toHaveLength(0);
+    });
+  });
+
+  describe("line:col suffix — colon format", () => {
+    it("detects :line", () => {
+      const links = parseFileLinks("src/foo.ts:42");
+      expect(links).toHaveLength(1);
+      expect(links[0].path).toBe("src/foo.ts");
+      expect(links[0].line).toBe(42);
+      expect(links[0].col).toBeUndefined();
+    });
+
+    it("detects :line:col", () => {
+      const links = parseFileLinks("src/foo.ts:42:10");
+      expect(links).toHaveLength(1);
+      expect(links[0].path).toBe("src/foo.ts");
+      expect(links[0].line).toBe(42);
+      expect(links[0].col).toBe(10);
+    });
+  });
+
+  describe("line:col suffix — parenthesis format", () => {
+    it("detects (line)", () => {
+      const links = parseFileLinks("src/foo.ts(42)");
+      expect(links).toHaveLength(1);
+      expect(links[0].line).toBe(42);
+      expect(links[0].col).toBeUndefined();
+    });
+
+    it("detects (line, col)", () => {
+      const links = parseFileLinks("src/foo.ts(42, 10)");
+      expect(links).toHaveLength(1);
+      expect(links[0].line).toBe(42);
+      expect(links[0].col).toBe(10);
+    });
+
+    it("detects (line,col) without space", () => {
+      const links = parseFileLinks("src/foo.ts(42,10)");
+      expect(links).toHaveLength(1);
+      expect(links[0].line).toBe(42);
+      expect(links[0].col).toBe(10);
+    });
+  });
+
+  describe("line:col suffix — bracket format", () => {
+    it("detects [line, col]", () => {
+      const links = parseFileLinks("src/foo.ts[42, 10]");
+      expect(links).toHaveLength(1);
+      expect(links[0].line).toBe(42);
+      expect(links[0].col).toBe(10);
+    });
+
+    it("detects [line]", () => {
+      const links = parseFileLinks("src/foo.ts[42]");
+      expect(links).toHaveLength(1);
+      expect(links[0].line).toBe(42);
+      expect(links[0].col).toBeUndefined();
+    });
+  });
+
+  describe("position tracking", () => {
+    it("reports correct startIndex", () => {
+      const links = parseFileLinks("error in src/foo.ts:10");
+      expect(links[0].startIndex).toBe(9); // "error in " = 9 chars
+    });
+
+    it("totalLength includes suffix", () => {
+      const links = parseFileLinks("src/foo.ts:42:10");
+      // "src/foo.ts" = 10, ":42:10" = 6
+      expect(links[0].totalLength).toBe(16);
+    });
+
+    it("totalLength excludes suffix when none present", () => {
+      const links = parseFileLinks("src/foo.ts is broken");
+      expect(links[0].totalLength).toBe(10); // "src/foo.ts"
+    });
+  });
+
+  describe("real-world terminal output", () => {
+    it("vitest FAIL line", () => {
+      const links = parseFileLinks(" FAIL  src/lib/__tests__/file-utils.test.ts > getAssistantCacheDir");
+      expect(links).toHaveLength(1);
+      expect(links[0].path).toBe("src/lib/__tests__/file-utils.test.ts");
+    });
+
+    it("TypeScript error", () => {
+      const links = parseFileLinks("src/components/button.tsx(15,3): error TS2322: Type");
+      expect(links).toHaveLength(1);
+      expect(links[0].path).toBe("src/components/button.tsx");
+      expect(links[0].line).toBe(15);
+      expect(links[0].col).toBe(3);
+    });
+
+    it("ESLint warning", () => {
+      const links = parseFileLinks("  ./src/hooks/use-theme.ts:23:5  warning  ...");
+      expect(links).toHaveLength(1);
+      expect(links[0].path).toBe("./src/hooks/use-theme.ts");
+      expect(links[0].line).toBe(23);
+      expect(links[0].col).toBe(5);
+    });
+
+    it("Rust compiler error", () => {
+      const links = parseFileLinks("  --> src/main.rs:42:10");
+      expect(links).toHaveLength(1);
+      expect(links[0].path).toBe("src/main.rs");
+      expect(links[0].line).toBe(42);
+      expect(links[0].col).toBe(10);
+    });
+
+    it("deeply nested path", () => {
+      const links = parseFileLinks("Modified: src/app/api/internal/assistant/images/route.ts");
+      expect(links).toHaveLength(1);
+      expect(links[0].path).toBe("src/app/api/internal/assistant/images/route.ts");
+    });
+  });
+});

package/src/lib/__tests__/upload-route-security.test.ts

@@ -0,0 +1,120 @@
+/**
+ * Security tests for /api/internal/hooks/upload
+ *
+ * Tests the CRITICAL path containment fix: filePath must be within
+ * the project directory or /tmp. Prevents arbitrary file read.
+ */
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import * as path from "path";
+
+// We test the path containment logic in isolation rather than the full route,
+// because the route requires Next.js request objects and DB connections.
+
+describe("Upload Route Path Containment", () => {
+  // Extracted path containment logic for unit testing
+  function isPathAllowed(
+    filePath: string,
+    projectRoot: string | null,
+    tmpDir: string
+  ): boolean {
+    const resolvedFile = path.resolve(filePath);
+    const isUnderProject =
+      projectRoot &&
+      resolvedFile.startsWith(path.resolve(projectRoot) + path.sep);
+    const isUnderTmp = resolvedFile.startsWith(
+      path.resolve(tmpDir) + path.sep
+    );
+    return !!(isUnderProject || isUnderTmp);
+  }
+
+  const projectRoot = "/Users/test/project/my-app";
+  const tmpDir = "/tmp";
+
+  describe("allows files within project directory", () => {
+    it("accepts file directly in project root", () => {
+      expect(
+        isPathAllowed(`${projectRoot}/output.png`, projectRoot, tmpDir)
+      ).toBe(true);
+    });
+
+    it("accepts file in nested subdirectory", () => {
+      expect(
+        isPathAllowed(`${projectRoot}/src/lib/output.json`, projectRoot, tmpDir)
+      ).toBe(true);
+    });
+  });
+
+  describe("allows files within /tmp", () => {
+    it("accepts file in /tmp", () => {
+      expect(isPathAllowed("/tmp/upload-123.png", projectRoot, tmpDir)).toBe(
+        true
+      );
+    });
+
+    it("accepts file in /tmp subdirectory", () => {
+      expect(
+        isPathAllowed("/tmp/tower/session/file.md", projectRoot, tmpDir)
+      ).toBe(true);
+    });
+  });
+
+  describe("BLOCKS files outside allowed directories", () => {
+    it("blocks absolute path to home directory", () => {
+      expect(
+        isPathAllowed("/Users/test/.ssh/id_rsa", projectRoot, tmpDir)
+      ).toBe(false);
+    });
+
+    it("blocks absolute path to claude settings", () => {
+      expect(
+        isPathAllowed(
+          "/Users/test/.claude/settings.json",
+          projectRoot,
+          tmpDir
+        )
+      ).toBe(false);
+    });
+
+    it("blocks path traversal attack with ../", () => {
+      expect(
+        isPathAllowed(
+          `${projectRoot}/../../../etc/passwd`,
+          projectRoot,
+          tmpDir
+        )
+      ).toBe(false);
+    });
+
+    it("blocks path to /etc", () => {
+      expect(isPathAllowed("/etc/hosts", projectRoot, tmpDir)).toBe(false);
+    });
+
+    it("blocks root path", () => {
+      expect(isPathAllowed("/", projectRoot, tmpDir)).toBe(false);
+    });
+
+    it("blocks path that starts with projectRoot as prefix but different dir", () => {
+      // /Users/test/project/my-app-evil should NOT match /Users/test/project/my-app
+      expect(
+        isPathAllowed(
+          "/Users/test/project/my-app-evil/secret.json",
+          projectRoot,
+          tmpDir
+        )
+      ).toBe(false);
+    });
+  });
+
+  describe("edge cases", () => {
+    it("blocks when projectRoot is null", () => {
+      expect(isPathAllowed("/some/file.png", null, tmpDir)).toBe(false);
+    });
+
+    it("blocks symlink-like paths outside root (resolved)", () => {
+      // path.resolve normalizes .. segments
+      expect(
+        isPathAllowed(`${projectRoot}/../../etc/shadow`, projectRoot, tmpDir)
+      ).toBe(false);
+    });
+  });
+});