383 lines
13 KiB
TypeScript
383 lines
13 KiB
TypeScript
import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
|
|
import Fastify, { type FastifyInstance } from 'fastify';
|
|
import Database from 'better-sqlite3';
|
|
import { drizzle } from 'drizzle-orm/better-sqlite3';
|
|
import fs from 'node:fs';
|
|
import path from 'node:path';
|
|
import os from 'node:os';
|
|
import jwt from 'jsonwebtoken';
|
|
import { eq } from 'drizzle-orm';
|
|
import { fileURLToPath } from 'node:url';
|
|
import * as schema from '../db/schema.js';
|
|
import { setWorkerId } from '../utils/snowflake.js';
|
|
import { signJwt } from '../utils/auth.js';
|
|
|
|
setWorkerId(9);
|
|
const __dirname = path.dirname(fileURLToPath(import.meta.url));
|
|
|
|
type TestDb = ReturnType<typeof drizzle<typeof schema>>;
|
|
let sqlite: Database.Database;
|
|
let testDb: TestDb;
|
|
let app: FastifyInstance;
|
|
|
|
// Each test gets a fresh tmp dir so tus file I/O stays isolated.
|
|
let tmpDir: string;
|
|
|
|
vi.mock('../db/index.js', () => ({
|
|
getDb: () => testDb,
|
|
getRawDb: () => sqlite,
|
|
schema,
|
|
}));
|
|
|
|
// Mock heavy media-processing so tests don't need real files / ffmpeg.
|
|
vi.mock('../utils/thumbnail.js', () => ({
|
|
generateThumbnail: vi.fn().mockResolvedValue(null),
|
|
isResizableImage: vi.fn().mockReturnValue(false),
|
|
probeImageDimensions: vi.fn().mockResolvedValue(null),
|
|
probeMediaMeta: vi.fn().mockResolvedValue(null),
|
|
generateVideoThumbnail: vi.fn().mockResolvedValue(null),
|
|
}));
|
|
|
|
function applyMigrations(db: Database.Database): void {
|
|
const migrationsDir = path.resolve(__dirname, '../../drizzle');
|
|
const files = fs.readdirSync(migrationsDir).filter(f => f.endsWith('.sql')).sort();
|
|
for (const f of files) {
|
|
const sqlText = fs.readFileSync(path.join(migrationsDir, f), 'utf8');
|
|
const statements = sqlText.split(/-->\s*statement-breakpoint/);
|
|
for (const stmt of statements) {
|
|
const clean = stmt.trim();
|
|
if (clean) db.exec(clean);
|
|
}
|
|
}
|
|
}
|
|
|
|
// Override config paths to use the test-local tmpDir so tus file I/O is isolated.
|
|
// We do this by mocking the config module.
|
|
vi.mock('../config.js', async () => {
|
|
// Grab the real config first (runs dotenv so JWT_SECRET etc. are set)
|
|
const real = await import('../config.js');
|
|
// We'll patch the directory fields; the proxy below reads `tmpDir` at
|
|
// call time, which is reassigned in each beforeEach.
|
|
return {
|
|
config: new Proxy(real.config, {
|
|
get(target, prop: string) {
|
|
if (prop === 'uploadDir') return tmpDir ?? target.uploadDir;
|
|
if (prop === 'tusUploadDir') return tmpDir ? path.join(tmpDir, '.tus') : target.tusUploadDir;
|
|
return (target as Record<string, unknown>)[prop];
|
|
},
|
|
}),
|
|
};
|
|
});
|
|
|
|
async function buildApp(): Promise<FastifyInstance> {
|
|
const { filesRoutes } = await import('./files.js');
|
|
const f = Fastify();
|
|
await f.register(filesRoutes);
|
|
return f;
|
|
}
|
|
|
|
const USER_A_ID = 'user-a';
|
|
const USER_B_ID = 'user-b';
|
|
|
|
beforeEach(async () => {
|
|
tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'backspace-tus-test-'));
|
|
|
|
sqlite = new Database(':memory:');
|
|
sqlite.pragma('foreign_keys = ON');
|
|
applyMigrations(sqlite);
|
|
testDb = drizzle(sqlite, { schema });
|
|
|
|
// Seed instance_settings (ensureDefaults equivalent)
|
|
testDb.insert(schema.instanceSettings).values({
|
|
id: 1,
|
|
updatedAt: Date.now(),
|
|
maxUploadSizeBytes: 10 * 1024 * 1024 * 1024, // 10 GB default for most tests
|
|
}).run();
|
|
|
|
// Seed two users for ownership tests
|
|
testDb.insert(schema.users).values([
|
|
{ id: USER_A_ID, username: 'user_a', passwordHash: 'x', isAdmin: 0, createdAt: Date.now() },
|
|
{ id: USER_B_ID, username: 'user_b', passwordHash: 'x', isAdmin: 0, createdAt: Date.now() },
|
|
]).run();
|
|
|
|
app = await buildApp();
|
|
});
|
|
|
|
afterEach(async () => {
|
|
await app.close();
|
|
// FileStore.checkOrCreateDirectory() fires an async fs.mkdir in its
|
|
// constructor callback. Deleting the tree before that callback resolves
|
|
// causes an ENOENT uncaught error. We drain one I/O tick to let the
|
|
// callback settle (it will see EEXIST and be ignored), then clean up.
|
|
await new Promise<void>(resolve => setTimeout(resolve, 50));
|
|
fs.rmSync(tmpDir, { recursive: true, force: true });
|
|
});
|
|
|
|
// ─── Helper: build a tus-compatible Upload-Metadata header ──────────────────
|
|
function tusMetadata(fields: Record<string, string>): string {
|
|
return Object.entries(fields)
|
|
.map(([k, v]) => `${k} ${Buffer.from(v).toString('base64')}`)
|
|
.join(',');
|
|
}
|
|
|
|
describe('POST /api/files — tus upload endpoint', () => {
|
|
it('unauthenticated POST returns 401', async () => {
|
|
const res = await app.inject({
|
|
method: 'POST',
|
|
url: '/api/files',
|
|
headers: {
|
|
'tus-resumable': '1.0.0',
|
|
'upload-length': '1024',
|
|
'content-length': '0',
|
|
},
|
|
});
|
|
expect(res.statusCode).toBe(401);
|
|
});
|
|
|
|
it('authenticated create returns 201 + Location + Upload-Expires', async () => {
|
|
const token = signJwt({ userId: USER_A_ID, username: 'user_a' });
|
|
|
|
const res = await app.inject({
|
|
method: 'POST',
|
|
url: '/api/files',
|
|
headers: {
|
|
'authorization': `Bearer ${token}`,
|
|
'tus-resumable': '1.0.0',
|
|
'upload-length': '512',
|
|
'upload-metadata': tusMetadata({ originalName: 'test.png' }),
|
|
'content-length': '0',
|
|
},
|
|
});
|
|
expect(res.statusCode).toBe(201);
|
|
expect(res.headers['location']).toBeTruthy();
|
|
expect(res.headers['upload-expires']).toBeTruthy();
|
|
});
|
|
|
|
it('non-owner PATCH returns 403', async () => {
|
|
const tokenA = signJwt({ userId: USER_A_ID, username: 'user_a' });
|
|
const tokenB = signJwt({ userId: USER_B_ID, username: 'user_b' });
|
|
|
|
// User A creates the upload
|
|
const createRes = await app.inject({
|
|
method: 'POST',
|
|
url: '/api/files',
|
|
headers: {
|
|
'authorization': `Bearer ${tokenA}`,
|
|
'tus-resumable': '1.0.0',
|
|
'upload-length': '4',
|
|
'upload-metadata': tusMetadata({ originalName: 'secret.txt' }),
|
|
'content-length': '0',
|
|
},
|
|
});
|
|
expect(createRes.statusCode).toBe(201);
|
|
|
|
const location = createRes.headers['location'] as string;
|
|
// Extract the upload ID path from the full Location URL
|
|
const uploadPath = location.replace(/^https?:\/\/[^/]+/, '');
|
|
|
|
// User B tries to PATCH — must be rejected
|
|
const patchRes = await app.inject({
|
|
method: 'PATCH',
|
|
url: uploadPath,
|
|
headers: {
|
|
'authorization': `Bearer ${tokenB}`,
|
|
'tus-resumable': '1.0.0',
|
|
'upload-offset': '0',
|
|
'content-type': 'application/offset+octet-stream',
|
|
'content-length': '4',
|
|
},
|
|
payload: Buffer.from('data'),
|
|
});
|
|
expect(patchRes.statusCode).toBe(403);
|
|
});
|
|
|
|
it('rejects DELETE from a non-owner with 403', async () => {
|
|
const tokenA = signJwt({ userId: USER_A_ID, username: 'user_a' });
|
|
const tokenB = signJwt({ userId: USER_B_ID, username: 'user_b' });
|
|
|
|
const createRes = await app.inject({
|
|
method: 'POST',
|
|
url: '/api/files',
|
|
headers: {
|
|
'authorization': `Bearer ${tokenA}`,
|
|
'tus-resumable': '1.0.0',
|
|
'upload-length': '8',
|
|
'upload-metadata': tusMetadata({ originalName: 'mine.txt' }),
|
|
'content-length': '0',
|
|
},
|
|
});
|
|
expect(createRes.statusCode).toBe(201);
|
|
const uploadPath = (createRes.headers['location'] as string).replace(/^https?:\/\/[^/]+/, '');
|
|
|
|
const delRes = await app.inject({
|
|
method: 'DELETE',
|
|
url: uploadPath,
|
|
headers: {
|
|
'authorization': `Bearer ${tokenB}`,
|
|
'tus-resumable': '1.0.0',
|
|
},
|
|
});
|
|
expect(delRes.statusCode).toBe(403);
|
|
});
|
|
|
|
it('rejects HEAD from a non-owner with 403', async () => {
|
|
const tokenA = signJwt({ userId: USER_A_ID, username: 'user_a' });
|
|
const tokenB = signJwt({ userId: USER_B_ID, username: 'user_b' });
|
|
|
|
const createRes = await app.inject({
|
|
method: 'POST',
|
|
url: '/api/files',
|
|
headers: {
|
|
'authorization': `Bearer ${tokenA}`,
|
|
'tus-resumable': '1.0.0',
|
|
'upload-length': '8',
|
|
'upload-metadata': tusMetadata({ originalName: 'mine.txt' }),
|
|
'content-length': '0',
|
|
},
|
|
});
|
|
expect(createRes.statusCode).toBe(201);
|
|
const uploadPath = (createRes.headers['location'] as string).replace(/^https?:\/\/[^/]+/, '');
|
|
|
|
const headRes = await app.inject({
|
|
method: 'HEAD',
|
|
url: uploadPath,
|
|
headers: {
|
|
'authorization': `Bearer ${tokenB}`,
|
|
'tus-resumable': '1.0.0',
|
|
},
|
|
});
|
|
expect(headRes.statusCode).toBe(403);
|
|
});
|
|
|
|
it('rejects requests from a soft-deleted user', async () => {
|
|
const token = signJwt({ userId: USER_A_ID, username: 'user_a' });
|
|
|
|
// Mark user A as soft-deleted AFTER signing the token.
|
|
testDb.update(schema.users)
|
|
.set({ isDeleted: 1 })
|
|
.where(eq(schema.users.id, USER_A_ID))
|
|
.run();
|
|
|
|
const res = await app.inject({
|
|
method: 'POST',
|
|
url: '/api/files',
|
|
headers: {
|
|
'authorization': `Bearer ${token}`,
|
|
'tus-resumable': '1.0.0',
|
|
'upload-length': '4',
|
|
'upload-metadata': tusMetadata({ originalName: 'x.bin' }),
|
|
'content-length': '0',
|
|
},
|
|
});
|
|
expect(res.statusCode).toBe(401);
|
|
});
|
|
|
|
it("rejects tokens issued before the user's password was changed", async () => {
|
|
// Sign a token with iat = T1 (1000s ago).
|
|
const t1 = Math.floor(Date.now() / 1000) - 1000;
|
|
const { config } = await import('../config.js');
|
|
const token = jwt.sign(
|
|
{ userId: USER_A_ID, username: 'user_a', iat: t1 },
|
|
config.jwtSecret,
|
|
{ algorithm: 'HS256', expiresIn: '7d' },
|
|
);
|
|
|
|
// Set passwordChangedAt to T2 (500s ago) in milliseconds — newer than iat.
|
|
const t2Ms = (Math.floor(Date.now() / 1000) - 500) * 1000;
|
|
testDb.update(schema.users)
|
|
.set({ passwordChangedAt: t2Ms })
|
|
.where(eq(schema.users.id, USER_A_ID))
|
|
.run();
|
|
|
|
const res = await app.inject({
|
|
method: 'POST',
|
|
url: '/api/files',
|
|
headers: {
|
|
'authorization': `Bearer ${token}`,
|
|
'tus-resumable': '1.0.0',
|
|
'upload-length': '4',
|
|
'upload-metadata': tusMetadata({ originalName: 'x.bin' }),
|
|
'content-length': '0',
|
|
},
|
|
});
|
|
expect(res.statusCode).toBe(401);
|
|
});
|
|
|
|
it('completes an upload end-to-end and returns Attachment JSON in final PATCH response', async () => {
|
|
const token = signJwt({ userId: USER_A_ID, username: 'user_a' });
|
|
const body = Buffer.from('hello world\n'); // 12 bytes
|
|
|
|
const createRes = await app.inject({
|
|
method: 'POST',
|
|
url: '/api/files',
|
|
headers: {
|
|
'authorization': `Bearer ${token}`,
|
|
'tus-resumable': '1.0.0',
|
|
'upload-length': String(body.length),
|
|
'upload-metadata': tusMetadata({ originalName: 'greeting.txt' }),
|
|
'content-length': '0',
|
|
},
|
|
});
|
|
expect(createRes.statusCode).toBe(201);
|
|
const uploadPath = (createRes.headers['location'] as string).replace(/^https?:\/\/[^/]+/, '');
|
|
|
|
const patchRes = await app.inject({
|
|
method: 'PATCH',
|
|
url: uploadPath,
|
|
headers: {
|
|
'authorization': `Bearer ${token}`,
|
|
'tus-resumable': '1.0.0',
|
|
'upload-offset': '0',
|
|
'content-type': 'application/offset+octet-stream',
|
|
'content-length': String(body.length),
|
|
},
|
|
payload: body,
|
|
});
|
|
// tus returns 204 from the underlying handler, but onUploadFinish overrides
|
|
// with a 200 + JSON body. Either way the body should contain the Attachment.
|
|
expect([200, 204]).toContain(patchRes.statusCode);
|
|
const json = JSON.parse(patchRes.body) as {
|
|
id: string; filename: string; size: number; mimetype: string;
|
|
};
|
|
expect(json.id).toBeTruthy();
|
|
expect(json.size).toBe(body.length);
|
|
expect(json.mimetype).toBe('application/octet-stream'); // .txt isn't in EXT_MIMETYPES
|
|
expect(json.filename.endsWith('.txt')).toBe(true);
|
|
|
|
// The attachments row should exist in the DB.
|
|
const row = testDb
|
|
.select()
|
|
.from(schema.attachments)
|
|
.where(eq(schema.attachments.id, json.id))
|
|
.get();
|
|
expect(row).toBeTruthy();
|
|
expect(row?.size).toBe(body.length);
|
|
expect(row?.uploaderId).toBe(USER_A_ID);
|
|
|
|
// The committed file should exist in the upload dir.
|
|
expect(fs.existsSync(path.join(tmpDir, json.filename))).toBe(true);
|
|
});
|
|
|
|
it('oversize Upload-Length returns 413', async () => {
|
|
// Set the instance limit to a small value
|
|
testDb.update(schema.instanceSettings)
|
|
.set({ maxUploadSizeBytes: 1024 }) // 1 KB limit
|
|
.run();
|
|
|
|
const token = signJwt({ userId: USER_A_ID, username: 'user_a' });
|
|
|
|
const res = await app.inject({
|
|
method: 'POST',
|
|
url: '/api/files',
|
|
headers: {
|
|
'authorization': `Bearer ${token}`,
|
|
'tus-resumable': '1.0.0',
|
|
'upload-length': String(10 * 1024 * 1024 * 1024), // 10 GB > 1 KB
|
|
'upload-metadata': tusMetadata({ originalName: 'huge.bin' }),
|
|
'content-length': '0',
|
|
},
|
|
});
|
|
expect(res.statusCode).toBe(413);
|
|
});
|
|
});
|