AgentHub/server/__tests__/file-explorer.test.js

/**
 * @file Route tests for the workspace File Explorer (`/api/lanes/:id/fs/*`,
 * server/lib/file-explorer.js): list, mkdir/newfile, rename, move, copy (in
 * place, across workspaces), delete into the trash and restore/purge, a
 * streamed upload into new sub-folders with every conflict policy, a zip of
 * files and folders that unzips back to the same bytes — and the guards: no
 * `..`, no symlink walking out, nothing in `.git`, no secret file, the
 * workspace folder itself never moved or deleted, cross-origin refused.
 * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
 */

const { describe, it, before, after } = require("node:test");
const assert = require("node:assert/strict");
const fs = require("node:fs");
const os = require("node:os");
const path = require("node:path");
const http = require("node:http");

const ROOT = fs.mkdtempSync(path.join(os.tmpdir(), "file-explorer-"));
process.env.DASHBOARD_DB_PATH = path.join(ROOT, "t.db");
process.env.CLAUDE_HOME = path.join(ROOT, ".claude");
process.env.DASHBOARD_DATA_DIR = path.join(ROOT, "data");
process.env.DASHBOARD_REMOTE_SYNC_MS = "0";
process.env.DASHBOARD_LIVENESS_PROBE = "0";
process.env.HOME = ROOT;

const { createApp } = require("../index");
const AdmZip = require("adm-zip");

let app;
let base;
const W1 = path.join(ROOT, "w1");
const W2 = path.join(ROOT, "w2");
let lane1;
let lane2;

function request(method, p, body, headers = {}) {
  const raw = Buffer.isBuffer(body) || typeof body === "string";
  return fetch(`${base}${p}`, {
    method,
    headers: { ...(raw ? {} : { "Content-Type": "application/json" }), ...headers },
    body: body === undefined ? undefined : raw ? body : JSON.stringify(body),
  }).then(async (r) => {
    const buf = Buffer.from(await r.arrayBuffer());
    let json = null;
    try {
      json = JSON.parse(buf.toString("utf8"));
    } catch {
      /* binary */
    }
    return { status: r.status, body: json, buf, headers: r.headers };
  });
}
const fsApi = (lane, op, body) => request("POST", `/api/lanes/${lane}/fs/${op}`, body);
const ls = async (lane, p = "") =>
  (await request("GET", `/api/lanes/${lane}/fs/list?path=${encodeURIComponent(p)}`)).body;
const names = (l) => l.entries.map((e) => e.name);

before(async () => {
  for (const w of [W1, W2]) fs.mkdirSync(w, { recursive: true });
  fs.writeFileSync(path.join(W1, "a.txt"), "alpha\n");
  fs.mkdirSync(path.join(W1, "src/lib"), { recursive: true });
  fs.writeFileSync(path.join(W1, "src/lib/x.js"), "x\n");
  fs.mkdirSync(path.join(W1, ".git"));
  fs.writeFileSync(path.join(W1, ".git/config"), "[core]\n");
  fs.mkdirSync(path.join(W1, ".claude"));
  fs.writeFileSync(path.join(W1, ".claude/settings.local.json"), '{"secret":1}');
  fs.symlinkSync("/etc", path.join(W1, "out"));
  app = http.createServer(createApp());
  await new Promise((r) => app.listen(0, "127.0.0.1", r));
  base = `http://127.0.0.1:${app.address().port}`;
  lane1 = (await request("POST", "/api/lanes/ensure", { cwd: W1, exact: true })).body.lane.id;
  lane2 = (await request("POST", "/api/lanes/ensure", { cwd: W2, exact: true })).body.lane.id;
});
after(async () => {
  await new Promise((r) => app.close(r));
});

describe("File Explorer", () => {
  it("lists folders first, never a secret, a symlink shown as a link", async () => {
    const l = await ls(lane1);
    assert.equal(l.path, "");
    assert.equal(l.parent, null);
    assert.deepEqual(
      l.entries.filter((e) => e.type === "dir").map((e) => e.name),
      [".claude", ".git", "src"]
    );
    assert.ok(names(l).includes("a.txt"));
    assert.equal(l.entries.find((e) => e.name === "out").type, "link");
    const claude = await ls(lane1, ".claude");
    assert.ok(!names(claude).includes("settings.local.json"));
    assert.equal((await ls(lane1, "src")).parent, "");
  });

  it("refuses paths that leave the workspace", async () => {
    for (const p of ["../", "/etc", "out", "out/passwd", "src/../../x"]) {
      const r = await request("GET", `/api/lanes/${lane1}/fs/list?path=${encodeURIComponent(p)}`);
      assert.ok([400, 403, 404].includes(r.status), `${p} → ${r.status}`);
    }
  });

  it("makes a folder and an empty file, refusing a taken name", async () => {
    assert.equal((await fsApi(lane1, "mkdir", { path: "docs" })).status, 201);
    assert.equal((await fsApi(lane1, "newfile", { path: "docs/readme.md" })).status, 201);
    assert.equal(fs.readFileSync(path.join(W1, "docs/readme.md"), "utf8"), "");
    const again = await fsApi(lane1, "mkdir", { path: "docs" });
    assert.equal(again.status, 409);
    assert.deepEqual(again.body.error.names, ["docs"]);
    assert.equal((await fsApi(lane1, "mkdir", { path: ".git/hooks2" })).status, 400);
    assert.equal((await fsApi(lane1, "newfile", { path: "a/b\\c" })).status, 404);
  });

  it("renames, never onto a taken name or out of the folder", async () => {
    assert.equal(
      (await fsApi(lane1, "rename", { path: "docs/readme.md", name: "README.md" })).status,
      200
    );
    assert.ok(fs.existsSync(path.join(W1, "docs/README.md")));
    assert.equal(
      (await fsApi(lane1, "rename", { path: "docs/README.md", name: "../a.txt" })).status,
      400
    );
    fs.writeFileSync(path.join(W1, "docs/other.md"), "o");
    assert.equal(
      (await fsApi(lane1, "rename", { path: "docs/other.md", name: "README.md" })).status,
      409
    );
  });

  it("moves, asking about a taken name, and never a folder into itself", async () => {
    fs.writeFileSync(path.join(W1, "src/a.txt"), "other alpha\n");
    const clash = await fsApi(lane1, "move", { paths: ["a.txt"], dest: "src" });
    assert.equal(clash.status, 409);
    assert.deepEqual(clash.body.error.names, ["a.txt"]);
    const keep = await fsApi(lane1, "move", { paths: ["a.txt"], dest: "src", conflict: "keep" });
    assert.deepEqual(keep.body.moved, ["src/a (1).txt"]);
    assert.equal((await fsApi(lane1, "move", { paths: ["src"], dest: "src/lib" })).status, 400);
    assert.equal((await fsApi(lane1, "move", { paths: [".git"], dest: "docs" })).status, 400);
  });

  it("copies in place (keeping both) and into another workspace of the account", async () => {
    const inPlace = await fsApi(lane1, "copy", { paths: ["src/lib/x.js"], dest: "src/lib" });
    assert.deepEqual(inPlace.body.copied, ["src/lib/x (1).js"]);
    const across = await request("POST", `/api/lanes/${lane2}/fs/copy`, {
      paths: ["src"],
      dest: "",
      fromLane: lane1,
    });
    assert.equal(across.status, 200, JSON.stringify(across.body));
    assert.equal(fs.readFileSync(path.join(W2, "src/lib/x.js"), "utf8"), "x\n");
    // A symlink inside a copied folder stays a link — never followed.
    fs.symlinkSync("/etc/hostname", path.join(W1, "docs/link"));
    await request("POST", `/api/lanes/${lane2}/fs/copy`, {
      paths: ["docs"],
      dest: "",
      fromLane: lane1,
    });
    assert.ok(fs.lstatSync(path.join(W2, "docs/link")).isSymbolicLink());
  });

  it("deletes into the trash, restores to the same place, and purges", async () => {
    const del = await fsApi(lane1, "delete", { paths: ["docs/README.md", "src/lib"] });
    assert.equal(del.status, 200);
    assert.ok(!fs.existsSync(path.join(W1, "src/lib")));
    const trash = (await request("GET", `/api/lanes/${lane1}/fs/trash`)).body;
    assert.equal(trash.items.length, 2);
    const lib = trash.items.find((i) => i.name === "lib");
    assert.equal(lib.isDir, true);
    const back = await fsApi(lane1, "trash/restore", { id: lib.id });
    assert.equal(back.status, 200, JSON.stringify(back.body));
    assert.equal(fs.readFileSync(path.join(W1, "src/lib/x.js"), "utf8"), "x\n");
    assert.equal((await fsApi(lane1, "trash/purge", { id: "all" })).body.purged, 1);
    assert.equal((await request("GET", `/api/lanes/${lane1}/fs/trash`)).body.items.length, 0);
    assert.equal((await fsApi(lane1, "trash/restore", { id: "../../x" })).status, 400);
  });

  it("never deletes the workspace itself, .git, or a secret", async () => {
    for (const p of [".", "", ".git", ".git/config", ".claude/settings.local.json"]) {
      const r = await fsApi(lane1, "delete", { paths: [p] });
      assert.ok(r.status >= 400, `${p} → ${r.status}`);
    }
    assert.ok(fs.existsSync(path.join(W1, ".git/config")));
  });

  it("uploads a stream into new sub-folders, with every conflict policy", async () => {
    const up = (p, body, conflict) =>
      request(
        "POST",
        `/api/lanes/${lane1}/fs/upload?path=${encodeURIComponent(p)}${conflict ? `&conflict=${conflict}` : ""}`,
        Buffer.from(body),
        { "Content-Type": "application/octet-stream" }
      );
    assert.equal((await up("site/css/app.css", "body{}")).status, 201);
    assert.equal(fs.readFileSync(path.join(W1, "site/css/app.css"), "utf8"), "body{}");
    const clash = await up("site/css/app.css", "new");
    assert.equal(clash.status, 409);
    assert.equal((await up("site/css/app.css", "new", "skip")).body.skipped, true);
    assert.equal((await up("site/css/app.css", "kept", "keep")).body.path, "site/css/app (1).css");
    await up("site/css/app.css", "replaced", "replace");
    assert.equal(fs.readFileSync(path.join(W1, "site/css/app.css"), "utf8"), "replaced");
    // The replaced one is in the trash, restorable.
    assert.ok(
      (await request("GET", `/api/lanes/${lane1}/fs/trash`)).body.items.some(
        (i) => i.name === "app.css"
      )
    );
    assert.equal((await up(".git/hooks/post-commit", "x")).status, 400);
    assert.equal((await up("out/evil", "x")).status >= 400, true);
    // A declared size over the cap is refused before a byte is stored.
    const big = await new Promise((resolve) => {
      const req = http.request(
        `${base}/api/lanes/${lane1}/fs/upload?path=big.bin`,
        { method: "POST", headers: { "Content-Length": String(600 * 1024 * 1024) } },
        (r) => resolve(r.statusCode)
      );
      req.on("error", () => resolve("reset"));
      req.write("x");
    });
    assert.equal(big, 413);
    assert.ok(!fs.existsSync(path.join(W1, "big.bin")));
  });

  it("zips files and folders into one download that unzips to the same bytes", async () => {
    const r = await request("GET", `/api/lanes/${lane1}/fs/zip?p=src&p=site/css/app.css`);
    assert.equal(r.status, 200);
    assert.equal(r.headers.get("content-type"), "application/zip");
    const z = new AdmZip(r.buf);
    const got = Object.fromEntries(
      z
        .getEntries()
        .filter((e) => !e.isDirectory)
        .map((e) => [e.entryName, e.getData().toString()])
    );
    assert.equal(got["src/lib/x.js"], "x\n");
    assert.equal(got["app.css"], "replaced");
    assert.ok(z.getEntries().some((e) => e.entryName === "src/lib/"));
    // A secret is never in a zip.
    const s = await request("GET", `/api/lanes/${lane1}/fs/zip?p=.claude`);
    const zs = new AdmZip(s.buf);
    assert.ok(!zs.getEntries().some((e) => e.entryName.includes("settings.local.json")));
  });

  it("refuses a cross-origin write", async () => {
    const r = await request(
      "POST",
      `/api/lanes/${lane1}/fs/mkdir`,
      { path: "x" },
      { Origin: "https://evil.example" }
    );
    assert.equal(r.status, 403);
  });
});

describe("File Explorer in a member's folder (S3, run-as stubbed)", () => {
  const runAs = require("../lib/run-as");
  const fx = require("../lib/file-explorer");
  const M = path.join(ROOT, "users", "an", "proj");
  const acct = {
    name: "an",
    login: "ah-an",
    home: path.join(ROOT, "users", "an"),
    uid: process.getuid(),
  };
  const saved = {};
  let calls = [];
  before(() => {
    fs.mkdirSync(path.join(M, "d"), { recursive: true });
    fs.writeFileSync(path.join(M, "f.txt"), "f");
    for (const k of ["accountForPath", "writeAsAsync", "writeAsCanMove", "mkdirAs"])
      saved[k] = runAs[k];
    runAs.accountForPath = (p) => (String(p).startsWith(acct.home) ? acct : null);
    runAs.writeAsCanMove = () => true;
    runAs.mkdirAs = (_a, d) => calls.push(["mkdir", d]);
    runAs.writeAsAsync = async (_a, file, args) => {
      calls.push([file, ...args]);
    };
  });
  after(() => Object.assign(runAs, saved));

  it("moves and copies through write-as as the member, never with fs", async () => {
    calls = [];
    await fx.move(M, ["f.txt"], "d");
    await fx.copy(M, ["d"], "", {});
    assert.deepEqual(calls[0], [path.join(M, "f.txt"), "move", path.join(M, "d", "f.txt")]);
    assert.deepEqual(calls[1], [path.join(M, "d"), "copy", path.join(M, "d (1)")]);
    assert.ok(fs.existsSync(path.join(M, "f.txt")), "the host itself moved nothing");
  });

  it("says the helper needs updating instead of failing obscurely", async () => {
    runAs.writeAsCanMove = () => false;
    try {
      await assert.rejects(fx.rename(M, "f.txt", "g.txt"), { code: "EUPGRADE" });
    } finally {
      runAs.writeAsCanMove = () => true;
    }
  });
});