AgentHub/server/__tests__/lane-file-transfer.test.js

/**
 * @file Tests for a workspace folder that is NOT a git repo (issue #78): the
 * Files tab's tree, expand-all and quick-open read off the disk
 * (server/lib/git-diff.js `walkFolder`), and the file download / upload of
 * server/lib/lane-file-transfer.js with their guards — confined to the
 * folder, no secrets, an upload that only creates and never touches `.git`.
 * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
 */

const { describe, it, before, after } = require("node:test");
const assert = require("node:assert/strict");
const fs = require("node:fs");
const os = require("node:os");
const path = require("node:path");

const { inRepo, listPaths, listTree, listTreeAll, readFileAt } = require("../lib/git-diff");
const { openDownload, saveUpload, UPLOAD_MAX_BYTES } = require("../lib/lane-file-transfer");

const ROOT = fs.mkdtempSync(path.join(os.tmpdir(), "agenthub-plainfolder-"));
const WS = path.join(ROOT, "ws");
const OUTSIDE = path.join(ROOT, "outside");

function write(file, body) {
  fs.mkdirSync(path.dirname(file), { recursive: true });
  fs.writeFileSync(file, body);
}

async function readAll(stream) {
  const chunks = [];
  for await (const c of stream) chunks.push(c);
  return Buffer.concat(chunks).toString("utf8");
}

describe("a workspace folder that is not a git repo", () => {
  before(() => {
    write(path.join(WS, "sonar_issues.json"), '{"ok":true}\n');
    write(path.join(WS, "autocoupon-api", "src", "main.py"), "print(1)\n");
    write(path.join(WS, "node_modules", "dep", "index.js"), "x\n");
    write(path.join(WS, ".claude", "settings.local.json"), '{"key":"sk"}\n');
    write(path.join(OUTSIDE, "secret.txt"), "not yours\n");
    fs.mkdirSync(path.join(WS, ".git-not"), { recursive: true });
    fs.symlinkSync(OUTSIDE, path.join(WS, "out-link"));
  });
  after(() => fs.rmSync(ROOT, { recursive: true, force: true }));

  it("is not a repo, and its tree lists the disk one level at a time", async () => {
    assert.equal(await inRepo(WS), false);
    const top = await listTree(WS);
    assert.deepEqual(
      top.entries.map((e) => `${e.dir ? "d" : "f"}:${e.path}${e.ignored ? "!" : ""}`),
      [
        "d:.claude",
        "d:.git-not",
        "d:autocoupon-api",
        "d:node_modules!",
        "f:out-link",
        "f:sonar_issues.json",
      ]
    );
    const sub = await listTree(WS, { subdir: "autocoupon-api" });
    assert.deepEqual(
      sub.entries.map((e) => e.path),
      ["autocoupon-api/src"]
    );
    await assert.rejects(listTree(WS, { subdir: "../outside" }), { code: "EBADPATH" });
    await assert.rejects(listTree(WS, { subdir: "out-link" }), { code: "EBADPATH" });
  });

  it("expands every level in one read, node_modules kept shut", async () => {
    const { levels, truncated } = await listTreeAll(WS);
    assert.equal(truncated, false);
    assert.deepEqual(
      levels["autocoupon-api/src"].map((e) => e.name),
      ["main.py"]
    );
    assert.equal(levels.node_modules, undefined);
    assert.ok(levels[""].some((e) => e.path === "node_modules" && e.ignored));
  });

  it("quick-open finds a file by name, never inside node_modules or out of the folder", async () => {
    assert.deepEqual((await listPaths(WS, { q: "main" })).paths, ["autocoupon-api/src/main.py"]);
    assert.deepEqual((await listPaths(WS, { q: "index.js" })).paths, []);
    assert.deepEqual((await listPaths(WS, { q: "secret" })).paths, []);
  });

  it("opens a file for viewing without git", async () => {
    const f = await readFileAt(WS, "sonar_issues.json");
    assert.deepEqual(f.lines, ['{"ok":true}']);
  });

  it("downloads a file, never a secret, a folder or one outside", async () => {
    const d = await openDownload(WS, "autocoupon-api/src/main.py");
    assert.equal(d.name, "main.py");
    assert.equal(d.size, 9);
    assert.equal(await readAll(d.stream), "print(1)\n");
    await assert.rejects(openDownload(WS, ".claude/settings.local.json"), { code: "ESECRET" });
    await assert.rejects(openDownload(WS, "../outside/secret.txt"), { code: "EBADPATH" });
    await assert.rejects(openDownload(WS, "out-link/secret.txt"), { code: "EBADPATH" });
    await assert.rejects(openDownload(WS, "autocoupon-api"), { code: "ENOFILE" });
    await assert.rejects(openDownload(WS, "missing.txt"), { code: "ENOFILE" });
  });

  it("uploads a new file into an existing folder, and only creates", async () => {
    const body = Buffer.from("report\n");
    assert.deepEqual(await saveUpload(WS, "", "report.md", body), { path: "report.md" });
    assert.equal(fs.readFileSync(path.join(WS, "report.md"), "utf8"), "report\n");
    assert.deepEqual(await saveUpload(WS, "autocoupon-api", "notes.txt", body), {
      path: "autocoupon-api/notes.txt",
    });
    await assert.rejects(saveUpload(WS, "", "report.md", Buffer.from("again")), {
      code: "EEXISTS",
    });
    assert.equal(fs.readFileSync(path.join(WS, "report.md"), "utf8"), "report\n");
    // A symlink planted at the name is "taken" too, never written through.
    fs.symlinkSync(path.join(OUTSIDE, "planted.txt"), path.join(WS, "planted.txt"));
    await assert.rejects(saveUpload(WS, "", "planted.txt", body), { code: "EEXISTS" });
    assert.equal(fs.existsSync(path.join(OUTSIDE, "planted.txt")), false);
  });

  it("refuses an upload out of the folder, into .git, over a secret name or too big", async () => {
    const body = Buffer.from("x");
    await assert.rejects(saveUpload(WS, "../outside", "a.txt", body), { code: "EBADPATH" });
    await assert.rejects(saveUpload(WS, "out-link", "a.txt", body), { code: "EBADPATH" });
    await assert.rejects(saveUpload(WS, "", "../a.txt", body), { code: "EBADNAME" });
    await assert.rejects(saveUpload(WS, "", "", body), { code: "EBADNAME" });
    await assert.rejects(saveUpload(WS, ".git/hooks", "pre-commit", body), {
      code: "EBADPATH",
    });
    await assert.rejects(saveUpload(WS, "", ".git", body), { code: "EBADNAME" });
    await assert.rejects(saveUpload(WS, ".claude", "settings.local.json", body), {
      code: "ESECRET",
    });
    await assert.rejects(saveUpload(WS, "no-such-dir", "a.txt", body), { code: "ENOFILE" });
    await assert.rejects(saveUpload(WS, "", "big.bin", Buffer.alloc(UPLOAD_MAX_BYTES + 1)), {
      code: "ETOOBIG",
    });
    assert.equal(fs.existsSync(path.join(OUTSIDE, "a.txt")), false);
  });
});