nntrivi2001
8546748759
Dependencies
- Security: body-parser and multer DoS advisories fixed (npm audit: 0).
- Server: Express 5 (query parser kept "extended", req.body defaults to {},
SPA catch-all /{*splat}, send-file helper restores Express 4's dot-folder
rule for sendFile/download, alerts ack route without inline regex),
better-sqlite3 13, js-yaml 5 (server/lib/yaml.js keeps js-yaml 4's default
schema), uuid dropped for crypto.randomUUID, node-pty beta.18, multer 2.5.
- Client: React 19, xterm 6 (WebGL renderer replaces the removed canvas one,
DOM fallback on context loss; Alt+arrow word moves re-mapped), lucide-react 1,
TypeScript 7, i18next/react-i18next/codemirror minors.
Workspace rename step 4
- `agenthub lanes` and `--lane` exit 1 with "renamed: use …"; client api.ts,
the CLI and the MCP server call /api/workspaces; /api/lanes stays mounted.
Server mode (S3): members manage their own Claude Code config
- server/lib/cc-target.js resolves whose config a /cc-config request touches
and gates the router by allowlist; /profiles* and /plugins/update-all stay
admin-only. Member writes go through write-as, CLI calls through sudo as the
member (never -y), reads through openSafe; cc_config_changed reaches only
its owner. Not verified live on an S3 install yet.
Other
- Chat: an HTML file is an artifact only when written whole and not a project
page (index.html, or under src/, public/, templates/, …).
- OpenAPI covers every /api route; openapi-coverage.test.js guards it.
- read-pool test keeps its event loop alive (its worker is unref'd).
- Docs: plan statuses, checklists, CLI.md, LANES.md, SERVER-MODE.md, API.md.
58 lines
2.0 KiB
JavaScript
58 lines
2.0 KiB
JavaScript
/**
|
|
* @file Tests for server/lib/send-file.js: under Express 5 a server-chosen
|
|
* absolute path inside a dotted directory (`~/.claude/…`) is still served, a
|
|
* dotfile itself is still refused (Express 4's rule), and a download keeps its
|
|
* attachment name.
|
|
* @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
|
|
*/
|
|
|
|
const { describe, it, before, after } = require("node:test");
|
|
const assert = require("node:assert/strict");
|
|
const fs = require("fs");
|
|
const os = require("os");
|
|
const path = require("path");
|
|
const express = require("express");
|
|
const { sendFile, download } = require("../lib/send-file");
|
|
|
|
describe("send-file", () => {
|
|
let dir;
|
|
let server;
|
|
let base;
|
|
|
|
before(async () => {
|
|
dir = fs.mkdtempSync(path.join(os.tmpdir(), "send-file-"));
|
|
fs.mkdirSync(path.join(dir, ".claude"));
|
|
fs.writeFileSync(path.join(dir, ".claude", "a.txt"), "hi");
|
|
fs.writeFileSync(path.join(dir, ".claude", ".secret"), "no");
|
|
const app = express();
|
|
app.get("/file", (_req, res) => sendFile(res, path.join(dir, ".claude", "a.txt")));
|
|
app.get("/dot", (_req, res) => sendFile(res, path.join(dir, ".claude", ".secret")));
|
|
app.get("/dl", (_req, res) => download(res, path.join(dir, ".claude", "a.txt"), "r.txt"));
|
|
await new Promise((r) => (server = app.listen(0, "127.0.0.1", r)));
|
|
base = `http://127.0.0.1:${server.address().port}`;
|
|
});
|
|
|
|
after(() => {
|
|
server.close();
|
|
fs.rmSync(dir, { recursive: true, force: true });
|
|
});
|
|
|
|
it("serves a file whose parent directory is a dot-directory", async () => {
|
|
const res = await fetch(`${base}/file`);
|
|
assert.equal(res.status, 200);
|
|
assert.equal(await res.text(), "hi");
|
|
});
|
|
|
|
it("still refuses a dotfile", async () => {
|
|
const res = await fetch(`${base}/dot`);
|
|
assert.equal(res.status, 404);
|
|
});
|
|
|
|
it("downloads under the given name", async () => {
|
|
const res = await fetch(`${base}/dl`);
|
|
assert.equal(res.status, 200);
|
|
assert.match(res.headers.get("content-disposition"), /^attachment; filename="?r\.txt"?$/);
|
|
assert.equal(await res.text(), "hi");
|
|
});
|
|
});
|