v3: the backend gets a test suite, and the bugs it turned up are fixed — deno task test runs 186 tests over api/ in about 18s, against a throwaway database and uploads directory (GERBEUR_DB_PATH and GERBEUR_UPLOADS_DIR now override the defaults; api/test/setup.ts sets them before any app module loads), with requests sent through the whole middleware stack in-process via app.handle, outbound fetches and DNS stubbed, and the socket tests on a real Oak listener since an upgraded request has no response for handle() to return. It covers auth (token purposes, revocation after a password change, live roles, login rate limiting, invites claimed once even under parallel registrations, password resets), dumps end to end (create, privacy, by-url matching on the canonical key, backlinks, categories, edits, file replacement, thumbnails, refresh, delete), file serving headers and ranges, attachments, avatars, comments and likes, playlists, follows and feeds, notifications and mentions, categories, search, chat cursors and read markers, link previews and the SSRF guard on every redirect hop, the Bandcamp and YouTube resolvers, migrations (a fresh schema is left untouched; the data rewrites in 0004/0005 and 0010–0013 do what they say), CORS, OG tags, static caching, and the WebSocket protocol. Fixed along the way: an unknown category id on a new dump returned 400 but kept the dump row, and for a file dump deleted the file while keeping the row; an edit or file replacement with one was half-applied before the 400 — categories are now checked before anything is written. A suffix range (bytes=-3) was read as an end offset and got a 416 instead of the last three bytes. Reordering a playlist accepted a list naming a member twice. verifyPassword threw on a stored hash without a salt instead of answering false. And a request with no Accept-Encoding, which RFC 9110 lets a server treat as accepting anything, was sent the brotli sibling; curl and bots now get the plain file.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-09-27 12:31:05 +00:00
parent 16b510764c
commit 25601edaf8
29 changed files with 5521 additions and 19 deletions
--- a/api/test/middleware.test.ts
+++ b/api/test/middleware.test.ts
@@ -0,0 +1,255 @@
+// The app-wide middleware: error rendering, CORS, OG tags for crawlers, and
+// static file serving with its cache rules.
+import {
+  BASE_URL,
+  createUser,
+  get,
+  insertDump,
+  insertPlaylist,
+  request,
+  test,
+  TEST_DIR,
+} from "./helpers.ts";
+import { assertEquals, assertFalse, assertStringIncludes } from "@std/assert";
+import { Application } from "@oak/oak";
+import { errorMiddleware } from "../middleware/error.ts";
+import { ogMiddleware } from "../middleware/og.ts";
+import { routeStaticFilesFrom } from "../lib/static.ts";
+import { APIErrorCode, APIException } from "../model/interfaces.ts";
+
+async function handle(
+  app: Application,
+  path: string,
+  headers: HeadersInit = {},
+) {
+  const res = await app.handle(new Request(`${BASE_URL}${path}`, { headers }));
+  if (!res) throw new Error("no response");
+  return { res, text: await res.text() };
+}
+
+Deno.test("errorMiddleware: APIExceptions keep their status, anything else is a bare 500", async () => {
+  const app = new Application();
+  app.use(errorMiddleware);
+  app.use((ctx) => {
+    if (ctx.request.url.pathname === "/api-error") {
+      throw new APIException(APIErrorCode.NOT_FOUND, 404, "Nope");
+    }
+    throw new Error("secret internals");
+  });
+  const known = await handle(app, "/api-error");
+  assertEquals(known.res.status, 404);
+  assertEquals(JSON.parse(known.text), {
+    success: false,
+    error: { code: "NOT_FOUND", message: "Nope" },
+  });
+  const unknown = await handle(app, "/boom");
+  assertEquals(unknown.res.status, 500);
+  assertEquals(JSON.parse(unknown.text).error, {
+    code: "SERVER_ERROR",
+    message: "Unexpected server error",
+  });
+});
+
+test("CORS: allowed origins get the headers, others don't", async () => {
+  const allowed = await get("/api/categories", {
+    headers: { Origin: "http://allowed.test" },
+  });
+  assertEquals(
+    allowed.headers.get("access-control-allow-origin"),
+    "http://allowed.test",
+  );
+  // The public URL is always allowed.
+  const self = await get("/api/categories", { headers: { Origin: BASE_URL } });
+  assertEquals(self.headers.get("access-control-allow-origin"), BASE_URL);
+  const evil = await get("/api/categories", {
+    headers: { Origin: "http://evil.test" },
+  });
+  assertEquals(evil.status, 200);
+  assertEquals(evil.headers.get("access-control-allow-origin"), null);
+
+  const preflight = await request("OPTIONS", "/api/dumps", {
+    headers: {
+      Origin: "http://allowed.test",
+      "Access-Control-Request-Method": "POST",
+      "Access-Control-Request-Headers": "authorization,content-type",
+    },
+  });
+  assertEquals(preflight.status, 204);
+  assertEquals(
+    preflight.headers.get("access-control-allow-origin"),
+    "http://allowed.test",
+  );
+});
+
+test("GET /ws: refuses other origins, and plain requests from allowed ones", async () => {
+  assertEquals(
+    (await get("/ws", { headers: { Origin: "http://evil.test" } })).status,
+    403,
+  );
+  assertEquals((await get("/ws")).status, 403);
+  assertEquals(
+    (await get("/ws", { headers: { Origin: "http://allowed.test" } })).status,
+    426,
+  );
+});
+
+function ogApp() {
+  const app = new Application();
+  app.use(ogMiddleware);
+  app.use((ctx) => {
+    ctx.response.body = "fallthrough";
+  });
+  return app;
+}
+
+test("ogMiddleware: dump pages get escaped OG tags", async () => {
+  const user = await createUser();
+  const dump = insertDump({
+    userId: user.id,
+    title: `Tom & "Jerry" <script>`,
+    comment: "A comment",
+    richContent: {
+      type: "generic",
+      url: "x",
+      thumbnailUrl: "https://img.test/a.jpg",
+    },
+  });
+  const { res, text } = await handle(ogApp(), `/dumps/${dump.slug}`);
+  assertEquals(res.headers.get("content-type"), "text/html; charset=utf-8");
+  assertStringIncludes(
+    text,
+    `<meta property="og:title" content="Tom &amp; &quot;Jerry&quot; &lt;script&gt;" />`,
+  );
+  assertStringIncludes(
+    text,
+    `<title>Tom &amp; &quot;Jerry&quot; &lt;script&gt;</title>`,
+  );
+  assertStringIncludes(
+    text,
+    `<meta property="og:description" content="A comment" />`,
+  );
+  assertStringIncludes(
+    text,
+    `<meta property="og:image" content="https://img.test/a.jpg" />`,
+  );
+  assertStringIncludes(text, `content="summary_large_image"`);
+  assertStringIncludes(
+    text,
+    `<meta property="og:url" content="${BASE_URL}/dumps/${dump.slug}" />`,
+  );
+  // The index's own title is replaced, not duplicated.
+  assertEquals(text.match(/<title>/g)?.length, 1);
+  assertFalse(text.includes("__SITE_NAME__"));
+});
+
+test("ogMiddleware: no artwork falls back to the site icon as a small card", async () => {
+  const user = await createUser();
+  const dump = insertDump({ userId: user.id, title: "Plain" });
+  const { text } = await handle(ogApp(), `/dumps/${dump.id}`);
+  assertStringIncludes(text, `content="${BASE_URL}/apple-touch-icon.png"`);
+  assertStringIncludes(text, `<meta name="twitter:card" content="summary" />`);
+  const file = insertDump({
+    userId: user.id,
+    fileName: "a.png",
+    fileMime: "image/png",
+  });
+  assertStringIncludes(
+    (await handle(ogApp(), `/dumps/${file.id}`)).text,
+    `content="${BASE_URL}/api/files/${file.id}"`,
+  );
+});
+
+test("ogMiddleware: users and public playlists; private things fall through", async () => {
+  const user = await createUser();
+  const app = ogApp();
+  assertStringIncludes(
+    (await handle(app, `/users/${user.username}/~/votes`)).text,
+    `<meta property="og:title" content="${user.username}" />`,
+  );
+  const pub = insertPlaylist({ userId: user.id, title: "Open list" });
+  assertStringIncludes(
+    (await handle(app, `/playlists/${pub.slug}`)).text,
+    "Open list",
+  );
+  const priv = insertPlaylist({
+    userId: user.id,
+    title: "Closed",
+    isPublic: false,
+  });
+  assertEquals(
+    (await handle(app, `/playlists/${priv.slug}`)).text,
+    "fallthrough",
+  );
+  const secret = insertDump({
+    userId: user.id,
+    title: "Secret",
+    isPrivate: true,
+  });
+  assertEquals((await handle(app, `/dumps/${secret.id}`)).text, "fallthrough");
+  assertEquals((await handle(app, `/dumps/nope`)).text, "fallthrough");
+  assertEquals(
+    (await handle(app, `/api/dumps/${secret.id}`)).text,
+    "fallthrough",
+  );
+  assertEquals((await handle(app, `/favicon.ico`)).text, "fallthrough");
+});
+
+Deno.test("routeStaticFilesFrom: index, SPA fallback, cache rules, precompressed files", async () => {
+  const root = `${TEST_DIR}/static-${crypto.randomUUID()}`;
+  await Deno.mkdir(`${root}/assets`, { recursive: true });
+  await Deno.writeTextFile(
+    `${root}/index.html`,
+    `<html><head><title>__SITE_NAME__</title></head><body>__BANDCAMP_PLAYER__</body></html>`,
+  );
+  const js = "console.log('app');".repeat(50);
+  await Deno.writeTextFile(`${root}/assets/app-abc123.js`, js);
+  const br = new Uint8Array([1, 2, 3]);
+  await Deno.writeFile(`${root}/assets/app-abc123.js.br`, br);
+  await Deno.writeTextFile(`${root}/robots.txt`, "User-agent: *");
+
+  const app = new Application();
+  app.use(routeStaticFilesFrom([root]));
+
+  const index = await handle(app, "/");
+  assertEquals(index.res.headers.get("cache-control"), "no-cache");
+  assertEquals(
+    index.text,
+    "<html><head><title>gerbeur</title></head><body>embed</body></html>",
+  );
+
+  const spa = await handle(app, "/users/someone");
+  assertEquals(spa.res.status, 200);
+  assertEquals(spa.text, index.text);
+
+  // No Accept-Encoding header: the plain file, not the .br sibling.
+  const asset = await handle(app, "/assets/app-abc123.js");
+  assertEquals(asset.text, js);
+  assertEquals(asset.res.headers.get("content-encoding"), null);
+  assertStringIncludes(asset.res.headers.get("cache-control")!, "immutable");
+  assertStringIncludes(
+    asset.res.headers.get("cache-control")!,
+    "max-age=31536000",
+  );
+  assertStringIncludes(asset.res.headers.get("vary")!, "Accept-Encoding");
+
+  const compressed = await handle(app, "/assets/app-abc123.js", {
+    "Accept-Encoding": "br, gzip",
+  });
+  assertEquals(compressed.res.headers.get("content-encoding"), "br");
+  assertEquals(compressed.text, "\x01\x02\x03"); // the .br file's bytes
+
+  const plain = await handle(app, "/robots.txt");
+  assertEquals(plain.text, "User-agent: *");
+  assertFalse(
+    (plain.res.headers.get("cache-control") ?? "").includes("immutable"),
+  );
+
+  // A chunk from an older build 404s rather than being answered with the index.
+  const stale = await handle(app, "/assets/app-old999.js");
+  assertEquals(stale.res.status, 404);
+  assertFalse(stale.text.includes("<html>"));
+  assertEquals(
+    (await handle(app, "/emojibase/17.0.0/missing.json")).res.status,
+    404,
+  );
+});