v3: the backend gets a test suite, and the bugs it turned up are fixed — deno task test runs 186 tests over api/ in about 18s, against a throwaway database and uploads directory (GERBEUR_DB_PATH and GERBEUR_UPLOADS_DIR now override the defaults; api/test/setup.ts sets them before any app module loads), with requests sent through the whole middleware stack in-process via app.handle, outbound fetches and DNS stubbed, and the socket tests on a real Oak listener since an upgraded request has no response for handle() to return. It covers auth (token purposes, revocation after a password change, live roles, login rate limiting, invites claimed once even under parallel registrations, password resets), dumps end to end (create, privacy, by-url matching on the canonical key, backlinks, categories, edits, file replacement, thumbnails, refresh, delete), file serving headers and ranges, attachments, avatars, comments and likes, playlists, follows and feeds, notifications and mentions, categories, search, chat cursors and read markers, link previews and the SSRF guard on every redirect hop, the Bandcamp and YouTube resolvers, migrations (a fresh schema is left untouched; the data rewrites in 0004/0005 and 0010–0013 do what they say), CORS, OG tags, static caching, and the WebSocket protocol. Fixed along the way: an unknown category id on a new dump returned 400 but kept the dump row, and for a file dump deleted the file while keeping the row; an edit or file replacement with one was half-applied before the 400 — categories are now checked before anything is written. A suffix range (bytes=-3) was read as an end offset and got a 416 instead of the last three bytes. Reordering a playlist accepted a list naming a member twice. verifyPassword threw on a stored hash without a salt instead of answering false. And a request with no Accept-Encoding, which RFC 9110 lets a server treat as accepting anything, was sent the brotli sibling; curl and bots now get the plain file.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-09-27 12:31:05 +00:00
parent 16b510764c
commit 25601edaf8
29 changed files with 5521 additions and 19 deletions
--- a/api/test/social.test.ts
+++ b/api/test/social.test.ts
@@ -0,0 +1,284 @@
+// Follows, feeds, notifications and invites.
+import {
+  count,
+  createUser,
+  db,
+  del,
+  get,
+  insertCategory,
+  insertDump,
+  insertPlaylist,
+  patch,
+  post,
+  test,
+} from "./helpers.ts";
+import { assertEquals, assertMatch } from "@std/assert";
+
+function titles(res: { body: { data: { items: { title: string }[] } } }) {
+  return res.body.data.items.map((d) => d.title);
+}
+
+test("following users: status, idempotence, no self-follow, one notification", async () => {
+  const me = await createUser();
+  const them = await createUser();
+  assertEquals(
+    (await post(`/api/follows/users/${them.id}`, { auth: me.auth })).status,
+    204,
+  );
+  assertEquals(
+    (await post(`/api/follows/users/${them.id}`, { auth: me.auth })).status,
+    204,
+  );
+  assertEquals(
+    (await post(`/api/follows/users/${me.id}`, { auth: me.auth })).status,
+    400,
+  );
+  assertEquals(
+    (await get("/api/follows/status", { auth: me.auth })).body.data,
+    { followedUserIds: [them.id], followedPlaylistIds: [] },
+  );
+  // Unfollow and follow again: still just the one notification.
+  await del(`/api/follows/users/${them.id}`, { auth: me.auth });
+  assertEquals(
+    (await get("/api/follows/status", { auth: me.auth })).body.data
+      .followedUserIds,
+    [],
+  );
+  await post(`/api/follows/users/${them.id}`, { auth: me.auth });
+  assertEquals(
+    count(
+      `SELECT COUNT(*) as n FROM notifications WHERE user_id = ? AND type = 'user_followed';`,
+      them.id,
+    ),
+    1,
+  );
+  const list = await get(`/api/users/${me.username}/followed-users`);
+  assertEquals(list.body.data.items.map((u: { id: string }) => u.id), [
+    them.id,
+  ]);
+  assertEquals(list.body.data.items[0].email, undefined);
+});
+
+test("following playlists: public ones only, and not your own notification", async () => {
+  const owner = await createUser();
+  const me = await createUser();
+  const pub = insertPlaylist({ userId: owner.id });
+  const priv = insertPlaylist({ userId: owner.id, isPublic: false });
+  assertEquals(
+    (await post(`/api/follows/playlists/${pub.id}`, { auth: me.auth })).status,
+    204,
+  );
+  assertEquals(
+    (await post(`/api/follows/playlists/${priv.id}`, { auth: me.auth })).status,
+    403,
+  );
+  assertEquals(
+    (await post(`/api/follows/playlists/${crypto.randomUUID()}`, {
+      auth: me.auth,
+    })).status,
+    404,
+  );
+  await post(`/api/follows/playlists/${pub.id}`, { auth: owner.auth });
+  assertEquals(
+    count(
+      `SELECT COUNT(*) as n FROM notifications WHERE type = 'playlist_followed';`,
+    ),
+    1,
+  );
+  assertEquals(
+    (await get(`/api/users/${me.username}/followed-playlists`)).body.data
+      .items[0].id,
+    pub.id,
+  );
+  await del(`/api/follows/playlists/${pub.id}`, { auth: me.auth });
+  assertEquals(
+    (await get("/api/follows/status", { auth: me.auth })).body.data
+      .followedPlaylistIds,
+    [],
+  );
+});
+
+test("followed-users feed: public dumps of the people I follow, newest first", async () => {
+  const me = await createUser();
+  const followed = await createUser();
+  const stranger = await createUser();
+  const music = insertCategory({ slug: "music" });
+  insertDump({
+    userId: followed.id,
+    title: "old",
+    createdAt: "2024-01-01T00:00:00Z",
+  });
+  const tagged = insertDump({
+    userId: followed.id,
+    title: "new",
+    createdAt: "2024-02-01T00:00:00Z",
+  });
+  db.prepare(
+    `INSERT INTO dump_categories (dump_id, category_id) VALUES (?, ?);`,
+  )
+    .run(tagged.id, music);
+  insertDump({ userId: followed.id, title: "private", isPrivate: true });
+  insertDump({ userId: stranger.id, title: "stranger" });
+  await post(`/api/follows/users/${followed.id}`, { auth: me.auth });
+
+  const feed = await get("/api/follows/feed/users", { auth: me.auth });
+  assertEquals(titles(feed), ["new", "old"]);
+  assertEquals(feed.body.data.items[0].categoryIds, [music]);
+  assertEquals(
+    titles(
+      await get("/api/follows/feed/users?category=music", { auth: me.auth }),
+    ),
+    ["new"],
+  );
+  // An unknown category filters everything out rather than nothing.
+  assertEquals(
+    (await get("/api/follows/feed/users?category=nope", { auth: me.auth })).body
+      .data,
+    { items: [], total: 0, hasMore: false },
+  );
+  assertEquals((await get("/api/follows/feed/users")).status, 401);
+});
+
+test("followed-playlists feed: each dump once, public playlists only", async () => {
+  const me = await createUser();
+  const owner = await createUser();
+  const p1 = insertPlaylist({ userId: owner.id });
+  const p2 = insertPlaylist({ userId: owner.id });
+  const d = insertDump({ userId: owner.id, title: "shared" });
+  const priv = insertDump({
+    userId: owner.id,
+    title: "private",
+    isPrivate: true,
+  });
+  for (const p of [p1, p2]) {
+    await post(`/api/follows/playlists/${p.id}`, { auth: me.auth });
+    await post(`/api/playlists/${p.id}/dumps/${d.id}`, { auth: owner.auth });
+  }
+  await post(`/api/playlists/${p1.id}/dumps/${priv.id}`, { auth: owner.auth });
+  const feed = await get("/api/follows/feed/playlists", { auth: me.auth });
+  assertEquals(titles(feed), ["shared"]);
+  assertEquals(feed.body.data.total, 1);
+
+  // A playlist gone private drops out of the feed.
+  db.prepare(`UPDATE playlists SET is_public = 0;`).run();
+  assertEquals(
+    (await get("/api/follows/feed/playlists", { auth: me.auth })).body.data
+      .total,
+    0,
+  );
+});
+
+test("notifications: listed newest first, marked read one or all, never someone else's", async () => {
+  const me = await createUser();
+  const other = await createUser();
+  const { id: dumpId } = insertDump({ userId: me.id, title: "Mine" });
+  // Two notifications for me, one for other.
+  await post(`/api/follows/users/${me.id}`, { auth: other.auth });
+  await post(`/api/dumps/${dumpId}/comments`, {
+    auth: other.auth,
+    json: { body: "hey" },
+  });
+  await post(`/api/follows/users/${other.id}`, { auth: me.auth });
+
+  const list = await get("/api/notifications", { auth: me.auth });
+  assertEquals(list.body.data.total, 2);
+  assertEquals(
+    list.body.data.items.map((n: { type: string }) => n.type),
+    ["dump_commented", "user_followed"],
+  );
+  assertEquals(
+    list.body.data.items.every((n: { read: boolean }) => !n.read),
+    true,
+  );
+
+  const theirs =
+    (await get("/api/notifications", { auth: other.auth })).body.data
+      .items[0].id;
+  assertEquals(
+    (await patch(`/api/notifications/${theirs}/read`, { auth: me.auth }))
+      .status,
+    204,
+  );
+  assertEquals(
+    (await get("/api/notifications", { auth: other.auth })).body.data.items[0]
+      .read,
+    false,
+  );
+
+  const first = list.body.data.items[0].id;
+  await patch(`/api/notifications/${first}/read`, { auth: me.auth });
+  const after =
+    (await get("/api/notifications", { auth: me.auth })).body.data.items;
+  assertEquals(after.map((n: { read: boolean }) => n.read), [true, false]);
+
+  assertEquals(
+    (await post("/api/notifications/read-all", { auth: me.auth })).status,
+    204,
+  );
+  assertEquals(
+    count(
+      `SELECT COUNT(*) as n FROM notifications WHERE user_id = ? AND read = 0;`,
+      me.id,
+    ),
+    0,
+  );
+  assertEquals((await get("/api/notifications")).status, 401);
+});
+
+test("mentions: notify the named, once per context, never the author or an email domain", async () => {
+  const author = await createUser();
+  const named = await createUser();
+  const { id: dumpId } = insertDump({ userId: author.id, title: "Topic" });
+  const body = `hi @${named.username.toUpperCase()} and @${named.username}, ` +
+    `me @${author.username}, mail x@${named.username}.com, ` +
+    `[@${named.username}](link) @nobody_known`;
+  const c = await post(`/api/dumps/${dumpId}/comments`, {
+    auth: author.auth,
+    json: { body },
+  });
+  const notes = db.prepare(
+    `SELECT user_id, data FROM notifications WHERE type = 'user_mentioned';`,
+  ).all() as { user_id: string; data: string }[];
+  assertEquals(notes.length, 1);
+  assertEquals(notes[0].user_id, named.id);
+  assertEquals(JSON.parse(notes[0].data), {
+    mentionerId: author.id,
+    mentionerUsername: author.username,
+    contextType: "comment",
+    contextId: c.body.data.id,
+    contextTitle: "Topic",
+    dumpId,
+  });
+  // Editing the comment doesn't notify a second time.
+  await patch(`/api/comments/${c.body.data.id}`, {
+    auth: author.auth,
+    json: { body: `again @${named.username}` },
+  });
+  assertEquals(
+    count(
+      `SELECT COUNT(*) as n FROM notifications WHERE type = 'user_mentioned';`,
+    ),
+    1,
+  );
+});
+
+test("invites: anyone signed in can make one; it validates until used or stale", async () => {
+  const user = await createUser();
+  assertEquals((await post("/api/invites")).status, 401);
+  const res = await post("/api/invites", { auth: user.auth });
+  assertEquals(res.status, 201);
+  const token = res.body.data.token;
+  assertMatch(token, /^[A-Za-z0-9_-]{22}$/);
+  assertEquals((await get(`/api/invites/${token}`)).status, 200);
+  assertEquals((await get(`/api/invites/unknown`)).status, 404);
+  db.prepare(`UPDATE invites SET used_at = ? WHERE token = ?;`).run(
+    new Date().toISOString(),
+    token,
+  );
+  assertEquals((await get(`/api/invites/${token}`)).status, 404);
+  db.prepare(
+    `UPDATE invites SET used_at = NULL, created_at = ? WHERE token = ?;`,
+  )
+    .run(new Date(Date.now() - 8 * 86400_000).toISOString(), token);
+  assertEquals((await get(`/api/invites/${token}`)).status, 404);
+});