1import { beforeAll, describe, expect, test } from "bun:test";2import { writeFile } from "node:fs/promises";3import { join } from "node:path";4import { openBucket } from "../src/bucket/reader.ts";5import {6 checkFormat,7 escapePath,8 listEventIds,9 listRepos,10 readEvent,11 readHead,12 readObject,13 readSave,14} from "../src/bucket/repo.ts";15import { type Fixture, makeKohBucket } from "./fixture.ts";1617let fx: Fixture;18beforeAll(async () => {19 fx = await makeKohBucket();20});2122const bucket = () => openBucket({ kind: "folder", path: fx.bucketDir });2324describe("reading a koh3-produced folder remote", () => {25 test("lists the repo", async () => {26 expect(await listRepos(bucket())).toEqual([fx.repo]);27 });2829 test("reads format, head, the save record and one verified object end to end", async () => {30 const b = bucket();31 await checkFormat(b, fx.repo);32 const head = await readHead(b, fx.repo);33 expect(head).toBe(fx.saveIds[0] as string);3435 const save = await readSave(b, fx.repo, head as string);36 expect(save.message).toBe("say hello");37 expect(save.is_checkpoint).toBe(false);38 const checkpoint = await readSave(b, fx.repo, save.parent);39 expect(checkpoint.is_checkpoint).toBe(true);40 const first = await readSave(b, fx.repo, checkpoint.parent);41 expect([first.agent, first.session]).toEqual(["test-agent", "fixture"]);4243 const main = save.files.find((file) => file.path === "src/main.ts");44 const { bytes } = await readObject(b, fx.repo, main?.hash as string);45 expect(new TextDecoder().decode(bytes)).toBe("// Entry point.\nconsole.log('hello');\n");46 });4748 test("a missing key reads as null and a listing is prefix-scoped", async () => {49 const b = bucket();50 expect(await b.get(`${fx.repo}/nothing-here`)).toBeNull();51 const saves = await b.list(`${fx.repo}/saves/`);52 expect(saves.sort()).toEqual(fx.saveIds.map((id) => `${fx.repo}/saves/${id}`).sort());53 });54});5556test("the S3 reader pages through listings with sizes and reads a missing key as null", async () => {57 const pageSize = 2;58 const server = Bun.serve({59 port: 0,60 async fetch(req) {61 const url = new URL(req.url);62 const folder = bucket();63 if (url.searchParams.get("list-type") === "2") {64 const sizes = await folder.sizes(url.searchParams.get("prefix") ?? "");65 const all = [...sizes.keys()];66 const start = Number(url.searchParams.get("continuation-token") ?? 0);67 const page = all.slice(start, start + pageSize);68 const more = start + pageSize < all.length;69 const contents = page70 .map((key) => `<Contents><Key>${key}</Key><Size>${sizes.get(key)}</Size></Contents>`)71 .join("");72 const next = more73 ? `<NextContinuationToken>${start + pageSize}</NextContinuationToken>`74 : "";75 return new Response(76 `<ListBucketResult><IsTruncated>${more}</IsTruncated>${contents}${next}</ListBucketResult>`,77 );78 }79 const bytes = await folder.get(url.pathname.replace("/kohbucket/", ""));80 if (bytes) return new Response(bytes);81 return new Response("<Error><Code>NoSuchKey</Code></Error>", { status: 404 });82 },83 });84 try {85 const s3 = openBucket({86 kind: "s3",87 endpoint: `http://localhost:${server.port}`,88 name: "kohbucket",89 region: "fr-par",90 accessKeyId: "read",91 secretAccessKey: "only",92 });93 expect(await s3.list(`${fx.repo}/`)).toEqual(await bucket().list(`${fx.repo}/`));94 const sizes = await s3.sizes(`${fx.repo}/`);95 expect(sizes).toEqual(await bucket().sizes(`${fx.repo}/`));96 expect(sizes.get(`${fx.repo}/head`)).toBe(12);97 expect(await readHead(s3, fx.repo)).toBe(fx.saveIds[0] as string);98 99 100 const format = await s3.get(`${fx.repo}/format`);101 expect(format === null ? null : new TextDecoder().decode(format)).toBe("koh-remote 1");102 expect(await s3.get(`${fx.repo}/no-such-key`)).toBeNull();103 const url = new URL(104 s3.downloadUrl("demo/releases/1.0/android-arm64/a b.apk", "a b.apk", "t/x"),105 );106 expect(url.pathname).toBe("/kohbucket/demo/releases/1.0/android-arm64/a%20b.apk");107 expect(url.searchParams.get("X-Amz-Expires")).toBe("300");108 expect(url.searchParams.get("response-content-disposition")).toBe(109 'attachment; filename="a b.apk"',110 );111 expect(url.searchParams.get("response-content-type")).toBe("t/x");112 } finally {113 server.stop();114 }115});116117describe("the format rule", () => {118 test("accepts koh-remote 1 and refuses anything else", async () => {119 const { bucketDir, repo } = await makeKohBucket("formatted");120 const b = openBucket({ kind: "folder", path: bucketDir });121 await writeFile(join(bucketDir, repo, "format"), "koh-remote 1");122 await checkFormat(b, repo);123 await writeFile(join(bucketDir, repo, "format"), "koh-remote 2");124 await expect(checkFormat(b, repo)).rejects.toThrow('remote format "koh-remote 2"');125 });126});127128describe("object verification", () => {129 test("refuses an object whose content does not match its key", async () => {130 const b = bucket();131 const save = await readSave(b, fx.repo, fx.saveIds[0] as string);132 const [one, two] = save.files;133 const swapped = {134 ...b,135 get: (key: string) => b.get(key.replace(one?.hash ?? "", two?.hash ?? "")),136 };137 await expect(readObject(swapped, fx.repo, one?.hash as string)).rejects.toThrow(138 "does not match its hash",139 );140 });141});142143describe("untrusted input", () => {144 145 async function readTampered(change: (record: Record<string, unknown>) => void) {146 const id = fx.saveIds[0] as string;147 const real = await bucket().get(`${fx.repo}/saves/${id}`);148 const record = JSON.parse(new TextDecoder().decode(real as Uint8Array));149 change(record);150 const bytes = new TextEncoder().encode(JSON.stringify(record));151 return readSave(152 {153 get: async () => bytes,154 list: async () => [],155 sizes: async () => new Map(),156 downloadUrl: () => "",157 viewUrl: () => null,158 put: async () => {},159 remove: async () => {},160 },161 fx.repo,162 id,163 );164 }165 const withPath = (path: string) => (record: Record<string, unknown>) => {166 (record.files as { path: string }[])[0] = { ...(record.files as { path: string }[])[0], path };167 };168169 test("the genuine record is accepted", async () => {170 expect((await readTampered(() => {})).message).toBe("say hello");171 });172173 174 test.each([175 "",176 "/etc/passwd",177 "../escape",178 "src/../../escape",179 "./src/main.ts",180 "src//main.ts",181 "src/",182 "src\\main.ts",183 "src/ma\0in.ts",184 "src/ma\nin.ts",185 "Icon\r",186 "a\u0085b",187 ])("quarantines the file path %p", async (path) => {188 const save = await readTampered(withPath(path));189 expect(save.files.map((file) => file.path)).not.toContain(path);190 expect(save.files.length).toBeGreaterThan(0);191 expect(save.quarantined).toEqual([escapePath(path)]);192 });193194 test("quarantines bytes outside UTF-8 and unpaired surrogate escapes, and keeps a real U+FFFD", async () => {195 const id = fx.saveIds[0] as string;196 const real = await bucket().get(`${fx.repo}/saves/${id}`);197 const record = JSON.parse(new TextDecoder().decode(real as Uint8Array));198 record.files[0].path = "bad-X-name";199 record.files[1].path = "odd-\ufffd-name";200 record.files[2].path = "lead-\ud800";201 record.files[3].path = "pair-\ud83d\ude00";202 const bytes = Buffer.from(JSON.stringify(record));203 bytes[bytes.indexOf("bad-X-name") + 4] = 0xff;204 const save = await readSave(205 {206 get: async () => bytes,207 list: async () => [],208 sizes: async () => new Map(),209 downloadUrl: () => "",210 viewUrl: () => null,211 put: async () => {},212 remove: async () => {},213 },214 fx.repo,215 id,216 );217 expect(save.quarantined.sort()).toEqual(["bad-\\xff-name", "lead-\\xed\\xa0\\x80"]);218 expect(save.files.map((file) => file.path)).toContain("odd-\ufffd-name");219 expect(save.files.map((file) => file.path)).toContain("pair-\ud83d\ude00");220 });221222 test("escapes a name as Koh's escape_path does", () => {223 expect(["Icon\r", "a\\b", "a\u0085", "\x7f", "plain/ok"].map(escapePath)).toEqual([224 "Icon\\x0d",225 "a\\\\b",226 "a\\u0085",227 "\\x7f",228 "plain/ok",229 ]);230 });231232 test("refuses duplicate paths in one record", async () => {233 const dupe = (record: Record<string, unknown>) => {234 const files = record.files as { path: string }[];235 files[1] = { ...files[1], path: (files[0] as { path: string }).path } as { path: string };236 };237 await expect(readTampered(dupe)).rejects.toThrow("Koh 3 schema");238 });239240 test("accepts the six-character IDs that Koh 2's early saves keep through migration", async () => {241 expect((await readTampered((record) => (record.parent = "af96c8"))).parent).toBe("af96c8");242 });243244 test.each([245 ["parent", "not-an-id"],246 ["parent", "af96c"],247 ["parent", "af96c8a"],248 ["restores", "ABCDEF123456"],249 ["replayed_from", "../../../x"],250 ["created_at", -1],251 ["created_at", 1.5],252 ["size_bytes", -10],253 ["size_bytes", "12"],254 ])("refuses %s = %p", async (field, value) => {255 await expect(readTampered((record) => (record[field] = value))).rejects.toThrow("Koh 3 schema");256 });257258 test("refuses bad repo names and save IDs before building a key", async () => {259 const b = bucket();260 for (const repo of ["..", "a/b", "", "../demo"]) {261 await expect(checkFormat(b, repo)).rejects.toThrow("not a repo name");262 await expect(readHead(b, repo)).rejects.toThrow("not a repo name");263 await expect(readSave(b, repo, fx.saveIds[0] as string)).rejects.toThrow("not a repo name");264 await expect(readObject(b, repo, "0".repeat(64))).rejects.toThrow("not a repo name");265 }266 for (const id of ["../head", "abc", "ABCDEF123456", `${fx.saveIds[0]}0`]) {267 await expect(readSave(b, fx.repo, id)).rejects.toThrow("not a save ID");268 }269 });270});271272describe("event records", () => {273 test("reads a genuine koh3 flag event and refuses a tampered one", async () => {274 const b = bucket();275 const [id] = await listEventIds(b, fx.repo);276 const event = await readEvent(b, fx.repo, id as string);277 expect([event.kind, event.save_id, event.reason]).toEqual([278 "flag",279 fx.saveIds[3] as string,280 "holds a secret",281 ]);282 const stripAll = { kind: "strip", save_id: "", path: "secret.txt" };283 const accepted = new TextEncoder().encode(JSON.stringify({ ...event, ...stripAll }));284 const reader = {285 get: async () => accepted,286 list: async () => [],287 sizes: async () => new Map(),288 downloadUrl: () => "",289 viewUrl: () => null,290 put: async () => {},291 remove: async () => {},292 };293 expect((await readEvent(reader, fx.repo, event.id)).kind).toBe("strip");294 for (const change of [295 { kind: "delete" },296 { path: "../x" },297 { save_id: "nope" },298 { kind: "flag", save_id: "" },299 { kind: "clear", save_id: "" },300 { kind: "flag", path: "secret.txt" },301 { kind: "clear", path: "secret.txt" },302 303 ]) {304 const bytes = new TextEncoder().encode(JSON.stringify({ ...event, ...change }));305 const tampered = {306 get: async () => bytes,307 list: async () => [],308 sizes: async () => new Map(),309 downloadUrl: () => "",310 viewUrl: () => null,311 put: async () => {},312 remove: async () => {},313 };314 await expect(readEvent(tampered, fx.repo, event.id)).rejects.toThrow("Koh 3 schema");315 }316 });317});