ClaudeandClaude Sonnet 5.5
dd1597862a
Neuer abhängigkeitsfreier Node-22-Dienst in deploy/api/ (appwrite.js, app.js,
server.js), der alle Galerie-Schreibzugriffe mit dem Appwrite-Server-Key
ausführt: POST /api/veroeffentlichen, /zurueckziehen, /melden (Rate-Limit
10/h je Melder, IPv6 auf /64, Auto-Ausblenden ab 3), /admin/sichtbarkeit und
GET /api/gesundheit.
- JWT-Prüfung über GET /account (Header X-Aircard-Jwt), Admin = Label admin
- IDs per Muster geprüft, Pfadsegmente kodiert, "." und ".." abgelehnt
- deterministische Zeilen-IDs (Galerie, Meldung): Appwrite-409 ersetzt jede
Doppelt-Prüfung; Sperre je Karte gegen verlorene Zählerstände
- Dateiprüfung: Bucket, delete("user:<ich>"), PNG/WebP, höchstens 5 MiB
- Appwrite-Aufrufe mit 10-s-Zeitlimit, Logs ohne Key, Salz, JWT und IPs
- Tests gegen einen Fake-Appwrite im Speicher (70 Tests), Compose-Service
aircard-api (Router aircard-gallery-api) und README ergänzt
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
948 lines
43 KiB
JavaScript
948 lines
43 KiB
JavaScript
'use strict';
|
||
|
||
// Tests für deploy/api/app.js: echte HTTP-Anfragen auf Port 0 gegen createApp, dahinter ein Fake-Appwrite im
|
||
// Speicher (fake-appwrite.js) und das echte appwrite.js. Aufruf: node --test "deploy/api/*.test.js"
|
||
|
||
const { test, afterEach } = require('node:test');
|
||
const assert = require('node:assert/strict');
|
||
const crypto = require('node:crypto');
|
||
const http = require('node:http');
|
||
|
||
const { createAppwrite } = require('./appwrite.js');
|
||
const { startFakeAppwrite } = require('./fake-appwrite.js');
|
||
const {
|
||
createApp,
|
||
visibleRowPermissions,
|
||
hiddenRowPermissions,
|
||
visibleFilePermissions,
|
||
hiddenFilePermissions,
|
||
reporterHash,
|
||
clientIp,
|
||
normalizeIp,
|
||
validatePublish,
|
||
buildSearchText,
|
||
galleryRowId,
|
||
reportRowId,
|
||
} = require('./app.js');
|
||
|
||
const SALT = 'test-salt-0123456789abcdef0123456789abcdef';
|
||
const ME = 'user-me';
|
||
const OTHER = 'user-other';
|
||
const ADMIN = 'user-admin';
|
||
const JWT_ME = 'eyJhbGciOiJI.payload-me.signature-me';
|
||
const JWT_OTHER = 'eyJhbGciOiJI.payload-other.signature-other';
|
||
const JWT_ADMIN = 'eyJhbGciOiJI.payload-admin.signature-admin';
|
||
const MIB5 = 5 * 1024 * 1024;
|
||
|
||
// ---- Aufbau ---------------------------------------------------------------------------------
|
||
|
||
const cleanups = [];
|
||
afterEach(async () => {
|
||
for (const fn of cleanups.splice(0).reverse()) await fn();
|
||
});
|
||
|
||
async function setup() {
|
||
const fake = await startFakeAppwrite();
|
||
fake.addUser(JWT_ME, { id: ME });
|
||
fake.addUser(JWT_OTHER, { id: OTHER });
|
||
fake.addUser(JWT_ADMIN, { id: ADMIN, labels: ['admin'] });
|
||
|
||
const logs = [];
|
||
const clock = { value: 1_700_000_000_000 };
|
||
const appwrite = createAppwrite({ endpoint: fake.endpoint, project: fake.project, key: fake.key });
|
||
const app = createApp({ appwrite, salt: SALT, now: () => clock.value, log: (line) => logs.push(String(line)) });
|
||
const server = http.createServer(app);
|
||
await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
|
||
const { port } = server.address();
|
||
|
||
cleanups.push(async () => {
|
||
server.closeAllConnections();
|
||
await new Promise((resolve) => server.close(resolve));
|
||
await fake.close();
|
||
});
|
||
|
||
const call = (method, path, options) => request(port, method, path, options);
|
||
const post = (path, body, jwt, headers = {}) =>
|
||
call('POST', path, { body, headers: { ...(jwt ? { 'X-Aircard-Jwt': jwt } : {}), ...headers } });
|
||
const report = (id, ip, reason = 'spam') => post('/api/melden', { id, reason }, null, ip ? { 'X-Real-Ip': ip } : {});
|
||
|
||
return { fake, app, logs, clock, port, call, post, report };
|
||
}
|
||
|
||
function request(port, method, path, { headers = {}, body, raw, contentType = 'application/json' } = {}) {
|
||
return new Promise((resolve, reject) => {
|
||
const payload = raw !== undefined ? raw : body === undefined ? undefined : JSON.stringify(body);
|
||
const requestHeaders = { ...headers };
|
||
if (payload !== undefined && contentType) requestHeaders['Content-Type'] = contentType;
|
||
if (payload !== undefined && !('Transfer-Encoding' in requestHeaders)) {
|
||
requestHeaders['Content-Length'] = Buffer.byteLength(payload);
|
||
}
|
||
const req = http.request({ host: '127.0.0.1', port, method, path, headers: requestHeaders }, (res) => {
|
||
const chunks = [];
|
||
res.on('data', (chunk) => chunks.push(chunk));
|
||
res.on('end', () => {
|
||
const text = Buffer.concat(chunks).toString('utf8');
|
||
let json = null;
|
||
try {
|
||
json = JSON.parse(text);
|
||
} catch {
|
||
// kein JSON
|
||
}
|
||
resolve({ status: res.statusCode, headers: res.headers, text, json });
|
||
});
|
||
});
|
||
req.on('error', reject);
|
||
if (payload !== undefined) req.write(payload);
|
||
req.end();
|
||
});
|
||
}
|
||
|
||
function publishBody(overrides = {}) {
|
||
return {
|
||
title: 'Mein Motiv',
|
||
issuer: 'Beispielbank',
|
||
tags: ['Blau', ' Neon '],
|
||
displayName: 'Kenso',
|
||
imageFileId: 'img1',
|
||
previewFileId: 'prev1',
|
||
sourceCardId: 'card1',
|
||
...overrides,
|
||
};
|
||
}
|
||
|
||
function seedUploads(fake, owner = ME, { image = 'img1', preview = 'prev1' } = {}) {
|
||
fake.addFile({ id: image, owner });
|
||
fake.addFile({ id: preview, owner, mimeType: 'image/webp' });
|
||
}
|
||
|
||
/** Legt eine veröffentlichte Karte direkt im Fake an (Zeile + zwei Dateien mit passenden Rechten). */
|
||
function seedCard(fake, { id = 'card-1', owner = ME, hidden = false, reportCount = 0 } = {}) {
|
||
const imageFileId = `${id}-img`;
|
||
const previewFileId = `${id}-prev`;
|
||
fake.addFile({ id: imageFileId, owner });
|
||
fake.addFile({ id: previewFileId, owner, mimeType: 'image/webp' });
|
||
if (hidden) {
|
||
fake.file(imageFileId).$permissions = hiddenFilePermissions(owner);
|
||
fake.file(previewFileId).$permissions = hiddenFilePermissions(owner);
|
||
}
|
||
fake.addRow(
|
||
'gallery',
|
||
id,
|
||
{
|
||
title: 'Karte',
|
||
issuer: '',
|
||
tags: '',
|
||
displayName: '',
|
||
imageFileId,
|
||
previewFileId,
|
||
sourceCardId: `src-${id}`,
|
||
ownerId: owner,
|
||
hidden,
|
||
reportCount,
|
||
searchText: 'karte',
|
||
},
|
||
hidden ? hiddenRowPermissions(owner) : visibleRowPermissions(),
|
||
);
|
||
return { imageFileId, previewFileId };
|
||
}
|
||
|
||
const storageCalls = (fake) => fake.calls.filter((c) => c.path.startsWith('/v1/storage/'));
|
||
const sha32 = (text) => crypto.createHash('sha256').update(text).digest('hex').slice(0, 32);
|
||
|
||
// ---- Reine Helfer ------------------------------------------------------------------------------
|
||
|
||
test('Rechte-Strings sind genau die aus der Spec', () => {
|
||
assert.deepEqual(visibleRowPermissions(), ['read("any")']);
|
||
assert.deepEqual(hiddenRowPermissions('abc'), ['read("user:abc")', 'read("label:admin")']);
|
||
assert.deepEqual(visibleFilePermissions('abc'), ['read("any")', 'delete("user:abc")']);
|
||
assert.deepEqual(hiddenFilePermissions('abc'), ['read("user:abc")', 'read("label:admin")', 'delete("user:abc")']);
|
||
});
|
||
|
||
test('Rechte-Helfer lehnen unzulässige Nutzer-IDs ab (kein Einschleusen in Rechte-Strings)', () => {
|
||
for (const bad of ['a")', 'x","read("any', '', '../x', 5, null]) {
|
||
assert.throws(() => hiddenRowPermissions(bad));
|
||
assert.throws(() => visibleFilePermissions(bad));
|
||
assert.throws(() => hiddenFilePermissions(bad));
|
||
}
|
||
});
|
||
|
||
test('Zeilen-IDs sind deterministisch: erste 32 Hex von sha256(a|b)', () => {
|
||
assert.equal(galleryRowId('u1', 'c1'), sha32('u1|c1'));
|
||
assert.equal(reportRowId('g1', 'hash1'), sha32('g1|hash1'));
|
||
assert.match(galleryRowId('u1', 'c1'), /^[0-9a-f]{32}$/);
|
||
assert.notEqual(galleryRowId('u1', 'c1'), galleryRowId('u2', 'c1'));
|
||
});
|
||
|
||
test('reporterHash ist HMAC-SHA256 (Hex) mit dem Salz; IPv6 wird auf /64 gekürzt', () => {
|
||
assert.equal(reporterHash(SALT, '203.0.113.7'), crypto.createHmac('sha256', SALT).update('203.0.113.7').digest('hex'));
|
||
assert.notEqual(reporterHash('anderes-salz', '203.0.113.7'), reporterHash(SALT, '203.0.113.7'));
|
||
assert.equal(reporterHash(SALT, '2001:db8:abcd:12::1'), reporterHash(SALT, '2001:db8:abcd:12:ffff:eeee:dddd:2'));
|
||
assert.notEqual(reporterHash(SALT, '2001:db8:abcd:12::1'), reporterHash(SALT, '2001:db8:abcd:13::1'));
|
||
});
|
||
|
||
test('normalizeIp: IPv4 bleibt, IPv4-gemappte IPv6 wird IPv4, sonst /64', () => {
|
||
assert.equal(normalizeIp('203.0.113.7'), '203.0.113.7');
|
||
assert.equal(normalizeIp(' 203.0.113.7:5555 '), '203.0.113.7');
|
||
assert.equal(normalizeIp('::ffff:203.0.113.7'), '203.0.113.7');
|
||
assert.equal(normalizeIp('::ffff:cb00:7107'), '203.0.113.7');
|
||
assert.equal(normalizeIp('2001:0DB8:abcd:0012:0000:0000:0000:0001'), '2001:db8:abcd:12::/64');
|
||
assert.equal(normalizeIp('2001:db8::1'), '2001:db8:0:0::/64');
|
||
assert.equal(normalizeIp('::1'), '0:0:0:0::/64');
|
||
assert.equal(normalizeIp('[2001:db8:1:2::9]'), '2001:db8:1:2::/64');
|
||
assert.equal(normalizeIp('fe80::1%eth0'), 'fe80:0:0:0::/64');
|
||
assert.equal(normalizeIp('64:ff9b::192.0.2.33'), '64:ff9b:0:0::/64');
|
||
assert.equal(normalizeIp('kein-ip'), 'kein-ip');
|
||
assert.equal(normalizeIp(undefined), '');
|
||
});
|
||
|
||
test('clientIp: x-real-ip, sonst erstes x-forwarded-for, sonst Socket', () => {
|
||
const socket = { remoteAddress: '10.0.0.9' };
|
||
assert.equal(clientIp({ headers: { 'x-real-ip': '1.1.1.1', 'x-forwarded-for': '2.2.2.2' }, socket }), '1.1.1.1');
|
||
assert.equal(clientIp({ headers: { 'x-forwarded-for': ' 2.2.2.2 , 3.3.3.3' }, socket }), '2.2.2.2');
|
||
assert.equal(clientIp({ headers: {}, socket }), '10.0.0.9');
|
||
assert.equal(clientIp({ headers: { 'x-real-ip': '' }, socket }), '10.0.0.9');
|
||
});
|
||
|
||
test('buildSearchText: klein, mit Leerzeichen verbunden, höchstens 300 Zeichen', () => {
|
||
assert.equal(buildSearchText({ title: 'Mein MOTIV', issuer: 'Beispielbank', tags: ['blau', 'neon'] }), 'mein motiv beispielbank blau neon');
|
||
assert.equal(buildSearchText({ title: 'A', issuer: '', tags: [] }), 'a');
|
||
assert.equal(buildSearchText({ title: 'A', issuer: 'B', tags: 'x,y' }), 'a b x y');
|
||
assert.equal(buildSearchText({ title: 'x'.repeat(400), issuer: '', tags: [] }).length, 300);
|
||
});
|
||
|
||
test('validatePublish: normalisiert Tags und liefert saubere Daten', () => {
|
||
const result = validatePublish(publishBody({ title: ' Mein Motiv ', tags: [' Blau ', 'NEON', '', 'blau'], issuer: undefined, displayName: null }));
|
||
assert.equal(result.ok, true);
|
||
assert.deepEqual(result.data, {
|
||
title: 'Mein Motiv',
|
||
issuer: '',
|
||
tags: ['blau', 'neon'],
|
||
displayName: '',
|
||
imageFileId: 'img1',
|
||
previewFileId: 'prev1',
|
||
sourceCardId: 'card1',
|
||
});
|
||
});
|
||
|
||
test('validatePublish: Längen und Tags an den Grenzen', () => {
|
||
assert.equal(validatePublish(publishBody({ title: 'x'.repeat(60), issuer: 'y'.repeat(40), displayName: 'z'.repeat(30) })).ok, true);
|
||
assert.equal(validatePublish(publishBody({ tags: ['a', 'b', 'c', 'd', 'e'] })).ok, true);
|
||
assert.equal(validatePublish(publishBody({ tags: ['x'.repeat(20)] })).ok, true);
|
||
assert.equal(validatePublish(publishBody({ tags: ['a', 'b', 'c', 'd', 'e', 'f'] })).ok, false);
|
||
assert.equal(validatePublish(publishBody({ tags: ['x'.repeat(21)] })).ok, false);
|
||
const bad = validatePublish(publishBody({ title: '' }));
|
||
assert.equal(bad.ok, false);
|
||
assert.equal(typeof bad.message, 'string');
|
||
});
|
||
|
||
// ---- Gesundheit, Routing, Body ------------------------------------------------------------------
|
||
|
||
test('GET /api/gesundheit antwortet {ok:true} mit sicheren Kopfzeilen', async () => {
|
||
const { call } = await setup();
|
||
const res = await call('GET', '/api/gesundheit?x=1');
|
||
assert.equal(res.status, 200);
|
||
assert.deepEqual(res.json, { ok: true });
|
||
assert.match(res.headers['content-type'], /^application\/json/);
|
||
assert.equal(res.headers['cache-control'], 'no-store');
|
||
assert.equal(res.headers['x-content-type-options'], 'nosniff');
|
||
});
|
||
|
||
test('Alles andere ist 404, auch falsche Methoden', async () => {
|
||
const { call, fake } = await setup();
|
||
for (const [method, path] of [
|
||
['GET', '/'],
|
||
['GET', '/api'],
|
||
['GET', '/api/melden'],
|
||
['POST', '/api/gesundheit'],
|
||
['POST', '/api/unbekannt'],
|
||
['POST', '/api/melden/'],
|
||
['POST', '/api/admin'],
|
||
['PUT', '/api/melden'],
|
||
['OPTIONS', '/api/melden'],
|
||
['DELETE', '/api/zurueckziehen'],
|
||
['GET', '/v1/account'],
|
||
]) {
|
||
const res = await call(method, path, { body: {} });
|
||
assert.equal(res.status, 404, `${method} ${path}`);
|
||
assert.equal(typeof res.json.error, 'string');
|
||
}
|
||
assert.equal(fake.calls.length, 0);
|
||
});
|
||
|
||
test('Nur application/json: sonst 415 (auch mit Charset-Zusatz erlaubt)', async () => {
|
||
const { call, fake } = await setup();
|
||
seedCard(fake);
|
||
for (const contentType of ['text/plain', 'application/x-www-form-urlencoded', 'application/jsonx', null]) {
|
||
const res = await call('POST', '/api/melden', { raw: '{"id":"card-1","reason":"spam"}', contentType });
|
||
assert.equal(res.status, 415, String(contentType));
|
||
}
|
||
const ok = await call('POST', '/api/melden', {
|
||
raw: '{"id":"card-1","reason":"spam"}',
|
||
contentType: 'application/json; charset=utf-8',
|
||
headers: { 'X-Real-Ip': '203.0.113.1' },
|
||
});
|
||
assert.equal(ok.status, 200);
|
||
});
|
||
|
||
test('Body über 8 KB: 413 (mit Content-Length und chunked), genau 8 KB geht noch durch', async () => {
|
||
const { call, fake } = await setup();
|
||
const padded = (length) => {
|
||
const base = '{"id":"nope","reason":"spam"}';
|
||
return base + ' '.repeat(length - Buffer.byteLength(base));
|
||
};
|
||
|
||
const declared = await call('POST', '/api/melden', { raw: padded(8193) });
|
||
assert.equal(declared.status, 413);
|
||
assert.equal(typeof declared.json.error, 'string');
|
||
assert.equal(declared.headers.connection, 'close', 'nach einem zu großen Body wird die Verbindung geschlossen');
|
||
|
||
const chunked = await call('POST', '/api/veroeffentlichen', {
|
||
raw: padded(9000),
|
||
headers: { 'Transfer-Encoding': 'chunked', 'X-Aircard-Jwt': JWT_ME },
|
||
});
|
||
assert.equal(chunked.status, 413);
|
||
|
||
const exact = await call('POST', '/api/melden', { raw: padded(8192), headers: { 'X-Real-Ip': '203.0.113.2' } });
|
||
assert.equal(exact.status, 404, 'genau 8192 Byte werden verarbeitet (Karte existiert nicht)');
|
||
assert.equal(fake.calls.filter((c) => c.path.includes('/account')).length, 0, 'bei 413 wurde nichts bei Appwrite abgefragt');
|
||
});
|
||
|
||
test('Kaputtes JSON, Array oder leerer Body: 400', async () => {
|
||
const { call } = await setup();
|
||
for (const raw of ['{kaputt', '[]', '"text"', 'null', '']) {
|
||
const res = await call('POST', '/api/melden', { raw });
|
||
assert.equal(res.status, 400, JSON.stringify(raw));
|
||
assert.equal(typeof res.json.error, 'string');
|
||
}
|
||
});
|
||
|
||
// ---- Veröffentlichen --------------------------------------------------------------------------------
|
||
|
||
test('Veröffentlichen: legt eine sichtbare Zeile an (Rechte, searchText, ownerId)', async () => {
|
||
const { post, fake } = await setup();
|
||
seedUploads(fake);
|
||
|
||
const res = await post('/api/veroeffentlichen', publishBody(), JWT_ME);
|
||
assert.equal(res.status, 201);
|
||
assert.equal(res.json.id, galleryRowId(ME, 'card1'));
|
||
|
||
const row = fake.row('gallery', res.json.id);
|
||
assert.deepEqual(row.$permissions, ['read("any")']);
|
||
assert.equal(row.title, 'Mein Motiv');
|
||
assert.equal(row.issuer, 'Beispielbank');
|
||
assert.equal(row.tags, 'blau,neon');
|
||
assert.equal(row.displayName, 'Kenso');
|
||
assert.equal(row.imageFileId, 'img1');
|
||
assert.equal(row.previewFileId, 'prev1');
|
||
assert.equal(row.sourceCardId, 'card1');
|
||
assert.equal(row.ownerId, ME);
|
||
assert.equal(row.hidden, false);
|
||
assert.equal(row.reportCount, 0);
|
||
assert.equal(row.searchText, 'mein motiv beispielbank blau neon');
|
||
// der Server-Key hängt an jedem Datenaufruf, das JWT nur am Konto-Aufruf
|
||
const accountCall = fake.calls.find((c) => c.path === '/v1/account');
|
||
assert.equal(accountCall.headers['x-appwrite-jwt'], JWT_ME);
|
||
assert.equal(accountCall.headers['x-appwrite-key'], undefined);
|
||
for (const c of fake.calls.filter((x) => x.path !== '/v1/account')) {
|
||
assert.equal(c.headers['x-appwrite-key'], fake.key);
|
||
assert.equal(c.headers['x-appwrite-jwt'], undefined);
|
||
}
|
||
});
|
||
|
||
test('Veröffentlichen: Bild und Vorschau dürfen PNG oder WebP sein, Anzeigename und Herausgeber sind optional', async () => {
|
||
const { post, fake } = await setup();
|
||
fake.addFile({ id: 'img1', owner: ME, mimeType: 'image/png', size: MIB5 });
|
||
fake.addFile({ id: 'prev1', owner: ME, mimeType: 'image/png' });
|
||
const res = await post('/api/veroeffentlichen', { title: 'Nur Titel', imageFileId: 'img1', previewFileId: 'prev1', sourceCardId: 'card1' }, JWT_ME);
|
||
assert.equal(res.status, 201);
|
||
const row = fake.row('gallery', res.json.id);
|
||
assert.equal(row.issuer, '');
|
||
assert.equal(row.tags, '');
|
||
assert.equal(row.displayName, '');
|
||
});
|
||
|
||
test('Veröffentlichen ohne oder mit ungültigem JWT: 401 und nichts angelegt', async () => {
|
||
const { post, fake } = await setup();
|
||
seedUploads(fake);
|
||
|
||
assert.equal((await post('/api/veroeffentlichen', publishBody())).status, 401);
|
||
assert.equal((await post('/api/veroeffentlichen', publishBody(), 'xxx.yyy.zzz')).status, 401);
|
||
assert.equal((await post('/api/veroeffentlichen', publishBody(), 'zwei teile')).status, 401);
|
||
assert.equal((await post('/api/veroeffentlichen', {}, '')).status, 401);
|
||
assert.equal(fake.rows('gallery').length, 0);
|
||
assert.equal(storageCalls(fake).length, 0);
|
||
assert.equal(fake.calls.filter((c) => c.path === '/v1/account').length, 1, 'fehlendes oder kaputtes JWT erreicht Appwrite gar nicht erst');
|
||
});
|
||
|
||
test('Veröffentlichen mit fremder Datei: 403 und nichts angelegt', async () => {
|
||
const { post, fake } = await setup();
|
||
fake.addFile({ id: 'img1', owner: OTHER });
|
||
fake.addFile({ id: 'prev1', owner: ME, mimeType: 'image/webp' });
|
||
let res = await post('/api/veroeffentlichen', publishBody(), JWT_ME);
|
||
assert.equal(res.status, 403);
|
||
assert.equal(typeof res.json.error, 'string');
|
||
|
||
fake.addFile({ id: 'img2', owner: ME });
|
||
fake.addFile({ id: 'prev2', owner: OTHER, mimeType: 'image/webp' });
|
||
res = await post('/api/veroeffentlichen', publishBody({ imageFileId: 'img2', previewFileId: 'prev2' }), JWT_ME);
|
||
assert.equal(res.status, 403);
|
||
|
||
// Rechte ohne delete("user:me"): nur lesen reicht nicht
|
||
fake.addFile({ id: 'img3', owner: ME, permissions: ['read("any")', 'read("user:user-me")'] });
|
||
fake.addFile({ id: 'prev3', owner: ME, mimeType: 'image/webp' });
|
||
res = await post('/api/veroeffentlichen', publishBody({ imageFileId: 'img3', previewFileId: 'prev3' }), JWT_ME);
|
||
assert.equal(res.status, 403);
|
||
|
||
assert.equal(fake.rows('gallery').length, 0);
|
||
});
|
||
|
||
test('Veröffentlichen mit Datei in falschem Bucket: 403', async () => {
|
||
const { post, fake } = await setup();
|
||
fake.addFile({ id: 'img1', owner: ME, bucket: 'card-images' });
|
||
fake.addFile({ id: 'prev1', owner: ME, mimeType: 'image/webp' });
|
||
const res = await post('/api/veroeffentlichen', publishBody(), JWT_ME);
|
||
assert.equal(res.status, 403);
|
||
assert.equal(fake.rows('gallery').length, 0);
|
||
});
|
||
|
||
test('Veröffentlichen mit fehlender Datei: 400 "Bild nicht gefunden."', async () => {
|
||
const { post, fake } = await setup();
|
||
fake.addFile({ id: 'prev1', owner: ME, mimeType: 'image/webp' });
|
||
let res = await post('/api/veroeffentlichen', publishBody(), JWT_ME);
|
||
assert.equal(res.status, 400);
|
||
assert.equal(res.json.error, 'Bild nicht gefunden.');
|
||
|
||
fake.addFile({ id: 'img1', owner: ME });
|
||
res = await post('/api/veroeffentlichen', publishBody({ previewFileId: 'ghost' }), JWT_ME);
|
||
assert.equal(res.status, 400);
|
||
assert.equal(res.json.error, 'Bild nicht gefunden.');
|
||
assert.equal(fake.rows('gallery').length, 0);
|
||
});
|
||
|
||
test('Veröffentlichen: nur PNG/WebP bis 5 MiB, sonst 400', async () => {
|
||
const { post, fake } = await setup();
|
||
const attempt = (image, preview) => {
|
||
fake.addFile({ id: 'img1', owner: ME, ...image });
|
||
fake.addFile({ id: 'prev1', owner: ME, mimeType: 'image/webp', ...preview });
|
||
return post('/api/veroeffentlichen', publishBody(), JWT_ME);
|
||
};
|
||
|
||
assert.equal((await attempt({ mimeType: 'image/jpeg' }, {})).status, 400);
|
||
assert.equal((await attempt({ mimeType: 'application/pdf' }, {})).status, 400);
|
||
assert.equal((await attempt({}, { mimeType: 'image/svg+xml' })).status, 400);
|
||
assert.equal((await attempt({ size: MIB5 + 1 }, {})).status, 400);
|
||
assert.equal((await attempt({}, { size: MIB5 + 1 })).status, 400);
|
||
assert.equal(fake.rows('gallery').length, 0);
|
||
|
||
assert.equal((await attempt({ size: MIB5 }, { size: MIB5 })).status, 201);
|
||
});
|
||
|
||
test('Veröffentlichen doppelt: 409 "Diese Karte ist schon veröffentlicht."', async () => {
|
||
const { post, fake } = await setup();
|
||
seedUploads(fake);
|
||
assert.equal((await post('/api/veroeffentlichen', publishBody(), JWT_ME)).status, 201);
|
||
|
||
fake.addFile({ id: 'img2', owner: ME });
|
||
fake.addFile({ id: 'prev2', owner: ME, mimeType: 'image/webp' });
|
||
const again = await post('/api/veroeffentlichen', publishBody({ imageFileId: 'img2', previewFileId: 'prev2' }), JWT_ME);
|
||
assert.equal(again.status, 409);
|
||
assert.equal(again.json.error, 'Diese Karte ist schon veröffentlicht.');
|
||
assert.equal(fake.rows('gallery').length, 1);
|
||
|
||
// eine andere Person darf dieselbe sourceCardId-Zeichenfolge haben (Zeilen-ID enthält den Besitzer)
|
||
seedUploads(fake, OTHER, { image: 'img9', preview: 'prev9' });
|
||
const other = await post('/api/veroeffentlichen', publishBody({ imageFileId: 'img9', previewFileId: 'prev9' }), JWT_OTHER);
|
||
assert.equal(other.status, 201);
|
||
assert.notEqual(other.json.id, galleryRowId(ME, 'card1'));
|
||
assert.equal(fake.rows('gallery').length, 2);
|
||
});
|
||
|
||
test('Veröffentlichen nach Zurückziehen ist wieder möglich (gleiche Zeilen-ID)', async () => {
|
||
const { post, fake } = await setup();
|
||
seedUploads(fake);
|
||
const first = await post('/api/veroeffentlichen', publishBody(), JWT_ME);
|
||
assert.equal((await post('/api/zurueckziehen', { id: first.json.id }, JWT_ME)).status, 200);
|
||
seedUploads(fake);
|
||
const second = await post('/api/veroeffentlichen', publishBody(), JWT_ME);
|
||
assert.equal(second.status, 201);
|
||
assert.equal(second.json.id, first.json.id);
|
||
});
|
||
|
||
test('Veröffentlichen: Validierung liefert 400 und fasst Appwrite (Dateien, Zeilen) nicht an', async () => {
|
||
const { post, fake } = await setup();
|
||
seedUploads(fake);
|
||
const cases = [
|
||
['leerer Titel', { title: '' }, /Titel/],
|
||
['nur Leerzeichen als Titel', { title: ' ' }, /Titel/],
|
||
['Titel fehlt', { title: undefined }, /Titel/],
|
||
['Titel zu lang', { title: 'x'.repeat(61) }, /Titel/],
|
||
['Titel keine Zeichenkette', { title: 42 }, /Titel/],
|
||
['Titel mit Steuerzeichen', { title: 'a\nb' }, /Titel/],
|
||
['Herausgeber zu lang', { issuer: 'x'.repeat(41) }, /Herausgeber/],
|
||
['Anzeigename zu lang', { displayName: 'x'.repeat(31) }, /Anzeigename/],
|
||
['6 Tags', { tags: ['a', 'b', 'c', 'd', 'e', 'f'] }, /Tags/],
|
||
['Tag zu lang', { tags: ['x'.repeat(21)] }, /Tag/],
|
||
['Tags als Zeichenkette', { tags: 'a,b' }, /Tags/],
|
||
['Tag keine Zeichenkette', { tags: ['a', 5] }, /Tags/],
|
||
['Tag mit Komma', { tags: ['a,b'] }, /Komma/],
|
||
['Bild-ID mit ../', { imageFileId: '../x' }, /ID/],
|
||
['Bild-ID ..', { imageFileId: '..' }, /ID/],
|
||
['Bild-ID Zahl', { imageFileId: 123 }, /ID/],
|
||
['Bild-ID mit Schrägstrich', { imageFileId: 'a/b' }, /ID/],
|
||
['Bild-ID zu lang', { imageFileId: 'a'.repeat(37) }, /ID/],
|
||
['Bild-ID beginnt mit Punkt', { imageFileId: '.hidden' }, /ID/],
|
||
['Bild-ID leer', { imageFileId: '' }, /ID/],
|
||
['Vorschau-ID null', { previewFileId: null }, /ID/],
|
||
['Vorschau-ID mit Leerzeichen', { previewFileId: 'a b' }, /ID/],
|
||
['sourceCardId ../x', { sourceCardId: '../x' }, /ID/],
|
||
['sourceCardId Zahl', { sourceCardId: 7 }, /ID/],
|
||
['sourceCardId fehlt', { sourceCardId: undefined }, /ID/],
|
||
['Bild = Vorschau', { previewFileId: 'img1' }, /verschieden/],
|
||
];
|
||
for (const [label, overrides, pattern] of cases) {
|
||
const res = await post('/api/veroeffentlichen', publishBody(overrides), JWT_ME);
|
||
assert.equal(res.status, 400, label);
|
||
assert.match(res.json.error, pattern, label);
|
||
}
|
||
assert.equal(fake.rows('gallery').length, 0);
|
||
assert.equal(storageCalls(fake).length, 0, 'ungültige IDs erreichen Appwrite nie');
|
||
assert.equal((await post('/api/veroeffentlichen', publishBody({ tags: 'a,b' }), JWT_ME)).status, 400);
|
||
});
|
||
|
||
test('Veröffentlichen: Tags werden serverseitig erneut normalisiert', async () => {
|
||
const { post, fake } = await setup();
|
||
seedUploads(fake);
|
||
const res = await post('/api/veroeffentlichen', publishBody({ tags: [' BLAU ', 'Neon', '', ' ', 'blau'] }), JWT_ME);
|
||
assert.equal(res.status, 201);
|
||
assert.equal(fake.row('gallery', res.json.id).tags, 'blau,neon');
|
||
});
|
||
|
||
test('Veröffentlichen: Appwrite-Ausfall ergibt 502 mit deutschem Text, nichts angelegt', async () => {
|
||
const { post, fake } = await setup();
|
||
seedUploads(fake);
|
||
fake.failNext((c) => c.path === '/v1/account', { status: 500 });
|
||
let res = await post('/api/veroeffentlichen', publishBody(), JWT_ME);
|
||
assert.equal(res.status, 502);
|
||
assert.equal(res.json.error, 'Der Dienst ist gerade nicht erreichbar.');
|
||
|
||
fake.failNext((c) => c.method === 'POST' && c.path.endsWith('/rows'), { status: 500 });
|
||
res = await post('/api/veroeffentlichen', publishBody(), JWT_ME);
|
||
assert.equal(res.status, 502);
|
||
assert.equal(fake.rows('gallery').length, 0);
|
||
});
|
||
|
||
// ---- Melden ---------------------------------------------------------------------------------------
|
||
|
||
test('Melden: drei verschiedene IPs blenden die Karte aus (Zeilen- und Dateirechte)', async () => {
|
||
const { report, fake } = await setup();
|
||
const { imageFileId, previewFileId } = seedCard(fake);
|
||
|
||
let res = await report('card-1', '203.0.113.1');
|
||
assert.deepEqual(res.json, { ok: true });
|
||
assert.equal(fake.row('gallery', 'card-1').reportCount, 1);
|
||
assert.equal(fake.row('gallery', 'card-1').hidden, false);
|
||
res = await report('card-1', '203.0.113.2', 'urheberrecht');
|
||
assert.deepEqual(res.json, { ok: true });
|
||
assert.equal(fake.row('gallery', 'card-1').reportCount, 2);
|
||
assert.deepEqual(fake.row('gallery', 'card-1').$permissions, ['read("any")']);
|
||
|
||
res = await report('card-1', '203.0.113.3', 'kartendaten');
|
||
assert.equal(res.status, 200);
|
||
assert.deepEqual(res.json, { ok: true });
|
||
|
||
const row = fake.row('gallery', 'card-1');
|
||
assert.equal(row.hidden, true);
|
||
assert.equal(row.reportCount, 3);
|
||
assert.deepEqual(row.$permissions, ['read("user:user-me")', 'read("label:admin")']);
|
||
const hiddenFile = ['read("user:user-me")', 'read("label:admin")', 'delete("user:user-me")'];
|
||
assert.deepEqual(fake.file(imageFileId).$permissions, hiddenFile);
|
||
assert.deepEqual(fake.file(previewFileId).$permissions, hiddenFile);
|
||
assert.equal(fake.rows('reports').length, 3);
|
||
|
||
// ausgeblendete Karte melden: 404
|
||
res = await report('card-1', '203.0.113.4');
|
||
assert.equal(res.status, 404);
|
||
assert.equal(res.json.error, 'Diese Karte ist nicht (mehr) verfügbar.');
|
||
assert.equal(fake.rows('reports').length, 3);
|
||
});
|
||
|
||
test('Melden: zwei Melder reichen nicht, die Meldungen speichern nur Hash, Grund und Karte', async () => {
|
||
const { report, fake } = await setup();
|
||
seedCard(fake);
|
||
await report('card-1', '203.0.113.1', 'spam');
|
||
await report('card-1', '203.0.113.2', 'sonstiges');
|
||
assert.equal(fake.row('gallery', 'card-1').hidden, false);
|
||
|
||
const hash = reporterHash(SALT, '203.0.113.1');
|
||
const stored = fake.row('reports', reportRowId('card-1', hash));
|
||
assert.ok(stored, 'Zeilen-ID = sha256(galleryId|reporterHash)');
|
||
assert.equal(stored.galleryId, 'card-1');
|
||
assert.equal(stored.reason, 'spam');
|
||
assert.equal(stored.reporterHash, hash);
|
||
assert.deepEqual(stored.$permissions, []);
|
||
assert.ok(!JSON.stringify(fake.rows('reports')).includes('203.0.113'), 'keine IP im Klartext gespeichert');
|
||
});
|
||
|
||
test('Melden: dieselbe IP fünfmal zählt einmal, Antworten sind schonGemeldet', async () => {
|
||
const { report, fake } = await setup();
|
||
seedCard(fake);
|
||
|
||
const first = await report('card-1', '203.0.113.9');
|
||
assert.deepEqual(first.json, { ok: true });
|
||
for (let i = 0; i < 4; i += 1) {
|
||
const again = await report('card-1', '203.0.113.9', i % 2 ? 'spam' : 'unangemessen');
|
||
assert.equal(again.status, 200);
|
||
assert.deepEqual(again.json, { schonGemeldet: true });
|
||
}
|
||
assert.equal(fake.row('gallery', 'card-1').reportCount, 1);
|
||
assert.equal(fake.row('gallery', 'card-1').hidden, false);
|
||
assert.equal(fake.rows('reports').length, 1);
|
||
});
|
||
|
||
test('Melden: Rate-Limit 10 pro Stunde und IP, danach 429, nach einer Stunde wieder erlaubt', async () => {
|
||
const { report, fake, clock } = await setup();
|
||
seedCard(fake);
|
||
|
||
for (let i = 0; i < 10; i += 1) {
|
||
const res = await report('card-1', '203.0.113.50');
|
||
assert.equal(res.status, 200, `Meldung ${i + 1}`);
|
||
}
|
||
let res = await report('card-1', '203.0.113.50');
|
||
assert.equal(res.status, 429);
|
||
assert.equal(res.json.error, 'Zu viele Meldungen – bitte später nochmal.');
|
||
assert.equal(res.headers['retry-after'], '3600');
|
||
|
||
// eine andere IP ist nicht betroffen
|
||
assert.equal((await report('card-1', '203.0.113.51')).status, 200);
|
||
|
||
// knapp vor Ablauf noch gesperrt, nach einer Stunde wieder frei
|
||
clock.value += 3600_000 - 1;
|
||
assert.equal((await report('card-1', '203.0.113.50')).status, 429);
|
||
clock.value += 1;
|
||
res = await report('card-1', '203.0.113.50');
|
||
assert.equal(res.status, 200);
|
||
assert.deepEqual(res.json, { schonGemeldet: true });
|
||
});
|
||
|
||
test('Melden: abgelaufene Rate-Limit-Einträge werden entfernt', async () => {
|
||
const { report, fake, clock, app } = await setup();
|
||
seedCard(fake);
|
||
for (const ip of ['203.0.113.1', '203.0.113.2', '203.0.113.3']) await report('card-1', ip);
|
||
assert.equal(app.rateLimitEntries(), 3);
|
||
|
||
clock.value += 3600_000 + 60_000;
|
||
await report('card-1', '203.0.113.4');
|
||
assert.equal(app.rateLimitEntries(), 1, 'die drei alten Einträge sind weg, nur der neue bleibt');
|
||
});
|
||
|
||
test('Melden: Ungültige Anfragen (Grund, ID) zählen nicht zum Limit und erreichen Appwrite nicht', async () => {
|
||
const { report, post, fake, app } = await setup();
|
||
seedCard(fake);
|
||
for (const reason of ['gibt-es-nicht', '', null, 7, undefined, 'SPAM']) {
|
||
const res = await post('/api/melden', { id: 'card-1', reason }, null, { 'X-Real-Ip': '203.0.113.1' });
|
||
assert.equal(res.status, 400, String(reason));
|
||
assert.equal(typeof res.json.error, 'string');
|
||
}
|
||
for (const id of ['../x', '..', 42, null, undefined, 'a/b', 'a'.repeat(37), '']) {
|
||
const res = await post('/api/melden', { id, reason: 'spam' }, null, { 'X-Real-Ip': '203.0.113.1' });
|
||
assert.equal(res.status, 400, String(id));
|
||
}
|
||
assert.equal(fake.calls.length, 0);
|
||
assert.equal(app.rateLimitEntries(), 0);
|
||
assert.equal((await report('card-1', '203.0.113.1')).status, 200);
|
||
});
|
||
|
||
test('Melden: nicht vorhandene Karte ist 404', async () => {
|
||
const { report, fake } = await setup();
|
||
const res = await report('gibts-nicht', '203.0.113.1');
|
||
assert.equal(res.status, 404);
|
||
assert.equal(res.json.error, 'Diese Karte ist nicht (mehr) verfügbar.');
|
||
assert.equal(fake.rows('reports').length, 0);
|
||
});
|
||
|
||
test('Melden: gültige Gründe sind unangemessen, kartendaten, urheberrecht, spam, sonstiges', async () => {
|
||
const { report, fake } = await setup();
|
||
seedCard(fake);
|
||
const reasons = ['unangemessen', 'kartendaten', 'urheberrecht', 'spam', 'sonstiges'];
|
||
for (let i = 0; i < reasons.length; i += 1) {
|
||
const res = await report('card-1', `198.51.100.${i + 1}`, reasons[i]);
|
||
assert.equal(res.status, 200, reasons[i]);
|
||
if (i === 2) break; // ab 3 Meldern ist die Karte weg
|
||
}
|
||
const stored = fake.rows('reports').map((r) => r.reason).sort();
|
||
assert.deepEqual(stored, ['kartendaten', 'unangemessen', 'urheberrecht']);
|
||
});
|
||
|
||
test('Melden: IPv6-Adressen aus demselben /64 zählen als ein Melder', async () => {
|
||
const { report, fake } = await setup();
|
||
seedCard(fake);
|
||
assert.deepEqual((await report('card-1', '2001:db8:abcd:12::1')).json, { ok: true });
|
||
assert.deepEqual((await report('card-1', '2001:db8:abcd:12:aaaa:bbbb:cccc:dddd')).json, { schonGemeldet: true });
|
||
assert.deepEqual((await report('card-1', '2001:db8:abcd:13::1')).json, { ok: true });
|
||
assert.equal(fake.row('gallery', 'card-1').reportCount, 2);
|
||
});
|
||
|
||
test('Melden: ohne X-Real-Ip gilt das erste X-Forwarded-For, sonst die Socket-Adresse', async () => {
|
||
const { post, fake } = await setup();
|
||
seedCard(fake);
|
||
const viaForwarded = (ip) => post('/api/melden', { id: 'card-1', reason: 'spam' }, null, { 'X-Forwarded-For': `${ip}, 10.0.0.1` });
|
||
assert.deepEqual((await viaForwarded('203.0.113.77')).json, { ok: true });
|
||
assert.deepEqual((await viaForwarded('203.0.113.77')).json, { schonGemeldet: true });
|
||
assert.deepEqual((await viaForwarded('203.0.113.78')).json, { ok: true });
|
||
// ohne beide Header zählt die Socket-Adresse (127.0.0.1) als dritter Melder
|
||
assert.deepEqual((await post('/api/melden', { id: 'card-1', reason: 'spam' })).json, { ok: true });
|
||
assert.equal(fake.row('gallery', 'card-1').hidden, true, 'drei verschiedene Quellen');
|
||
});
|
||
|
||
test('Melden: gleichzeitige Meldungen von drei IPs ergeben genau drei und blenden aus', async () => {
|
||
const { report, fake } = await setup();
|
||
seedCard(fake);
|
||
const results = await Promise.all([report('card-1', '203.0.113.1'), report('card-1', '203.0.113.2'), report('card-1', '203.0.113.3')]);
|
||
assert.deepEqual(results.map((r) => r.status), [200, 200, 200]);
|
||
const row = fake.row('gallery', 'card-1');
|
||
assert.equal(row.reportCount, 3);
|
||
assert.equal(row.hidden, true);
|
||
assert.equal(fake.rows('reports').length, 3);
|
||
});
|
||
|
||
test('Melden: eine verspätete Zählerstand-Änderung überschreibt neuere Stände nicht (Sperre je Karte)', async () => {
|
||
const { report, fake } = await setup();
|
||
seedCard(fake);
|
||
// Die erste Meldung schreibt ihren Zähler (1) erst nach 150 ms; währenddessen kommen zwei weitere.
|
||
fake.delayNext((c) => c.method === 'PATCH' && c.body && c.body.data && c.body.data.reportCount === 1, 150);
|
||
const first = report('card-1', '203.0.113.1');
|
||
await new Promise((resolve) => setTimeout(resolve, 40));
|
||
const others = await Promise.all([report('card-1', '203.0.113.2'), report('card-1', '203.0.113.3')]);
|
||
const firstResult = await first;
|
||
assert.deepEqual([firstResult.status, ...others.map((r) => r.status)], [200, 200, 200]);
|
||
|
||
const row = fake.row('gallery', 'card-1');
|
||
assert.equal(row.reportCount, 3);
|
||
assert.equal(row.hidden, true);
|
||
assert.deepEqual(row.$permissions, ['read("user:user-me")', 'read("label:admin")']);
|
||
});
|
||
|
||
test('Melden: eine doppelte Meldung heilt einen früher steckengebliebenen Zählerstand', async () => {
|
||
const { report, fake } = await setup();
|
||
seedCard(fake);
|
||
// drei Meldungen liegen schon vor, der Zähler an der Karte kam aber nie an (z. B. Ausfall mitten im Ablauf)
|
||
for (const ip of ['203.0.113.1', '203.0.113.2', '203.0.113.3']) {
|
||
const hash = reporterHash(SALT, ip);
|
||
fake.addRow('reports', reportRowId('card-1', hash), { galleryId: 'card-1', reason: 'spam', reporterHash: hash }, []);
|
||
}
|
||
assert.equal(fake.row('gallery', 'card-1').hidden, false);
|
||
const res = await report('card-1', '203.0.113.1');
|
||
assert.deepEqual(res.json, { schonGemeldet: true });
|
||
assert.equal(fake.row('gallery', 'card-1').hidden, true);
|
||
assert.equal(fake.row('gallery', 'card-1').reportCount, 3);
|
||
});
|
||
|
||
test('Melden: Ausfall beim Anlegen der Meldung ergibt 502 und zählt nicht', async () => {
|
||
const { report, fake } = await setup();
|
||
seedCard(fake);
|
||
fake.failNext((c) => c.method === 'POST' && c.path.endsWith('/tables/reports/rows'), { status: 500 });
|
||
const res = await report('card-1', '203.0.113.1');
|
||
assert.equal(res.status, 502);
|
||
assert.equal(fake.row('gallery', 'card-1').reportCount, 0);
|
||
assert.equal(fake.rows('reports').length, 0);
|
||
});
|
||
|
||
test('Melden: Ausfall beim Ausblenden endet mit 502, ein erneuter Versuch blendet aus', async () => {
|
||
const { report, fake } = await setup();
|
||
seedCard(fake, { reportCount: 0 });
|
||
await report('card-1', '203.0.113.1');
|
||
await report('card-1', '203.0.113.2');
|
||
fake.failNext((c) => c.method === 'PATCH' && c.path.includes('/tables/gallery/rows/'), { status: 500 });
|
||
const res = await report('card-1', '203.0.113.3');
|
||
assert.equal(res.status, 502);
|
||
assert.equal(fake.row('gallery', 'card-1').hidden, false);
|
||
const retry = await report('card-1', '203.0.113.3');
|
||
assert.equal(retry.status, 200);
|
||
assert.equal(fake.row('gallery', 'card-1').hidden, true);
|
||
});
|
||
|
||
// ---- Zurückziehen ----------------------------------------------------------------------------------
|
||
|
||
test('Zurückziehen durch den Autor löscht Zeile, beide Dateien und die Meldungen', async () => {
|
||
const { post, fake } = await setup();
|
||
const { imageFileId, previewFileId } = seedCard(fake);
|
||
seedCard(fake, { id: 'card-2' });
|
||
for (const [id, hash] of [['card-1', 'h1'], ['card-1', 'h2'], ['card-2', 'h3']]) {
|
||
fake.addRow('reports', reportRowId(id, hash), { galleryId: id, reason: 'spam', reporterHash: hash }, []);
|
||
}
|
||
|
||
const res = await post('/api/zurueckziehen', { id: 'card-1' }, JWT_ME);
|
||
assert.equal(res.status, 200);
|
||
assert.deepEqual(res.json, { ok: true });
|
||
assert.equal(fake.row('gallery', 'card-1'), null);
|
||
assert.equal(fake.file(imageFileId), null);
|
||
assert.equal(fake.file(previewFileId), null);
|
||
assert.deepEqual(fake.rows('reports').map((r) => r.galleryId), ['card-2']);
|
||
assert.ok(fake.row('gallery', 'card-2'), 'andere Karten bleiben');
|
||
assert.ok(fake.file('card-2-img'));
|
||
});
|
||
|
||
test('Zurückziehen durch Admin geht, auch bei ausgeblendeter Karte', async () => {
|
||
const { post, fake } = await setup();
|
||
seedCard(fake, { hidden: true, reportCount: 3 });
|
||
const res = await post('/api/zurueckziehen', { id: 'card-1' }, JWT_ADMIN);
|
||
assert.equal(res.status, 200);
|
||
assert.equal(fake.row('gallery', 'card-1'), null);
|
||
assert.equal(fake.file('card-1-img'), null);
|
||
});
|
||
|
||
test('Zurückziehen durch Fremde: 403 und nichts gelöscht', async () => {
|
||
const { post, fake } = await setup();
|
||
seedCard(fake);
|
||
const res = await post('/api/zurueckziehen', { id: 'card-1' }, JWT_OTHER);
|
||
assert.equal(res.status, 403);
|
||
assert.equal(typeof res.json.error, 'string');
|
||
assert.ok(fake.row('gallery', 'card-1'));
|
||
assert.ok(fake.file('card-1-img'));
|
||
assert.ok(fake.file('card-1-prev'));
|
||
});
|
||
|
||
test('Zurückziehen: 401 ohne JWT, 404 bei fehlender Karte, 400 bei ungültiger ID', async () => {
|
||
const { post, fake } = await setup();
|
||
seedCard(fake);
|
||
assert.equal((await post('/api/zurueckziehen', { id: 'card-1' })).status, 401);
|
||
assert.equal((await post('/api/zurueckziehen', { id: 'card-1' }, 'xxx.yyy.zzz')).status, 401);
|
||
assert.equal((await post('/api/zurueckziehen', { id: 'nope' }, JWT_ME)).status, 404);
|
||
for (const id of ['../x', '..', 5, null, undefined]) {
|
||
assert.equal((await post('/api/zurueckziehen', { id }, JWT_ME)).status, 400, String(id));
|
||
}
|
||
assert.ok(fake.row('gallery', 'card-1'));
|
||
});
|
||
|
||
test('Zurückziehen ist wiederholbar, wenn schon eine Datei fehlt (Wiederholung nach Teilausfall)', async () => {
|
||
const { post, fake } = await setup();
|
||
seedCard(fake);
|
||
fake.failNext((c) => c.method === 'DELETE' && c.path.includes('/tables/gallery/rows/'), { status: 500 });
|
||
assert.equal((await post('/api/zurueckziehen', { id: 'card-1' }, JWT_ME)).status, 502);
|
||
assert.ok(fake.row('gallery', 'card-1'), 'Zeile bleibt, bis alles andere weg ist');
|
||
assert.equal(fake.file('card-1-img'), null);
|
||
const retry = await post('/api/zurueckziehen', { id: 'card-1' }, JWT_ME);
|
||
assert.equal(retry.status, 200);
|
||
assert.equal(fake.row('gallery', 'card-1'), null);
|
||
});
|
||
|
||
// ---- Admin ------------------------------------------------------------------------------------------
|
||
|
||
test('Admin-Sichtbarkeit: Nicht-Admin 403, ohne JWT 401', async () => {
|
||
const { post, fake } = await setup();
|
||
seedCard(fake);
|
||
assert.equal((await post('/api/admin/sichtbarkeit', { id: 'card-1', sichtbar: false }, JWT_ME)).status, 403);
|
||
assert.equal((await post('/api/admin/sichtbarkeit', { id: 'card-1', sichtbar: false }, JWT_OTHER)).status, 403);
|
||
assert.equal((await post('/api/admin/sichtbarkeit', { id: 'card-1', sichtbar: false })).status, 401);
|
||
assert.deepEqual(fake.row('gallery', 'card-1').$permissions, ['read("any")']);
|
||
assert.equal(fake.row('gallery', 'card-1').hidden, false);
|
||
});
|
||
|
||
test('Admin blendet aus: Zeilen- und Dateirechte, hidden=true, Meldungen bleiben', async () => {
|
||
const { post, fake } = await setup();
|
||
seedCard(fake, { reportCount: 1 });
|
||
fake.addRow('reports', reportRowId('card-1', 'h1'), { galleryId: 'card-1', reason: 'spam', reporterHash: 'h1' }, []);
|
||
|
||
const res = await post('/api/admin/sichtbarkeit', { id: 'card-1', sichtbar: false }, JWT_ADMIN);
|
||
assert.equal(res.status, 200);
|
||
const row = fake.row('gallery', 'card-1');
|
||
assert.equal(row.hidden, true);
|
||
assert.equal(row.reportCount, 1);
|
||
assert.deepEqual(row.$permissions, ['read("user:user-me")', 'read("label:admin")']);
|
||
const hiddenFile = ['read("user:user-me")', 'read("label:admin")', 'delete("user:user-me")'];
|
||
assert.deepEqual(fake.file('card-1-img').$permissions, hiddenFile);
|
||
assert.deepEqual(fake.file('card-1-prev').$permissions, hiddenFile);
|
||
assert.equal(fake.rows('reports').length, 1);
|
||
});
|
||
|
||
test('Admin blendet ein: sichtbare Rechte, hidden=false, reportCount=0, Meldungen gelöscht', async () => {
|
||
const { post, fake, report } = await setup();
|
||
seedCard(fake, { hidden: true, reportCount: 3 });
|
||
seedCard(fake, { id: 'card-2' });
|
||
for (const [id, hash] of [['card-1', 'h1'], ['card-1', 'h2'], ['card-1', 'h3'], ['card-2', 'h4']]) {
|
||
fake.addRow('reports', reportRowId(id, hash), { galleryId: id, reason: 'spam', reporterHash: hash }, []);
|
||
}
|
||
|
||
const res = await post('/api/admin/sichtbarkeit', { id: 'card-1', sichtbar: true }, JWT_ADMIN);
|
||
assert.equal(res.status, 200);
|
||
const row = fake.row('gallery', 'card-1');
|
||
assert.equal(row.hidden, false);
|
||
assert.equal(row.reportCount, 0);
|
||
assert.deepEqual(row.$permissions, ['read("any")']);
|
||
assert.deepEqual(fake.file('card-1-img').$permissions, ['read("any")', 'delete("user:user-me")']);
|
||
assert.deepEqual(fake.file('card-1-prev').$permissions, ['read("any")', 'delete("user:user-me")']);
|
||
assert.deepEqual(fake.rows('reports').map((r) => r.galleryId), ['card-2']);
|
||
|
||
// die Karte ist wieder meldbar
|
||
assert.equal((await report('card-1', '203.0.113.1')).status, 200);
|
||
});
|
||
|
||
test('Admin-Sichtbarkeit: Body-Prüfung und fehlende Karte', async () => {
|
||
const { post, fake } = await setup();
|
||
seedCard(fake);
|
||
for (const body of [
|
||
{ id: 'card-1' },
|
||
{ id: 'card-1', sichtbar: 'ja' },
|
||
{ id: 'card-1', sichtbar: 1 },
|
||
{ id: '../x', sichtbar: true },
|
||
{ id: 7, sichtbar: true },
|
||
{},
|
||
]) {
|
||
assert.equal((await post('/api/admin/sichtbarkeit', body, JWT_ADMIN)).status, 400, JSON.stringify(body));
|
||
}
|
||
assert.equal((await post('/api/admin/sichtbarkeit', { id: 'nope', sichtbar: true }, JWT_ADMIN)).status, 404);
|
||
});
|
||
|
||
// ---- Logs und Fehler --------------------------------------------------------------------------------
|
||
|
||
test('Logs enthalten nie Key, Salz, JWT oder IPs im Klartext, aber das Präfix [aircard-api]', async () => {
|
||
const { post, report, fake, logs } = await setup();
|
||
seedUploads(fake);
|
||
seedCard(fake, { id: 'card-9' });
|
||
await post('/api/veroeffentlichen', publishBody(), JWT_ME);
|
||
await post('/api/veroeffentlichen', publishBody(), 'xxx.yyy.zzz');
|
||
await report('card-9', '203.0.113.7');
|
||
await report('card-9', '203.0.113.8');
|
||
await report('card-9', '203.0.113.9');
|
||
await post('/api/admin/sichtbarkeit', { id: 'card-9', sichtbar: true }, JWT_ADMIN);
|
||
fake.failNext((c) => c.method === 'GET' && c.path.includes('/rows/'), { status: 500 });
|
||
await post('/api/zurueckziehen', { id: 'card-9' }, JWT_ME);
|
||
await post('/api/zurueckziehen', { id: 'card-9' }, JWT_ME);
|
||
|
||
assert.ok(logs.length > 0);
|
||
const all = logs.join('\n');
|
||
for (const secret of [fake.key, SALT, JWT_ME, JWT_OTHER, JWT_ADMIN, 'xxx.yyy.zzz', '203.0.113', '127.0.0.1', reporterHash(SALT, '203.0.113.7')]) {
|
||
assert.ok(!all.includes(secret), `Log enthält ${secret.slice(0, 12)}…`);
|
||
}
|
||
for (const line of logs) assert.ok(line.startsWith('[aircard-api] '), line);
|
||
});
|
||
|
||
test('Unerwartete Fehler im Appwrite-Objekt ergeben 500, ohne die Anfrage hängen zu lassen', async () => {
|
||
const logs = [];
|
||
const broken = {
|
||
accountFromJwt: async () => {
|
||
throw new Error('kaputt GEHEIM');
|
||
},
|
||
};
|
||
const app = createApp({ appwrite: broken, salt: SALT, log: (line) => logs.push(line) });
|
||
const server = http.createServer(app);
|
||
await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
|
||
cleanups.push(() => {
|
||
server.closeAllConnections();
|
||
return new Promise((resolve) => server.close(resolve));
|
||
});
|
||
const res = await request(server.address().port, 'POST', '/api/zurueckziehen', {
|
||
body: { id: 'x' },
|
||
headers: { 'X-Aircard-Jwt': JWT_ME },
|
||
});
|
||
assert.equal(res.status, 500);
|
||
assert.equal(typeof res.json.error, 'string');
|
||
assert.ok(!logs.join('\n').includes('GEHEIM'), 'Fehlertexte werden nicht ins Log übernommen');
|
||
});
|
||
|
||
test('createApp verlangt Appwrite-Objekt und Salz', () => {
|
||
assert.throws(() => createApp({ salt: SALT }));
|
||
assert.throws(() => createApp({ appwrite: {}, salt: '' }));
|
||
assert.throws(() => createApp({ appwrite: {} }));
|
||
});
|