Lucas WintherandClaude Opus 5.5
8045c80d93
- Critical 1 (CSRF): core wrap refuses every POST/PUT/PATCH/DELETE whose Origin (Referer as fallback) is not publicUrl's origin or STC_ALLOWED_ORIGINS, and any body that is not application/json (multipart only on declared upload routes). Better Auth routes go through the same guard; only declared identity-provider callbacks (SAML ACS/SLO, OAuth callbacks) are exempt. Better Auth trustedOrigins use the same list. Session cookie stays Lax (Strict breaks OAuth/OIDC/SAML returns); documented. - Important 4 / learner minor 4: the first-owner claim and the role row are one transaction guarded by "no owner yet"; only a unique violation means learner; any other error fails the sign-up with 500 and removes the half-created user. Serialised per DB handle (Bun's SQLite connection). - Important 2 / learner minor 12: code zips stream entry by entry (large files stored in 256 KB chunks with a data descriptor and incremental CRC-32), so memory stays at one chunk; the cap is now 1 GiB (ZIP32). - Important 3 / learner minor 10: the e2e runs the production wiring (productFeatures order, AI drafts through the real sink) against a restricted course and asserts 404/401 for learner and anonymous on course, lesson, media, cover, code, zip, notes, progress, attempts, AI chat, library, search and AI status; a real Range request (206, 416); forged writes (foreign Origin, text/plain, no Origin) are 403 and the MCP test command never runs. - Minors 7-9: compose passes every documented variable; the health check uses STC_PORT; productFeatures checks the studio-before-AI order. Co-Authored-By: Claude Opus 5.5 <[email protected]>
52 lines
2.7 KiB
TypeScript
52 lines
2.7 KiB
TypeScript
import { expect, test } from "bun:test";
|
|
import { mkdtempSync } from "node:fs";
|
|
import { tmpdir } from "node:os";
|
|
import { join, resolve } from "node:path";
|
|
import type { AuthUser, Feature, ServerContext } from "@stc/contracts";
|
|
import { composeServer, resolveConfig } from "../src";
|
|
|
|
const FIXTURES = resolve(import.meta.dir, "../../../fixtures/courses");
|
|
const config = () => resolveConfig({ dataDir: mkdtempSync(join(tmpdir(), "stc-compose-")), databaseUrl: "sqlite://:memory:", courseDirs: [FIXTURES] });
|
|
|
|
test("factories get the context; the queue is built from the union of their jobs; auth and stop are honoured", async () => {
|
|
const seen: string[] = [];
|
|
let stopped = 0;
|
|
const user: AuthUser = { id: "u", email: "u@x", name: "U", roles: ["owner"], groups: [] };
|
|
let early: unknown = null;
|
|
const a = (ctx: ServerContext): Feature => {
|
|
// the handle exists while factories run, but enqueuing must wait for the real queue
|
|
try { void ctx.jobs.enqueue("b.work", {}); } catch (e) { early = e; }
|
|
return {
|
|
name: "a",
|
|
routes: { "/api/a": { GET: async (_r, rc) => Response.json({ who: rc.user?.id ?? null, courses: ctx.courses.list().length }) } },
|
|
jobs: { "a.work": async (p) => { seen.push(`a:${JSON.stringify(p)}`); return null; } },
|
|
auth: { userFromRequest: async () => user },
|
|
stop: () => { stopped++; },
|
|
};
|
|
};
|
|
const b = (ctx: ServerContext): Feature => ({
|
|
name: "b",
|
|
routes: { "/api/b": { POST: async () => Response.json({ id: await ctx.jobs.enqueue("a.work", { n: 1 }) }) } },
|
|
jobs: { "b.work": async () => null },
|
|
});
|
|
const s = await composeServer(config(), [a, b]);
|
|
try {
|
|
expect(String(early)).toMatch(/not ready/);
|
|
expect(await (await s.app.fetch(new Request("http://x/api/a"))).json()).toEqual({ who: "u", courses: 1 });
|
|
const { id } = (await (await s.app.fetch(new Request("http://x/api/b", { method: "POST", headers: { origin: "http://localhost:3000" } }))).json()) as { id: string };
|
|
for (let i = 0; i < 200 && (await s.ctx.jobs.get(id))?.status !== "done"; i++) await Bun.sleep(10);
|
|
expect((await s.ctx.jobs.get(id))?.status).toBe("done");
|
|
expect(seen).toEqual(['a:{"n":1}']);
|
|
} finally {
|
|
await s.stop();
|
|
}
|
|
expect(stopped).toBe(1);
|
|
});
|
|
|
|
test("duplicate job kinds and two auth services are refused", async () => {
|
|
const f = (name: string, extra: Partial<Feature>) => (): Feature => ({ name, routes: {}, ...extra });
|
|
await expect(composeServer(config(), [f("x", { jobs: { k: async () => null } }), f("y", { jobs: { k: async () => null } })])).rejects.toThrow(/Duplicate job kind "k"/);
|
|
const auth = { userFromRequest: async () => null };
|
|
await expect(composeServer(config(), [f("x", { auth }), f("y", { auth })])).rejects.toThrow(/AuthService/);
|
|
});
|