more tests + half cache plugins

Overlord-Server/src/server/agent-auth.test.ts

@@ -0,0 +1,80 @@
+import { describe, expect, test, afterEach } from "bun:test";
+import { isAuthorizedAgentRequest } from "./agent-auth";
+
+function makeReq(headers: Record<string, string> = {}): Request {
+  return new Request("https://localhost/ws", { headers });
+}
+
+function makeUrl(query: Record<string, string> = {}): URL {
+  const u = new URL("https://localhost/ws");
+  for (const [k, v] of Object.entries(query)) u.searchParams.set(k, v);
+  return u;
+}
+
+describe("isAuthorizedAgentRequest", () => {
+  const originalEnv: Record<string, string | undefined> = {};
+
+  function setEnv(key: string, value: string | undefined) {
+    if (!(key in originalEnv)) originalEnv[key] = process.env[key];
+    if (value === undefined) delete process.env[key];
+    else process.env[key] = value;
+  }
+
+  afterEach(() => {
+    for (const [k, v] of Object.entries(originalEnv)) {
+      if (v === undefined) delete process.env[k];
+      else process.env[k] = v;
+    }
+    for (const k of Object.keys(originalEnv)) delete originalEnv[k];
+  });
+
+  test("returns true when agentToken is empty/undefined", () => {
+    expect(isAuthorizedAgentRequest(makeReq(), makeUrl(), "")).toBe(true);
+    expect(isAuthorizedAgentRequest(makeReq(), makeUrl(), undefined)).toBe(true);
+  });
+
+  test("authenticates via x-agent-token header", () => {
+    const token = "secret-agent-token-abc123";
+    const req = makeReq({ "x-agent-token": token });
+    expect(isAuthorizedAgentRequest(req, makeUrl(), token)).toBe(true);
+  });
+
+  test("authenticates via query string token", () => {
+    const token = "secret-agent-token-abc123";
+    const url = makeUrl({ token });
+    expect(isAuthorizedAgentRequest(makeReq(), url, token)).toBe(true);
+  });
+
+  test("rejects wrong header token", () => {
+    const req = makeReq({ "x-agent-token": "wrong" });
+    expect(isAuthorizedAgentRequest(req, makeUrl(), "correct-token")).toBe(false);
+  });
+
+  test("rejects wrong query token", () => {
+    const url = makeUrl({ token: "wrong" });
+    expect(isAuthorizedAgentRequest(makeReq(), url, "correct-token")).toBe(false);
+  });
+
+  test("rejects when no token is provided but agentToken is set", () => {
+    expect(isAuthorizedAgentRequest(makeReq(), makeUrl(), "required-token")).toBe(false);
+  });
+
+  test("OVERLORD_DISABLE_AGENT_AUTH bypasses in non-production", () => {
+    setEnv("OVERLORD_DISABLE_AGENT_AUTH", "true");
+    setEnv("NODE_ENV", "development");
+    expect(isAuthorizedAgentRequest(makeReq(), makeUrl(), "secret")).toBe(true);
+  });
+
+  test("OVERLORD_DISABLE_AGENT_AUTH is ignored in production", () => {
+    setEnv("OVERLORD_DISABLE_AGENT_AUTH", "true");
+    setEnv("NODE_ENV", "production");
+    expect(isAuthorizedAgentRequest(makeReq(), makeUrl(), "secret")).toBe(false);
+  });
+
+  test("header token takes priority when both header and query are present", () => {
+    const token = "the-real-token";
+    const req = makeReq({ "x-agent-token": token });
+    const url = makeUrl({ token: "wrong-query-token" });
+    expect(isAuthorizedAgentRequest(req, url, token)).toBe(true);
+  });
+});

Overlord-Server/src/server/http-security.test.ts

@@ -0,0 +1,57 @@
+import { describe, expect, test } from "bun:test";
+import { CORS_HEADERS, SECURITY_HEADERS } from "./http-security";
+
+describe("CORS_HEADERS", () => {
+  test("has restrictive Access-Control-Allow-Origin", () => {
+    expect(CORS_HEADERS["Access-Control-Allow-Origin"]).toBe("null");
+  });
+
+  test("limits allowed methods", () => {
+    expect(CORS_HEADERS["Access-Control-Allow-Methods"]).toContain("GET");
+    expect(CORS_HEADERS["Access-Control-Allow-Methods"]).toContain("OPTIONS");
+  });
+
+  test("allows Content-Type header", () => {
+    expect(CORS_HEADERS["Access-Control-Allow-Headers"]).toContain("Content-Type");
+  });
+});
+
+describe("SECURITY_HEADERS", () => {
+  test("sets Content-Security-Policy with self default-src", () => {
+    const csp = SECURITY_HEADERS["Content-Security-Policy"];
+    expect(csp).toContain("default-src 'self'");
+    expect(csp).toContain("script-src 'self'");
+    expect(csp).toContain("frame-ancestors 'none'");
+  });
+
+  test("prevents MIME sniffing", () => {
+    expect(SECURITY_HEADERS["X-Content-Type-Options"]).toBe("nosniff");
+  });
+
+  test("denies framing", () => {
+    expect(SECURITY_HEADERS["X-Frame-Options"]).toBe("DENY");
+  });
+
+  test("enables XSS protection", () => {
+    expect(SECURITY_HEADERS["X-XSS-Protection"]).toBe("1; mode=block");
+  });
+
+  test("sets strict referrer policy", () => {
+    expect(SECURITY_HEADERS["Referrer-Policy"]).toBe("strict-origin-when-cross-origin");
+  });
+
+  test("enables HSTS with long max-age", () => {
+    const hsts = SECURITY_HEADERS["Strict-Transport-Security"];
+    expect(hsts).toContain("max-age=");
+    expect(hsts).toContain("includeSubDomains");
+    const maxAge = Number(hsts.match(/max-age=(\d+)/)?.[1] || 0);
+    expect(maxAge).toBeGreaterThanOrEqual(31536000);
+  });
+
+  test("disables camera, geolocation, payment via Permissions-Policy", () => {
+    const pp = SECURITY_HEADERS["Permissions-Policy"];
+    expect(pp).toContain("camera=()");
+    expect(pp).toContain("geolocation=()");
+    expect(pp).toContain("payment=()");
+  });
+});

Overlord-Server/src/server/routes/plugin-routes.ts

@@ -1058,8 +1058,13 @@ export async function handlePluginRoutes(
       injected = raw.replace(headMatch[0], `${headMatch[0]}\n    ${baseTag}`);
     }
 
+    const etag = `"${file.size.toString(36)}-${file.lastModified.toString(36)}"`;
+    if (req.headers.get("if-none-match") === etag) {
+      return new Response(null, { status: 304 });
+    }
+
     return new Response(injected, {
-      headers: deps.secureHeaders("text/html; charset=utf-8"),
+      headers: { ...deps.secureHeaders("text/html; charset=utf-8"), "Cache-Control": "no-cache", ETag: etag },
     });
   }
 
@@ -1089,10 +1094,19 @@ export async function handlePluginRoutes(
 
     const htmlFile = path.join(deps.PLUGIN_ROOT, pluginId, "assets", `${pluginId}.html`);
     const file = Bun.file(htmlFile);
+    const htmlExists = await file.exists();
+
+    const etag = htmlExists
+      ? `"page-${file.size.toString(36)}-${file.lastModified.toString(36)}"`
+      : `"page-empty"`;
+    if (req.headers.get("if-none-match") === etag) {
+      return new Response(null, { status: 304 });
+    }
+
     let pluginBody = "";
     let pluginHeadExtras = "";
 
-    if (await file.exists()) {
+    if (htmlExists) {
       const raw = await file.text();
 
       const bodyMatch = raw.match(/<body[^>]*>([\s\S]*?)<\/body>/i);
@@ -1143,7 +1157,9 @@ export async function handlePluginRoutes(
   </body>
 </html>`;
 
-    return new Response(html, { headers: deps.secureHeaders("text/html; charset=utf-8") });
+    return new Response(html, {
+      headers: { ...deps.secureHeaders("text/html; charset=utf-8"), "Cache-Control": "no-cache", ETag: etag },
+    });
   }
 
   const pluginAssetMatch = url.pathname.match(/^\/plugins\/([^/]+)\/assets\/(.+)$/);
@@ -1180,7 +1196,13 @@ export async function handlePluginRoutes(
 
     const file = Bun.file(resolvedPath);
     if (await file.exists()) {
-      return new Response(file, { headers: deps.secureHeaders(deps.mimeType(assetPath)) });
+      const etag = `"${file.size.toString(36)}-${file.lastModified.toString(36)}"`;
+      if (req.headers.get("if-none-match") === etag) {
+        return new Response(null, { status: 304 });
+      }
+      return new Response(file, {
+        headers: { ...deps.secureHeaders(deps.mimeType(assetPath)), "Cache-Control": "no-cache", ETag: etag },
+      });
     }
     return new Response("Not found", { status: 404 });
   }

Overlord-Server/src/server/stale-prune.test.ts

@@ -0,0 +1,120 @@
+import { describe, expect, test } from "bun:test";
+import { pruneStaleClients } from "./stale-prune";
+import type { ClientInfo } from "../types";
+
+function makeClient(id: string, lastSeen: number, role: "client" | "viewer" = "client"): ClientInfo {
+  const calls: string[] = [];
+  return {
+    id,
+    lastSeen,
+    role,
+    ws: {
+      close(...args: any[]) { calls.push(`close:${args.join(",")}`); },
+      send() {},
+      _calls: calls,
+    },
+  } as any;
+}
+
+describe("pruneStaleClients", () => {
+  test("does nothing when all clients are fresh", () => {
+    const clients = new Map<string, ClientInfo>();
+    clients.set("a", makeClient("a", Date.now()));
+
+    const offlined: string[] = [];
+    const deleted: string[] = [];
+
+    pruneStaleClients({
+      clients,
+      staleMs: 60_000,
+      pruneBatch: 10,
+      setOnlineState: (id, online) => { if (!online) offlined.push(id); },
+      deleteClient: (id) => { deleted.push(id); },
+    });
+
+    expect(offlined).toEqual([]);
+    expect(deleted).toEqual([]);
+  });
+
+  test("closes and marks offline stale role=client entries without deleting", () => {
+    const clients = new Map<string, ClientInfo>();
+    const staleClient = makeClient("stale-c", Date.now() - 120_000, "client");
+    clients.set("stale-c", staleClient);
+
+    const offlined: string[] = [];
+    const deleted: string[] = [];
+
+    pruneStaleClients({
+      clients,
+      staleMs: 60_000,
+      pruneBatch: 10,
+      setOnlineState: (id, online) => { if (!online) offlined.push(id); },
+      deleteClient: (id) => { deleted.push(id); },
+    });
+
+    expect(offlined).toContain("stale-c");
+    expect(deleted).not.toContain("stale-c");
+    expect((staleClient.ws as any)._calls[0]).toStartWith("close:");
+  });
+
+  test("closes and deletes stale non-client (viewer) entries", () => {
+    const clients = new Map<string, ClientInfo>();
+    const viewer = makeClient("stale-v", Date.now() - 120_000, "viewer");
+    clients.set("stale-v", viewer);
+
+    const offlined: string[] = [];
+    const deleted: string[] = [];
+
+    pruneStaleClients({
+      clients,
+      staleMs: 60_000,
+      pruneBatch: 10,
+      setOnlineState: (id, online) => { if (!online) offlined.push(id); },
+      deleteClient: (id) => { deleted.push(id); },
+    });
+
+    expect(deleted).toContain("stale-v");
+    expect(offlined).toContain("stale-v");
+  });
+
+  test("respects pruneBatch limit", () => {
+    const clients = new Map<string, ClientInfo>();
+    for (let i = 0; i < 5; i++) {
+      clients.set(`s-${i}`, makeClient(`s-${i}`, Date.now() - 200_000, "viewer"));
+    }
+
+    let pruned = 0;
+
+    pruneStaleClients({
+      clients,
+      staleMs: 60_000,
+      pruneBatch: 2,
+      setOnlineState: () => { pruned++; },
+      deleteClient: () => {},
+    });
+
+    expect(pruned).toBe(2);
+  });
+
+  test("mixes fresh and stale correctly", () => {
+    const clients = new Map<string, ClientInfo>();
+    clients.set("fresh", makeClient("fresh", Date.now()));
+    clients.set("stale", makeClient("stale", Date.now() - 200_000, "viewer"));
+
+    const offlined: string[] = [];
+    const deleted: string[] = [];
+
+    pruneStaleClients({
+      clients,
+      staleMs: 60_000,
+      pruneBatch: 10,
+      setOnlineState: (id, online) => { if (!online) offlined.push(id); },
+      deleteClient: (id) => { deleted.push(id); },
+    });
+
+    expect(offlined).toContain("stale");
+    expect(offlined).not.toContain("fresh");
+    expect(deleted).toContain("stale");
+    expect(deleted).not.toContain("fresh");
+  });
+});