438 tests per windows builds now

2026-05-17 01:15:52 -05:00
parent d6b562482a
commit c2b0d31578
4 changed files with 313 additions and 0 deletions
@@ -0,0 +1,93 @@
+import { describe, expect, test } from "bun:test";
+import { generateBuildMutex, sanitizeMutex, sanitizeOutputName } from "./build-utils";
+
+describe("generateBuildMutex", () => {
+  test("returns string of requested length", () => {
+    expect(generateBuildMutex(24)).toHaveLength(24);
+    expect(generateBuildMutex(1)).toHaveLength(1);
+    expect(generateBuildMutex(64)).toHaveLength(64);
+  });
+
+  test("defaults to length 24", () => {
+    expect(generateBuildMutex()).toHaveLength(24);
+  });
+
+  test("only uses allowed alphabet characters", () => {
+    const value = generateBuildMutex(256);
+    expect(value).toMatch(/^[A-Za-z0-9._-]+$/);
+  });
+
+  test("produces different values across calls", () => {
+    const a = generateBuildMutex(24);
+    const b = generateBuildMutex(24);
+    expect(a).not.toBe(b);
+  });
+
+  test("result passes sanitizeMutex", () => {
+    expect(sanitizeMutex(generateBuildMutex(24))).toBeDefined();
+  });
+});
+
+describe("sanitizeMutex", () => {
+  test("returns undefined for falsy input", () => {
+    expect(sanitizeMutex(undefined)).toBeUndefined();
+    expect(sanitizeMutex("")).toBeUndefined();
+  });
+
+  test("returns undefined for whitespace-only input", () => {
+    expect(sanitizeMutex("   ")).toBeUndefined();
+    expect(sanitizeMutex("\t\n")).toBeUndefined();
+  });
+
+  test("trims surrounding whitespace", () => {
+    expect(sanitizeMutex("  abc  ")).toBe("abc");
+  });
+
+  test("accepts allowed characters", () => {
+    expect(sanitizeMutex("Abc.123_-xyz")).toBe("Abc.123_-xyz");
+  });
+
+  test("rejects spaces inside the value", () => {
+    expect(() => sanitizeMutex("ab cd")).toThrow(/Mutex must be/);
+  });
+
+  test("rejects disallowed punctuation", () => {
+    expect(() => sanitizeMutex("abc/def")).toThrow();
+    expect(() => sanitizeMutex("abc@def")).toThrow();
+    expect(() => sanitizeMutex("abc#def")).toThrow();
+  });
+
+  test("enforces max length of 64", () => {
+    expect(sanitizeMutex("a".repeat(64))).toBe("a".repeat(64));
+    expect(() => sanitizeMutex("a".repeat(65))).toThrow();
+  });
+});
+
+describe("sanitizeOutputName", () => {
+  test("accepts plain filenames", () => {
+    expect(sanitizeOutputName("agent.exe")).toBe("agent.exe");
+    expect(sanitizeOutputName("my-build_v2.0.bin")).toBe("my-build_v2.0.bin");
+  });
+
+  test("strips path components from traversal attempts", () => {
+    // path.basename removes the directory portion, neutralizing traversal.
+    // The returned value still has to match the allowed-character set.
+    expect(sanitizeOutputName("../etc/passwd")).toBe("passwd");
+    expect(sanitizeOutputName("/etc/shadow")).toBe("shadow");
+  });
+
+  test("rejects when basename itself contains a disallowed character", () => {
+    expect(() => sanitizeOutputName("bad name")).toThrow(/Invalid output filename/);
+    expect(() => sanitizeOutputName("weird$.bin")).toThrow();
+  });
+
+  test("rejects names with disallowed characters", () => {
+    expect(() => sanitizeOutputName("agent name.exe")).toThrow();
+    expect(() => sanitizeOutputName("agent$.exe")).toThrow();
+    expect(() => sanitizeOutputName("agent*.exe")).toThrow();
+  });
+
+  test("rejects empty result", () => {
+    expect(() => sanitizeOutputName("")).toThrow();
+  });
+});
@@ -0,0 +1,79 @@
+import { describe, expect, test } from "bun:test";
+import { mimeType, secureHeaders } from "./http-utils";
+import { SECURITY_HEADERS } from "./http-security";
+
+describe("mimeType", () => {
+  test("maps common web extensions", () => {
+    expect(mimeType("index.html")).toBe("text/html; charset=utf-8");
+    expect(mimeType("app.css")).toBe("text/css; charset=utf-8");
+    expect(mimeType("bundle.js")).toBe("text/javascript; charset=utf-8");
+    expect(mimeType("worker.mjs")).toBe("text/javascript; charset=utf-8");
+    expect(mimeType("data.json")).toBe("application/json");
+  });
+
+  test("maps image extensions", () => {
+    expect(mimeType("a.png")).toBe("image/png");
+    expect(mimeType("a.jpg")).toBe("image/jpeg");
+    expect(mimeType("a.jpeg")).toBe("image/jpeg");
+    expect(mimeType("a.webp")).toBe("image/webp");
+    expect(mimeType("a.svg")).toBe("image/svg+xml");
+    expect(mimeType("a.ico")).toBe("image/x-icon");
+  });
+
+  test("maps font extensions", () => {
+    expect(mimeType("Inter.woff")).toBe("font/woff");
+    expect(mimeType("Inter.woff2")).toBe("font/woff2");
+    expect(mimeType("Inter.ttf")).toBe("font/ttf");
+  });
+
+  test("is case insensitive on the extension", () => {
+    expect(mimeType("PIC.PNG")).toBe("image/png");
+    expect(mimeType("Style.CSS")).toBe("text/css; charset=utf-8");
+  });
+
+  test("uses only the final extension", () => {
+    expect(mimeType("archive.tar.gz")).toBe("application/octet-stream");
+    expect(mimeType("script.min.js")).toBe("text/javascript; charset=utf-8");
+  });
+
+  test("returns octet-stream for unknown extensions", () => {
+    expect(mimeType("file.xyz")).toBe("application/octet-stream");
+    expect(mimeType("binary.bin")).toBe("application/octet-stream");
+  });
+
+  test("returns octet-stream when there is no extension", () => {
+    expect(mimeType("README")).toBe("application/octet-stream");
+    expect(mimeType("")).toBe("application/octet-stream");
+  });
+
+  test("handles full paths", () => {
+    expect(mimeType("/var/www/index.html")).toBe("text/html; charset=utf-8");
+    expect(mimeType("C:\\dist\\app.js")).toBe("text/javascript; charset=utf-8");
+  });
+});
+
+describe("secureHeaders", () => {
+  test("includes every security header by default", () => {
+    const headers = secureHeaders();
+    for (const [name, value] of Object.entries(SECURITY_HEADERS)) {
+      expect(headers[name as keyof typeof headers]).toBe(value);
+    }
+  });
+
+  test("omits Content-Type when none provided", () => {
+    const headers = secureHeaders();
+    expect((headers as Record<string, string>)["Content-Type"]).toBeUndefined();
+  });
+
+  test("adds Content-Type when provided", () => {
+    const headers = secureHeaders("application/json");
+    expect((headers as Record<string, string>)["Content-Type"]).toBe("application/json");
+  });
+
+  test("returns a fresh object each call (no shared mutation)", () => {
+    const a = secureHeaders("text/plain") as Record<string, string>;
+    const b = secureHeaders("text/html") as Record<string, string>;
+    a["Content-Type"] = "mutated";
+    expect(b["Content-Type"]).toBe("text/html");
+  });
+});
@@ -0,0 +1,26 @@
+import { describe, expect, test } from "bun:test";
+import { sanitizePluginId } from "./plugin-utils";
+
+describe("sanitizePluginId", () => {
+  test("accepts a plain id", () => {
+    expect(sanitizePluginId("my-plugin")).toBe("my-plugin");
+    expect(sanitizePluginId("plugin.v2_0")).toBe("plugin.v2_0");
+  });
+
+  test("strips path components to defend against traversal", () => {
+    expect(sanitizePluginId("../../../etc/passwd")).toBe("passwd");
+    expect(sanitizePluginId("/var/log/syslog")).toBe("syslog");
+    expect(sanitizePluginId("nested/dir/plugin")).toBe("plugin");
+  });
+
+  test("strips disallowed characters from the basename", () => {
+    expect(sanitizePluginId("hello world!")).toBe("helloworld");
+    expect(sanitizePluginId("plug$in@123")).toBe("plugin123");
+  });
+
+  test("throws when nothing survives sanitization", () => {
+    expect(() => sanitizePluginId("")).toThrow(/Invalid plugin id/);
+    expect(() => sanitizePluginId("!!!@@@")).toThrow(/Invalid plugin id/);
+    expect(() => sanitizePluginId("/")).toThrow(/Invalid plugin id/);
+  });
+});