feature: file uploading
This commit is contained in:
parent
a144c88c17
commit
ffe0678e5b
8 changed files with 388 additions and 13 deletions
309
tests/01_file_uploads.test.ts
Normal file
309
tests/01_file_uploads.test.ts
Normal file
|
|
@ -0,0 +1,309 @@
|
|||
import { api, API_CLIENT } from '../utils/api.ts';
|
||||
import * as asserts from '@std/assert';
|
||||
import { USER } from '../models/user.ts';
|
||||
import { EPHEMERAL_SERVER, get_ephemeral_listen_server, random_username, set_user_permissions } from './helpers.ts';
|
||||
import { Cookie, getSetCookies } from '@std/http/cookie';
|
||||
import { generateTotp } from '../utils/totp.ts';
|
||||
import * as fs from '@std/fs';
|
||||
import * as path from '@std/path';
|
||||
import { ensureFile } from '@std/fs';
|
||||
|
||||
Deno.test({
|
||||
name: 'file uploading (home directory)',
|
||||
permissions: {
|
||||
env: true,
|
||||
read: true,
|
||||
write: true,
|
||||
net: true
|
||||
},
|
||||
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
|
||||
fn: async () => {
|
||||
let test_server_info: EPHEMERAL_SERVER | null = null;
|
||||
try {
|
||||
test_server_info = await get_ephemeral_listen_server();
|
||||
const client: API_CLIENT = api({
|
||||
prefix: '/api',
|
||||
hostname: test_server_info.hostname,
|
||||
port: test_server_info.port
|
||||
});
|
||||
|
||||
const username = random_username();
|
||||
const password = 'password';
|
||||
|
||||
const user_creation_response: Record<string, any> = await client.fetch('/users', {
|
||||
method: 'POST',
|
||||
json: {
|
||||
username,
|
||||
password
|
||||
}
|
||||
});
|
||||
|
||||
asserts.assert(user_creation_response?.user);
|
||||
asserts.assert(user_creation_response?.session);
|
||||
|
||||
let cookies: Cookie[] = [];
|
||||
const auth_response: any = await client.fetch('/auth', {
|
||||
method: 'POST',
|
||||
json: {
|
||||
username,
|
||||
password: 'password'
|
||||
},
|
||||
done: (response) => {
|
||||
cookies = getSetCookies(response.headers);
|
||||
}
|
||||
});
|
||||
|
||||
const user: USER | undefined = auth_response.user;
|
||||
asserts.assert(user);
|
||||
asserts.assert(user.id);
|
||||
|
||||
const session: Record<string, any> | undefined = auth_response.session;
|
||||
asserts.assert(session);
|
||||
|
||||
cookies.push({
|
||||
name: 'totp',
|
||||
value: await generateTotp(session?.secret ?? ''),
|
||||
maxAge: 30,
|
||||
expires: Date.now() + 30_000,
|
||||
path: '/'
|
||||
});
|
||||
|
||||
const headers_for_upload_request = new Headers();
|
||||
for (const cookie of cookies) {
|
||||
headers_for_upload_request.append(`x-${cookie.name}`, cookie.value);
|
||||
}
|
||||
headers_for_upload_request.append(
|
||||
'cookie',
|
||||
cookies.map((cookie) => `${cookie.name}=${cookie.value}`).join('; ')
|
||||
);
|
||||
|
||||
const upload_body = new FormData();
|
||||
upload_body.append(
|
||||
'file',
|
||||
new File(['this is the test content'], 'test_uploading_to_home_dir.txt')
|
||||
);
|
||||
const upload_response = await fetch(
|
||||
`http://${test_server_info.hostname}:${test_server_info.port}/files/users/${user.id}/test_uploading_to_home_dir.txt`,
|
||||
{
|
||||
method: 'PUT',
|
||||
headers: headers_for_upload_request,
|
||||
body: upload_body
|
||||
}
|
||||
);
|
||||
|
||||
asserts.assert(upload_response.ok);
|
||||
const upload_response_body = await upload_response.text();
|
||||
asserts.assert(upload_response_body);
|
||||
|
||||
const get_response = await fetch(
|
||||
`http://${test_server_info.hostname}:${test_server_info.port}/files/users/${user.id}/test_uploading_to_home_dir.txt`
|
||||
);
|
||||
|
||||
asserts.assert(get_response.ok);
|
||||
asserts.assert(get_response.body);
|
||||
|
||||
const local_download_path = path.join(Deno.cwd(), 'files', 'users', user.id, 'test_uploading_to_home_dir.txt-downloaded');
|
||||
await ensureFile(local_download_path);
|
||||
|
||||
const file = await Deno.open(local_download_path, { truncate: true, write: true });
|
||||
await get_response.body.pipeTo(file.writable);
|
||||
|
||||
const download_content = await Deno.readTextFile(local_download_path);
|
||||
asserts.assert(download_content);
|
||||
asserts.assertEquals(download_content, 'this is the test content');
|
||||
|
||||
await Deno.remove(local_download_path);
|
||||
asserts.assert(!fs.existsSync(local_download_path));
|
||||
|
||||
const uploaded_to_homedir_path = path.join(Deno.cwd(), 'files', 'users', user.id, 'test_uploading_to_home_dir.txt');
|
||||
await Deno.remove(uploaded_to_homedir_path);
|
||||
asserts.assert(!fs.existsSync(uploaded_to_homedir_path));
|
||||
|
||||
let dir = path.dirname(uploaded_to_homedir_path);
|
||||
do {
|
||||
if (dir.endsWith('files')) {
|
||||
break;
|
||||
}
|
||||
|
||||
const files = Deno.readDirSync(dir);
|
||||
let has_files = false;
|
||||
for (const _ of files) {
|
||||
has_files = true;
|
||||
break;
|
||||
}
|
||||
|
||||
if (has_files) {
|
||||
dir = '';
|
||||
break;
|
||||
}
|
||||
|
||||
await Deno.remove(dir);
|
||||
dir = path.dirname(dir);
|
||||
} while (dir.length);
|
||||
} finally {
|
||||
if (test_server_info) {
|
||||
await test_server_info?.server?.stop();
|
||||
}
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: 'file uploading (outside home directory)',
|
||||
permissions: {
|
||||
env: true,
|
||||
read: true,
|
||||
write: true,
|
||||
net: true
|
||||
},
|
||||
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
|
||||
fn: async () => {
|
||||
let test_server_info: EPHEMERAL_SERVER | null = null;
|
||||
try {
|
||||
test_server_info = await get_ephemeral_listen_server();
|
||||
const client: API_CLIENT = api({
|
||||
prefix: '/api',
|
||||
hostname: test_server_info.hostname,
|
||||
port: test_server_info.port
|
||||
});
|
||||
|
||||
const username = random_username();
|
||||
const password = 'password';
|
||||
|
||||
const user_creation_response: Record<string, any> = await client.fetch('/users', {
|
||||
method: 'POST',
|
||||
json: {
|
||||
username,
|
||||
password
|
||||
}
|
||||
});
|
||||
|
||||
asserts.assert(user_creation_response?.user);
|
||||
asserts.assert(user_creation_response?.session);
|
||||
|
||||
let cookies: Cookie[] = [];
|
||||
const auth_response: any = await client.fetch('/auth', {
|
||||
method: 'POST',
|
||||
json: {
|
||||
username,
|
||||
password: 'password'
|
||||
},
|
||||
done: (response) => {
|
||||
cookies = getSetCookies(response.headers);
|
||||
}
|
||||
});
|
||||
|
||||
const user: USER | undefined = auth_response.user;
|
||||
asserts.assert(user);
|
||||
asserts.assert(user.id);
|
||||
|
||||
const session: Record<string, any> | undefined = auth_response.session;
|
||||
asserts.assert(session);
|
||||
|
||||
cookies.push({
|
||||
name: 'totp',
|
||||
value: await generateTotp(session?.secret ?? ''),
|
||||
maxAge: 30,
|
||||
expires: Date.now() + 30_000,
|
||||
path: '/'
|
||||
});
|
||||
|
||||
const headers_for_upload_request = new Headers();
|
||||
for (const cookie of cookies) {
|
||||
headers_for_upload_request.append(`x-${cookie.name}`, cookie.value);
|
||||
}
|
||||
headers_for_upload_request.append(
|
||||
'cookie',
|
||||
cookies.map((cookie) => `${cookie.name}=${cookie.value}`).join('; ')
|
||||
);
|
||||
|
||||
const upload_body = new FormData();
|
||||
upload_body.append(
|
||||
'file',
|
||||
new File(['this is the root dir test content'], 'test_uploading_to_root_dir.txt')
|
||||
);
|
||||
|
||||
const disallowed_upload_response = await fetch(
|
||||
`http://${test_server_info.hostname}:${test_server_info.port}/files/test_uploading_to_root_dir.txt`,
|
||||
{
|
||||
method: 'PUT',
|
||||
headers: headers_for_upload_request,
|
||||
body: upload_body
|
||||
}
|
||||
);
|
||||
|
||||
asserts.assert(!disallowed_upload_response.ok);
|
||||
await disallowed_upload_response.text();
|
||||
|
||||
await set_user_permissions(client, user, session, [...user.permissions, 'files.write.all']);
|
||||
|
||||
const allowed_upload_response = await fetch(
|
||||
`http://${test_server_info.hostname}:${test_server_info.port}/files/test_uploading_to_root_dir.txt`,
|
||||
{
|
||||
method: 'PUT',
|
||||
headers: headers_for_upload_request,
|
||||
body: upload_body
|
||||
}
|
||||
);
|
||||
|
||||
asserts.assert(allowed_upload_response.ok);
|
||||
await allowed_upload_response.text();
|
||||
|
||||
const get_response = await fetch(
|
||||
`http://${test_server_info.hostname}:${test_server_info.port}/files/test_uploading_to_root_dir.txt`
|
||||
);
|
||||
|
||||
asserts.assert(get_response.ok);
|
||||
asserts.assert(get_response.body);
|
||||
|
||||
const local_download_path = path.join(Deno.cwd(), 'files', 'test_uploading_to_root_dir.txt-downloaded');
|
||||
await ensureFile(local_download_path);
|
||||
|
||||
const file = await Deno.open(local_download_path, { truncate: true, write: true });
|
||||
await get_response.body.pipeTo(file.writable);
|
||||
|
||||
const download_content = await Deno.readTextFile(local_download_path);
|
||||
asserts.assert(download_content);
|
||||
asserts.assertEquals(download_content, 'this is the root dir test content');
|
||||
|
||||
await Deno.remove(local_download_path);
|
||||
asserts.assert(!fs.existsSync(local_download_path));
|
||||
|
||||
const uploaded_to_root_dir_path = path.join(Deno.cwd(), 'files', 'test_uploading_to_root_dir.txt');
|
||||
await Deno.remove(uploaded_to_root_dir_path);
|
||||
asserts.assert(!fs.existsSync(uploaded_to_root_dir_path));
|
||||
|
||||
let dir = path.dirname(uploaded_to_root_dir_path);
|
||||
do {
|
||||
if (dir.endsWith('files')) {
|
||||
break;
|
||||
}
|
||||
|
||||
const files = Deno.readDirSync(dir);
|
||||
let has_files = false;
|
||||
for (const _ of files) {
|
||||
has_files = true;
|
||||
break;
|
||||
}
|
||||
|
||||
if (has_files) {
|
||||
dir = '';
|
||||
break;
|
||||
}
|
||||
|
||||
await Deno.remove(dir);
|
||||
dir = path.dirname(dir);
|
||||
} while (dir.length);
|
||||
} finally {
|
||||
if (test_server_info) {
|
||||
await test_server_info?.server?.stop();
|
||||
}
|
||||
}
|
||||
}
|
||||
});
|
||||
Loading…
Add table
Add a link
Reference in a new issue