Files
Codeman/test/routes/scheduled-routes.test.ts
Codeman maintainer ccb3afc9ee fix(multiuser): close cross-user web-layer scoping holes found in review
The opt-in multi-user feature's only enforcement is web-layer scoping
(all sessions share one OS account). An adversarial review found 8 critical
+ 7 high cross-user holes that defeated it, plus mediums; all fixed here.
Single-user (flag-off) behavior stays byte-identical apart from documented
consistency deltas.

Ownership / confinement:
- DELETE /api/sessions (bulk) + /:id now owner-scope / findSessionOrFail
- quick-start, cron (create+fire), scheduled runs confine workingDir to the
  owner's space; case link/docker-link/docker-import confine the host path
- resolveCasePath no longer resolves linked cases for non-admins; foreign
  remote/docker cases are skipped (fall through to the caller's own local case)
- history, subagents/workflows, mux-sessions, orchestrator, cron run-history,
  away-digest, and remote/docker host reads are owner- or admin-scoped

Permission policy (section 6.3):
- non-granted users are downgraded at every spawn site incl. legacy
  /api/scheduled, PlanOrchestrator one-shots, remote launch, and the cron-fire
  gemini/codex bypass switches; resolveClaudeModeForUsername now fails closed

Auth / store:
- verify-first login throttle (a correct password is never locked out),
  /ws terminal subject to the change-password lockbox, cookie fast-path
  re-validates identity live, role/grant changes revoke sessions, admin delete
  runs the last-admin guard before any teardown
- users.json: distinguish missing (ENOENT) from corrupt/unreadable so a bad
  read can't overwrite all accounts; unique per-process temp write path

Event streams:
- debounced session:updated + batched task:updated, clipboard, and push
  notifications route by owner (fail closed); getLightState hides machine-wide
  globalStats from non-admins

Tests: two suites updated to assert the fixed (secure) behavior. tsc, eslint,
and test:ci all green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-20 12:33:12 +02:00

266 lines
7.9 KiB
TypeScript

/**
* @fileoverview Tests for scheduled-routes route handlers.
*
* Uses app.inject() — no real HTTP ports needed.
* Port: N/A (app.inject doesn't open ports)
*/
import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
import { createRouteTestHarness, type RouteTestHarness } from './_route-test-utils.js';
import { registerScheduledRoutes } from '../../src/web/routes/scheduled-routes.js';
describe('scheduled-routes', () => {
let harness: RouteTestHarness;
beforeEach(async () => {
harness = await createRouteTestHarness(registerScheduledRoutes);
});
afterEach(async () => {
await harness.app.close();
});
// ========== GET /api/scheduled ==========
describe('GET /api/scheduled', () => {
it('returns empty array when no scheduled runs exist', async () => {
const res = await harness.app.inject({
method: 'GET',
url: '/api/scheduled',
});
expect(res.statusCode).toBe(200);
const body = JSON.parse(res.body);
expect(body).toEqual([]);
});
it('returns all scheduled runs', async () => {
const run1 = {
id: 'run-1',
prompt: 'test prompt 1',
workingDir: '/tmp/test',
durationMinutes: 60,
startedAt: Date.now(),
endAt: Date.now() + 3600000,
status: 'running' as const,
sessionId: null,
completedTasks: 0,
totalCost: 0,
logs: [],
};
const run2 = {
id: 'run-2',
prompt: 'test prompt 2',
workingDir: '/tmp/test2',
durationMinutes: 120,
startedAt: Date.now(),
endAt: Date.now() + 7200000,
status: 'completed' as const,
sessionId: 'sess-1',
completedTasks: 5,
totalCost: 1.5,
logs: ['started'],
};
harness.ctx.scheduledRuns.set('run-1', run1);
harness.ctx.scheduledRuns.set('run-2', run2);
const res = await harness.app.inject({
method: 'GET',
url: '/api/scheduled',
});
expect(res.statusCode).toBe(200);
const body = JSON.parse(res.body);
expect(body).toHaveLength(2);
});
});
// ========== POST /api/scheduled ==========
describe('POST /api/scheduled', () => {
it('creates a scheduled run with valid input', async () => {
const mockRun = {
id: 'new-run',
prompt: 'do something',
workingDir: '/tmp',
durationMinutes: 60,
startedAt: Date.now(),
endAt: Date.now() + 3600000,
status: 'running' as const,
sessionId: null,
completedTasks: 0,
totalCost: 0,
logs: [],
};
harness.ctx.startScheduledRun = vi.fn(async () => mockRun);
const res = await harness.app.inject({
method: 'POST',
url: '/api/scheduled',
payload: {
prompt: 'do something',
durationMinutes: 60,
},
});
expect(res.statusCode).toBe(200);
const body = JSON.parse(res.body);
// Handler returns a bare { run } now; the uniform envelope wraps it to
// { success:true, data:{ run } } in production. At the route-handler layer
// the harness sees the bare return, so assert body.run directly.
expect(body.run.id).toBe('new-run');
});
it('rejects empty prompt', async () => {
const res = await harness.app.inject({
method: 'POST',
url: '/api/scheduled',
payload: {
prompt: '',
},
});
expect(res.statusCode).toBe(400);
const body = JSON.parse(res.body);
expect(body.success).toBe(false);
});
it('rejects missing prompt', async () => {
const res = await harness.app.inject({
method: 'POST',
url: '/api/scheduled',
payload: {},
});
expect(res.statusCode).toBe(400);
const body = JSON.parse(res.body);
expect(body.success).toBe(false);
});
it('rejects invalid workingDir with shell metacharacters', async () => {
const res = await harness.app.inject({
method: 'POST',
url: '/api/scheduled',
payload: {
prompt: 'test prompt',
workingDir: '/tmp/test;rm -rf /',
},
});
expect(res.statusCode).toBe(400);
const body = JSON.parse(res.body);
expect(body.success).toBe(false);
});
it('accepts optional durationMinutes', async () => {
const mockRun = {
id: 'run-default-duration',
prompt: 'test',
workingDir: process.cwd(),
durationMinutes: 60,
startedAt: Date.now(),
endAt: Date.now() + 3600000,
status: 'running' as const,
sessionId: null,
completedTasks: 0,
totalCost: 0,
logs: [],
};
harness.ctx.startScheduledRun = vi.fn(async () => mockRun);
const res = await harness.app.inject({
method: 'POST',
url: '/api/scheduled',
payload: {
prompt: 'test',
},
});
expect(res.statusCode).toBe(200);
const body = JSON.parse(res.body);
// Bare { run } return (envelope-wrapped to { success:true, data:{ run } }
// in production; harness sees the bare return).
expect(body.run).toBeDefined();
// Should default to 60 minutes; 4th arg is the multi-user owner (undefined in single-user).
expect(harness.ctx.startScheduledRun).toHaveBeenCalledWith('test', expect.any(String), 60, undefined);
});
});
// ========== DELETE /api/scheduled/:id ==========
describe('DELETE /api/scheduled/:id', () => {
it('deletes an existing scheduled run', async () => {
const run = {
id: 'run-to-delete',
prompt: 'test',
workingDir: '/tmp',
durationMinutes: 60,
startedAt: Date.now(),
endAt: Date.now() + 3600000,
status: 'running' as const,
sessionId: null,
completedTasks: 0,
totalCost: 0,
logs: [],
};
harness.ctx.scheduledRuns.set('run-to-delete', run);
const res = await harness.app.inject({
method: 'DELETE',
url: '/api/scheduled/run-to-delete',
});
expect(res.statusCode).toBe(200);
const body = JSON.parse(res.body);
// Handler returns a bare {} on success; the uniform envelope wraps it to
// { success:true, data:{} } in production. The harness sees the bare return.
expect(body).toEqual({});
expect(harness.ctx.stopScheduledRun).toHaveBeenCalledWith('run-to-delete');
});
it('returns error for nonexistent scheduled run', async () => {
const res = await harness.app.inject({
method: 'DELETE',
url: '/api/scheduled/nonexistent',
});
expect(res.statusCode).toBe(200);
const body = JSON.parse(res.body);
expect(body.success).toBe(false);
expect(body.error).toBeDefined();
});
});
// ========== GET /api/scheduled/:id ==========
describe('GET /api/scheduled/:id', () => {
it('returns an existing scheduled run', async () => {
const run = {
id: 'run-1',
prompt: 'test prompt',
workingDir: '/tmp/test',
durationMinutes: 60,
startedAt: Date.now(),
endAt: Date.now() + 3600000,
status: 'running' as const,
sessionId: null,
completedTasks: 0,
totalCost: 0,
logs: [],
};
harness.ctx.scheduledRuns.set('run-1', run);
const res = await harness.app.inject({
method: 'GET',
url: '/api/scheduled/run-1',
});
expect(res.statusCode).toBe(200);
const body = JSON.parse(res.body);
expect(body.id).toBe('run-1');
expect(body.prompt).toBe('test prompt');
});
it('returns error for nonexistent scheduled run', async () => {
const res = await harness.app.inject({
method: 'GET',
url: '/api/scheduled/nonexistent',
});
expect(res.statusCode).toBe(200);
const body = JSON.parse(res.body);
expect(body.success).toBe(false);
expect(body.error).toBeDefined();
});
});
});