mirror of
https://github.com/Ark0N/Codeman.git
synced 2026-09-30 12:39:42 +02:00
The opt-in multi-user feature's only enforcement is web-layer scoping (all sessions share one OS account). An adversarial review found 8 critical + 7 high cross-user holes that defeated it, plus mediums; all fixed here. Single-user (flag-off) behavior stays byte-identical apart from documented consistency deltas. Ownership / confinement: - DELETE /api/sessions (bulk) + /:id now owner-scope / findSessionOrFail - quick-start, cron (create+fire), scheduled runs confine workingDir to the owner's space; case link/docker-link/docker-import confine the host path - resolveCasePath no longer resolves linked cases for non-admins; foreign remote/docker cases are skipped (fall through to the caller's own local case) - history, subagents/workflows, mux-sessions, orchestrator, cron run-history, away-digest, and remote/docker host reads are owner- or admin-scoped Permission policy (section 6.3): - non-granted users are downgraded at every spawn site incl. legacy /api/scheduled, PlanOrchestrator one-shots, remote launch, and the cron-fire gemini/codex bypass switches; resolveClaudeModeForUsername now fails closed Auth / store: - verify-first login throttle (a correct password is never locked out), /ws terminal subject to the change-password lockbox, cookie fast-path re-validates identity live, role/grant changes revoke sessions, admin delete runs the last-admin guard before any teardown - users.json: distinguish missing (ENOENT) from corrupt/unreadable so a bad read can't overwrite all accounts; unique per-process temp write path Event streams: - debounced session:updated + batched task:updated, clipboard, and push notifications route by owner (fail closed); getLightState hides machine-wide globalStats from non-admins Tests: two suites updated to assert the fixed (secure) behavior. tsc, eslint, and test:ci all green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
266 lines
7.9 KiB
TypeScript
266 lines
7.9 KiB
TypeScript
/**
|
|
* @fileoverview Tests for scheduled-routes route handlers.
|
|
*
|
|
* Uses app.inject() — no real HTTP ports needed.
|
|
* Port: N/A (app.inject doesn't open ports)
|
|
*/
|
|
|
|
import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
|
|
import { createRouteTestHarness, type RouteTestHarness } from './_route-test-utils.js';
|
|
import { registerScheduledRoutes } from '../../src/web/routes/scheduled-routes.js';
|
|
|
|
describe('scheduled-routes', () => {
|
|
let harness: RouteTestHarness;
|
|
|
|
beforeEach(async () => {
|
|
harness = await createRouteTestHarness(registerScheduledRoutes);
|
|
});
|
|
|
|
afterEach(async () => {
|
|
await harness.app.close();
|
|
});
|
|
|
|
// ========== GET /api/scheduled ==========
|
|
|
|
describe('GET /api/scheduled', () => {
|
|
it('returns empty array when no scheduled runs exist', async () => {
|
|
const res = await harness.app.inject({
|
|
method: 'GET',
|
|
url: '/api/scheduled',
|
|
});
|
|
expect(res.statusCode).toBe(200);
|
|
const body = JSON.parse(res.body);
|
|
expect(body).toEqual([]);
|
|
});
|
|
|
|
it('returns all scheduled runs', async () => {
|
|
const run1 = {
|
|
id: 'run-1',
|
|
prompt: 'test prompt 1',
|
|
workingDir: '/tmp/test',
|
|
durationMinutes: 60,
|
|
startedAt: Date.now(),
|
|
endAt: Date.now() + 3600000,
|
|
status: 'running' as const,
|
|
sessionId: null,
|
|
completedTasks: 0,
|
|
totalCost: 0,
|
|
logs: [],
|
|
};
|
|
const run2 = {
|
|
id: 'run-2',
|
|
prompt: 'test prompt 2',
|
|
workingDir: '/tmp/test2',
|
|
durationMinutes: 120,
|
|
startedAt: Date.now(),
|
|
endAt: Date.now() + 7200000,
|
|
status: 'completed' as const,
|
|
sessionId: 'sess-1',
|
|
completedTasks: 5,
|
|
totalCost: 1.5,
|
|
logs: ['started'],
|
|
};
|
|
harness.ctx.scheduledRuns.set('run-1', run1);
|
|
harness.ctx.scheduledRuns.set('run-2', run2);
|
|
|
|
const res = await harness.app.inject({
|
|
method: 'GET',
|
|
url: '/api/scheduled',
|
|
});
|
|
expect(res.statusCode).toBe(200);
|
|
const body = JSON.parse(res.body);
|
|
expect(body).toHaveLength(2);
|
|
});
|
|
});
|
|
|
|
// ========== POST /api/scheduled ==========
|
|
|
|
describe('POST /api/scheduled', () => {
|
|
it('creates a scheduled run with valid input', async () => {
|
|
const mockRun = {
|
|
id: 'new-run',
|
|
prompt: 'do something',
|
|
workingDir: '/tmp',
|
|
durationMinutes: 60,
|
|
startedAt: Date.now(),
|
|
endAt: Date.now() + 3600000,
|
|
status: 'running' as const,
|
|
sessionId: null,
|
|
completedTasks: 0,
|
|
totalCost: 0,
|
|
logs: [],
|
|
};
|
|
harness.ctx.startScheduledRun = vi.fn(async () => mockRun);
|
|
|
|
const res = await harness.app.inject({
|
|
method: 'POST',
|
|
url: '/api/scheduled',
|
|
payload: {
|
|
prompt: 'do something',
|
|
durationMinutes: 60,
|
|
},
|
|
});
|
|
expect(res.statusCode).toBe(200);
|
|
const body = JSON.parse(res.body);
|
|
// Handler returns a bare { run } now; the uniform envelope wraps it to
|
|
// { success:true, data:{ run } } in production. At the route-handler layer
|
|
// the harness sees the bare return, so assert body.run directly.
|
|
expect(body.run.id).toBe('new-run');
|
|
});
|
|
|
|
it('rejects empty prompt', async () => {
|
|
const res = await harness.app.inject({
|
|
method: 'POST',
|
|
url: '/api/scheduled',
|
|
payload: {
|
|
prompt: '',
|
|
},
|
|
});
|
|
expect(res.statusCode).toBe(400);
|
|
const body = JSON.parse(res.body);
|
|
expect(body.success).toBe(false);
|
|
});
|
|
|
|
it('rejects missing prompt', async () => {
|
|
const res = await harness.app.inject({
|
|
method: 'POST',
|
|
url: '/api/scheduled',
|
|
payload: {},
|
|
});
|
|
expect(res.statusCode).toBe(400);
|
|
const body = JSON.parse(res.body);
|
|
expect(body.success).toBe(false);
|
|
});
|
|
|
|
it('rejects invalid workingDir with shell metacharacters', async () => {
|
|
const res = await harness.app.inject({
|
|
method: 'POST',
|
|
url: '/api/scheduled',
|
|
payload: {
|
|
prompt: 'test prompt',
|
|
workingDir: '/tmp/test;rm -rf /',
|
|
},
|
|
});
|
|
expect(res.statusCode).toBe(400);
|
|
const body = JSON.parse(res.body);
|
|
expect(body.success).toBe(false);
|
|
});
|
|
|
|
it('accepts optional durationMinutes', async () => {
|
|
const mockRun = {
|
|
id: 'run-default-duration',
|
|
prompt: 'test',
|
|
workingDir: process.cwd(),
|
|
durationMinutes: 60,
|
|
startedAt: Date.now(),
|
|
endAt: Date.now() + 3600000,
|
|
status: 'running' as const,
|
|
sessionId: null,
|
|
completedTasks: 0,
|
|
totalCost: 0,
|
|
logs: [],
|
|
};
|
|
harness.ctx.startScheduledRun = vi.fn(async () => mockRun);
|
|
|
|
const res = await harness.app.inject({
|
|
method: 'POST',
|
|
url: '/api/scheduled',
|
|
payload: {
|
|
prompt: 'test',
|
|
},
|
|
});
|
|
expect(res.statusCode).toBe(200);
|
|
const body = JSON.parse(res.body);
|
|
// Bare { run } return (envelope-wrapped to { success:true, data:{ run } }
|
|
// in production; harness sees the bare return).
|
|
expect(body.run).toBeDefined();
|
|
// Should default to 60 minutes; 4th arg is the multi-user owner (undefined in single-user).
|
|
expect(harness.ctx.startScheduledRun).toHaveBeenCalledWith('test', expect.any(String), 60, undefined);
|
|
});
|
|
});
|
|
|
|
// ========== DELETE /api/scheduled/:id ==========
|
|
|
|
describe('DELETE /api/scheduled/:id', () => {
|
|
it('deletes an existing scheduled run', async () => {
|
|
const run = {
|
|
id: 'run-to-delete',
|
|
prompt: 'test',
|
|
workingDir: '/tmp',
|
|
durationMinutes: 60,
|
|
startedAt: Date.now(),
|
|
endAt: Date.now() + 3600000,
|
|
status: 'running' as const,
|
|
sessionId: null,
|
|
completedTasks: 0,
|
|
totalCost: 0,
|
|
logs: [],
|
|
};
|
|
harness.ctx.scheduledRuns.set('run-to-delete', run);
|
|
|
|
const res = await harness.app.inject({
|
|
method: 'DELETE',
|
|
url: '/api/scheduled/run-to-delete',
|
|
});
|
|
expect(res.statusCode).toBe(200);
|
|
const body = JSON.parse(res.body);
|
|
// Handler returns a bare {} on success; the uniform envelope wraps it to
|
|
// { success:true, data:{} } in production. The harness sees the bare return.
|
|
expect(body).toEqual({});
|
|
expect(harness.ctx.stopScheduledRun).toHaveBeenCalledWith('run-to-delete');
|
|
});
|
|
|
|
it('returns error for nonexistent scheduled run', async () => {
|
|
const res = await harness.app.inject({
|
|
method: 'DELETE',
|
|
url: '/api/scheduled/nonexistent',
|
|
});
|
|
expect(res.statusCode).toBe(200);
|
|
const body = JSON.parse(res.body);
|
|
expect(body.success).toBe(false);
|
|
expect(body.error).toBeDefined();
|
|
});
|
|
});
|
|
|
|
// ========== GET /api/scheduled/:id ==========
|
|
|
|
describe('GET /api/scheduled/:id', () => {
|
|
it('returns an existing scheduled run', async () => {
|
|
const run = {
|
|
id: 'run-1',
|
|
prompt: 'test prompt',
|
|
workingDir: '/tmp/test',
|
|
durationMinutes: 60,
|
|
startedAt: Date.now(),
|
|
endAt: Date.now() + 3600000,
|
|
status: 'running' as const,
|
|
sessionId: null,
|
|
completedTasks: 0,
|
|
totalCost: 0,
|
|
logs: [],
|
|
};
|
|
harness.ctx.scheduledRuns.set('run-1', run);
|
|
|
|
const res = await harness.app.inject({
|
|
method: 'GET',
|
|
url: '/api/scheduled/run-1',
|
|
});
|
|
expect(res.statusCode).toBe(200);
|
|
const body = JSON.parse(res.body);
|
|
expect(body.id).toBe('run-1');
|
|
expect(body.prompt).toBe('test prompt');
|
|
});
|
|
|
|
it('returns error for nonexistent scheduled run', async () => {
|
|
const res = await harness.app.inject({
|
|
method: 'GET',
|
|
url: '/api/scheduled/nonexistent',
|
|
});
|
|
expect(res.statusCode).toBe(200);
|
|
const body = JSON.parse(res.body);
|
|
expect(body.success).toBe(false);
|
|
expect(body.error).toBeDefined();
|
|
});
|
|
});
|
|
});
|