Files
software-mansion__argent/packages/tool-server/test/artifacts.test.ts
Ignacy Łątka 81ab110e8b fix(link): close a case-varied bypass of the preview flag exclusion and reject non-canonical headers
Three defects found reviewing the forwarding path.

Express matches mount paths case-insensitively, so `/PREVIEW/boot` reaches the
same preview router as `/preview/boot` while a case-sensitive exclusion let it
through — carrying a forged flag set past `requireLensFlag` on routes the auth
gate exempts, on a `--no-auth` server with no token at all. The two questions
now have two predicates: what the auth gate exempts stays an exact match, and
what the flag gate skips is everything Express will route into that subtree.
Skipping an override on a request that still needs a token costs nothing;
exempting one from auth would not.

`Buffer.from(…, "base64")` stops at the padding rather than rejecting what
follows, so `<valid>GARBAGE` — and the comma-joined string Node builds from a
duplicated header — decoded to the first payload, were acknowledged, and
applied. The header value is now shape-checked before it is decoded.

A forwarded `__proto__` is dropped, because the flags.json reader assigns onto
a plain object where that key hits the prototype setter and stores nothing. The
claimed disk/wire parity was false for exactly that name; a test now asserts it
against the real reader instead of restating it.

`argent link` also warns about an unacknowledged probe when no flags are set.
An empty set is the strongest assertion in this protocol — it turns every
flag-gated tool off — so a server that ignores it serves tools the CLI just
said would be hidden. The earlier asymmetry had it backwards.

Two prose fixes for claims this feature falsified: `requireLensFlag` no longer
tracks the tool gate (it reads this machine's flags by design), and `argent
enable` rejects a flag only a newer linked server knows, which its error
message now says.
2026-07-30 23:42:27 +02:00

263 lines
9.2 KiB
TypeScript

import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
import supertest from "supertest";
import { join } from "node:path";
import { tmpdir } from "node:os";
import { mkdtemp, mkdir, rm, writeFile } from "node:fs/promises";
import { execFileSync } from "node:child_process";
import { createHttpApp, type HttpAppHandle } from "../src/http";
import { ArtifactStore } from "@argent/registry";
import type { Registry } from "@argent/registry";
const isFlagEnabledMock = vi.hoisted(() => vi.fn(() => false));
// supertest/superagent doesn't buffer binary bodies (gzip) by default.
function binaryParser(res: NodeJS.ReadableStream, cb: (err: Error | null, body: Buffer) => void) {
const chunks: Buffer[] = [];
res.on("data", (c: Buffer) => chunks.push(Buffer.from(c)));
res.on("end", () => cb(null, Buffer.concat(chunks)));
res.on("error", (e: Error) => cb(e, Buffer.alloc(0)));
}
vi.mock("../src/utils/update-checker", () => ({
getUpdateState: vi.fn(() => ({
updateAvailable: false,
latestVersion: null,
currentVersion: "1.0.0",
})),
isUpdateNoteSuppressed: vi.fn(() => true),
suppressUpdateNote: vi.fn(),
}));
// Only isFlagEnabled is stubbed; the rest of the module (forwarded-flag scope
// and header codec, which http.ts also uses) stays real.
vi.mock("@argent/configuration-core", async (importOriginal) => ({
...(await importOriginal<typeof import("@argent/configuration-core")>()),
isFlagEnabled: isFlagEnabledMock,
}));
// A minimal Registry carrying a real ArtifactStore — the `/artifacts/:id` route
// resolves files from `registry.artifacts`, so the test registers into the same
// store instance it hands to createHttpApp.
function stubRegistry(): Registry {
return {
artifacts: new ArtifactStore(),
getSnapshot: vi.fn(() => ({ services: new Map(), namespaces: [], tools: [] })),
getTool: vi.fn(() => undefined),
invokeTool: vi.fn(),
} as unknown as Registry;
}
describe("ArtifactStore", () => {
it("registers a file and infers filename, mime type, and size", async () => {
const dir = await mkdtemp(join(tmpdir(), "artifact-reg-"));
try {
const filePath = join(dir, "shot.png");
await writeFile(filePath, Buffer.from([1, 2, 3, 4]));
const handle = await new ArtifactStore().register(filePath);
expect(handle.__argentArtifact).toBe(true);
expect(handle.filename).toBe("shot.png");
expect(handle.mimeType).toBe("image/png");
expect(handle.size).toBe(4);
expect(typeof handle.id).toBe("string");
// Emitted so a co-located client can read the file directly (gate).
expect(handle.hostPath).toBe(filePath);
expect(typeof handle.mtimeMs).toBe("number");
} finally {
await rm(dir, { recursive: true, force: true });
}
});
it("honours filename and mimeType overrides", async () => {
const dir = await mkdtemp(join(tmpdir(), "artifact-reg-"));
try {
const filePath = join(dir, "raw.bin");
await writeFile(filePath, "hi");
const handle = await new ArtifactStore().register(filePath, {
filename: "pretty.png",
mimeType: "image/png",
});
expect(handle.filename).toBe("pretty.png");
expect(handle.mimeType).toBe("image/png");
} finally {
await rm(dir, { recursive: true, force: true });
}
});
it("marks a directory (e.g. a .trace bundle) for tar.gz delivery", async () => {
const root = await mkdtemp(join(tmpdir(), "artifact-dir-"));
try {
const bundle = join(root, "session.trace");
await mkdir(bundle, { recursive: true });
await writeFile(join(bundle, "data.bin"), "trace");
const handle = await new ArtifactStore().register(bundle);
expect(handle.archive).toBe("tar.gz");
expect(handle.filename).toBe("session.trace");
expect(handle.hostPath).toBe(bundle);
} finally {
await rm(root, { recursive: true, force: true });
}
});
it("honours an explicit archive option when the path can't be stat'd", async () => {
const handle = await new ArtifactStore().register("/tmp/does-not-exist-yet.trace", {
archive: "tar.gz",
});
expect(handle.archive).toBe("tar.gz");
});
it("lists safe metadata for registered artifacts", async () => {
const dir = await mkdtemp(join(tmpdir(), "artifact-list-store-"));
try {
const filePath = join(dir, "shot.png");
await writeFile(filePath, "png");
const store = new ArtifactStore();
const handle = await store.register(filePath, { mimeType: "image/png" });
expect(store.list()).toEqual([
{
id: handle.id,
filename: "shot.png",
mimeType: "image/png",
size: 3,
isDirectory: false,
},
]);
} finally {
await rm(dir, { recursive: true, force: true });
}
});
});
describe("GET /artifacts", () => {
let handle: HttpAppHandle | null = null;
beforeEach(() => {
isFlagEnabledMock.mockReturnValue(false);
});
afterEach(() => {
handle?.dispose();
handle = null;
isFlagEnabledMock.mockReset();
});
it("404s with a JSON hint unless the artifact list endpoint flag is enabled", async () => {
handle = createHttpApp(stubRegistry());
const res = await supertest(handle.app).get("/artifacts");
expect(res.status).toBe(404);
expect(res.body.error).toContain("argent enable artifacts-list-endpoint");
});
it("returns registered artifact metadata without host paths", async () => {
const dir = await mkdtemp(join(tmpdir(), "artifact-list-route-"));
try {
const filePath = join(dir, "img.png");
await writeFile(filePath, "image");
const registry = stubRegistry();
const artifact = await registry.artifacts.register(filePath, { mimeType: "image/png" });
isFlagEnabledMock.mockReturnValue(true);
handle = createHttpApp(registry);
const res = await supertest(handle.app).get("/artifacts");
expect(res.status).toBe(200);
expect(res.body).toEqual({
artifacts: [
{
id: artifact.id,
filename: "img.png",
mimeType: "image/png",
size: 5,
isDirectory: false,
},
],
});
expect(JSON.stringify(res.body)).not.toContain(filePath);
} finally {
await rm(dir, { recursive: true, force: true });
}
});
});
describe("GET /artifacts/:id", () => {
let handle: HttpAppHandle | null = null;
afterEach(() => {
handle?.dispose();
handle = null;
});
it("streams a registered file with its content type", async () => {
const dir = await mkdtemp(join(tmpdir(), "artifact-route-"));
try {
const filePath = join(dir, "img.png");
const bytes = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0xaa, 0xbb]);
await writeFile(filePath, bytes);
const registry = stubRegistry();
const artifact = await registry.artifacts.register(filePath, { mimeType: "image/png" });
handle = createHttpApp(registry);
const res = await supertest(handle.app).get(`/artifacts/${artifact.id}`);
expect(res.status).toBe(200);
expect(res.headers["content-type"]).toContain("image/png");
expect(Buffer.from(res.body)).toEqual(bytes);
} finally {
await rm(dir, { recursive: true, force: true });
}
});
it("streams a directory bundle as a gzipped tar that unpacks to the original files", async () => {
const root = await mkdtemp(join(tmpdir(), "artifact-bundle-"));
try {
const bundle = join(root, "session.trace");
await mkdir(join(bundle, "sub"), { recursive: true });
await writeFile(join(bundle, "top.txt"), "top");
await writeFile(join(bundle, "sub", "nested.txt"), "nested");
const registry = stubRegistry();
const artifact = await registry.artifacts.register(bundle);
handle = createHttpApp(registry);
const res = await supertest(handle.app)
.get(`/artifacts/${artifact.id}`)
.buffer(true)
.parse(binaryParser as never);
expect(res.status).toBe(200);
expect(res.headers["content-type"]).toContain("application/gzip");
expect(res.headers["content-disposition"]).toContain("session.trace.tar.gz");
// Round-trip: the gzipped tar lists the bundle's own files under its name.
const tarball = join(root, "out.tar.gz");
await writeFile(tarball, res.body);
const listing = execFileSync("tar", ["-tzf", tarball], { encoding: "utf8" });
expect(listing).toContain("session.trace/top.txt");
expect(listing).toContain("session.trace/sub/nested.txt");
} finally {
await rm(root, { recursive: true, force: true });
}
});
it("404s an unknown artifact id", async () => {
handle = createHttpApp(stubRegistry());
const res = await supertest(handle.app).get("/artifacts/does-not-exist");
expect(res.status).toBe(404);
});
it("410s when the registered file has been removed", async () => {
const dir = await mkdtemp(join(tmpdir(), "artifact-gone-"));
const filePath = join(dir, "gone.png");
await writeFile(filePath, "x");
const registry = stubRegistry();
const artifact = await registry.artifacts.register(filePath);
await rm(dir, { recursive: true, force: true });
handle = createHttpApp(registry);
const res = await supertest(handle.app).get(`/artifacts/${artifact.id}`);
expect(res.status).toBe(410);
});
});