feat: manage uploaded image retention

2026-08-07 07:14:14 +00:00
parent dc0e1a6da9
commit a935b23571
13 changed files with 966 additions and 23 deletions
@@ -176,3 +176,96 @@ test('sync endpoint rejects unknown callers and body fields outside the sync con
  });
  assert.equal(extraField.status, 400);
 });
+
+test('internal content access endpoint batches only valid uploaded content paths', async (t) => {
+  const service = { async initialize() {}, async recordError() {} };
+  const touched = [];
+  const assetStore = {
+    async initialize() {},
+    touch(path) { touched.push(path); return path.startsWith('uploads/'); },
+    close() {},
+  };
+  const { server } = await createApp({ maxBodyBytes: 4096 }, {
+    service, uploadStore: noUploadStore, assetStore,
+  });
+  server.listen(0, '127.0.0.1');
+  await once(server, 'listening');
+  t.after(() => server.close());
+  const address = server.address();
+  const validPath = `/uploads/core2026/${'e'.repeat(32)}.png?cache=1`;
+  const valid = await fetch(`http://127.0.0.1:${address.port}/v1/internal/content-access`, {
+    headers: { 'x-image-path': validPath },
+  });
+  assert.equal(valid.status, 204);
+  assert.deepEqual(touched, [`uploads/core2026/${'e'.repeat(32)}.png`]);
+
+  const legacyBase = await fetch(`http://127.0.0.1:${address.port}/v1/internal/content-access`, {
+    method: 'HEAD',
+    headers: { 'x-image-path': `/image/uploads/core/${'f'.repeat(32)}.webp` },
+  });
+  assert.equal(legacyBase.status, 204);
+  assert.deepEqual(touched, [
+    `uploads/core2026/${'e'.repeat(32)}.png`,
+    `uploads/core/${'f'.repeat(32)}.webp`,
+  ]);
+});
+
+test('admin panel uses a separate login session and CSRF-protected asset actions', async (t) => {
+  const service = { async initialize() {}, async recordError() {} };
+  const actions = [];
+  const asset = {
+    path: `uploads/core/${'f'.repeat(32)}.webp`, category: 'content', client: 'core',
+    filename: `${'f'.repeat(32)}.webp`, sizeBytes: 10, digest: null,
+    createdAt: new Date(0).toISOString(), lastSeenAt: new Date(0).toISOString(),
+    state: 'candidate', candidateAt: new Date(0).toISOString(), quarantinedAt: null,
+    deletedAt: null, eligibleAt: new Date(0).toISOString(), deleteAvailableAt: null, deleteAvailable: false,
+  };
+  const assetStore = {
+    async initialize() {}, touch() { return false; }, close() {},
+    list() { return { total: 1, limit: 100, offset: 0, assets: [asset] }; },
+    summary() { return { totalCount: 1, totalBytes: 10, groups: { 'content:candidate': { count: 1, bytes: 10 } } }; },
+    async quarantine(path) { actions.push(['quarantine', path]); return { ...asset, state: 'quarantined' }; },
+  };
+  const config = {
+    maxBodyBytes: 4096,
+    adminPanelPassword: 'panel-password-value',
+    adminPanelSessionSecret: 'p'.repeat(32),
+    adminPanelSessionTtlMs: 8 * 3_600_000,
+  };
+  const { server } = await createApp(config, { service, uploadStore: noUploadStore, assetStore });
+  server.listen(0, '127.0.0.1');
+  await once(server, 'listening');
+  t.after(() => server.close());
+  const base = `http://127.0.0.1:${server.address().port}`;
+
+  const anonymousApi = await fetch(`${base}/admin/api/assets`);
+  assert.equal(anonymousApi.status, 401);
+  const loginBody = new URLSearchParams({ password: config.adminPanelPassword });
+  const login = await fetch(`${base}/admin/login`, {
+    method: 'POST', redirect: 'manual',
+    headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: loginBody,
+  });
+  assert.equal(login.status, 303);
+  const cookie = login.headers.get('set-cookie').split(';', 1)[0];
+  assert.match(login.headers.get('set-cookie'), /HttpOnly; Secure; SameSite=Strict/);
+  const dashboard = await fetch(`${base}/admin/`, { headers: { cookie } });
+  assert.equal(dashboard.status, 200);
+  assert.match(dashboard.headers.get('content-security-policy'), /frame-ancestors 'none'/);
+  const html = await dashboard.text();
+  const csrf = html.match(/name="csrf-token" content="([^"]+)"/)[1];
+
+  const list = await fetch(`${base}/admin/api/assets`, { headers: { cookie } });
+  assert.equal(list.status, 200);
+  assert.equal((await list.json()).assets[0].state, 'candidate');
+  const rejected = await fetch(`${base}/admin/api/assets/action`, {
+    method: 'POST', headers: { cookie, 'content-type': 'application/json' },
+    body: JSON.stringify({ path: asset.path, action: 'quarantine' }),
+  });
+  assert.equal(rejected.status, 403);
+  const accepted = await fetch(`${base}/admin/api/assets/action`, {
+    method: 'POST', headers: { cookie, 'content-type': 'application/json', 'x-csrf-token': csrf },
+    body: JSON.stringify({ path: asset.path, action: 'quarantine' }),
+  });
+  assert.equal(accepted.status, 200);
+  assert.deepEqual(actions, [['quarantine', asset.path]]);
+});