Initial import of verae-middleware from zapier monorepo

test/integration/objects.test.js

@@ -0,0 +1,159 @@
+import { describe, it, before, after } from 'node:test';
+import assert from 'node:assert/strict';
+import http from 'node:http';
+import { createApp } from '../../src/app.js';
+import { useTempStore, seedProTenant, seedFreeTenant } from '../helpers.js';
+import { clearMockJobs } from '../../src/clients/veraeClient.js';
+import { config } from '../../src/config.js';
+
+describe('encrypted objects + share + pdf receipt', () => {
+  let ctx;
+  let server;
+  let port;
+  let ownerKey;
+  let otherKey;
+
+  before(async () => {
+    config.mockVerae = true;
+    config.natsEnabled = false;
+    config.mockJobCompleteMs = 40;
+    clearMockJobs();
+    ctx = useTempStore();
+    ownerKey = seedProTenant().apiKey;
+    otherKey = seedFreeTenant({ id: 'tenant-other', veraeUsername: 'other', veraePassword: 'otherpass' }).apiKey;
+    const app = createApp();
+    await new Promise((resolve) => {
+      server = app.listen(0, '127.0.0.1', () => {
+        port = server.address().port;
+        resolve();
+      });
+    });
+  });
+
+  after(async () => {
+    await new Promise((r) => server.close(r));
+    ctx.cleanup();
+  });
+
+  it('stores encrypted blob, hides it from other tenants, shares via token', async () => {
+    const created = await call(port, 'POST', '/zapier/v1/objects', ownerKey, {
+      filename: 'secret.txt',
+      contentBase64: Buffer.from('top-secret').toString('base64'),
+      publicMetadata: { title: 'pub' },
+      privateMetadata: { ssn: '000' },
+    });
+    assert.equal(created.status, 201);
+    const id = created.body.id;
+
+    const mine = await call(port, 'GET', `/zapier/v1/objects/${id}`, ownerKey);
+    assert.equal(mine.status, 200);
+    assert.equal(Buffer.from(mine.body.contentBase64, 'base64').toString(), 'top-secret');
+    assert.equal(mine.body.privateMetadata.ssn, '000');
+
+    const theirs = await call(port, 'GET', `/zapier/v1/objects/${id}`, otherKey);
+    assert.equal(theirs.status, 403);
+
+    const share = await call(port, 'POST', `/zapier/v1/objects/${id}/share`, ownerKey, { label: 'for-other' });
+    assert.equal(share.status, 201);
+    const redeemed = await call(port, 'GET', `/zapier/v1/shares/${share.body.token}`, otherKey);
+    assert.equal(redeemed.status, 200);
+    assert.equal(redeemed.body.filename, 'secret.txt');
+    assert.ok(redeemed.body.dek);
+    assert.equal(redeemed.body.publicMetadata.title, 'pub');
+  });
+
+  it('shares a directory tree of encrypted files', async () => {
+    const tree = await call(port, 'POST', '/zapier/v1/objects/trees', ownerKey, {
+      prefix: 'docs/',
+      files: [
+        { path: 'docs/a.txt', data: 'alpha' },
+        { path: 'docs/b.txt', data: 'beta' },
+      ],
+    });
+    assert.equal(tree.status, 201);
+    assert.equal(tree.body.fileCount, 2);
+    const share = await call(port, 'POST', `/zapier/v1/objects/trees/${tree.body.id}/share`, ownerKey, {});
+    assert.equal(share.status, 201);
+    assert.equal(share.body.kind, 'tree');
+    const redeemed = await call(port, 'GET', `/zapier/v1/shares/${share.body.token}`, otherKey);
+    assert.equal(redeemed.status, 200);
+    assert.equal(redeemed.body.kind, 'tree');
+    assert.equal(redeemed.body.files.length, 2);
+    assert.ok(redeemed.body.files[0].dek);
+  });
+
+  it('hash lookup never includes privateMetadata', async () => {
+    const created = await call(port, 'POST', '/zapier/v1/timestamp', ownerKey, {
+      data: 'meta-private',
+      publicMetadata: { vis: 'yes' },
+      privateMetadata: { secret: 'nope' },
+    });
+    const sha = created.body.sha256;
+    const look = await call(port, 'GET', `/zapier/v1/hashes/${sha}`, ownerKey);
+    assert.equal(look.status, 200);
+    assert.equal(look.body.publicMetadata.vis, 'yes');
+    assert.equal(look.body.privateMetadata, undefined);
+    const st = await call(port, 'GET', `/zapier/v1/status/${created.body.jobId}`, ownerKey);
+    assert.equal(st.body.privateMetadata.secret, 'nope');
+  });
+
+  it('returns a PDF receipt starting with %PDF', async () => {
+    const wait = await call(port, 'POST', '/zapier/v1/timestamp/wait', ownerKey, { data: 'pdf-receipt' });
+    const jobId = wait.body.id;
+    const rec = await raw(port, 'GET', `/zapier/v1/receipts/${jobId}?format=pdf`, ownerKey);
+    assert.equal(rec.status, 200);
+    assert.match(rec.body.toString('latin1').slice(0, 5), /%PDF-/);
+  });
+});
+
+function call(port, method, path, apiKey, body) {
+  return new Promise((resolve, reject) => {
+    const req = http.request(
+      {
+        hostname: '127.0.0.1',
+        port,
+        path,
+        method,
+        headers: { authorization: `Bearer ${apiKey}`, 'content-type': 'application/json' },
+      },
+      (res) => {
+        const chunks = [];
+        res.on('data', (c) => chunks.push(c));
+        res.on('end', () => {
+          const buf = Buffer.concat(chunks);
+          let parsed = {};
+          try {
+            parsed = buf.length ? JSON.parse(buf.toString()) : {};
+          } catch {
+            parsed = { raw: buf.toString() };
+          }
+          resolve({ status: res.statusCode, body: parsed });
+        });
+      },
+    );
+    req.on('error', reject);
+    if (body) req.write(JSON.stringify(body));
+    req.end();
+  });
+}
+
+function raw(port, method, path, apiKey) {
+  return new Promise((resolve, reject) => {
+    const req = http.request(
+      {
+        hostname: '127.0.0.1',
+        port,
+        path,
+        method,
+        headers: { authorization: `Bearer ${apiKey}` },
+      },
+      (res) => {
+        const chunks = [];
+        res.on('data', (c) => chunks.push(c));
+        res.on('end', () => resolve({ status: res.statusCode, body: Buffer.concat(chunks) }));
+      },
+    );
+    req.on('error', reject);
+    req.end();
+  });
+}