133 lines
8.4 KiB
JavaScript
133 lines
8.4 KiB
JavaScript
import test from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { spawn } from 'node:child_process';
|
|
import { once } from 'node:events';
|
|
import fs from 'node:fs/promises';
|
|
import net from 'node:net';
|
|
import os from 'node:os';
|
|
import path from 'node:path';
|
|
import { fileURLToPath } from 'node:url';
|
|
import { createStore } from '../src/store.js';
|
|
import { encodePng } from '../src/png.js';
|
|
import { normalizeToWebp } from '../src/normalize.js';
|
|
|
|
const projectRoot = fileURLToPath(new URL('../', import.meta.url));
|
|
const adminToken = 'test-admin-token-000000000000';
|
|
|
|
test('public search/read and admin-only metadata mutations work end to end', { timeout: 20_000 }, async (t) => {
|
|
const probe = net.createServer();
|
|
try {
|
|
await new Promise((resolve, reject) => { probe.once('error', reject); probe.listen(0, '127.0.0.1', resolve); });
|
|
} catch (error) {
|
|
if (error.code === 'EPERM') { t.skip('loopback listeners are disabled in this sandbox'); return; }
|
|
throw error;
|
|
}
|
|
const port = probe.address().port;
|
|
await new Promise((resolve) => probe.close(resolve));
|
|
const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'meme-search-api-'));
|
|
const store = await createStore({ dataDir: dir });
|
|
await store.addTag('cats');
|
|
await store.addTag('work');
|
|
const png = encodePng(16, 16, () => [0, 220, 40, 255]);
|
|
const normalized = await normalizeToWebp(png);
|
|
const approved = await store.save({ ...normalized, originalName: 'cat.png', caption: 'An angry cat at work', tags: ['cats', 'work'] });
|
|
const pendingImage = await normalizeToWebp(encodePng(16, 16, () => [10, 150, 40, 255]));
|
|
const pending = await store.save({ ...pendingImage, originalName: 'pending.png', caption: 'A pending cat', tags: ['cats'], status: 'pending' });
|
|
const mockPath = path.join(dir, 'mock-ai.mjs');
|
|
await fs.writeFile(mockPath, `globalThis.fetch = async () => ({ ok: true, json: async () => ({ status: 'completed', output_text: JSON.stringify({ decision: 'approved', score: 99, reason: 'A good meme', caption: 'AI caption: a sleeping cat at work', tags: ['cats', 'invented'] }) }) });`);
|
|
const child = spawn(process.execPath, ['--import', mockPath, 'server.js'], {
|
|
cwd: projectRoot,
|
|
env: { ...process.env, ADMIN_TOKEN: adminToken, OPENAI_API_KEY: 'test-key', AUTO_APPROVE_MIN_SCORE: '80', DATA_DIR: dir,
|
|
HOST: '127.0.0.1', PORT: String(port), SEED_DEMO_MEMES: 'false', SITE_URL: `http://127.0.0.1:${port}` },
|
|
stdio: ['ignore', 'pipe', 'pipe']
|
|
});
|
|
t.after(async () => {
|
|
if (child.exitCode === null && child.signalCode === null) { child.kill(); await once(child, 'exit'); }
|
|
await fs.rm(dir, { recursive: true, force: true });
|
|
});
|
|
await new Promise((resolve, reject) => {
|
|
let output = '';
|
|
const timeout = setTimeout(() => finish(new Error(`Server startup timed out: ${output}`)), 10_000);
|
|
const onData = (chunk) => { output += chunk; if (output.includes('The Meme Protocol listening')) finish(); };
|
|
const onExit = () => finish(new Error(`Server failed to start: ${output}`));
|
|
const finish = (error) => {
|
|
clearTimeout(timeout); child.stdout.off('data', onData); child.stderr.off('data', onData); child.off('exit', onExit);
|
|
error ? reject(error) : resolve();
|
|
};
|
|
child.stdout.on('data', onData); child.stderr.on('data', onData); child.once('exit', onExit);
|
|
});
|
|
const base = `http://127.0.0.1:${port}`;
|
|
const request = (url, method = 'GET', body, authenticated = false) => fetch(`${base}${url}`, {
|
|
method, headers: { ...(authenticated ? { 'X-Admin-Token': adminToken } : {}), ...(body !== undefined ? { 'Content-Type': 'application/json' } : {}) },
|
|
...(body !== undefined ? { body: typeof body === 'string' ? body : JSON.stringify(body) } : {})
|
|
});
|
|
const publicList = await (await request('/api/memes?q=ANGRY%20catt&tag=cats&tag=work')).json();
|
|
assert.equal(publicList.total, 1);
|
|
assert.equal(publicList.memes[0].id, approved.id);
|
|
assert.equal(publicList.memes[0].caption, 'An angry cat at work');
|
|
assert.deepEqual(publicList.memes[0].tags, ['cats', 'work']);
|
|
assert.equal('storageKey' in publicList.memes[0], false);
|
|
assert.equal('metadataVersion' in publicList.memes[0], false);
|
|
assert.deepEqual((await (await request('/api/tags')).json()).tags, ['cats', 'work']);
|
|
assert.equal((await request(`/api/memes/${pending.id}`)).status, 404);
|
|
assert.equal((await request('/api/memes?q=' + 'a'.repeat(201))).status, 400);
|
|
assert.equal((await request('/api/memes?tag=%3Cscript%3E')).status, 400);
|
|
assert.equal((await request('/api/memes?' + Array(21).fill('tag=cats').join('&'))).status, 400);
|
|
|
|
for (const [url, method, body] of [
|
|
['/api/admin/memes', 'GET'], ['/api/admin/tags', 'GET'], ['/api/admin/pending', 'GET'],
|
|
['/api/admin/tags', 'POST', { name: 'dogs' }], ['/api/admin/tags/cats', 'DELETE'],
|
|
[`/api/admin/memes/${approved.id}`, 'PATCH', { caption: 'Malicious overwrite', tags: [] }],
|
|
[`/api/admin/memes/${approved.id}/generate`, 'POST'],
|
|
['/api/admin/approve', 'POST', { ids: [pending.id] }], ['/api/admin/delete', 'POST', { ids: [approved.id] }]
|
|
]) assert.equal((await request(url, method, body)).status, 404, `${method} ${url} must require admin auth`);
|
|
assert.equal((await request(`/api/memes/${approved.id}`, 'PATCH', { caption: 'Public write' })).status, 404);
|
|
assert.equal((await request('/api/tags', 'POST', { name: 'public-tag' })).status, 404);
|
|
const all = await request('/api/admin/memes?status=all', 'GET', undefined, true);
|
|
assert.equal(all.headers.get('cache-control'), 'no-store');
|
|
assert.equal((await all.json()).total, 2);
|
|
assert.equal((await request('/api/admin/memes?status=bad', 'GET', undefined, true)).status, 400);
|
|
assert.equal((await request(`/api/admin/memes/${approved.id}`, 'PATCH', '{bad json', true)).status, 400);
|
|
assert.equal((await request(`/api/admin/memes/${approved.id}`, 'PATCH', null, true)).status, 400);
|
|
assert.equal((await request(`/api/admin/memes/${approved.id}`, 'PATCH', { tags: ['invented'] }, true)).status, 400);
|
|
assert.equal((await request(`/api/admin/memes/${approved.id}`, 'PATCH', { status: 'pending' }, true)).status, 400);
|
|
assert.equal((await request('/api/admin/tags', 'POST', { name: ' Dogs ' }, true)).status, 201);
|
|
assert.equal((await request('/api/admin/tags', 'POST', { name: 'dogs' }, true)).status, 409);
|
|
const edited = await request(`/api/admin/memes/${approved.id}`, 'PATCH', { caption: 'Admin caption', tags: ['dogs'] }, true);
|
|
assert.equal(edited.status, 200);
|
|
const metadata = await (await request(`/api/memes/${approved.id}`)).json();
|
|
assert.equal(metadata.meme.caption, 'Admin caption');
|
|
assert.deepEqual(metadata.meme.tags, ['dogs']);
|
|
|
|
const skipped = await (await request(`/api/admin/memes/${approved.id}/generate`, 'POST', { onlyMissing: true }, true)).json();
|
|
assert.equal(skipped.skipped, true);
|
|
assert.equal(skipped.meme.caption, 'Admin caption');
|
|
const generated = await (await request(`/api/admin/memes/${pending.id}/generate`, 'POST', {}, true)).json();
|
|
assert.equal(generated.meme.caption, 'AI caption: a sleeping cat at work');
|
|
assert.deepEqual(generated.meme.tags, ['cats']);
|
|
assert.equal(generated.meme.status, 'pending');
|
|
assert.equal((await request(`/api/memes/${pending.id}`)).status, 404);
|
|
|
|
const form = new FormData();
|
|
form.append('meme', new Blob([encodePng(16, 16, () => [200, 40, 90, 255])], { type: 'image/png' }), 'upload.png');
|
|
form.append('caption', 'Client injected caption');
|
|
form.append('tags', 'invented');
|
|
const upload = await fetch(`${base}/api/memes`, { method: 'POST', body: form });
|
|
assert.equal(upload.status, 201);
|
|
const uploaded = (await upload.json()).meme;
|
|
assert.equal(uploaded.caption, 'AI caption: a sleeping cat at work');
|
|
assert.deepEqual(uploaded.tags, ['cats']);
|
|
const view = await (await request(`/api/memes/${uploaded.id}/view`, 'POST')).json();
|
|
assert.equal(view.meme.caption, uploaded.caption);
|
|
const deletedTag = await request('/api/admin/tags/cats', 'DELETE', undefined, true);
|
|
assert.equal(deletedTag.status, 200);
|
|
assert.deepEqual((await (await request(`/api/memes/${uploaded.id}`)).json()).meme.tags, []);
|
|
const spec = await (await request('/openapi.json')).json();
|
|
assert.ok(spec.paths['/api/tags']);
|
|
assert.ok(spec.components.schemas.Meme.properties.caption);
|
|
assert.ok(!Object.keys(spec.paths).some((url) => url.startsWith('/api/admin')));
|
|
const reloaded = await createStore({ dataDir: dir });
|
|
assert.equal(reloaded.get(approved.id).caption, 'Admin caption');
|
|
assert.deepEqual(reloaded.get(pending.id).tags, []);
|
|
});
|