knowledge-governance/internal/platform/spool/artifact_test.go

package spool

import (
	"crypto/sha256"
	"encoding/hex"
	"io"
	"os"
	"path/filepath"
	"testing"
)

func TestOpenVerifiedRechecksSizeAndSHAWhileStreaming(t *testing.T) {
	root := t.TempDir()
	if err := os.Mkdir(filepath.Join(root, "objects"), 0o700); err != nil {
		t.Fatal(err)
	}
	body := []byte("safe governance document\n")
	ref := filepath.Join("objects", "artifact.md")
	if err := os.WriteFile(filepath.Join(root, ref), body, 0o600); err != nil {
		t.Fatal(err)
	}
	digest := sha256.Sum256(body)
	artifact, err := OpenVerified(root, Expectation{
		RelativeRef: ref,
		SHA256:      hex.EncodeToString(digest[:]),
		SizeBytes:   int64(len(body)),
		Format:      "md",
	}, 50*1024*1024)
	if err != nil {
		t.Fatalf("OpenVerified() error = %v", err)
	}
	defer artifact.Close()
	streamed, err := io.ReadAll(artifact)
	if err != nil {
		t.Fatalf("ReadAll() error = %v", err)
	}
	if string(streamed) != string(body) {
		t.Fatalf("streamed body = %q", streamed)
	}
	if err := artifact.VerifyComplete(); err != nil {
		t.Fatalf("VerifyComplete() error = %v", err)
	}
}

func TestInspectVerifiedReturnsCanonicalExpectation(t *testing.T) {
	root := t.TempDir()
	body := []byte("governance p3 unique fact\n")
	if err := os.Mkdir(filepath.Join(root, "manual"), 0o700); err != nil {
		t.Fatal(err)
	}
	ref := filepath.Join("manual", "fixture.md")
	if err := os.WriteFile(filepath.Join(root, ref), body, 0o600); err != nil {
		t.Fatal(err)
	}
	digest := sha256.Sum256(body)

	got, err := InspectVerified(root, ref, "md", 1024)
	if err != nil {
		t.Fatalf("InspectVerified() error = %v", err)
	}
	if got.RelativeRef != ref || got.SizeBytes != int64(len(body)) || got.SHA256 != hex.EncodeToString(digest[:]) || got.Format != "md" {
		t.Fatalf("expectation = %#v", got)
	}
}

func TestOpenVerifiedRejectsSymlinksAndPathEscapes(t *testing.T) {
	root := t.TempDir()
	body := []byte("safe governance document\n")
	digest := sha256.Sum256(body)
	expected := Expectation{
		SHA256:    hex.EncodeToString(digest[:]),
		SizeBytes: int64(len(body)),
		Format:    "md",
	}
	if err := os.Mkdir(filepath.Join(root, "real"), 0o700); err != nil {
		t.Fatal(err)
	}
	if err := os.WriteFile(filepath.Join(root, "real", "artifact.md"), body, 0o600); err != nil {
		t.Fatal(err)
	}
	if err := os.Symlink(filepath.Join("real", "artifact.md"), filepath.Join(root, "file-link.md")); err != nil {
		t.Fatal(err)
	}
	if err := os.Symlink("real", filepath.Join(root, "dir-link")); err != nil {
		t.Fatal(err)
	}
	parent := filepath.Dir(root)
	rootLink := filepath.Join(parent, filepath.Base(root)+"-link")
	if err := os.Symlink(root, rootLink); err != nil {
		t.Fatal(err)
	}
	defer os.Remove(rootLink)

	tests := []struct {
		name string
		root string
		ref  string
	}{
		{name: "absolute reference", root: root, ref: filepath.Join(root, "real", "artifact.md")},
		{name: "parent escape", root: root, ref: "../artifact.md"},
		{name: "file symlink", root: root, ref: "file-link.md"},
		{name: "directory symlink", root: root, ref: filepath.Join("dir-link", "artifact.md")},
		{name: "root symlink", root: rootLink, ref: filepath.Join("real", "artifact.md")},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			expectation := expected
			expectation.RelativeRef = tt.ref
			artifact, err := OpenVerified(tt.root, expectation, 50*1024*1024)
			if artifact != nil {
				artifact.Close()
			}
			if err == nil {
				t.Fatalf("OpenVerified(%q) error = nil", tt.ref)
			}
		})
	}
}

func TestOpenVerifiedRejectsUnsupportedFormat(t *testing.T) {
	root := t.TempDir()
	body := []byte("safe governance document\n")
	path := filepath.Join(root, "artifact.bin")
	if err := os.WriteFile(path, body, 0o600); err != nil {
		t.Fatal(err)
	}
	digest := sha256.Sum256(body)
	artifact, err := OpenVerified(root, Expectation{
		RelativeRef: "artifact.bin",
		SHA256:      hex.EncodeToString(digest[:]),
		SizeBytes:   int64(len(body)),
		Format:      "exe",
	}, 50*1024*1024)
	if artifact != nil {
		artifact.Close()
	}
	if err == nil {
		t.Fatal("OpenVerified() error = nil for unsupported format")
	}
}

func TestOpenVerifiedRejectsContentThatDoesNotMatchFormat(t *testing.T) {
	tests := []struct {
		name   string
		format string
		body   []byte
	}{
		{name: "PDF magic", format: "pdf", body: []byte("not a PDF")},
		{name: "DOCX container", format: "docx", body: []byte("not a ZIP")},
		{name: "legacy Office magic", format: "doc", body: []byte("not OLE")},
		{name: "JSON syntax", format: "json", body: []byte("{")},
		{name: "text binary", format: "md", body: []byte{'a', 0, 'b'}},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			root := t.TempDir()
			if err := os.WriteFile(filepath.Join(root, "artifact"), tt.body, 0o600); err != nil {
				t.Fatal(err)
			}
			digest := sha256.Sum256(tt.body)
			artifact, err := OpenVerified(root, Expectation{
				RelativeRef: "artifact",
				SHA256:      hex.EncodeToString(digest[:]),
				SizeBytes:   int64(len(tt.body)),
				Format:      tt.format,
			}, 50*1024*1024)
			if artifact != nil {
				artifact.Close()
			}
			if err == nil {
				t.Fatalf("OpenVerified() error = nil for format %s", tt.format)
			}
		})
	}
}

func TestOpenVerifiedRejectsHTMLMasqueradingAsText(t *testing.T) {
	root := t.TempDir()
	body := []byte(" <!doctype html><html><title>Sign in</title></html>")
	if err := os.WriteFile(filepath.Join(root, "artifact.md"), body, 0o600); err != nil {
		t.Fatal(err)
	}
	digest := sha256.Sum256(body)
	artifact, err := OpenVerified(root, Expectation{
		RelativeRef: "artifact.md",
		SHA256:      hex.EncodeToString(digest[:]),
		SizeBytes:   int64(len(body)),
		Format:      "md",
	}, 50*1024*1024)
	if artifact != nil {
		artifact.Close()
	}
	if err == nil {
		t.Fatal("OpenVerified() error = nil for HTML login page")
	}
}

func TestOpenVerifiedRejectsEmptyArtifact(t *testing.T) {
	root := t.TempDir()
	if err := os.WriteFile(filepath.Join(root, "empty.md"), nil, 0o600); err != nil {
		t.Fatal(err)
	}
	digest := sha256.Sum256(nil)
	artifact, err := OpenVerified(root, Expectation{
		RelativeRef: "empty.md",
		SHA256:      hex.EncodeToString(digest[:]),
		SizeBytes:   0,
		Format:      "md",
	}, 50*1024*1024)
	if artifact != nil {
		artifact.Close()
	}
	if err == nil {
		t.Fatal("OpenVerified() error = nil for empty artifact")
	}
}