import { mkdir, symlink, writeFile } from "node:fs/promises"; import { join } from "node:path"; import { makeTorrent } from "@umt/testkit"; import { afterAll, beforeAll, describe, expect, it } from "vitest"; import { createFmHarness, EXEC_KEY, type FmHarness, pgAvailable, READ_KEY, SESSION } from "./harness.ts"; // FM-2:GET /files/preview —— 仅管理员会话;路径守卫同下载;文本编码探测、字幕前 N 条、.torrent 解析、图片尺寸。 const skip = !(await pgAvailable()); describe.skipIf(skip)("files preview FM-2", () => { let h: FmHarness; beforeAll(async () => { h = await createFmHarness("fm2pv", {}, { runTransfers: false }); const dir = join(h.lib, "pv"); await mkdir(dir, { recursive: true }); // GBK "你好,世界。" await writeFile( join(dir, "readme.txt"), new Uint8Array([0xc4, 0xe3, 0xba, 0xc3, 0xa3, 0xac, 0xca, 0xc0, 0xbd, 0xe7, 0xa1, 0xa3]), ); await writeFile(join(dir, "movie.nfo"), "沙丘"); await writeFile(join(dir, "big.log"), "a".repeat(1024 * 1024 + 10)); const srt = Array.from( { length: 250 }, (_, i) => `${i + 1}\n00:00:${String(i % 60).padStart(2, "0")},000 --> 00:00:${String(i % 60).padStart(2, "0")},500\n第 ${i + 1} 句\n`, ).join("\n"); await writeFile(join(dir, "a.srt"), srt); const t = makeTorrent({ name: "Dune.Part.Two.2024", files: [ { path: "Dune.mkv", length: 1000 }, { path: "Subs/chs.srt", length: 20 }, ], private: true, announce: "https://tracker.example/announce", }); await writeFile(join(dir, "dune.torrent"), t.bytes); await writeFile(join(dir, "bad.torrent"), "not bencode"); const png = new Uint8Array(32); png.set([ 0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0, 0, 0, 13, 0x49, 0x48, 0x44, 0x52, 0, 0, 3, 232, 0, 0, 5, 220, ]); await writeFile(join(dir, "poster.png"), png); await writeFile(join(dir, "v.mkv"), "video"); await symlink(join(h.outside, "secret.txt"), join(dir, "leak.txt")); (h as unknown as { torrentHash: string }).torrentHash = t.hash; }); afterAll(async () => h?.close()); const url = (path: string) => `/files/preview?root=${encodeURIComponent(h.libRoot)}&path=${encodeURIComponent(path)}`; it("只接受管理员会话", async () => { expect((await h.api("GET", url("pv/movie.nfo"), undefined, READ_KEY)).status).toBe(403); expect((await h.api("GET", url("pv/movie.nfo"), undefined, EXEC_KEY)).status).toBe(403); expect((await h.api("GET", url("pv/movie.nfo"))).status).toBe(403); }); it("文本:编码探测、1 MiB 截断", async () => { const gbk = await h.api("GET", url("pv/readme.txt"), undefined, SESSION); expect(gbk.status).toBe(200); expect(gbk.body.data).toMatchObject({ type: "text", format: "txt", encoding: "gb18030", text: "你好,世界。", truncated: false, }); const nfo = await h.api("GET", url("pv/movie.nfo"), undefined, SESSION); expect(nfo.body.data).toMatchObject({ type: "text", encoding: "utf-8" }); const big = await h.api("GET", url("pv/big.log"), undefined, SESSION); expect(big.body.data.truncated).toBe(true); expect(big.body.data.text.length).toBe(1024 * 1024); expect(big.body.data.size).toBe(1024 * 1024 + 10); }); it("字幕:按时间排序、只回前 200 条", async () => { const r = await h.api("GET", url("pv/a.srt"), undefined, SESSION); expect(r.body.data.type).toBe("subtitle"); expect(r.body.data.cues.length).toBe(200); expect(r.body.data.parsed).toBe(250); expect(r.body.data.cues[0]).toEqual({ start: 0, end: 500, text: "第 1 句" }); }); it(".torrent:文件列表、tracker、hash;坏文件 400", async () => { const r = await h.api("GET", url("pv/dune.torrent"), undefined, SESSION); expect(r.status).toBe(200); expect(r.body.data).toMatchObject({ type: "torrent", name: "Dune.Part.Two.2024", hash: (h as unknown as { torrentHash: string }).torrentHash, private: true, fileCount: 2, totalSize: 1020, trackers: ["https://tracker.example/announce"], }); expect(r.body.data.files[1]).toEqual({ path: "Dune.Part.Two.2024/Subs/chs.srt", length: 20 }); const bad = await h.api("GET", url("pv/bad.torrent"), undefined, SESSION); expect(bad.status).toBe(400); }); it("图片只回尺寸;视频/目录/根外链接拒绝", async () => { const img = await h.api("GET", url("pv/poster.png"), undefined, SESSION); expect(img.body.data).toEqual({ type: "image", size: 32, mime: "image/png", width: 1000, height: 1500 }); expect((await h.api("GET", url("pv/v.mkv"), undefined, SESSION)).status).toBe(403); expect((await h.api("GET", url("pv"), undefined, SESSION)).status).toBe(400); const leak = await h.api("GET", url("pv/leak.txt"), undefined, SESSION); expect(leak.status).toBe(400); expect(leak.body.error.message).toMatch(/^path_escape:/); expect((await h.api("GET", url("pv/none.txt"), undefined, SESSION)).status).toBe(404); }); it("下载也放行文本与 .torrent(附件)", async () => { const r = await h.raw( "GET", `/files/download?root=${encodeURIComponent(h.libRoot)}&path=${encodeURIComponent("pv/dune.torrent")}`, SESSION, ); expect(r.status).toBe(200); expect(r.headers.get("content-type")).toBe("application/x-bittorrent"); expect(r.headers.get("content-disposition")).toMatch(/^attachment;/); await r.arrayBuffer(); }); });