初始提交：DSH 多租户平台（dshs）

scripts/smoke-fs.mjs

@@ -0,0 +1,93 @@
+// Desktop/FS flow: login, list (empty), mkdir (nested), upload, and isolation
+// checks (path escape rejected, upload name sanitized, unauthenticated rejected).
+// Uses a throwaway dataRoot + in-memory DB so each run is fully isolated.
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { buildServer } from '../lib/web/server.js'
+import { resolveConfig } from '../lib/config.js'
+import { hashPassword } from '../lib/web/auth.js'
+
+function assert(condition, message) {
+  if (!condition) throw new Error('ASSERT: ' + message)
+}
+
+const dataRoot = mkdtempSync(join(tmpdir(), 'dsh-smoke-fs-'))
+const app = await buildServer(resolveConfig({ port: 0, dbPath: ':memory:', dataRoot }))
+await app.listen({ port: 0 })
+const base = `http://127.0.0.1:${app.server.address().port}`
+
+await app.db.createUser({
+  id: 'u1',
+  username: 'bob',
+  passHash: await hashPassword('bobpass123'),
+  role: 'active',
+  homeDir: '/tmp/u1-home',
+})
+
+async function json(path, { method = 'GET', body, cookie } = {}) {
+  const res = await fetch(base + path, {
+    method,
+    headers: {
+      ...(body ? { 'content-type': 'application/json' } : {}),
+      ...(cookie ? { cookie } : {}),
+    },
+    body: body ? JSON.stringify(body) : undefined,
+  })
+  const text = await res.text()
+  return { status: res.status, body: text ? JSON.parse(text) : null, setCookie: res.headers.get('set-cookie') }
+}
+
+try {
+  let r
+
+  r = await json('/api/desktop/tree')
+  assert(r.status === 401, 'unauthenticated tree is rejected')
+
+  r = await json('/api/auth/login', { method: 'POST', body: { username: 'bob', password: 'bobpass123' } })
+  assert(r.status === 200, 'login succeeds')
+  const cookie = r.setCookie.split(';')[0]
+
+  r = await json('/api/desktop/tree', { cookie })
+  console.log('tree (empty)    ->', r.status, r.body?.entries)
+  assert(r.status === 200 && r.body.entries.length === 0, 'empty workspace lists zero entries')
+
+  r = await json('/api/fs/mkdir', { method: 'POST', cookie, body: { path: 'proj' } })
+  console.log('mkdir proj      ->', r.status)
+  assert(r.status === 200, 'mkdir succeeds')
+
+  r = await json('/api/fs/mkdir', { method: 'POST', cookie, body: { path: 'proj/sub' } })
+  console.log('mkdir proj/sub  ->', r.status)
+  assert(r.status === 200, 'nested mkdir succeeds')
+
+  r = await json('/api/fs/upload', {
+    method: 'POST',
+    cookie,
+    body: { path: 'proj', name: 'hello.txt', data: Buffer.from('hi there').toString('base64') },
+  })
+  console.log('upload          ->', r.status)
+  assert(r.status === 200, 'upload succeeds')
+
+  r = await json('/api/desktop/tree?path=proj', { cookie })
+  console.log('tree proj       ->', r.status, r.body?.entries?.map((e) => `${e.name}:${e.type}`))
+  assert(r.status === 200 && r.body.entries.some((e) => e.name === 'hello.txt'), 'uploaded file is listed')
+
+  // isolation: a `..` in the *path* is rejected outright
+  r = await json('/api/fs/mkdir', { method: 'POST', cookie, body: { path: '../escape' } })
+  console.log('mkdir ../escape ->', r.status)
+  assert(r.status === 400, 'path escape is rejected')
+
+  // isolation: a path component in the *name* is sanitized to its base name
+  r = await json('/api/fs/upload', {
+    method: 'POST',
+    cookie,
+    body: { path: '', name: '../../evil.txt', data: 'aGk=' },
+  })
+  console.log('upload ../../   ->', r.status, r.body?.name)
+  assert(r.status === 200 && r.body?.name === 'evil.txt', 'upload name is sanitized to its base name')
+
+  console.log('OK: desktop/fs flow + isolation checks passed')
+} finally {
+  await app.close()
+  rmSync(dataRoot, { recursive: true, force: true })
+}