223 lines
8.5 KiB
TypeScript
223 lines
8.5 KiB
TypeScript
import fs from 'node:fs/promises';
|
|
import os from 'node:os';
|
|
import path from 'node:path';
|
|
|
|
import { afterAll, beforeAll, describe, expect, it } from 'vitest';
|
|
|
|
import type { GameSessionTokenPayload } from '@sammo-ts/common/auth/gameToken';
|
|
import {
|
|
createGamePostgresConnector,
|
|
createRedisConnector,
|
|
resolveRedisConfigFromEnv,
|
|
type GamePrismaClient,
|
|
type RedisConnector,
|
|
} from '@sammo-ts/infra';
|
|
|
|
import { RedisAccessTokenStore } from '../src/auth/accessTokenStore.js';
|
|
import { createGameApiServer } from '../src/server.js';
|
|
|
|
const databaseUrl = process.env.INPUT_EVENT_DATABASE_URL;
|
|
const integration = describe.skipIf(!databaseUrl || !process.env.REDIS_URL);
|
|
const profileId = process.env.POSTGRES_SCHEMA ?? 'public';
|
|
const profileName = `che:diplomacy-html-${process.pid}`;
|
|
const userId = `diplomacy-html-user-${process.pid}`;
|
|
const fixtureId = 920_000 + (process.pid % 50_000);
|
|
const foreignNationId = fixtureId + 1;
|
|
const secret = 'diplomacy-html-http-secret';
|
|
const redisPrefix = `sammo:diplomacy-html:${process.pid}`;
|
|
const envKeys = [
|
|
'PROFILE',
|
|
'SCENARIO',
|
|
'GAME_PROFILE_NAME',
|
|
'GAME_API_HOST',
|
|
'GAME_API_PORT',
|
|
'GAME_TOKEN_SECRET',
|
|
'GATEWAY_REDIS_PREFIX',
|
|
'GAME_UPLOAD_DIR',
|
|
'DATABASE_URL',
|
|
] as const;
|
|
const originalEnv = new Map(envKeys.map((key) => [key, process.env[key]]));
|
|
|
|
type RunningServer = Awaited<ReturnType<typeof createGameApiServer>>;
|
|
|
|
let server: RunningServer | null = null;
|
|
let baseUrl = '';
|
|
let uploadDir = '';
|
|
let db: GamePrismaClient;
|
|
let disconnectDb: (() => Promise<void>) | null = null;
|
|
let redis: RedisConnector | null = null;
|
|
let accessToken = '';
|
|
let legacyLetterId = 0;
|
|
|
|
const restoreEnv = (): void => {
|
|
for (const [key, value] of originalEnv) {
|
|
if (value === undefined) {
|
|
delete process.env[key];
|
|
} else {
|
|
process.env[key] = value;
|
|
}
|
|
}
|
|
};
|
|
|
|
const deleteProfileRedisKeys = async (): Promise<void> => {
|
|
if (!redis) return;
|
|
for await (const keys of redis.client.scanIterator({ MATCH: `sammo:game:*:${profileName}:*`, COUNT: 100 })) {
|
|
if (keys.length > 0) await redis.client.del(keys);
|
|
}
|
|
};
|
|
|
|
const cleanup = async (): Promise<void> => {
|
|
await db.diplomacyLetter.deleteMany({
|
|
where: {
|
|
OR: [
|
|
{ srcNationId: fixtureId },
|
|
{ destNationId: fixtureId },
|
|
{ srcNationId: foreignNationId },
|
|
{ destNationId: foreignNationId },
|
|
],
|
|
},
|
|
});
|
|
await db.generalAccessLog.deleteMany({ where: { generalId: fixtureId } });
|
|
await db.general.deleteMany({ where: { id: fixtureId } });
|
|
await db.nation.deleteMany({ where: { id: { in: [fixtureId, foreignNationId] } } });
|
|
await db.worldState.deleteMany({ where: { scenarioCode: 'diplomacy-html' } });
|
|
};
|
|
|
|
integration('diplomacy HTML purification over PostgreSQL and HTTP transport', () => {
|
|
beforeAll(async () => {
|
|
uploadDir = await fs.mkdtemp(path.join(os.tmpdir(), 'sammo-diplomacy-html-http-'));
|
|
process.env.PROFILE = profileId;
|
|
process.env.SCENARIO = 'diplomacy-html';
|
|
process.env.GAME_PROFILE_NAME = profileName;
|
|
process.env.GAME_API_HOST = '127.0.0.1';
|
|
process.env.GAME_API_PORT = '0';
|
|
process.env.GAME_TOKEN_SECRET = secret;
|
|
process.env.GATEWAY_REDIS_PREFIX = redisPrefix;
|
|
process.env.GAME_UPLOAD_DIR = uploadDir;
|
|
process.env.DATABASE_URL = databaseUrl;
|
|
|
|
const connector = createGamePostgresConnector({ url: databaseUrl! });
|
|
await connector.connect();
|
|
db = connector.prisma;
|
|
disconnectDb = () => connector.disconnect();
|
|
await cleanup();
|
|
|
|
await db.worldState.create({
|
|
data: {
|
|
scenarioCode: 'diplomacy-html',
|
|
currentYear: 200,
|
|
currentMonth: 1,
|
|
tickSeconds: 600,
|
|
meta: {},
|
|
},
|
|
});
|
|
await db.nation.createMany({
|
|
data: [
|
|
{ id: fixtureId, name: '정화국', color: '#00ffff' },
|
|
{ id: foreignNationId, name: '상대국', color: '#ff0000' },
|
|
],
|
|
});
|
|
await db.general.create({
|
|
data: {
|
|
id: fixtureId,
|
|
userId,
|
|
name: '정화외교관',
|
|
nationId: fixtureId,
|
|
officerLevel: 12,
|
|
turnTime: new Date('2026-07-31T00:00:00.000Z'),
|
|
},
|
|
});
|
|
const legacyLetter = await db.diplomacyLetter.create({
|
|
data: {
|
|
srcNationId: fixtureId,
|
|
destNationId: foreignNationId,
|
|
state: 'PROPOSED',
|
|
textBrief: '<p>과거 공개</p><img src=x onerror="globalThis.__legacyBriefXss=1">',
|
|
textDetail: '<strong>과거 기밀</strong><script>globalThis.__legacyDetailXss=1</script>',
|
|
srcSignerId: fixtureId,
|
|
aux: {
|
|
src: { nationName: '정화국', nationColor: '#00ffff', generalId: fixtureId },
|
|
dest: { nationName: '상대국', nationColor: '#ff0000' },
|
|
},
|
|
},
|
|
});
|
|
legacyLetterId = legacyLetter.id;
|
|
|
|
redis = createRedisConnector(resolveRedisConfigFromEnv());
|
|
await redis.connect();
|
|
const store = new RedisAccessTokenStore(redis.client, profileName);
|
|
const payload: GameSessionTokenPayload = {
|
|
version: 1,
|
|
profile: profileName,
|
|
issuedAt: new Date(Date.now() - 1_000).toISOString(),
|
|
expiresAt: new Date(Date.now() + 10 * 60_000).toISOString(),
|
|
sessionId: `diplomacy-html-session-${process.pid}`,
|
|
user: {
|
|
id: userId,
|
|
username: 'diplomacy-html-user',
|
|
displayName: 'Diplomacy HTML User',
|
|
roles: ['user'],
|
|
createdAt: '2026-07-31T00:00:00.000Z',
|
|
},
|
|
sanctions: {},
|
|
};
|
|
const created = await store.create(payload);
|
|
if (!created) throw new Error('failed to seed diplomacy HTML access token');
|
|
accessToken = created.accessToken;
|
|
|
|
server = await createGameApiServer();
|
|
baseUrl = await server.app.listen({ host: server.config.host, port: server.config.port });
|
|
}, 30_000);
|
|
|
|
afterAll(async () => {
|
|
await server?.app.close();
|
|
if (db) await cleanup();
|
|
await disconnectDb?.();
|
|
await deleteProfileRedisKeys();
|
|
await redis?.disconnect();
|
|
if (uploadDir) await fs.rm(uploadDir, { recursive: true, force: true });
|
|
restoreEnv();
|
|
}, 30_000);
|
|
|
|
it('purifies contaminated stored rows before HTTP serialization', async () => {
|
|
const response = await fetch(`${baseUrl}/trpc/diplomacy.getLetters`, {
|
|
headers: { authorization: `Bearer ${accessToken}` },
|
|
});
|
|
const body = (await response.json()) as {
|
|
result?: { data?: { letters?: Array<{ id: number; brief: string; detail: string }> } };
|
|
};
|
|
|
|
expect(response.status, JSON.stringify(body)).toBe(200);
|
|
expect(body.result?.data?.letters?.find(({ id }) => id === legacyLetterId)).toMatchObject({
|
|
brief: '<p>과거 공개</p><img src="x" />',
|
|
detail: '<strong>과거 기밀</strong>',
|
|
});
|
|
expect(JSON.stringify(body)).not.toMatch(/onerror|<script|__legacy/i);
|
|
});
|
|
|
|
it('persists only canonical editor HTML through the HTTP mutation', async () => {
|
|
const response = await fetch(`${baseUrl}/trpc/diplomacy.sendLetter`, {
|
|
method: 'POST',
|
|
headers: {
|
|
authorization: `Bearer ${accessToken}`,
|
|
'content-type': 'application/json',
|
|
},
|
|
body: JSON.stringify({
|
|
destNationId: foreignNationId,
|
|
brief: '<p><u>신규 공개</u></p><img src="javascript:alert(1)" onerror="alert(2)">',
|
|
detail: '<ol><li>조건</li></ol><a href="https://example.com" target="_blank">자료</a>',
|
|
}),
|
|
});
|
|
const body = (await response.json()) as { result?: { data?: { id?: number } } };
|
|
|
|
expect(response.status, JSON.stringify(body)).toBe(200);
|
|
const createdId = body.result?.data?.id;
|
|
expect(createdId).toBeTypeOf('number');
|
|
const stored = await db.diplomacyLetter.findUniqueOrThrow({ where: { id: createdId } });
|
|
expect(stored.textBrief).toBe('<p><u>신규 공개</u></p>');
|
|
expect(stored.textDetail).toBe(
|
|
'<ol><li>조건</li></ol><a href="https://example.com" target="_blank" rel="noopener noreferrer nofollow">자료</a>'
|
|
);
|
|
});
|
|
});
|