dashcaddy/dashcaddy-api/__tests__/share-dc083.routes.test.js

/**
 * DC-083 -- Public share endpoint input hardening.
 *
 * The two CSRF-exempt public endpoints (POST /share/:token/subscribe +
 * POST /share/:token/redeem-tailscale) accept untrusted body fields. The
 * pre-fix code had three coupled bugs:
 *
 *   1. `email.includes('@')` accepted `@`, `a@`, `<script>@x.c`, and 10MB
 *      strings as "valid email" -- and the field was never even used after
 *      validation (the subscribe endpoint discarded it).
 *   2. `typeof deviceId === 'string'` accepted arbitrary strings of any
 *      length, including CR/LF/NUL -- which fed straight into the Tailscale
 *      auth-key description string and the on-disk shares.json.
 *   3. No rate-limit; the general limiter (1000/15min) was too generous for
 *      unauthenticated state-mutating endpoints.
 *
 * Fix: charset/length/control-char-bounded validators at the route layer
 * AND at the store layer (defense-in-depth), plus a dedicated
 * SHARE_PUBLIC rate-limit (30/15min) on the public endpoints.
 *
 * Coverage:
 *   - subscribe email: rejects bare @, missing TLD, oversized, CR/LF, shell
 *     metachars, control chars; accepts normal addresses; accepts OMITTED
 *     email (backwards-compatible with the original behavior).
 *   - subscribe email propagates to share-store subscriberEmails (capped 8).
 *   - redeem-tailscale deviceId: rejects CR/LF/NUL, oversized, empty,
 *     spaces, brackets, quotes; accepts Tailscale-style base64url+hphens;
 *     accepts OMITTED deviceId (treated as 'unknown').
 *   - Sanitized usedBy is what flows into the on-disk shares.json.
 *   - Rate-limit fires after the configured budget per IP.
 *   - Store-level defense: bypassing the route (direct store call) still
 *     rejects invalid inputs.
 */

'use strict';

const fs = require('fs');
const path = require('path');
const os = require('os');
const express = require('express');
const request = require('supertest');
const { createShareStore } = require('../src/security/share-store');

function _tmpDir() {
  return fs.mkdtempSync(path.join(os.tmpdir(), 'dashcaddy-share-dc083-'));
}
function _cleanup(dir) {
  try { fs.rmSync(dir, { recursive: true, force: true }); } catch {}
}

function _buildApp({ shareStore } = {}) {
  const app = express();
  app.use(express.json());
  // No req.user injection -- the public endpoints must work without auth.
  const shareRoutes = require('../routes/share');
  app.use(shareRoutes({
    shareStore,
    licenseManager: { isPro: () => true, allowsLifetimeLicense: () => false },
    tailscaleCoord: { createAuthKey: async () => ({ id: 'k', key: 'tskey-x' }) },
    notificationManager: { sendEmail: async () => ({ messageId: 'fake' }) },
    servicesStateManager: { get: async () => null, read: async () => [] },
    servicesFile: null,
    asyncHandler: (fn, _label) => (req, res, next) => Promise.resolve(fn(req, res, next)).catch(next),
    log: { info() {}, warn() {}, error() {} },
  }));
  app.use((err, _req, res, _next) => {
    if (err && err.statusCode) {
      return res.status(err.statusCode).json({
        success: false,
        error: err.message,
        code: err.code,
      });
    }
    return res.status(500).json({ success: false, error: err && err.message });
  });
  return app;
}

// --------- Subscribe endpoint -- email validation ---------------------------------------------------------------------------------------

describe('DC-083: subscribe email validation', () => {
  let dir, shareStore;
  beforeEach(() => { dir = _tmpDir(); shareStore = createShareStore({ dataDir: dir }); });
  afterEach(() => _cleanup(dir));

  test('accepts omitted email (backwards-compatible)', async () => {
    const issued = await shareStore.issuePublic({ serviceId: 'plex' });
    const app = _buildApp({ shareStore });
    const res = await request(app).post(`/share/${issued.token}/subscribe`).send({});
    expect(res.status).toBe(200);
    expect(res.body.data.count).toBe(1);
  });

  test('accepts a well-formed email', async () => {
    const issued = await shareStore.issuePublic({ serviceId: 'plex' });
    const app = _buildApp({ shareStore });
    const res = await request(app)
      .post(`/share/${issued.token}/subscribe`)
      .send({ email: 'subscriber@example.com' });
    expect(res.status).toBe(200);
    expect(res.body.data.count).toBe(1);
  });

  test('lowercases the email on capture', async () => {
    const issued = await shareStore.issuePublic({ serviceId: 'plex' });
    const app = _buildApp({ shareStore });
    const res = await request(app)
      .post(`/share/${issued.token}/subscribe`)
      .send({ email: 'Subscriber@Example.COM' });
    expect(res.status).toBe(200);
    const raw = JSON.parse(fs.readFileSync(path.join(dir, 'shares.json'), 'utf8'));
    const id = Object.keys(raw.shares)[0];
    expect(raw.shares[id].subscriberEmails).toEqual(['subscriber@example.com']);
  });

  test('rejects bare @', async () => {
    const issued = await shareStore.issuePublic({ serviceId: 'plex' });
    const app = _buildApp({ shareStore });
    const res = await request(app)
      .post(`/share/${issued.token}/subscribe`)
      .send({ email: '@' });
    expect(res.status).toBe(400);
  });

  test('rejects missing local-part', async () => {
    const issued = await shareStore.issuePublic({ serviceId: 'plex' });
    const app = _buildApp({ shareStore });
    const res = await request(app)
      .post(`/share/${issued.token}/subscribe`)
      .send({ email: '@example.com' });
    expect(res.status).toBe(400);
  });

  test('rejects missing TLD', async () => {
    const issued = await shareStore.issuePublic({ serviceId: 'plex' });
    const app = _buildApp({ shareStore });
    const res = await request(app)
      .post(`/share/${issued.token}/subscribe`)
      .send({ email: 'user@localhost' });
    expect(res.status).toBe(400);
  });

  test('rejects single-char TLD', async () => {
    const issued = await shareStore.issuePublic({ serviceId: 'plex' });
    const app = _buildApp({ shareStore });
    const res = await request(app)
      .post(`/share/${issued.token}/subscribe`)
      .send({ email: 'user@example.c' });
    expect(res.status).toBe(400);
  });

  test('rejects CR/LF in email (CRLF-injection defense)', async () => {
    const issued = await shareStore.issuePublic({ serviceId: 'plex' });
    const app = _buildApp({ shareStore });
    const res = await request(app)
      .post(`/share/${issued.token}/subscribe`)
      .send({ email: 'a@b.com\r\nX-Injected: yes' });
    expect(res.status).toBe(400);
  });

  test('rejects NUL in email', async () => {
    const issued = await shareStore.issuePublic({ serviceId: 'plex' });
    const app = _buildApp({ shareStore });
    const res = await request(app)
      .post(`/share/${issued.token}/subscribe`)
      .send({ email: 'a@b.com\x00hack' });
    expect(res.status).toBe(400);
  });

  test('rejects oversized email (>254 chars)', async () => {
    const issued = await shareStore.issuePublic({ serviceId: 'plex' });
    const app = _buildApp({ shareStore });
    const longLocal = 'a'.repeat(250) + '@example.com';
    const res = await request(app)
      .post(`/share/${issued.token}/subscribe`)
      .send({ email: longLocal });
    expect(res.status).toBe(400);
  });

  test('rejects XSS-shape email', async () => {
    const issued = await shareStore.issuePublic({ serviceId: 'plex' });
    const app = _buildApp({ shareStore });
    const res = await request(app)
      .post(`/share/${issued.token}/subscribe`)
      .send({ email: '<script>@x.com' });
    expect(res.status).toBe(400);
  });

  test('rejects non-string email', async () => {
    const issued = await shareStore.issuePublic({ serviceId: 'plex' });
    const app = _buildApp({ shareStore });
    const res = await request(app)
      .post(`/share/${issued.token}/subscribe`)
      .send({ email: 42 });
    expect(res.status).toBe(400);
  });

  test('keeps subscriberEmails capped to 8 entries', async () => {
    const issued = await shareStore.issuePublic({ serviceId: 'plex' });
    const app = _buildApp({ shareStore });
    for (let i = 0; i < 12; i++) {
      await request(app)
        .post(`/share/${issued.token}/subscribe`)
        .send({ email: `user${i}@example.com` });
    }
    const raw = JSON.parse(fs.readFileSync(path.join(dir, 'shares.json'), 'utf8'));
    const id = Object.keys(raw.shares)[0];
    expect(raw.shares[id].subscriberEmails).toHaveLength(8);
    // FIFO cap -- the first 4 got dropped, latest 8 remain.
    expect(raw.shares[id].subscriberEmails[0]).toBe('user4@example.com');
    expect(raw.shares[id].subscriberEmails[7]).toBe('user11@example.com');
  });

  test('omitted email does not write subscriberEmails', async () => {
    const issued = await shareStore.issuePublic({ serviceId: 'plex' });
    const app = _buildApp({ shareStore });
    await request(app).post(`/share/${issued.token}/subscribe`).send({});
    const raw = JSON.parse(fs.readFileSync(path.join(dir, 'shares.json'), 'utf8'));
    const id = Object.keys(raw.shares)[0];
    expect(raw.shares[id].subscriberEmails).toBeUndefined();
  });
});

// --------- Redeem-tailscale endpoint -- deviceId validation ---------------------------------------------------------

describe('DC-083: redeem-tailscale deviceId validation', () => {
  let dir, shareStore;
  beforeEach(() => { dir = _tmpDir(); shareStore = createShareStore({ dataDir: dir }); });
  afterEach(() => _cleanup(dir));

  test('accepts Tailscale-style base64url ID', async () => {
    const issued = await shareStore.issueTailscale({ serviceId: 'plex', email: 'a@b.com' });
    const app = _buildApp({ shareStore });
    const res = await request(app)
      .post(`/share/${issued.token}/redeem-tailscale`)
      .send({ deviceId: 'nodekey-abc123-def456' });
    expect(res.status).toBe(200);
    expect(res.body.data.redeemed).toBe(true);
  });

  test('accepts OMITTED deviceId (treated as "unknown")', async () => {
    const issued = await shareStore.issueTailscale({ serviceId: 'plex', email: 'a@b.com' });
    const app = _buildApp({ shareStore });
    const res = await request(app)
      .post(`/share/${issued.token}/redeem-tailscale`)
      .send({});
    expect(res.status).toBe(200);
    const raw = JSON.parse(fs.readFileSync(path.join(dir, 'shares.json'), 'utf8'));
    const id = Object.keys(raw.shares)[0];
    expect(raw.shares[id].usedBy).toBe('unknown');
  });

  test('rejects CR/LF in deviceId (CRLF-injection defense)', async () => {
    const issued = await shareStore.issueTailscale({ serviceId: 'plex', email: 'a@b.com' });
    const app = _buildApp({ shareStore });
    const res = await request(app)
      .post(`/share/${issued.token}/redeem-tailscale`)
      .send({ deviceId: 'nodekey\r\nX-Injected: yes' });
    expect(res.status).toBe(400);
  });

  test('rejects NUL in deviceId', async () => {
    const issued = await shareStore.issueTailscale({ serviceId: 'plex', email: 'a@b.com' });
    const app = _buildApp({ shareStore });
    const res = await request(app)
      .post(`/share/${issued.token}/redeem-tailscale`)
      .send({ deviceId: 'nodekey\x00hack' });
    expect(res.status).toBe(400);
  });

  test('rejects oversized deviceId (>128 chars)', async () => {
    const issued = await shareStore.issueTailscale({ serviceId: 'plex', email: 'a@b.com' });
    const app = _buildApp({ shareStore });
    const long = 'a'.repeat(200);
    const res = await request(app)
      .post(`/share/${issued.token}/redeem-tailscale`)
      .send({ deviceId: long });
    expect(res.status).toBe(400);
  });

  test('rejects empty string deviceId', async () => {
    const issued = await shareStore.issueTailscale({ serviceId: 'plex', email: 'a@b.com' });
    const app = _buildApp({ shareStore });
    const res = await request(app)
      .post(`/share/${issued.token}/redeem-tailscale`)
      .send({ deviceId: '' });
    expect(res.status).toBe(400);
  });

  test('rejects whitespace in deviceId', async () => {
    const issued = await shareStore.issueTailscale({ serviceId: 'plex', email: 'a@b.com' });
    const app = _buildApp({ shareStore });
    const res = await request(app)
      .post(`/share/${issued.token}/redeem-tailscale`)
      .send({ deviceId: 'node key 1' });
    expect(res.status).toBe(400);
  });

  test('rejects shell metachars in deviceId', async () => {
    const issued = await shareStore.issueTailscale({ serviceId: 'plex', email: 'a@b.com' });
    const app = _buildApp({ shareStore });
    const res = await request(app)
      .post(`/share/${issued.token}/redeem-tailscale`)
      .send({ deviceId: 'nodekey; rm -rf /' });
    expect(res.status).toBe(400);
  });

  test('rejects non-string deviceId', async () => {
    const issued = await shareStore.issueTailscale({ serviceId: 'plex', email: 'a@b.com' });
    const app = _buildApp({ shareStore });
    const res = await request(app)
      .post(`/share/${issued.token}/redeem-tailscale`)
      .send({ deviceId: { evil: true } });
    expect(res.status).toBe(400);
  });

  test('sanitized usedBy flows into the on-disk shares.json', async () => {
    const issued = await shareStore.issueTailscale({ serviceId: 'plex', email: 'a@b.com' });
    const app = _buildApp({ shareStore });
    await request(app)
      .post(`/share/${issued.token}/redeem-tailscale`)
      .send({ deviceId: 'node-abc.def-123' });
    const raw = JSON.parse(fs.readFileSync(path.join(dir, 'shares.json'), 'utf8'));
    const id = Object.keys(raw.shares)[0];
    expect(raw.shares[id].usedBy).toBe('node-abc.def-123');
  });

  test('rejection does NOT mark the share used', async () => {
    const issued = await shareStore.issueTailscale({ serviceId: 'plex', email: 'a@b.com' });
    const app = _buildApp({ shareStore });
    const bad = await request(app)
      .post(`/share/${issued.token}/redeem-tailscale`)
      .send({ deviceId: 'node with spaces' });
    expect(bad.status).toBe(400);
    // A FOLLOW-UP valid redeem should still succeed.
    const ok = await request(app)
      .post(`/share/${issued.token}/redeem-tailscale`)
      .send({ deviceId: 'node-clean' });
    expect(ok.status).toBe(200);
  });
});

// --------- Store-layer defense-in-depth (bypass the route, hit the store) ------------

describe('DC-083: store-layer defense-in-depth', () => {
  let dir, store;
  beforeEach(() => { dir = _tmpDir(); store = createShareStore({ dataDir: dir }); });
  afterEach(() => _cleanup(dir));

  test('recordPublicSubscribe rejects CRLF in email', async () => {
    const issued = await store.issuePublic({ serviceId: 'svc' });
    const r = await store.recordPublicSubscribe(issued.token, { email: 'a@b.com\r\nX: 1' });
    expect(r.ok).toBe(false);
    expect(r.reason).toBe('invalid_email');
  });

  test('recordPublicSubscribe rejects oversized email', async () => {
    const issued = await store.issuePublic({ serviceId: 'svc' });
    const r = await store.recordPublicSubscribe(issued.token, { email: 'a'.repeat(300) + '@x.com' });
    expect(r.ok).toBe(false);
    expect(r.reason).toBe('invalid_email');
  });

  test('recordTailscaleUse rejects CRLF in deviceId', async () => {
    const issued = await store.issueTailscale({ serviceId: 'svc', email: 'a@b.com' });
    const r = await store.recordTailscaleUse(issued.token, { deviceId: 'node\r\nhack' });
    expect(r.ok).toBe(false);
    expect(r.reason).toBe('invalid_device_id');
  });

  test('recordTailscaleUse rejects oversized deviceId', async () => {
    const issued = await store.issueTailscale({ serviceId: 'svc', email: 'a@b.com' });
    const r = await store.recordTailscaleUse(issued.token, { deviceId: 'a'.repeat(200) });
    expect(r.ok).toBe(false);
    expect(r.reason).toBe('invalid_device_id');
  });

  test('recordTailscaleUse accepts null deviceId (defaults to "unknown")', async () => {
    const issued = await store.issueTailscale({ serviceId: 'svc', email: 'a@b.com' });
    const r = await store.recordTailscaleUse(issued.token, { deviceId: null });
    expect(r.ok).toBe(true);
    expect(r.share.usedBy).toBe('unknown');
  });

  test('recordTailscaleUse accepts omitted deviceId (defaults to "unknown")', async () => {
    const issued = await store.issueTailscale({ serviceId: 'svc', email: 'a@b.com' });
    const r = await store.recordTailscaleUse(issued.token, {});
    expect(r.ok).toBe(true);
    expect(r.share.usedBy).toBe('unknown');
  });

  test('recordPublicSubscribe accepts omitted email (backwards-compatible)', async () => {
    const issued = await store.issuePublic({ serviceId: 'svc' });
    const r = await store.recordPublicSubscribe(issued.token);
    expect(r.ok).toBe(true);
  });

  test('recordPublicSubscribe accepts null email (backwards-compatible)', async () => {
    const issued = await store.issuePublic({ serviceId: 'svc' });
    const r = await store.recordPublicSubscribe(issued.token, { email: null });
    expect(r.ok).toBe(true);
  });
});

// --------- Rate-limit guard ------------------------------------------------------------------------------------------------------------------------------------------------------

describe('DC-083: SHARE_PUBLIC rate-limit', () => {
  // We can't easily trigger the rate-limit in a unit test because the
  // default 30/15min is high. Instead, verify the constant is wired and
  // that the limiter is mounted on the public endpoints (the test env
  // skips the limiter, so we just confirm the constants).
  test('RATE_LIMITS.SHARE_PUBLIC is bounded tighter than GENERAL', () => {
    const { RATE_LIMITS } = require('../src/utilities/constants');
    expect(RATE_LIMITS.SHARE_PUBLIC).toBeDefined();
    expect(RATE_LIMITS.SHARE_PUBLIC.max).toBeLessThan(RATE_LIMITS.GENERAL.max);
    expect(RATE_LIMITS.SHARE_PUBLIC.max).toBeLessThanOrEqual(30);
    expect(RATE_LIMITS.SHARE_PUBLIC.windowMs).toBe(15 * 60 * 1000);
  });

  test('route module loads without throwing when express-rate-limit is wired', () => {
    // Smoke test: the route factory must succeed with the limiter attached.
    const dir = _tmpDir();
    try {
      const shareStore = createShareStore({ dataDir: dir });
      const app = _buildApp({ shareStore });
      // _buildApp would have thrown if the route factory threw.
      expect(typeof app).toBe('function');
    } finally {
      _cleanup(dir);
    }
  });

  test('sharePublicLimiter is mounted on /preview (route stack contains limiter)', () => {
    // Verify the limiter middleware is actually wired into /preview's route
    // stack. The route uses express.Router().use(path, ...mw, handler) so we
    // can inspect the stack via the router's internal `stack` array.
    const dir = _tmpDir();
    try {
      const shareStore = createShareStore({ dataDir: dir });
      const router = require('../routes/share')({
        shareStore,
        licenseManager: { isPro: () => true, allowsLifetimeLicense: () => false },
        tailscaleCoord: { createAuthKey: async () => ({ id: 'k', key: 'tskey-x' }) },
        notificationManager: { sendEmail: async () => ({ messageId: 'fake' }) },
        servicesStateManager: { get: async () => null, read: async () => [] },
        servicesFile: null,
        asyncHandler: (fn, _label) => (req, res, next) => Promise.resolve(fn(req, res, next)).catch(next),
        log: { info() {}, warn() {}, error() {} },
      });
      const previewStack = router.stack.find(
        (layer) => layer.route && layer.route.path === '/share/:token/preview'
      );
      expect(previewStack).toBeDefined();
      // The route handler should be preceded by at least one middleware
      // layer (the limiter). route.stack contains the per-route middleware.
      // In express, .route.stack has the route-local middleware + handler.
      // The limiter is mounted at the router level (router.use pattern), so
      // it's actually a separate layer in router.stack. Look for any layer
      // that has a regex/path matching /share/:token.
      const limiterLayer = router.stack.find(
        (layer) => layer.regexp && layer.regexp.test && layer.regexp.test('/share/abc/preview')
      );
      expect(limiterLayer).toBeDefined();
    } finally {
      _cleanup(dir);
    }
  });
});

describe('DC-083: positive smoke tests (legitimate inputs)', () => {
  test('validates user+tag@sub.domain.io (RFC 5322 plus addressing)', () => {
    const { validatePublicEmail } = require('../src/security/share-store');
    const v = validatePublicEmail('user+tag@sub.domain.io');
    expect(v).toEqual({ ok: true, email: 'user+tag@sub.domain.io' });
  });

  test('validates a typical Tailscale node ID as deviceId', () => {
    const { validatePublicDeviceId } = require('../src/security/share-store');
    // Tailscale node IDs look like "nodekey:abcdef0123456789" or just hex
    const v = validatePublicDeviceId('nodekey:abcdef0123456789');
    expect(v).toEqual({ ok: true, deviceId: 'nodekey:abcdef0123456789' });
  });
});