feat(photos): community film strip uploads + admin moderation

Backend - photos table + upload storage under DATA_DIR/uploads (magic-byte sniffing, no multipart dep, SVG rejected, wx exclusive writes) - POST/GET /api/photos, GET /api/photos/:id/file with nosniff + sandboxed CSP - admin routes (ADMIN_EMAILS allowlist): list, delete one, clear all - identity-keyed rate limits (login 20/15m, signup 5/h, upload 60/h) - cookie gains Secure when the request is https (via trustProxy) - /api/auth/me now 200 {user:null} instead of 401 when signed out Frontend - landing strip section: signed-in users upload straight from the reel, guests get a /app?auth=1 link - /admin page: grid of uploads with delete + clear all - nginx: nosniff / X-Frame-Options / Referrer-Policy, forward X-Forwarded-Proto so the API can mark cookies Secure behind TLS Tests: docker/backend test/security.mjs (45 checks)
2026-09-17 22:35:12 +07:00
parent 9ba2667c6c
commit ffdefd2c9c
15 changed files with 871 additions and 18 deletions
@@ -0,0 +1,260 @@
+// Security self-check for the API. Boots the real server against a throwaway
+// DATA_DIR and exercises the boundaries that matter: who may write, what may be
+// written, who may read a photo back, and who may moderate the strip.
+//
+//   npm test            (from docker/backend/)
+//
+// Node only — no test framework, no network beyond loopback.
+import { spawn } from 'node:child_process';
+import { existsSync, mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+const PORT = Number(process.env.TEST_PORT || 3411);
+const BASE = `http://127.0.0.1:${PORT}/api`;
+const ADMIN_EMAIL = 'admin@test.local';
+const DATA_DIR = mkdtempSync(join(tmpdir(), 'recipescam-sec-'));
+
+// A 1x1 PNG, and the first bytes of a JPEG (all the sniffer looks at).
+const PNG = Buffer.from(
+  'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAEhQGAhKmMIQAAAABJRU5ErkJggg==',
+  'base64',
+);
+const JPEG_HEAD = Buffer.concat([Buffer.from([0xff, 0xd8, 0xff, 0xe0]), Buffer.alloc(64)]);
+
+let pass = 0;
+let fail = 0;
+const check = (name, ok, detail = '') => {
+  if (ok) {
+    pass++;
+    console.log(`PASS ${name}`);
+  } else {
+    fail++;
+    console.log(`FAIL ${name}${detail ? ` :: ${detail}` : ''}`);
+  }
+};
+
+// One cookie jar per actor, so "signed in as A" cannot leak into B.
+function actor() {
+  let cookie = '';
+  return {
+    get cookie() {
+      return cookie;
+    },
+    async req(path, init = {}) {
+      const headers = { ...(init.headers ?? {}) };
+      if (cookie) headers.cookie = cookie;
+      const res = await fetch(BASE + path, { ...init, headers });
+      const set = res.headers.getSetCookie?.() ?? (res.headers.get('set-cookie') ? [res.headers.get('set-cookie')] : []);
+      for (const line of set) {
+        const value = line.split(';')[0];
+        if (value.startsWith('rc_session=')) cookie = value.endsWith('=') ? '' : value;
+      }
+      const text = await res.text();
+      let body = null;
+      try {
+        body = text ? JSON.parse(text) : null;
+      } catch {
+        body = text;
+      }
+      return { status: res.status, headers: res.headers, setCookie: set.join(' | '), body };
+    },
+    signup(email, password = 'supersecret1') {
+      return this.req('/auth/signup', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ email, password }),
+      });
+    },
+    upload(bytes, type) {
+      return this.req('/photos', { method: 'POST', headers: { 'content-type': type }, body: bytes });
+    },
+  };
+}
+
+// Run the sources, not a possibly stale build: the point of this suite is to
+// test the code as written.
+const tsx = join(ROOT, 'node_modules/.bin/tsx');
+const entry = existsSync(tsx) ? [tsx, 'src/server.ts'] : ['dist/server.js'];
+const server = spawn(process.execPath, entry, {
+  cwd: ROOT,
+  env: { ...process.env, PORT: String(PORT), DATA_DIR, ADMIN_EMAILS: ADMIN_EMAIL, NODE_ENV: 'test' },
+  stdio: ['ignore', 'pipe', 'pipe'],
+});
+let serverLog = '';
+server.stdout.on('data', (d) => (serverLog += d));
+server.stderr.on('data', (d) => (serverLog += d));
+
+async function waitForServer() {
+  for (let i = 0; i < 100; i++) {
+    try {
+      const res = await fetch(`${BASE}/health`);
+      if (res.ok) return true;
+    } catch {
+      /* not up yet */
+    }
+    await new Promise((r) => setTimeout(r, 100));
+  }
+  return false;
+}
+
+try {
+  if (!(await waitForServer())) throw new Error(`server never came up:\n${serverLog}`);
+
+  const stamp = Date.now();
+  const admin = actor();
+  const user = actor();
+  const other = actor();
+
+  // ---- accounts -----------------------------------------------------------
+  check('health responds', (await fetch(`${BASE}/health`)).ok);
+
+  const badEmail = await user.signup('not-an-email');
+  check('signup rejects a malformed email', badEmail.status === 400, `got ${badEmail.status}`);
+  const badPw = await user.signup(`short${stamp}@test.local`, 'short');
+  check('signup rejects a short password', badPw.status === 400, `got ${badPw.status}`);
+
+  const adminSignup = await admin.signup(ADMIN_EMAIL);
+  check('admin account signs up', adminSignup.status === 201, `got ${adminSignup.status}`);
+  const userSignup = await user.signup(`contributor${stamp}@test.local`);
+  check('contributor account signs up', userSignup.status === 201, `got ${userSignup.status}`);
+  await other.signup(`other${stamp}@test.local`);
+
+  const cookie = userSignup.setCookie;
+  check('session cookie is HttpOnly', /HttpOnly/i.test(cookie), cookie);
+  check('session cookie is SameSite', /SameSite=Lax/i.test(cookie), cookie);
+  check('session cookie is not Secure over plain http', !/;\s*Secure/i.test(cookie), cookie);
+  check('session token is 256 bits of hex', /rc_session=[0-9a-f]{64}/.test(cookie), cookie);
+
+  // The proxy hands nginx the public scheme; a TLS visitor must get Secure.
+  const tls = actor();
+  const tlsSignup = await tls.req('/auth/signup', {
+    method: 'POST',
+    headers: { 'content-type': 'application/json', 'x-forwarded-proto': 'https' },
+    body: JSON.stringify({ email: `tls${stamp}@test.local`, password: 'supersecret1' }),
+  });
+  check('session cookie is Secure behind https', /;\s*Secure/i.test(tlsSignup.setCookie), tlsSignup.setCookie);
+
+  // Documented, not fixed: the 409 is a deliberate UX choice and doubles as an
+  // account-existence oracle.
+  const dup = await actor().signup(ADMIN_EMAIL);
+  check('duplicate signup is a 409 (known user-enumeration oracle)', dup.status === 409, `got ${dup.status}`);
+
+  const noUser = await actor().req('/auth/login', {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ email: `ghost${stamp}@test.local`, password: 'supersecret1' }),
+  });
+  check('unknown email and wrong password look identical', noUser.status === 401, `got ${noUser.status}`);
+
+  const anonMe = await actor().req('/auth/me');
+  check('signed out is a 200 with no user', anonMe.status === 200 && anonMe.body?.user === null, JSON.stringify(anonMe.body));
+  const ownMe = await user.req('/auth/me');
+  check('/auth/me reports the signed-in account', ownMe.body?.user?.email === `contributor${stamp}@test.local`, JSON.stringify(ownMe.body));
+
+  // ---- rate limiting ------------------------------------------------------
+  const brute = actor();
+  const bruteEmail = `brute${stamp}@test.local`;
+  let limited = 0;
+  for (let i = 0; i < 21; i++) {
+    const res = await brute.req('/auth/login', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ email: bruteEmail, password: 'wrong-password' }),
+    });
+    if (res.status === 429) limited++;
+  }
+  check('login attempts are rate limited', limited === 1, `429s: ${limited}`);
+
+  // ---- upload boundary ----------------------------------------------------
+  check('guest cannot upload', (await actor().upload(PNG, 'image/png')).status === 401);
+  check(
+    'non-image content-type is refused',
+    (await user.upload(Buffer.from('<svg xmlns="http://www.w3.org/2000/svg"/>'), 'image/svg+xml')).status === 415,
+  );
+  check(
+    'svg bytes under an image content-type is refused',
+    (await user.upload(Buffer.from('<svg onload="alert(1)"/>'), 'image/jpeg')).status === 415,
+  );
+  check(
+    'a declared type that disagrees with the bytes is refused',
+    (await user.upload(JPEG_HEAD, 'image/png')).status === 415,
+  );
+  check('empty body is refused', (await user.upload(Buffer.alloc(0), 'image/png')).status === 400);
+
+  const tooBig = Buffer.concat([PNG, Buffer.alloc(4 * 1024 * 1024)]);
+  check('an over-limit body is refused', (await user.upload(tooBig, 'image/png')).status === 413);
+
+  const created = await user.upload(PNG, 'image/png');
+  check('a signed-in member can upload a real PNG', created.status === 201, JSON.stringify(created.body));
+
+  // ---- what the public may read ------------------------------------------
+  const list = await actor().req('/photos');
+  const listed = list.body?.photos ?? [];
+  check('the strip is readable anonymously', list.status === 200);
+  check(
+    'the public strip leaks no owner',
+    listed.length > 0 && !('userId' in listed[0]) && !('email' in listed[0]) && !('file' in listed[0]),
+    JSON.stringify(listed[0]),
+  );
+
+  const id = created.body?.photo?.id;
+  const served = await fetch(`${BASE}/photos/${id}/file`);
+  check('a contributed photo is served', served.status === 200);
+  check('the served photo keeps its sniffed type', served.headers.get('content-type') === 'image/png');
+  check('the served photo is nosniff', served.headers.get('x-content-type-options') === 'nosniff');
+  check('the served photo is sandboxed', (served.headers.get('content-security-policy') ?? '').includes('sandbox'));
+  check('the bytes round-trip intact', Buffer.from(await served.arrayBuffer()).equals(PNG));
+
+  check('an unknown id is a 404', (await fetch(`${BASE}/photos/999999/file`)).status === 404);
+  check('a non-numeric id is a 404', (await fetch(`${BASE}/photos/abc/file`)).status === 404);
+  check(
+    'an id cannot escape the uploads directory',
+    (await fetch(`${BASE}/photos/..%2f..%2fetc%2fpasswd/file`)).status === 404,
+  );
+
+  // ---- moderation ---------------------------------------------------------
+  check('a guest cannot moderate', (await actor().req('/admin/photos')).status === 401);
+  const forbidden = await user.req('/admin/photos');
+  check('a plain member is 403, not 200', forbidden.status === 403, `got ${forbidden.status}`);
+
+  const adminList = await admin.req('/admin/photos');
+  const rows = adminList.body?.photos ?? [];
+  check('an admin lists contributions', adminList.status === 200 && rows.length > 0);
+  check('the admin listing carries the owner', rows.some((r) => /@test\.local$/.test(r.email ?? '')));
+  check('a plain member cannot delete', (await user.req(`/admin/photos/${id}`, { method: 'DELETE' })).status === 403);
+
+  const deleted = await admin.req(`/admin/photos/${id}`, { method: 'DELETE' });
+  check('an admin deletes a contribution', deleted.status === 204, `got ${deleted.status}`);
+  check('the deleted file is gone from disk', (await fetch(`${BASE}/photos/${id}/file`)).status === 404);
+  check('the deleted row is gone from the listing', !((await admin.req('/admin/photos')).body?.photos ?? []).some((r) => r.id === id));
+
+  // ---- quota --------------------------------------------------------------
+  const quota = actor();
+  await quota.signup(`quota${stamp}@test.local`);
+  let last = 0;
+  for (let i = 0; i < 13; i++) last = (await quota.upload(PNG, 'image/png')).status;
+  check('uploads are capped per account', last === 429, `13th upload: ${last}`);
+
+  const cleared = await admin.req('/admin/photos', { method: 'DELETE' });
+  check('an admin clears the strip in one call', cleared.status === 200 && cleared.body?.removed > 0, JSON.stringify(cleared.body));
+  check('the strip is empty afterwards', ((await actor().req('/photos')).body?.photos ?? []).length === 0);
+
+  // ---- pre-existing guarantees still hold ---------------------------------
+  const foreignRecipe = await user.req('/recipes/1', { method: 'DELETE' });
+  check("another account's recipe is not deletable", foreignRecipe.status === 404, `got ${foreignRecipe.status}`);
+  const missing = await actor().req('/nope');
+  check('unknown routes keep the single error shape', missing.status === 404 && missing.body?.error === 'not_found');
+} catch (err) {
+  fail++;
+  console.log(`FAIL harness :: ${err && err.stack ? err.stack : err}`);
+  console.log(serverLog.slice(-2000));
+} finally {
+  server.kill('SIGTERM');
+  rmSync(DATA_DIR, { recursive: true, force: true });
+}
+
+console.log(`\n${pass} passed, ${fail} failed`);
+process.exit(fail === 0 ? 0 : 1);