feat(mindspace): gate published page delivery

2026-07-14 19:13:01 +08:00
parent ae9090948a
commit 27b11894f2
16 changed files with 448 additions and 39 deletions
@@ -0,0 +1,42 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  getPageDeliveryContract,
+  markPageDeliveryContractReady,
+  normalizeDeliveryRelativePath,
+  preparePageDeliveryContract,
+} from './mindspace-delivery-contract.mjs';
+
+test('normalizes only safe public HTML delivery paths', () => {
+  assert.equal(normalizeDeliveryRelativePath('public/survey.html'), 'public/survey.html');
+  assert.equal(normalizeDeliveryRelativePath('/public/nested/report.html'), 'public/nested/report.html');
+  assert.equal(normalizeDeliveryRelativePath('public/../secret.html'), null);
+  assert.equal(normalizeDeliveryRelativePath('public/report.js'), null);
+});
+
+test('contract lifecycle writes preparing then ready against the same route key', async () => {
+  const calls = [];
+  const pool = {
+    async query(sql, params) {
+      calls.push({ sql, params });
+      if (sql.includes('SELECT id, data_mode')) return [[{ id: 'contract-1', data_mode: 'pg_required', status: 'preparing' }]];
+      if (sql.includes('UPDATE h5_page_delivery_contracts')) return [{ affectedRows: 1 }];
+      return [{ affectedRows: 1 }];
+    },
+  };
+  const contract = await preparePageDeliveryContract({
+    pool,
+    userId: 'user-1',
+    requestId: 'request-1',
+    relativePath: 'public/form.html',
+    pgRequired: true,
+  });
+  assert.equal(contract.status, 'preparing');
+  assert.equal(contract.dataMode, 'pg_required');
+  const prepareCall = calls.find((call) => call.sql.includes('INSERT INTO h5_page_delivery_contracts'));
+  assert.equal(prepareCall.params[4], 'pg_required');
+  const current = await getPageDeliveryContract({ pool, userId: 'user-1', relativePath: 'public/form.html' });
+  assert.equal(current.status, 'preparing');
+  assert.equal(await markPageDeliveryContractReady({ pool, userId: 'user-1', relativePath: 'public/form.html' }), true);
+  assert.ok(calls.some((call) => call.sql.includes("status = 'ready'")));
+});