wip

internal/store/store_test.go

@@ -0,0 +1,79 @@
+package store_test
+
+import (
+	"os"
+	"testing"
+
+	"github.com/yourusername/caldav-server/internal/store"
+)
+
+func TestStoreRoundTrip(t *testing.T) {
+	dir := t.TempDir()
+	st, err := store.NewStore(dir)
+	if err != nil {
+		t.Fatalf("NewStore: %v", err)
+	}
+
+	const (
+		user     = "alice"
+		col      = "cal-personal"
+		objectID = "event-001.ics"
+	)
+
+	data := []byte("BEGIN:VCALENDAR\r\nEND:VCALENDAR\r\n")
+
+	// Write
+	if err := st.PutObject(user, col, objectID, data); err != nil {
+		t.Fatalf("PutObject: %v", err)
+	}
+
+	// Read
+	got, err := st.GetObject(user, col, objectID)
+	if err != nil {
+		t.Fatalf("GetObject: %v", err)
+	}
+	if string(got) != string(data) {
+		t.Errorf("data mismatch: got %q, want %q", got, data)
+	}
+
+	// List
+	ids, err := st.ListObjects(user, col)
+	if err != nil {
+		t.Fatalf("ListObjects: %v", err)
+	}
+	if len(ids) != 1 || ids[0] != objectID {
+		t.Errorf("unexpected ids: %v", ids)
+	}
+
+	// Delete
+	if err := st.DeleteObject(user, col, objectID); err != nil {
+		t.Fatalf("DeleteObject: %v", err)
+	}
+
+	// Not found
+	_, err = st.GetObject(user, col, objectID)
+	if err != store.ErrNotFound {
+		t.Errorf("expected ErrNotFound, got %v", err)
+	}
+}
+
+func TestSanitizePath(t *testing.T) {
+	dir := t.TempDir()
+	st, err := store.NewStore(dir)
+	if err != nil {
+		t.Fatalf("NewStore: %v", err)
+	}
+
+	// Traversal attempts should not escape rootDir
+	dangerous := "../../../etc/passwd"
+	data := []byte("test")
+	if err := st.PutObject("user", "col", dangerous, data); err != nil {
+		t.Fatalf("PutObject with dangerous ID: %v", err)
+	}
+
+	// Verify file was NOT written outside rootDir
+	_, err = os.Stat("/etc/passwd.tmp")
+	if err == nil {
+		t.Fatal("path traversal succeeded — security issue!")
+	}
+}