80 lines
1.7 KiB
Go
80 lines
1.7 KiB
Go
package store_test
|
|
|
|
import (
|
|
"os"
|
|
"testing"
|
|
|
|
"github.com/yourusername/caldav-server/internal/store"
|
|
)
|
|
|
|
func TestStoreRoundTrip(t *testing.T) {
|
|
dir := t.TempDir()
|
|
st, err := store.NewStore(dir)
|
|
if err != nil {
|
|
t.Fatalf("NewStore: %v", err)
|
|
}
|
|
|
|
const (
|
|
user = "alice"
|
|
col = "cal-personal"
|
|
objectID = "event-001.ics"
|
|
)
|
|
|
|
data := []byte("BEGIN:VCALENDAR\r\nEND:VCALENDAR\r\n")
|
|
|
|
// Write
|
|
if err := st.PutObject(user, col, objectID, data); err != nil {
|
|
t.Fatalf("PutObject: %v", err)
|
|
}
|
|
|
|
// Read
|
|
got, err := st.GetObject(user, col, objectID)
|
|
if err != nil {
|
|
t.Fatalf("GetObject: %v", err)
|
|
}
|
|
if string(got) != string(data) {
|
|
t.Errorf("data mismatch: got %q, want %q", got, data)
|
|
}
|
|
|
|
// List
|
|
ids, err := st.ListObjects(user, col)
|
|
if err != nil {
|
|
t.Fatalf("ListObjects: %v", err)
|
|
}
|
|
if len(ids) != 1 || ids[0] != objectID {
|
|
t.Errorf("unexpected ids: %v", ids)
|
|
}
|
|
|
|
// Delete
|
|
if err := st.DeleteObject(user, col, objectID); err != nil {
|
|
t.Fatalf("DeleteObject: %v", err)
|
|
}
|
|
|
|
// Not found
|
|
_, err = st.GetObject(user, col, objectID)
|
|
if err != store.ErrNotFound {
|
|
t.Errorf("expected ErrNotFound, got %v", err)
|
|
}
|
|
}
|
|
|
|
func TestSanitizePath(t *testing.T) {
|
|
dir := t.TempDir()
|
|
st, err := store.NewStore(dir)
|
|
if err != nil {
|
|
t.Fatalf("NewStore: %v", err)
|
|
}
|
|
|
|
// Traversal attempts should not escape rootDir
|
|
dangerous := "../../../etc/passwd"
|
|
data := []byte("test")
|
|
if err := st.PutObject("user", "col", dangerous, data); err != nil {
|
|
t.Fatalf("PutObject with dangerous ID: %v", err)
|
|
}
|
|
|
|
// Verify file was NOT written outside rootDir
|
|
_, err = os.Stat("/etc/passwd.tmp")
|
|
if err == nil {
|
|
t.Fatal("path traversal succeeded — security issue!")
|
|
}
|
|
}
|