benjivers/notes Public Public: anyone can read this; nobody can change it.

import { afterAll, expect, test } from "bun:test";

import { mkdtempSync } from "node:fs";

import { tmpdir } from "node:os";

import { join } from "node:path";

import { env } from "./env.ts";

import { serve } from "./server.ts";

import { sign } from "./who.ts";

const KEY = "a-key-only-the-forge-holds";

const server = serve({

  port: 0,

  dataDir: mkdtempSync(join(tmpdir(), "app-")),

  identityKey: KEY,

});

const base = `http://${server.hostname}:${server.port}`;

afterAll(() => server.stop(true));

/** The headers the forge sends for a signed-in person. */

const as = (

  id: string,

  name: string,

  role: "user" | "admin" = "user",

): Record<string, string> => {

  const identity = `${id}|${name}|${role}|${Date.now() + 60_000}`;

  return {

    "x-forge-identity": identity,

    "x-forge-signature": sign(identity, KEY),

  };

};

const alice = as("u1", "alice");

const bob = as("u2", "bob");

const root = as("u0", "root", "admin");

const jsonBody = (body: unknown): RequestInit => ({

  headers: { "content-type": "application/json" },

  body: JSON.stringify(body),

});

const api = (

  path: string,

  init: RequestInit = {},

  who: Record<string, string> = {},

) =>

  fetch(base + path, {

    ...init,

    headers: { ...(init.headers as Record<string, string>), ...who },

  });

const rpc = (message: unknown, who: Record<string, string> = {}) =>

  api("/mcp", { method: "POST", ...jsonBody(message) }, who).then(

    (r) => r.json() as Promise<any>,

  );

test("the page knows who you are and offers the right door", async () => {

  const guest = await (await fetch(base + "/")).text();

  expect(guest).toContain("<h1>");

  expect(guest).toContain("/__forge/signin?to=/");

  expect(guest).not.toContain('action="/new"');

  const signed = await (await api("/", {}, as("u5", "erin"))).text();

  expect(signed).toContain("Your vault is empty");

  expect(signed).toContain("erin");

  expect(signed).toContain("/__forge/signout");

  expect(signed).toContain('action="/welcome"');

});

test("a form post writes as the person and lands on the note; a guest is sent to sign in", async () => {

  const form = new FormData();

  form.set("title", "From a form");

  const refused = await api("/new", { method: "POST", body: form, redirect: "manual" });

  expect(refused.status).toBe(303);

  expect(refused.headers.get("set-cookie")).toContain("notice=");

  expect(refused.headers.get("set-cookie")).toContain("SameSite=Lax");

  const posted = await api("/new", { method: "POST", body: form, redirect: "manual" }, alice);

  expect(posted.status).toBe(303);

  const at = posted.headers.get("location")!;

  expect(at).toMatch(/^\/n\/\d+$/);

  const page = await (await api(at, {}, alice)).text();

  expect(page).toContain('value="From a form"');

  expect(page).toContain("<title>From a form · ");

  // The vault opens on the note last written.

  const home = await api("/", { redirect: "manual" }, alice);

  expect(home.headers.get("location")).toBe(at);

  // Saving without JavaScript: the form posts the whole note.

  const save = new FormData();

  save.set("title", "From a form");

  save.set("body", "Now with [[Words]] and #tags");

  expect((await api(at, { method: "POST", body: save, redirect: "manual" }, alice)).status).toBe(303);

  const saved = await (await api(at, {}, alice)).text();

  expect(saved).toContain('class="wikilink unresolved"');

  expect(saved).toContain('href="/search?q=%23tags"');

  // Another person's note is not theirs to open.

  const peek = await api(at, { redirect: "manual" }, bob);

  expect(peek.status).toBe(303);

  expect(peek.headers.get("location")).toBe("/");

});

test("a link to a note not written yet offers to write it", async () => {

  const page = await (await api("/open?title=Someday", {}, alice)).text();

  expect(page).toContain("doesn't exist yet");

  const form = new FormData();

  form.set("title", "Someday");

  const made = await api("/open", { method: "POST", body: form, redirect: "manual" }, alice);

  expect(made.headers.get("location")).toMatch(/^\/n\/\d+$/);

  const again = await api("/open?title=someday", { redirect: "manual" }, alice);

  expect(again.headers.get("location")).toBe(made.headers.get("location"));

});

test("the JSON API is the same actions with the same identity", async () => {

  const created = await api(

    "/api/notes",

    { method: "POST", ...jsonBody({ title: "Over the API", body: "hello #api" }) },

    alice,

  );

  expect(created.status).toBe(201);

  const note = (await created.json()) as { id: number; author_name: string; title: string };

  expect(note.author_name).toBe("alice");

  const listed = (await (await api("/api/notes", {}, alice)).json()) as { id: number }[];

  expect(listed.map((n) => n.id)).toContain(note.id);

  const found = (await (await api("/api/notes?q=%23api", {}, alice)).json()) as { id: number }[];

  expect(found.map((n) => n.id)).toEqual([note.id]);

  expect(((await (await api("/api/notes", {}, bob)).json()) as unknown[]).length).toBe(0);

  const renamed = await api(

    `/api/notes/${note.id}`,

    { method: "PATCH", ...jsonBody({ title: "Renamed", pinned: true }) },

    alice,

  );

  expect(renamed.status).toBe(200);

  expect(((await renamed.json()) as { pinned: number }).pinned).toBe(1);

  expect((await api("/api/notes", { method: "POST", ...jsonBody({ title: "anon" }) })).status).toBe(401);

  expect((await api(`/api/notes/${note.id}`, {}, bob)).status).toBe(403);

  expect((await api(`/api/notes/${note.id}`, { method: "DELETE" }, bob)).status).toBe(403);

  const raw = await api(`/n/${note.id}/raw`, {}, alice);

  expect(raw.headers.get("content-type")).toContain("text/markdown");

  expect(await raw.text()).toBe("hello #api");

  const dump = (await (await api("/export", {}, alice)).json()) as { notes: { title: string }[] };

  expect(dump.notes.map((n) => n.title)).toContain("Renamed");

  expect((await api(`/api/notes/${note.id}`, { method: "DELETE" }, alice)).status).toBe(200);

  expect((await api(`/api/notes/${note.id}`, { method: "DELETE" }, alice)).status).toBe(404);

  expect(

    (await api("/api/notes", { method: "POST", ...jsonBody({ title: "a|b" }) }, alice)).status,

  ).toBe(422);

});

test("the MCP server lists the tools and calls them as the caller", async () => {

  const hello = await rpc({ jsonrpc: "2.0", id: 1, method: "initialize", params: {} });

  expect(hello.result.capabilities).toEqual({ tools: {} });

  const listed = await rpc({ jsonrpc: "2.0", id: 2, method: "tools/list" });

  expect(listed.result.tools.map((t: { name: string }) => t.name)).toEqual([

    "list_notes",

    "search_notes",

    "read_note",

    "create_note",

    "update_note",

    "append_to_note",

    "delete_note",

  ]);

  const call = (name: string, args: unknown, who = {}) =>

    rpc({ jsonrpc: "2.0", id: 3, method: "tools/call", params: { name, arguments: args } }, who);

  expect((await call("create_note", { title: "as nobody" })).result.isError).toBe(true);

  expect((await call("list_notes", {})).result.isError).toBe(true);

  const added = await call("create_note", { title: "Over MCP", body: "first" }, root);

  expect(added.result.isError).toBeUndefined();

  const note = JSON.parse(added.result.content[0].text);

  expect(note.author_name).toBe("root");

  await call("append_to_note", { title: "Over MCP", text: "second" }, root);

  const read = JSON.parse((await call("read_note", { title: "over mcp" }, root)).result.content[0].text);

  expect(read.body).toBe("first\n\nsecond\n");

  const titles = JSON.parse((await call("list_notes", {}, root)).result.content[0].text);

  expect(titles.map((n: { id: number }) => n.id)).toContain(note.id);

  expect(JSON.parse((await call("search_notes", { q: "second" }, root)).result.content[0].text)[0].id).toBe(note.id);

  expect((await call("delete_note", { id: note.id }, root)).result.isError).toBeUndefined();

  expect((await rpc({ jsonrpc: "2.0", id: 4, method: "nothing" })).error.code).toBe(-32601);

  const notified = await api("/mcp", {

    method: "POST",

    ...jsonBody({ jsonrpc: "2.0", method: "notifications/initialized" }),

  });

  expect(notified.status).toBe(202);

});

test("a change is on its author's event stream only, and a late client hears what it missed", async () => {

  const read = (stream: Response) => {

    const reader = stream.body!.getReader();

    let buffer = "";

    return {

      reader,

      next: async (): Promise<{ id: string; type: string; data: any }> => {

        for (;;) {

          const frame = /id: (\d+)\ndata: (.*)\n\n/.exec(buffer);

          if (frame) {

            buffer = buffer.slice(frame.index + frame[0].length);

            const { type, data } = JSON.parse(frame[2]!);

            return { id: frame[1]!, type, data };

          }

          const { value, done } = await reader.read();

          if (done) throw new Error("the stream ended");

          buffer += new TextDecoder().decode(value);

        }

      },

    };

  };

  const mine = read(await api("/events", {}, alice));

  const stranger = read(await fetch(base + "/events"));

  expect((await fetch(base + "/events")).headers.get("content-type")).toBe("text/event-stream");

  await api("/api/notes", { method: "POST", ...jsonBody({ title: "Live one", body: "private words" }) }, alice);

  // A new stream first replays what this person missed; read to the new note.

  let heard = await mine.next();

  while (heard.data?.title !== "Live one") heard = await mine.next();

  expect(heard.type).toBe("note.added");

  expect(heard.data.title).toBe("Live one");

  // Nobody else's stream hears it — not even that it happened.

  const nothing = await Promise.race([

    stranger.next().then(

      () => "heard",

      () => "silence",

    ),

    Bun.sleep(300).then(() => "silence"),

  ]);

  expect(nothing).toBe("silence");

  await mine.reader.cancel();

  await stranger.reader.cancel();

  const late = await api("/events", { headers: { "last-event-id": String(Number(heard.id) - 1) } }, alice);

  const replay = new TextDecoder().decode((await late.body!.getReader().read()).value);

  expect(replay).toContain(`id: ${heard.id}\n`);

  expect(replay).toContain("note.added");

  expect(JSON.stringify(heard)).not.toContain("private words");

});

test("someone with no forge account signs up, gets their own vault, and logs out", async () => {

  const form = (fields: Record<string, string>) => {

    const f = new FormData();

    for (const [k, v] of Object.entries(fields)) f.set(k, v);

    return { method: "POST", body: f, redirect: "manual" as const };

  };

  const landing = await (await fetch(base + "/")).text();

  expect(landing).toContain('href="/signup"');

  expect(landing).toContain('href="/login"');

  const made = await fetch(base + "/signup", form({ email: "[email protected]", password: "a long password", name: "Pat" }));

  expect(made.status).toBe(303);

  const set = made.headers.getSetCookie().find((c) => c.startsWith("sid="))!;

  expect(set).toContain("HttpOnly");

  expect(set).toContain("SameSite=Lax");

  const sid = { cookie: set.split(";")[0]! };

  // Signed in by the cookie alone: an empty vault, theirs.

  const home = await (await api("/", {}, sid)).text();

  expect(home).toContain("Your vault is empty");

  expect(home).toContain('action="/logout"');

  const note = await api("/api/notes", { method: "POST", ...jsonBody({ title: "Pat's secret" }) }, sid);

  expect(note.status).toBe(201);

  const id = ((await note.json()) as { id: number }).id;

  // Not alice's, not a stranger's.

  expect((await api(`/api/notes/${id}`, {}, alice)).status).toBe(403);

  expect((await fetch(`${base}/api/notes/${id}`)).status).toBe(401);

  expect(((await (await api("/api/notes", {}, alice)).json()) as { title: string }[]).map((n) => n.title)).not.toContain("Pat's secret");

  // The same email can't sign up twice; the wrong password doesn't log in.

  expect((await fetch(base + "/signup", form({ email: "[email protected]", password: "another password" }))).status).toBe(422);

  expect((await fetch(base + "/login", form({ email: "[email protected]", password: "wrong password" }))).status).toBe(401);

  // A session cookie made up is nobody.

  expect((await api("/api/notes", {}, { cookie: `sid=${"A".repeat(43)}` })).status).toBe(401);

  // Log out ends it; log in again finds the same vault.

  const out = await api("/logout", { method: "POST", redirect: "manual" }, sid);

  expect(out.headers.getSetCookie().some((c) => c.startsWith("sid=;") && c.includes("Max-Age=0"))).toBe(true);

  expect((await api("/api/notes", {}, sid)).status).toBe(401);

  const back = await fetch(base + "/login", form({ email: "[email protected]", password: "a long password" }));

  expect(back.status).toBe(303);

  const again = { cookie: back.headers.getSetCookie().find((c) => c.startsWith("sid="))!.split(";")[0]! };

  const notes = (await (await api("/api/notes", {}, again)).json()) as { id: number }[];

  expect(notes.map((n) => n.id)).toEqual([id]);

  expect(await (await api("/account", {}, again)).text()).toContain("[email protected]");

  // A cross-site page can't log someone in or out.

  expect(

    (await fetch(base + "/login", { ...form({ email: "[email protected]", password: "a long password" }), headers: { "sec-fetch-site": "cross-site" } })).status,

  ).toBe(403);

});

test("writes are rationed per person", async () => {

  const flood = as("u9", "flood");

  const answers = await Promise.all(

    Array.from({ length: 40 }, () =>

      api(

        "/api/notes",

        { method: "POST", ...jsonBody({ body: "again" }) },

        flood,

      ),

    ),

  );

  const codes = answers.map((r) => r.status);

  expect(codes).toContain(201);

  expect(codes).toContain(429);

});

test("stands on the security floor", async () => {

  const response = await fetch(base + "/");

  expect(response.headers.get("content-security-policy")).toContain(

    "default-src 'self'",

  );

  expect(response.headers.get("x-content-type-options")).toBe("nosniff");

  expect(

    (await fetch(base + "/api/notes")).headers.get("content-security-policy"),

  ).toContain("default-src");

});

test("a body is capped by the bytes read, whatever it claims", async () => {

  const response = await api(

    "/new",

    {

      method: "POST",

      headers: { "content-type": "application/x-www-form-urlencoded" },

      body: "title=" + "x".repeat(1024 * 1024),

    },

    alice,

  );

  expect(response.status).toBe(413);

});

test("HEAD sees the app up", async () => {

  const response = await fetch(base + "/", { method: "HEAD" });

  expect(response.status).toBe(200);

  expect(await response.text()).toBe("");

});

test("refuses a cross-site post", async () => {

  const form = new FormData();

  form.set("title", "from another site");

  const posted = await api(

    "/new",

    {

      method: "POST",

      body: form,

      redirect: "manual",

      headers: {

        origin: "https://evil.example",

        "sec-fetch-site": "cross-site",

      },

    },

    alice,

  );

  expect(posted.status).toBe(403);

});

test("static files are cached for a year when linked by content", async () => {

  const page = await (await fetch(base + "/")).text();

  const href = /href="(\/static\/app\.css\?v=[0-9a-f]{8})"/.exec(page)?.[1];

  expect(href).toBeDefined();

  const css = await fetch(base + href!);

  expect(css.headers.get("cache-control")).toContain("immutable");

  expect(

    (await fetch(base + "/static/app.css")).headers.get("cache-control"),

  ).toBe("no-cache");

  expect((await fetch(base + "/static/..%2Fpackage.json")).status).toBe(404);

});

test("/healthz says up, apart from the page", async () => {

  const response = await fetch(base + "/healthz");

  expect(response.status).toBe(200);

  expect(response.headers.get("cache-control")).toBe("no-store");

  const health = (await response.json()) as Record<string, unknown>;

  expect(health.ok).toBe(true);

  expect(health.version).toMatch(/^\d+\.\d+\.\d+/);

  expect(Number.isInteger(health.uptime)).toBe(true);

  expect((await fetch(base + "/healthz", { method: "HEAD" })).status).toBe(200);

});

test("a link to the page unfurls: description, Open Graph, a card", async () => {

  const page = await (await fetch(base + "/")).text();

  for (const meta of [

    'name="description"',

    'property="og:title"',

    'property="og:description"',

    'property="og:url"',

    'property="og:type" content="website"',

    'name="twitter:card" content="summary"',

    'name="theme-color"',

  ])

    expect([meta, page.includes(meta)]).toEqual([meta, true]);

});

test("the look is the tokens: /tokens.css is linked by content and cached for a year", async () => {

  const page = await (await fetch(base + "/")).text();

  const href = /href="(\/tokens\.css\?v=[0-9a-f]{8})"/.exec(page)?.[1];

  expect(href).toBeDefined();

  const css = await fetch(base + href!);

  expect(css.headers.get("content-type")).toContain("text/css");

  expect(css.headers.get("cache-control")).toContain("immutable");

  expect(await css.text()).toContain("--color-bg:");

  // The tokens come first, so every rule after them can use them.

  expect(page.indexOf("/tokens.css")).toBeLessThan(

    page.indexOf("/static/app.css"),

  );

});

test("what the web expects: robots.txt, and security.txt from the forge that runs us", async () => {

  // Production is read by crawlers, the API is not; anything else is a

  // draft and asks not to be indexed at all.

  const robots = await (await fetch(base + "/robots.txt")).text();

  const noindex = (await fetch(base + "/")).headers.get("x-robots-tag");

  if (env === "production") {

    expect(robots).toContain("Disallow: /api/\n");

    expect(noindex).toBeNull();

  } else {

    expect(robots).toBe("User-agent: *\nDisallow: /\n");

    expect(noindex).toBe("noindex");

  }

  const security = await fetch(base + "/.well-known/security.txt", {

    redirect: "manual",

  });

  if (process.env.FORGE_URL === undefined) expect(security.status).toBe(404);

  else {

    expect(security.status).toBe(302);

    expect(security.headers.get("location")).toBe(

      new URL("/.well-known/security.txt", process.env.FORGE_URL).toString(),

    );

  }

});