benjivers/val Public Public: anyone can read this; the crew can change it.

import { expect, test } from "bun:test";

import { mkdtempSync } from "node:fs";

import { tmpdir } from "node:os";

import { join } from "node:path";

process.env.FORGE_APP_DATA = mkdtempSync(join(tmpdir(), "app-"));

process.env.PORT = "0";

const { server } = await import("./server.ts");

const { match, snapshot, advance } = await import("./arena.ts");

const base = `http://${server.hostname}:${server.port}`;

test("serves a live match on the first paint, with no script needed", async () => {

  const response = await fetch(base + "/");

  expect(response.status).toBe(200);

  const body = await response.text();

  expect(body).toContain("<h1>val</h1>");

  // The score, the round and both team sheets are in the HTML itself.

  expect(body).toContain("red " + match().score.red);

  expect(body).toContain("round " + match().round);

  for (const player of match().players) expect(body).toContain(player.name);

});

test("the page hands out a session cookie and the script is named by content", async () => {

  const response = await fetch(base + "/", { redirect: "manual" });

  const cookie = response.headers.get("set-cookie") ?? "";

  expect(cookie).toContain("val_session=");

  expect(cookie).toContain("HttpOnly");

  const body = await response.text();

  const src = /src="(\/static\/val\.[0-9a-f]+\.js)"/.exec(body);

  expect(src).not.toBe(null);

  const script = await fetch(base + src![1]!);

  expect(script.status).toBe(200);

  expect(script.headers.get("cache-control")).toContain("immutable");

  expect(await script.text()).toContain("WebSocket");

});

test("a name is taken from a same-origin form and sanitised", async () => {

  const form = new FormData();

  form.set("name", '  Wren<script>"  ');

  const posted = await fetch(base + "/join", { method: "POST", body: form, redirect: "manual" });

  expect(posted.status).toBe(303);

  const cookie = posted.headers.getSetCookie().join(" ");

  expect(cookie).toContain("val_name=");

  // The angle brackets and the quote never reach the cookie or the match.

  expect(cookie).not.toContain("<");

  expect(cookie).not.toContain("%3C");

  expect(match().players.every((p) => !p.name.includes("<"))).toBe(true);

  // The seat that name took is a real player in the running match.

  expect(match().players.some((p) => !p.bot && p.name.includes("Wren"))).toBe(true);

});

test("refuses a cross-site post", async () => {

  const form = new FormData();

  form.set("name", "Evil");

  const posted = await fetch(base + "/join", {

    method: "POST",

    body: form,

    redirect: "manual",

    headers: { origin: "https://evil.example", "sec-fetch-site": "cross-site" },

  });

  expect(posted.status).toBe(403);

  expect(match().players.some((p) => p.name === "Evil")).toBe(false);

});

test("stands on the security floor", async () => {

  const response = await fetch(base + "/");

  expect(response.headers.get("content-security-policy")).toContain("default-src 'self'");

  expect(response.headers.get("x-content-type-options")).toBe("nosniff");

  const missing = await fetch(base + "/nope");

  expect(missing.status).toBe(404);

  expect(missing.headers.get("content-security-policy")).toContain("default-src 'self'");

});

test("a bug answers with the floor, not the runtime's page", async () => {

  // A percent-escape that is not one: whether the runtime decodes it or

  // throws, the answer carries the floor and never a stack trace.

  const response = await fetch(base + "/join", {

    method: "POST",

    headers: { "content-type": "application/x-www-form-urlencoded" },

    body: "name=%E0%A4%A",

    redirect: "manual",

  });

  expect([303, 500]).toContain(response.status);

  expect(await response.text()).not.toContain("src/server.ts");

  expect(response.headers.get("content-security-policy")).toContain("default-src 'self'");

});

test("a body is capped by the bytes read, whatever it claims", async () => {

  const response = await fetch(base + "/join", {

    method: "POST",

    headers: { "content-type": "application/x-www-form-urlencoded" },

    body: "name=" + "x".repeat(1024 * 1024),

  });

  expect(response.status).toBe(413);

});

test("HEAD sees the app up", async () => {

  const response = await server.fetch(new Request(base + "/", { method: "HEAD" }));

  expect(response.status).toBe(200);

  expect(await response.text()).toBe("");

});

test("the map is served as data, once, for the client to draw", async () => {

  const response = await fetch(base + "/map.json");

  const body = (await response.json()) as { rows: string[]; tile: number };

  expect(body.tile).toBe(80);

  expect(body.rows.length).toBeGreaterThan(10);

  expect(body.rows.some((r) => r.includes("A"))).toBe(true);

  expect(body.rows.some((r) => r.includes("B"))).toBe(true);

});

test("a websocket is refused to another site", async () => {

  const response = await server.fetch(

    new Request(base + "/ws", { headers: { "sec-fetch-site": "cross-site", origin: "https://evil.example" } }),

  );

  expect(response.status).toBe(403);

});

test("a snapshot only carries the enemies that viewer can see", () => {

  const state = match();

  const viewer = state.players.find((p) => p.side === "atk")!;

  const enemy = state.players.find((p) => p.side === "def")!;

  viewer.x = 1200;

  viewer.y = 1320;

  viewer.blind = 0;

  // Both of them alive on purpose: the arena is one live match that other

  // tests run forward, and a dead enemy is invisible for a different reason

  // than the one this test is about.

  viewer.alive = true;

  enemy.alive = true;

  enemy.x = 1200;

  enemy.y = 1240;

  enemy.revealed = 0;

  const near = JSON.parse(snapshot(viewer.id)) as { players: { id: string }[] };

  expect(near.players.some((p) => p.id === enemy.id)).toBe(true);

  // Behind the wall on the far side of the map, the same enemy is gone.

  enemy.x = 200;

  enemy.y = 200;

  const far = JSON.parse(snapshot(viewer.id)) as { players: { id: string }[]; board: unknown[] };

  expect(far.players.some((p) => p.id === enemy.id)).toBe(false);

  // The scoreboard still lists everyone; it carries no position.

  expect(far.board.length).toBe(10);

  expect(JSON.stringify(far.board)).not.toContain('"x"');

});

test("a command from a seat plants the spike, and nonsense from anyone else does nothing", async () => {

  const { command } = await import("./arena.ts");

  const { siteCentre } = await import("./map.ts");

  const state = match();

  state.phase = "live";

  state.clock = 100;

  const spot = siteCentre("B");

  const carrier = state.players.find((p) => p.side === "atk")!;

  // Nobody is a bot for these five seconds: no fight can end the round

  // underneath the plant and make this depend on who shot whom.

  for (const player of state.players) {

    player.bot = false;

    player.alive = true;

    player.hp = 100;

    player.input.fire = false;

  }

  carrier.x = spot.x;

  carrier.y = spot.y;

  carrier.spike = true;

  state.spike = { carried: carrier.id, x: spot.x, y: spot.y, planted: false, fuse: 0, site: null, defuse: 0, checkpoint: 0 };

  // Garbage is ignored, and a seat nobody holds cannot be driven.

  command(carrier.id, { t: "i", mx: "left" as unknown as number, a: Number.NaN, u: "yes" });

  command("nobody", { t: "i", u: true });

  expect(carrier.input.use).toBe(false);

  command(carrier.id, { t: "i", u: true, mx: 0, my: 0 });

  advance(5);

  expect(state.spike.planted).toBe(true);

  expect(state.spike.site).toBe("B");

  for (const player of state.players) player.bot = true;

});

test("the match keeps running and is never parked", () => {

  const state = match();

  const before = state.now;

  advance(30);

  expect(state.now).toBeGreaterThan(before);

  expect(["buy", "live", "end", "over"]).toContain(state.phase);

});

test("the kit is public: every ability, its price and what it does", async () => {

  const response = await fetch(base + "/agents.json");

  expect(response.status).toBe(200);

  expect(response.headers.get("content-security-policy")).toContain("default-src 'self'");

  const body = (await response.json()) as { agents: { id: string; abilities: Record<string, { name: string; cost: number; text: string }> }[] };

  expect(body.agents.length).toBe(5);

  const veil = body.agents.find((a) => a.id === "veil")!;

  expect(veil.abilities.c.name).toBe("Cloudburst");

  expect(veil.abilities.c.cost).toBe(100);

  expect(veil.abilities.e.text).toContain("smoke");

  // The ultimate is never for sale, and no server-only state leaks out.

  expect(veil.abilities.x.cost).toBe(0);

  expect(JSON.stringify(body)).not.toContain("kind");

});

test("the page carries the first-run card and the prompt line", async () => {

  const body = await (await fetch(base + "/")).text();

  expect(body).toContain('id="help"');

  expect(body).toContain("How to play");

  expect(body).toContain('id="prompt"');

  // Every buy button says what it costs, so the panel is readable at a glance.

  expect(body).toContain('data-buy="vandal" data-cost="2900"');

  expect(body).toContain('id="viewtoggle"');

});