release: WRNexusJS 0.4.0

packages/uploader/test/uploader.test.ts

@@ -2,7 +2,15 @@ import { expect, test } from "bun:test";
 import { mkdtempSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { configureStorage, getStore, serveStoredFile, upload } from "../src/index.ts";
+import {
+  configureStorage,
+  createSignedFileToken,
+  getStore,
+  safeObjectKey,
+  serveStoredFile,
+  upload,
+  verifySignedFileToken,
+} from "../src/index.ts";
 
 function configure() {
   configureStorage(
@@ -34,3 +42,22 @@ test("public active content is attachment-only and cannot be MIME-sniffed", asyn
   expect(response?.headers.get("x-content-type-options")).toBe("nosniff");
   expect(response?.headers.get("content-disposition")).toStartWith("attachment");
 });
+
+test("safe object keys discard traversal-like prefixes", () => {
+  expect(safeObjectKey("report.pdf", "../../private/reports")).toMatch(/^private\/reports\//);
+  expect(safeObjectKey("report.pdf", "../..")).toMatch(/^uploads\//);
+});
+
+test("signed file tokens reject tampering and expired payloads", async () => {
+  const secret = "a-long-test-secret-for-files";
+  const token = await createSignedFileToken(
+    { store: "private", key: "reports/a.pdf", expiresAt: 2_000 },
+    secret,
+  );
+  expect(await verifySignedFileToken(token, secret, 1_000)).toMatchObject({
+    store: "private",
+    key: "reports/a.pdf",
+  });
+  expect(await verifySignedFileToken(`${token}x`, secret, 1_000)).toBeNull();
+  expect(await verifySignedFileToken(token, secret, 2_000)).toBeNull();
+});