You can close this tab and return to the app.
This recording is password protected.
+`; + return new Response(lockedHtml, { + headers: { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'public, max-age=3600' }, + }); + } + + const desc = video.summary ? escapeHTML(video.summary) : `${formatTimestamp(video.duration)} screen recording`; + + const html = ` + + + +${escapeHTML(video.title)}
+ +`; + + return new Response(html, { + headers: { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'public, max-age=3600' }, + }); +} + +// --- Cron Cleanup --- + +async function cleanupExpired(env) { + const expired = await env.DB.prepare( + "SELECT id, share_code FROM videos WHERE datetime(expires_at) < datetime('now')" + ).all(); + + for (const video of expired.results || []) { + await Promise.all([ + env.VIDEOS_BUCKET.delete(`videos/${video.share_code}.mp4`), + env.VIDEOS_BUCKET.delete(`thumbnails/${video.share_code}.jpg`), + ]); + await env.DB.batch(deleteVideoStatements(env, video.id)); + } + + // Drop stale password rate-limit rows so the table can't grow unboundedly. + await env.DB.prepare( + "DELETE FROM password_attempts WHERE datetime(attempted_at) < datetime('now', '-1 day')" + ).run(); + await env.DB.prepare( + "DELETE FROM comment_sessions WHERE datetime(expires_at) < datetime('now')" + ).run(); +} + +// --- Password Verification --- + +async function handleVerifyPassword(request, env, shareCode) { + const video = await env.DB.prepare( + "SELECT * FROM videos WHERE share_code = ? AND upload_completed = 1 AND datetime(expires_at) > datetime('now')" + ).bind(shareCode).first(); + + if (!video || !video.password_hash) return errorResponse('Not found', 404); + + // Brute-force protection: 10 attempts per IP per video per 5 minutes. + const clientIP = request.headers.get('CF-Connecting-IP') || 'unknown'; + const recent = await env.DB.prepare( + "SELECT COUNT(*) as cnt FROM password_attempts WHERE video_id = ? AND client_ip = ? AND datetime(attempted_at) > datetime('now', '-5 minutes')" + ).bind(video.id, clientIP).first(); + if (recent && recent.cnt >= 10) return errorResponse('Too many attempts — try again later', 429); + + const body = await request.json(); + const password = body.password || ''; + + // The browser sends the raw password (HTTPS); the app stored it as a salted + // hash of SHA256(password). Legacy rows (pre-salt) hold bare SHA256(password). + const clientHash = await sha256Hex(password); + let matches; + if (video.password_salt) { + matches = timingSafeEqual(await sha256Hex(video.password_salt + clientHash), video.password_hash); + } else { + matches = timingSafeEqual(clientHash, video.password_hash); + // Lazy upgrade: re-store the legacy unsalted hash as salted on success. + if (matches) { + const salt = generateSalt(); + const upgraded = await sha256Hex(salt + clientHash); + await env.DB.prepare('UPDATE videos SET password_hash = ?, password_salt = ? WHERE id = ?') + .bind(upgraded, salt, video.id).run(); + } + } + + if (!matches) { + await env.DB.prepare( + 'INSERT INTO password_attempts (video_id, client_ip) VALUES (?, ?)' + ).bind(video.id, clientIP).run(); + return jsonResponse({ error: 'Incorrect password' }, 403); + } + + // Issue an HMAC session token (never the stored hash). + const authToken = await generateAuthToken(shareCode, video.expires_at, env.API_SECRET); + const expires = new Date(video.expires_at + 'Z'); + + return new Response(JSON.stringify({ ok: true }), { + status: 200, + headers: { + 'Content-Type': 'application/json', + 'Set-Cookie': `voom_auth_${shareCode}=${authToken}; Path=/; Expires=${expires.toUTCString()}; HttpOnly; SameSite=Lax; Secure`, + }, + }); +} + +// --- Reactions --- + +async function handleReact(request, env, shareCode) { + const video = await env.DB.prepare( + "SELECT id, password_hash, expires_at FROM videos WHERE share_code = ? AND upload_completed = 1 AND datetime(expires_at) > datetime('now')" + ).bind(shareCode).first(); + + if (!video) return errorResponse('Not found', 404); + + // Password check + if (video.password_hash) { + const authed = await verifyPasswordAuth(request, env, shareCode, video); + if (!authed) return errorResponse('Unauthorized', 401); + } + + const body = await request.json(); + const { timestamp, emoji } = body; + const allowedEmojis = ['👍', '❤️', '😂', '😮', '🔥', '👏']; + if (!allowedEmojis.includes(emoji)) return errorResponse('Invalid emoji'); + if (typeof timestamp !== 'number' || timestamp < 0) return errorResponse('Invalid timestamp'); + + // Rate limit: 50 reactions per IP per video + const clientIP = request.headers.get('CF-Connecting-IP') || 'unknown'; + const count = await env.DB.prepare( + 'SELECT COUNT(*) as cnt FROM reactions WHERE video_id = ? AND client_ip = ?' + ).bind(video.id, clientIP).first(); + if (count && count.cnt >= 50) return errorResponse('Rate limit exceeded', 429); + + await env.DB.prepare( + 'INSERT INTO reactions (video_id, timestamp, emoji, client_ip) VALUES (?, ?, ?, ?)' + ).bind(video.id, timestamp, emoji, clientIP).run(); + + return jsonResponse({ ok: true }); +} + +async function handleGetReactions(request, env, shareCode) { + const video = await env.DB.prepare( + "SELECT id, password_hash, expires_at FROM videos WHERE share_code = ? AND upload_completed = 1 AND datetime(expires_at) > datetime('now')" + ).bind(shareCode).first(); + + if (!video) return errorResponse('Not found', 404); + + // Same gate as POST /react — listing must not bypass the password. + const authed = await verifyPasswordAuth(request, env, shareCode, video); + if (!authed) return errorResponse('Password required', 401); + + const reactions = await env.DB.prepare( + 'SELECT timestamp, emoji, created_at FROM reactions WHERE video_id = ? ORDER BY created_at DESC LIMIT 500' + ).bind(video.id).all(); + + return jsonResponse({ reactions: reactions.results || [] }); +} + +// --- Comments --- + +async function handleComment(request, env, shareCode) { + const video = await env.DB.prepare( + "SELECT id, password_hash, expires_at FROM videos WHERE share_code = ? AND upload_completed = 1 AND datetime(expires_at) > datetime('now')" + ).bind(shareCode).first(); + + if (!video) return errorResponse('Not found', 404); + + // Password check + if (video.password_hash) { + const authed = await verifyPasswordAuth(request, env, shareCode, video); + if (!authed) return errorResponse('Unauthorized', 401); + } + + const body = await request.json(); + const { timestamp, text, author_name: authorName } = body; + if (typeof timestamp !== 'number' || timestamp < 0) return errorResponse('Invalid timestamp'); + if (!authorName || typeof authorName !== 'string' || authorName.trim().length === 0) { + return errorResponse('Display name is required'); + } + if (authorName.length > 100) return errorResponse('Display name is too long'); + if (!text || text.trim().length === 0) return errorResponse('Text is required'); + if (text.length > 2000) return errorResponse('Text too long'); + + // Rate limit: 5 comments per IP per 5 minutes + const clientIP = request.headers.get('CF-Connecting-IP') || 'unknown'; + const recent = await env.DB.prepare( + "SELECT COUNT(*) as cnt FROM comments WHERE video_id = ? AND client_ip = ? AND datetime(created_at) > datetime('now', '-5 minutes')" + ).bind(video.id, clientIP).first(); + if (recent && recent.cnt >= 5) return errorResponse('Rate limit exceeded', 429); + + await env.DB.prepare( + 'INSERT INTO comments (video_id, timestamp, author_name, text, client_ip) VALUES (?, ?, ?, ?, ?)' + ).bind(video.id, timestamp, authorName.trim(), text.trim().substring(0, 2000), clientIP).run(); + + return jsonResponse({ ok: true }); +} + +async function handleGetComments(request, env, shareCode) { + const video = await env.DB.prepare( + "SELECT id, password_hash, expires_at FROM videos WHERE share_code = ? AND upload_completed = 1 AND datetime(expires_at) > datetime('now')" + ).bind(shareCode).first(); + + if (!video) return errorResponse('Not found', 404); + + // Same gate as POST /comment — viewer comments can be sensitive. + const authed = await verifyPasswordAuth(request, env, shareCode, video); + if (!authed) return errorResponse('Password required', 401); + + const url = new URL(request.url); + const requestedPage = parseInt(url.searchParams.get('page') || '1', 10); + const requestedLimit = parseInt(url.searchParams.get('limit') || '50', 10); + const page = Number.isSafeInteger(requestedPage) ? Math.max(1, Math.min(requestedPage, Math.floor(Number.MAX_SAFE_INTEGER / 100))) : 1; + const limit = Number.isFinite(requestedLimit) ? Math.max(1, Math.min(requestedLimit, 100)) : 50; + const offset = (page - 1) * limit; + + const total = await env.DB.prepare( + 'SELECT COUNT(*) as cnt FROM comments WHERE video_id = ?' + ).bind(video.id).first(); + + const comments = await env.DB.prepare( + 'SELECT timestamp, author_name, text, created_at FROM comments WHERE video_id = ? ORDER BY timestamp ASC LIMIT ? OFFSET ?' + ).bind(video.id, limit, offset).all(); + + return jsonResponse({ + comments: comments.results || [], + total: total ? total.cnt : 0, + page, + limit, + }); +} + +// --- Check Views (authenticated) --- + +async function handleCheckViews(request, env) { + const body = await request.json(); + const { shareCodes } = body; + if (!Array.isArray(shareCodes) || shareCodes.length === 0) return errorResponse('shareCodes required'); + if (shareCodes.length > 90) return errorResponse('Too many shareCodes (max 90)'); + + const placeholders = shareCodes.map(() => '?').join(','); + const results = await env.DB.prepare( + `SELECT share_code, view_count FROM videos WHERE share_code IN (${placeholders})` + ).bind(...shareCodes).all(); + + const views = {}; + for (const row of results.results || []) { + views[row.share_code] = row.view_count || 0; + } + + return jsonResponse({ views }); +} + +// --- Library: list all shared videos (dashboard) --- + +async function handleListVideos(env) { + const rows = await env.DB.prepare( + `SELECT share_code, title, duration, width, height, file_size, created_at, expires_at, + view_count, is_meeting, summary, (password_hash IS NOT NULL) AS is_protected + FROM videos + WHERE upload_completed = 1 + ORDER BY datetime(created_at) DESC` + ).all(); + return jsonResponse({ videos: rows.results || [] }); +} + +// --- OG Image --- + +async function handleOGImage(env, shareCode) { + const video = await env.DB.prepare( + "SELECT * FROM videos WHERE share_code = ? AND upload_completed = 1 AND datetime(expires_at) > datetime('now')" + ) + .bind(shareCode) + .first(); + + if (!video) return new Response('Not found', { status: 404 }); + + // Serve uploaded thumbnail if available \u2014 but never for password-protected + // videos, whose poster frame may itself be sensitive. + if (!video.password_hash) { + const thumb = await env.VIDEOS_BUCKET.get(`thumbnails/${shareCode}.jpg`); + if (thumb) { + return new Response(thumb.body, { + status: 200, + headers: { + 'Content-Type': 'image/jpeg', + 'Cache-Control': 'public, max-age=86400', + }, + }); + } + } + + // Fallback SVG + const locked = !!video.password_hash; + const duration = formatDuration(video.duration); + const date = formatDate(video.created_at); + const rawTitle = locked ? 'Protected video' : video.title; + const title = rawTitle.length > 60 ? rawTitle.substring(0, 57) + '...' : rawTitle; + const res = !locked && video.width > 0 ? `${finiteNonnegative(video.width)}\u00d7${finiteNonnegative(video.height)}` : ''; + + const svg = ``; + + return new Response(svg, { + status: 200, + headers: { + 'Content-Type': 'image/svg+xml', + 'Cache-Control': 'public, max-age=86400', + 'X-Content-Type-Options': 'nosniff', + }, + }); +} + +// Exported for unit tests only — the worker runtime uses none of these exports. +export { generateShareCode, escapeHTML, parseCookies, timingSafeEqual, sha256Hex, generateSalt, formatVTTTime, expectedSessionToken, dashboardPassword }; diff --git a/services/recordly-share/worker/test/api.test.js b/services/recordly-share/worker/test/api.test.js new file mode 100644 index 000000000..aee4d6ad9 --- /dev/null +++ b/services/recordly-share/worker/test/api.test.js @@ -0,0 +1,506 @@ +import { describe, it, expect, beforeAll, vi } from 'vitest'; +import { env, SELF } from 'cloudflare:test'; +import worker, { sha256Hex } from '../src/index.js'; + +const AUTH = { Authorization: 'Bearer test-secret' }; +const BASE = 'https://share.test'; + +async function createShare(extra = {}) { + const res = await SELF.fetch(`${BASE}/api/upload`, { + method: 'POST', + headers: { ...AUTH, 'Content-Type': 'application/json' }, + body: JSON.stringify({ title: 'Test Recording', duration: 12.5, width: 1920, height: 1080, fileSize: 1000, ...extra }), + }); + expect(res.status).toBe(200); + return res.json(); +} + +async function completeUpload(shareCode, bytes = new Uint8Array([0, 1, 2, 3, 4, 5, 6, 7])) { + const put = await SELF.fetch(`${BASE}/api/upload-data/${shareCode}`, { + method: 'PUT', + headers: { ...AUTH, 'Content-Type': 'video/mp4' }, + body: bytes, + }); + expect(put.status).toBe(200); + const meta = await SELF.fetch(`${BASE}/api/metadata/${shareCode}`, { + method: 'POST', + headers: { ...AUTH, 'Content-Type': 'application/json' }, + body: JSON.stringify({ segments: [{ startTime: 0, endTime: 1, text: 'hello world' }] }), + }); + expect(meta.status).toBe(200); +} + +describe('auth', () => { + it('rejects /api/* without a token', async () => { + const res = await SELF.fetch(`${BASE}/api/health`); + expect(res.status).toBe(401); + }); + + it('rejects a wrong token', async () => { + const res = await SELF.fetch(`${BASE}/api/health`, { headers: { Authorization: 'Bearer wrong' } }); + expect(res.status).toBe(401); + }); + + it('rejects a Bearer header with no token', async () => { + const res = await SELF.fetch(`${BASE}/api/health`, { headers: { Authorization: 'Bearer' } }); + expect(res.status).toBe(401); + }); + + it('accepts the correct token', async () => { + const res = await SELF.fetch(`${BASE}/api/health`, { headers: AUTH }); + expect(res.status).toBe(200); + expect(await res.json()).toEqual({ ok: true, app: 'recordly' }); + }); +}); + +describe('comment accounts', () => { + it('allows comments without signing in and uses the supplied display name', async () => { + const { shareCode } = await createShare(); + await completeUpload(shareCode); + + const anonymous = await SELF.fetch(`${BASE}/s/${shareCode}/comment`, { + method: 'POST', + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify({ + timestamp: 2, + author_name: 'Link Reviewer', + text: 'No account required', + }), + }); + expect(anonymous.status).toBe(200); + + const comments = await SELF.fetch(`${BASE}/s/${shareCode}/comments`); + const data = await comments.json(); + expect(data.comments).toEqual(expect.arrayContaining([ + expect.objectContaining({ + author_name: 'Link Reviewer', + text: 'No account required', + }), + ])); + }); + + it('supports signing back in and invalidates a logged-out session', async () => { + const register = await SELF.fetch(`${BASE}/auth/register`, { + method: 'POST', + headers: { 'Content-Type': 'application/json', 'CF-Connecting-IP': '203.0.113.80' }, + body: JSON.stringify({ + displayName: 'Signed-in Reviewer', + email: 'reviewer@example.com', + password: 'correct-horse-battery-staple', + }), + }); + expect(register.status).toBe(200); + + const login = await SELF.fetch(`${BASE}/auth/login`, { + method: 'POST', + headers: { 'Content-Type': 'application/json', 'CF-Connecting-IP': '203.0.113.81' }, + body: JSON.stringify({ + email: 'reviewer@example.com', + password: 'correct-horse-battery-staple', + }), + }); + expect(login.status).toBe(200); + const cookie = login.headers.get('Set-Cookie').split(';')[0]; + + const logout = await SELF.fetch(`${BASE}/auth/logout`, { + method: 'POST', + headers: { Cookie: cookie }, + }); + expect(logout.status).toBe(200); + + const session = await SELF.fetch(`${BASE}/auth/session`, { headers: { Cookie: cookie } }); + expect(await session.json()).toEqual({ user: null }); + }); +}); + +describe('upload validation', () => { + it('requires a title', async () => { + const res = await SELF.fetch(`${BASE}/api/upload`, { + method: 'POST', + headers: { ...AUTH, 'Content-Type': 'application/json' }, + body: JSON.stringify({}), + }); + expect(res.status).toBe(400); + }); + + it('rejects javascript: CTA URLs', async () => { + const res = await SELF.fetch(`${BASE}/api/upload`, { + method: 'POST', + headers: { ...AUTH, 'Content-Type': 'application/json' }, + body: JSON.stringify({ title: 'x', cta_url: 'javascript:alert(1)' }), + }); + expect(res.status).toBe(400); + }); + + it('accepts https CTA URLs and returns a well-formed share code', async () => { + const data = await createShare({ cta_url: 'https://example.com', cta_text: 'Visit' }); + expect(data.shareCode).toMatch(/^[a-z0-9]{10}$/); + expect(data.shareURL).toContain(`/s/${data.shareCode}`); + }); + + it('uploads and completes a video through the multipart API', async () => { + const { shareCode } = await createShare({ fileSize: 6 }); + const start = await SELF.fetch(`${BASE}/api/upload-multipart/${shareCode}`, { + method: 'POST', + headers: AUTH, + }); + expect(start.status).toBe(200); + const { uploadId } = await start.json(); + + const part = await SELF.fetch( + `${BASE}/api/upload-part/${shareCode}/${encodeURIComponent(uploadId)}/1`, + { + method: 'PUT', + headers: { ...AUTH, 'Content-Type': 'video/mp4' }, + body: new Uint8Array([10, 20, 30, 40, 50, 60]), + }, + ); + expect(part.status).toBe(200); + const uploadedPart = await part.json(); + + const complete = await SELF.fetch( + `${BASE}/api/upload-complete/${shareCode}/${encodeURIComponent(uploadId)}`, + { + method: 'POST', + headers: { ...AUTH, 'Content-Type': 'application/json' }, + body: JSON.stringify({ parts: [uploadedPart] }), + }, + ); + expect(complete.status).toBe(200); + + const meta = await SELF.fetch(`${BASE}/api/metadata/${shareCode}`, { + method: 'POST', + headers: { ...AUTH, 'Content-Type': 'application/json' }, + body: JSON.stringify({}), + }); + expect(meta.status).toBe(200); + + const video = await SELF.fetch(`${BASE}/v/${shareCode}`); + expect(video.status).toBe(200); + expect(Array.from(new Uint8Array(await video.arrayBuffer()))).toEqual([10, 20, 30, 40, 50, 60]); + }); +}); + +describe('share data + view counts', () => { + it('serves data for a completed upload and increments views', async () => { + const { shareCode } = await createShare(); + await completeUpload(shareCode); + + const res1 = await SELF.fetch(`${BASE}/s/${shareCode}/data`); + expect(res1.status).toBe(200); + const d1 = await res1.json(); + expect(d1.video.title).toBe('Test Recording'); + expect(d1.video.view_count).toBe(1); + expect(d1.segments).toHaveLength(1); + + const res2 = await SELF.fetch(`${BASE}/s/${shareCode}/data`); + const d2 = await res2.json(); + expect(d2.video.view_count).toBe(2); + }); + + it('404s for incomplete uploads', async () => { + const { shareCode } = await createShare(); + const res = await SELF.fetch(`${BASE}/s/${shareCode}/data`); + expect(res.status).toBe(404); + }); +}); + +describe('video streaming + ranges', () => { + let shareCode; + const bytes = new Uint8Array(100).map((_, i) => i); + + beforeAll(async () => { + ({ shareCode } = await createShare()); + await completeUpload(shareCode, bytes); + }); + + it('serves the full object without a Range header', async () => { + const res = await SELF.fetch(`${BASE}/v/${shareCode}`); + expect(res.status).toBe(200); + expect(res.headers.get('Content-Length')).toBe('100'); + expect(res.headers.get('Accept-Ranges')).toBe('bytes'); + }); + + it('serves a bounded range with the full size in Content-Range', async () => { + const res = await SELF.fetch(`${BASE}/v/${shareCode}`, { headers: { Range: 'bytes=10-19' } }); + expect(res.status).toBe(206); + expect(res.headers.get('Content-Range')).toBe('bytes 10-19/100'); + expect(res.headers.get('Content-Length')).toBe('10'); + const body = new Uint8Array(await res.arrayBuffer()); + expect(Array.from(body)).toEqual([10, 11, 12, 13, 14, 15, 16, 17, 18, 19]); + }); + + it('serves an open-ended range', async () => { + const res = await SELF.fetch(`${BASE}/v/${shareCode}`, { headers: { Range: 'bytes=90-' } }); + expect(res.status).toBe(206); + expect(res.headers.get('Content-Range')).toBe('bytes 90-99/100'); + expect(res.headers.get('Content-Length')).toBe('10'); + }); + + it('serves a suffix range (bytes=-N)', async () => { + const res = await SELF.fetch(`${BASE}/v/${shareCode}`, { headers: { Range: 'bytes=-5' } }); + expect(res.status).toBe(206); + expect(res.headers.get('Content-Range')).toBe('bytes 95-99/100'); + const body = new Uint8Array(await res.arrayBuffer()); + expect(Array.from(body)).toEqual([95, 96, 97, 98, 99]); + }); + + it('returns 416 for an unsatisfiable range', async () => { + const res = await SELF.fetch(`${BASE}/v/${shareCode}`, { headers: { Range: 'bytes=5000-' } }); + expect(res.status).toBe(416); + }); +}); + +describe('password protection', () => { + const password = 'hunter2'; + let clientHash; + + beforeAll(async () => { + clientHash = await sha256Hex(password); // what the desktop app sends at share time + }); + + async function protectedShare() { + const share = await createShare({ password_hash: clientHash }); + await completeUpload(share.shareCode); + return share.shareCode; + } + + it('gates /data behind the password', async () => { + const shareCode = await protectedShare(); + const res = await SELF.fetch(`${BASE}/s/${shareCode}/data`); + expect(res.status).toBe(401); + expect((await res.json()).password_protected).toBe(true); + }); + + it('gates reactions, comments, and the thumbnail behind the password', async () => { + const shareCode = await protectedShare(); + + expect((await SELF.fetch(`${BASE}/s/${shareCode}/reactions`)).status).toBe(401); + expect((await SELF.fetch(`${BASE}/s/${shareCode}/comments`)).status).toBe(401); + expect((await SELF.fetch(`${BASE}/thumb/${shareCode}`)).status).toBe(404); + + // …and unlocks them all with the auth cookie. + const good = await SELF.fetch(`${BASE}/s/${shareCode}/verify-password`, { + method: 'POST', + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify({ password }), + }); + expect(good.status).toBe(200); + const cookie = good.headers.get('Set-Cookie').split(';')[0]; + + expect((await SELF.fetch(`${BASE}/s/${shareCode}/reactions`, { headers: { Cookie: cookie } })).status).toBe(200); + expect((await SELF.fetch(`${BASE}/s/${shareCode}/comments`, { headers: { Cookie: cookie } })).status).toBe(200); + }); + + it('rejects password attempts on expired videos', async () => { + const shareCode = await protectedShare(); + await env.DB.prepare( + "UPDATE videos SET expires_at = datetime('now', '-1 day') WHERE share_code = ?" + ).bind(shareCode).run(); + + const res = await SELF.fetch(`${BASE}/s/${shareCode}/verify-password`, { + method: 'POST', + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify({ password }), + }); + expect(res.status).toBe(404); + }); + + it('rejects a wrong password, accepts the right one, sets an HttpOnly cookie', async () => { + const shareCode = await protectedShare(); + + const bad = await SELF.fetch(`${BASE}/s/${shareCode}/verify-password`, { + method: 'POST', + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify({ password: 'wrong' }), + }); + expect(bad.status).toBe(403); + + const good = await SELF.fetch(`${BASE}/s/${shareCode}/verify-password`, { + method: 'POST', + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify({ password }), + }); + expect(good.status).toBe(200); + const cookie = good.headers.get('Set-Cookie'); + expect(cookie).toContain(`voom_auth_${shareCode}=`); + expect(cookie).toContain('HttpOnly'); + expect(cookie).toContain('Secure'); + + const authed = await SELF.fetch(`${BASE}/s/${shareCode}/data`, { + headers: { Cookie: cookie.split(';')[0] }, + }); + expect(authed.status).toBe(200); + }); + + it('stores passwords salted — never the bare client hash', async () => { + const shareCode = await protectedShare(); + const row = await env.DB.prepare('SELECT password_hash, password_salt FROM videos WHERE share_code = ?') + .bind(shareCode).first(); + expect(row.password_salt).toMatch(/^[0-9a-f]{32}$/); + expect(row.password_hash).not.toBe(clientHash); + }); + + it('lazily upgrades legacy unsalted rows on successful verify', async () => { + const shareCode = await protectedShare(); + // Regress the row to the legacy (pre-salt) format. + await env.DB.prepare('UPDATE videos SET password_hash = ?, password_salt = NULL WHERE share_code = ?') + .bind(clientHash, shareCode).run(); + + const res = await SELF.fetch(`${BASE}/s/${shareCode}/verify-password`, { + method: 'POST', + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify({ password }), + }); + expect(res.status).toBe(200); + + const row = await env.DB.prepare('SELECT password_hash, password_salt FROM videos WHERE share_code = ?') + .bind(shareCode).first(); + expect(row.password_salt).toMatch(/^[0-9a-f]{32}$/); + expect(row.password_hash).not.toBe(clientHash); // re-stored salted + }); + + it('rate-limits brute-force attempts (429 after 10 failures)', async () => { + const shareCode = await protectedShare(); + for (let i = 0; i < 10; i++) { + const res = await SELF.fetch(`${BASE}/s/${shareCode}/verify-password`, { + method: 'POST', + headers: { 'Content-Type': 'application/json', 'CF-Connecting-IP': '203.0.113.7' }, + body: JSON.stringify({ password: `wrong-${i}` }), + }); + expect(res.status).toBe(403); + } + const blocked = await SELF.fetch(`${BASE}/s/${shareCode}/verify-password`, { + method: 'POST', + headers: { 'Content-Type': 'application/json', 'CF-Connecting-IP': '203.0.113.7' }, + body: JSON.stringify({ password }), + }); + expect(blocked.status).toBe(429); + }); + + it('hides title and thumbnail from the OG page and image', async () => { + const shareCode = await protectedShare(); + const og = await SELF.fetch(`${BASE}/s/${shareCode}`, { headers: { 'User-Agent': 'Twitterbot/1.0' } }); + expect(og.status).toBe(200); + const html = await og.text(); + expect(html).toContain('Protected video'); + expect(html).not.toContain('Test Recording'); + + const img = await SELF.fetch(`${BASE}/og/${shareCode}`); + expect(img.status).toBe(200); + expect(img.headers.get('Content-Type')).toContain('svg'); + const svg = await img.text(); + expect(svg).toContain('Protected video'); + expect(svg).not.toContain('Test Recording'); + }); +}); + +describe('OG page (public video)', () => { + it('escapes the title in meta tags', async () => { + const { shareCode } = await createShare({ title: '' }); + await completeUpload(shareCode); + const res = await SELF.fetch(`${BASE}/s/${shareCode}`, { headers: { 'User-Agent': 'Slackbot 1.0' } }); + const html = await res.text(); + expect(html).not.toContain(''; + const { shareCode } = await createShare({ width: payload, height: payload, duration: 'invalid', fileSize: -1 }); + const row = await env.DB.prepare('SELECT width, height, duration, file_size FROM videos WHERE share_code = ?').bind(shareCode).first(); + expect(row).toMatchObject({ width: 0, height: 0, duration: 0, file_size: 0 }); + await completeUpload(shareCode); + await env.DB.prepare('UPDATE videos SET width = ?, height = ? WHERE share_code = ?').bind(payload, payload, shareCode).run(); + const response = await SELF.fetch(`${BASE}/s/${shareCode}`, { headers: { 'User-Agent': 'Twitterbot/1.0' } }); + expect(await response.text()).not.toContain(''); + }); +}); + + +it('normalizes invalid comment pagination and clamps zero limits', async () => { + const { shareCode } = await createShare(); + await completeUpload(shareCode); + for (const query of ['page=invalid&limit=invalid', 'page=-5&limit=0', 'page=1&limit=-1']) { + const response = await SELF.fetch(`${BASE}/s/${shareCode}/comments?${query}`); + expect(response.status).toBe(200); + const body = await response.json(); + expect(body.comments).toEqual([]); + } +}); diff --git a/services/recordly-share/worker/test/helpers.test.js b/services/recordly-share/worker/test/helpers.test.js new file mode 100644 index 000000000..b3cadfc0a --- /dev/null +++ b/services/recordly-share/worker/test/helpers.test.js @@ -0,0 +1,96 @@ +import { describe, it, expect } from 'vitest'; +import { + generateShareCode, + escapeHTML, + parseCookies, + timingSafeEqual, + sha256Hex, + generateSalt, + formatVTTTime, +} from '../src/index.js'; + +const SHARE_CODE_CHARS = 'abcdefghjkmnpqrstuvwxyz23456789'; +const SHARE_CODE_LENGTH = 10; + +describe('generateShareCode', () => { + it('produces codes of the documented length and charset', () => { + for (let i = 0; i < 50; i++) { + const code = generateShareCode(); + expect(code).toHaveLength(SHARE_CODE_LENGTH); + expect(code).toMatch(/^[a-z0-9]+$/); // must satisfy every route regex + for (const ch of code) expect(SHARE_CODE_CHARS).toContain(ch); + } + }); + + it('excludes ambiguous characters (i, l, o, 0, 1)', () => { + for (const ch of 'ilo01') expect(SHARE_CODE_CHARS).not.toContain(ch); + }); +}); + +describe('escapeHTML', () => { + it('escapes the four double-quote-context metacharacters', () => { + expect(escapeHTML(`Enter your dashboard password to manage shared recordings.
RecordlyLibraryRecordlyShared recordingEnter your dashboard password to manage shared recordings.
+ +Manage your shared videos and links.
+
{
+ e.currentTarget.style.visibility = 'hidden';
+ }}
+ />
+ Leave feedback at the exact moment you’re watching.
++ {timestampParts(comment.text, duration).map((part, n) => + part.time === undefined ? ( + part.text + ) : ( + + ), + )} +
+ {formatDate(comment.created_at)} +{data.video.title}
+{data.video.summary}
+