andy/CodeNavigator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Only allow local folder uploads when SHOW_LOCAL=true

Browse Source 
Local folder jobs are now refused with 403 unless the server runs with
SHOW_LOCAL=true, and job kinds other than local or github are rejected.
/api/health reports localFolders so the frontend can hide the option.
Tests enable it explicitly where they index local folders.
This commit is contained in:
Andy Dixon
2026-07-19 15:27:47 +01:00
parent 599ca2235a
commit 9299f3a9c4
3 changed files with 38 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
main_test.go
+27 -1
View File
@@ -107,6 +107,7 @@ func (c client) json(method, path, body string, wantStatus int, out any) {
func newTestServer(t *testing.T) (*Server, client) {
server := NewServer(filepath.Join(t.TempDir(), "codenavigator"))
server.showLocal = true // most tests index local folders
ts := httptest.NewServer(server)
t.Cleanup(ts.Close)
return server, client{t, ts.URL, nil}.stranger()
@@ -240,7 +241,7 @@ func TestRoutesAndHeaders(t *testing.T) {
t.Fatalf("preflight = %d %v", res.StatusCode, res.Header)
}
for path, contentType := range map[string]string{"/": "text/html", "/api.mjs": "text/javascript", "/styles.css": "text/css", "/config.js": "text/javascript", "/inter-latin.woff2": "font/woff2"} {
for path, contentType := range map[string]string{"/": "text/html", "/api.mjs": "text/javascript", "/styles.css": "text/css", "/config.js": "text/javascript", "/fonts/archivo-black.woff2": "font/woff2"} {
res, err := http.Get(c.url + path)
if err != nil {
t.Fatal(err)
@@ -434,3 +435,28 @@ func TestProgressStreamSendsKeepAlivesWhileQueued(t *testing.T) {
t.Fatalf("stream ended without a snapshot: %+v", job)
}
}
func TestLocalFoldersDisabledByDefault(t *testing.T) {
t.Setenv("SHOW_LOCAL", "")
server := NewServer(filepath.Join(t.TempDir(), "codenavigator"))
ts := httptest.NewServer(server)
defer ts.Close()
c := client{t, ts.URL, nil}.stranger()
var health map[string]any
c.json("GET", "/api/health", "", 200, &health)
if health["localFolders"] != false {
t.Fatalf("health = %v", health)
}
c.json("POST", "/api/jobs", `{"kind":"local"}`, 403, nil)
c.json("POST", "/api/jobs", `{"kind":"mystery"}`, 400, nil)
t.Setenv("SHOW_LOCAL", "true")
enabled := httptest.NewServer(NewServer(filepath.Join(t.TempDir(), "codenavigator")))
defer enabled.Close()
on := client{t, enabled.URL, nil}.stranger()
on.json("GET", "/api/health", "", 200, &health)
if health["localFolders"] != true {
t.Fatalf("health with SHOW_LOCAL=true = %v", health)
}
on.json("POST", "/api/jobs", `{"kind":"local"}`, 201, nil)
}