エンドポイントのテストを追加

packages/backend/package.json

@@ -222,6 +222,7 @@
 		"@types/semver": "7.7.0",
 		"@types/simple-oauth2": "5.0.7",
 		"@types/sinonjs__fake-timers": "8.1.5",
+		"@types/supertest": "6.0.3",
 		"@types/tinycolor2": "1.4.6",
 		"@types/tmp": "0.2.6",
 		"@types/vary": "1.1.3",
@@ -238,6 +239,7 @@
 		"jest-mock": "29.7.0",
 		"nodemon": "3.1.9",
 		"pid-port": "1.0.2",
-		"simple-oauth2": "5.1.0"
+		"simple-oauth2": "5.1.0",
+		"supertest": "7.1.0"
 	}
 }

packages/backend/src/server/ServerService.ts

@@ -73,7 +73,7 @@ export class ServerService implements OnApplicationShutdown {
 	}
 
 	@bindThis
-	public async launch(): Promise<void> {
+	public async launch() {
 		const fastify = Fastify({
 			trustProxy: true,
 			logger: false,
@@ -133,8 +133,8 @@ export class ServerService implements OnApplicationShutdown {
 				reply.header('content-type', 'text/plain; charset=utf-8');
 				reply.header('link', `<${encodeURI(location)}>; rel="canonical"`);
 				done(null, [
-					"Refusing to relay remote ActivityPub object lookup.",
+					'Refusing to relay remote ActivityPub object lookup.',
-					"",
+					'',
 					`Please remove 'application/activity+json' and 'application/ld+json' from the Accept header or fetch using the authoritative URL at ${location}.`,
 				].join('\n'));
 			});
@@ -301,6 +301,7 @@ export class ServerService implements OnApplicationShutdown {
 		}
 
 		await fastify.ready();
+		return fastify;
 	}
 
 	@bindThis

packages/backend/src/server/api/ApiCallService.ts

@@ -426,7 +426,6 @@ export class ApiCallService implements OnApplicationShutdown {
 			const policies = await this.roleService.getUserPolicies(user!.id);
 			const result = await this.handleAttachmentFile(
 				Math.min((policies.maxFileSizeMb * 1024 * 1024), this.config.maxFileSize),
-				request,
 				multipartFile,
 			);
 			attachmentFile = result.attachmentFile;
@@ -452,7 +451,6 @@ export class ApiCallService implements OnApplicationShutdown {
 	@bindThis
 	private async handleAttachmentFile(
 		fileSizeLimit: number,
-		request: FastifyRequest<{ Body: Record<string, unknown> | undefined, Querystring: Record<string, unknown> }>,
 		multipartFile: MultipartFile,
 	) {
 		function createTooLongError() {
@@ -480,12 +478,16 @@ export class ApiCallService implements OnApplicationShutdown {
 			});
 		}
 
-		if (request.headers['content-length'] && Number(request.headers['content-length']) > fileSizeLimit) {
-			throw createTooLongError();
-		}
-
 		const [path, cleanup] = await createTemp();
-		await stream.pipeline(multipartFile.file, createLimitStream(fileSizeLimit), fs.createWriteStream(path));
+		try {
+			await stream.pipeline(
+				multipartFile.file,
+				createLimitStream(fileSizeLimit),
+				fs.createWriteStream(path),
+			);
+		} finally {
+			cleanup();
+		}
 
 		// ファイルサイズが制限を超えていた場合
 		// なお truncated はストリームを読み切ってからでないと機能しないため、stream.pipeline より後にある必要がある

packages/backend/test/unit/server/api/drive/files/create.ts

@@ -0,0 +1,103 @@
+import { S3Client } from '@aws-sdk/client-s3';
+import { Test, TestingModule } from '@nestjs/testing';
+import { mockClient } from 'aws-sdk-client-mock';
+import { FastifyInstance } from 'fastify';
+import request from 'supertest';
+import { CoreModule } from '@/core/CoreModule.js';
+import { RoleService } from '@/core/RoleService.js';
+import { DI } from '@/di-symbols.js';
+import { GlobalModule } from '@/GlobalModule.js';
+import { MiRole, UserProfilesRepository, UsersRepository } from '@/models/_.js';
+import { MiUser } from '@/models/User.js';
+import { ServerModule } from '@/server/ServerModule.js';
+import { ServerService } from '@/server/ServerService.js';
+
+describe('/drive/files/create', () => {
+	let module: TestingModule;
+	let server: FastifyInstance;
+	const s3Mock = mockClient(S3Client);
+	let roleService: RoleService;
+
+	let root: MiUser;
+	let role_tinyAttachment: MiRole;
+
+	beforeAll(async () => {
+		module = await Test.createTestingModule({
+			imports: [GlobalModule, CoreModule, ServerModule],
+		}).compile();
+		module.enableShutdownHooks();
+
+		const serverService = module.get<ServerService>(ServerService);
+		server = await serverService.launch();
+
+		const usersRepository = module.get<UsersRepository>(DI.usersRepository);
+		root = await usersRepository.insert({
+			id: 'root',
+			username: 'root',
+			usernameLower: 'root',
+			token: '1234567890123456',
+		}).then(x => usersRepository.findOneByOrFail(x.identifiers[0]));
+
+		const userProfilesRepository = module.get<UserProfilesRepository>(DI.userProfilesRepository);
+		await userProfilesRepository.insert({
+			userId: root.id,
+		});
+
+		roleService = module.get<RoleService>(RoleService);
+		role_tinyAttachment = await roleService.create({
+			name: 'test-role001',
+			description: 'Test role001 description',
+			target: 'manual',
+			policies: {
+				maxFileSizeMb: {
+					useDefault: false,
+					priority: 1,
+					// 10byte
+					value: 10 / 1024 / 1024,
+				},
+			},
+		});
+	});
+
+	beforeEach(async () => {
+		s3Mock.reset();
+		await roleService.unassign(root.id, role_tinyAttachment.id).catch(() => {});
+	});
+
+	afterAll(async () => {
+		await server.close();
+		await module.close();
+	});
+
+	test('200 ok', async () => {
+		const result = await request(server.server)
+			.post('/api/drive/files/create')
+			.set('Content-Type', 'multipart/form-data')
+			.set('Authorization', `Bearer ${root.token}`)
+			.attach('file', Buffer.from('a'.repeat(1024 * 1024)));
+		expect(result.statusCode).toBe(200);
+	});
+
+	test('200 ok(with role)', async () => {
+		await roleService.assign(root.id, role_tinyAttachment.id);
+
+		const result = await request(server.server)
+			.post('/api/drive/files/create')
+			.set('Content-Type', 'multipart/form-data')
+			.set('Authorization', `Bearer ${root.token}`)
+			.attach('file', Buffer.from('a'.repeat(10)));
+		expect(result.statusCode).toBe(200);
+	});
+
+	test('413 too large', async () => {
+		await roleService.assign(root.id, role_tinyAttachment.id);
+
+		const result = await request(server.server)
+			.post('/api/drive/files/create')
+			.set('Content-Type', 'multipart/form-data')
+			.set('Authorization', `Bearer ${root.token}`)
+			.attach('file', Buffer.from('a'.repeat(11)));
+		expect(result.statusCode).toBe(413);
+		expect(result.body.error.code).toBe('FILE_SIZE_TOO_LARGE');
+	});
+});

pnpm-lock.yaml

@@ -552,6 +552,9 @@ importers:
       '@types/sinonjs__fake-timers':
         specifier: 8.1.5
         version: 8.1.5
+      '@types/supertest':
+        specifier: 6.0.3
+        version: 6.0.3
       '@types/tinycolor2':
         specifier: 1.4.6
         version: 1.4.6
@@ -603,6 +606,9 @@ importers:
       simple-oauth2:
         specifier: 5.1.0
         version: 5.1.0
+      supertest:
+        specifier: 7.1.0
+        version: 7.1.0
     optionalDependencies:
       '@swc/core-android-arm64':
         specifier: 1.3.11
@@ -3149,6 +3155,9 @@ packages:
     peerDependencies:
       '@opentelemetry/api': ^1.1.0
 
+  '@paralleldrive/cuid2@2.2.2':
+    resolution: {integrity: sha512-ZOBkgDwEdoYVlSeRbYYXs0S9MejQofiVYoTbKzy/6GQa39/q5tQU2IX46+shYnUkpEl3wc+J6wRlar7r2EK2xA==}
+
   '@parcel/watcher-android-arm64@2.5.0':
     resolution: {integrity: sha512-qlX4eS28bUcQCdribHkg/herLe+0A9RyYC+mm2PXpncit8z5b3nSqGVzMNR3CmtAOgRutiZ02eIJJgP/b1iEFQ==}
     engines: {node: '>= 10.0.0'}
@@ -4288,6 +4297,9 @@ packages:
   '@types/cookie@0.6.0':
     resolution: {integrity: sha512-4Kh9a6B2bQciAhf7FSuMRRkUWecJgJu9nPnx3yzpsfXX/c50REIqpHY4C82bXP90qrLtXtkDxTZosYO3UpOwlA==}
 
+  '@types/cookiejar@2.1.5':
+    resolution: {integrity: sha512-he+DHOWReW0nghN24E1WUqM0efK4kI9oTqDm6XmK8ZPe2djZ90BSNdGnIyCLzCPw7/pogPlGbzI2wHGGmi4O/Q==}
+
   '@types/debug@4.1.12':
     resolution: {integrity: sha512-vIChWdVG3LG1SMxEvI/AK+FWJthlrqlTu7fbrlywTkkaONwk/UAGaULXRlf8vkzFBLVm0zkMdCquhL5aOjhXPQ==}
 
@@ -4378,6 +4390,9 @@ packages:
   '@types/mdx@2.0.3':
     resolution: {integrity: sha512-IgHxcT3RC8LzFLhKwP3gbMPeaK7BM9eBH46OdapPA7yvuIUJ8H6zHZV53J8hGZcTSnt95jANt+rTBNUUc22ACQ==}
 
+  '@types/methods@1.1.4':
+    resolution: {integrity: sha512-ymXWVrDiCxTBE3+RIrrP533E70eA+9qu7zdWoHuOmGujkYtzf4HQF96b8nwHLqhuf4ykX61IGRIB38CC6/sImQ==}
+
   '@types/micromatch@4.0.9':
     resolution: {integrity: sha512-7V+8ncr22h4UoYRLnLXSpTxjQrNUXtWHGeMPRJt1nULXI57G9bIcpyrHlmrQ7QK24EyyuXvYcSSWAM8GA9nqCg==}
 
@@ -4522,6 +4537,12 @@ packages:
   '@types/statuses@2.0.4':
     resolution: {integrity: sha512-eqNDvZsCNY49OAXB0Firg/Sc2BgoWsntsLUdybGFOhAfCD6QJ2n9HXUIHGqt5qjrxmMv4wS8WLAw43ZkKcJ8Pw==}
 
+  '@types/superagent@8.1.9':
+    resolution: {integrity: sha512-pTVjI73witn+9ILmoJdajHGW2jkSaOzhiFYF1Rd3EQ94kymLqB9PjD9ISg7WaALC7+dCHT0FGe9T2LktLq/3GQ==}
+
+  '@types/supertest@6.0.3':
+    resolution: {integrity: sha512-8WzXq62EXFhJ7QsH3Ocb/iKQ/Ty9ZVWnVzoTKc9tyyFRRF3a74Tk2+TLFgaFFw364Ere+npzHKEJ6ga2LzIL7w==}
+
   '@types/tedious@4.0.14':
     resolution: {integrity: sha512-KHPsfX/FoVbUGbyYvk1q9MMQHLPeRZhRJZdO45Q4YjvFkv4hMNghCWTvy7rdKessBsmtz4euWCWAB6/tVpI1Iw==}
 
@@ -5713,6 +5734,9 @@ packages:
   compare-versions@6.1.1:
     resolution: {integrity: sha512-4hm4VPpIecmlg59CHXnRDnqGplJFrbLG4aFEl5vl6cK1u76ws3LLvX7ikFnTDl5vo39sjWD6AaDPYodJp/NNHg==}
 
+  component-emitter@1.3.1:
+    resolution: {integrity: sha512-T0+barUSQRTUQASh8bx02dl+DhF54GtIDY13Y3m9oWTklKbb3Wv974meRpeZ3lp1JpLVECWWNHC4vaG2XHXouQ==}
+
   compress-commons@6.0.2:
     resolution: {integrity: sha512-6FqVXeETqWPoGcfzrXb37E50NP0LXT8kAMu5ooZayhWWdgEY4lBEEcbQNXtkuKQsGduxiIcI4gOTsxTmuq/bSg==}
     engines: {node: '>= 14'}
@@ -5770,6 +5794,9 @@ packages:
     resolution: {integrity: sha512-Xd8lFX4LM9QEEwxQpF9J9NTUh8pmdJO0cyRJhFiDoLTk2eH8FXlRv2IFGYVadZpqI3j8fhNrSdKCeYPxiAhLXw==}
     engines: {node: '>=18'}
 
+  cookiejar@2.1.4:
+    resolution: {integrity: sha512-LDx6oHrK+PhzLKJU9j5S7/Y3jM/mUHvD/DeI1WQmJn652iPC5Y4TBzC9l+5OMOXlyTTA+SmVUPm0HQUwpD5Jqw==}
+
   core-js@3.29.1:
     resolution: {integrity: sha512-+jwgnhg6cQxKYIIjGtAHq2nwUOolo9eoFZ4sHfUH09BLXBgxnH4gA0zEd+t+BO2cNB8idaBtZFcFTRjQJRJmAw==}
 
@@ -6092,6 +6119,9 @@ packages:
   devlop@1.1.0:
     resolution: {integrity: sha512-RWmIqhcFf1lRYBvNmr7qTNuyCt/7/ns2jbpp1+PalgE/rDQcBT0fioSMUpJ93irlUhC5hrg4cYqe6U+0ImW0rA==}
 
+  dezalgo@1.0.4:
+    resolution: {integrity: sha512-rXSP0bf+5n0Qonsb+SVVfNfIsimO4HEtmnIpPHY8Q1UCzKlQrDMfdobr8nJOOsRgWCyMRqeSBQzmWUMq7zvVig==}
+
   diff-match-patch@1.0.5:
     resolution: {integrity: sha512-IayShXAgj/QMXgB0IWmKx+rOPuGMhqm5w6jvFxmVenXKIzRqTAAsbBPT3kWQeGANj3jGgvcvv4yK6SxqYmikgw==}
 
@@ -6745,6 +6775,10 @@ packages:
     resolution: {integrity: sha512-buewHzMvYL29jdeQTVILecSaZKnt/RJWjoZCF5OW60Z67/GmSLBkOFM7qh1PI3zFNtJbaZL5eQu1vLfazOwj4g==}
     engines: {node: '>=12.20.0'}
 
+  formidable@3.5.4:
+    resolution: {integrity: sha512-YikH+7CUTOtP44ZTnUhR7Ic2UASBPOqmaRkRKxRbywPTe5VxF7RRCck4af9wutiZ/QKM5nME9Bie2fFaPz5Gug==}
+    engines: {node: '>=14.0.0'}
+
   forwarded-parse@2.1.2:
     resolution: {integrity: sha512-alTFZZQDKMporBH77856pXgzhEzaUVmLCDk+egLgIgHst3Tpndzz8MnKe+GzRJRfvVdn69HhpW7cmXzvtLvJAw==}
 
@@ -10165,6 +10199,14 @@ packages:
     peerDependencies:
       postcss: ^8.4.31
 
+  superagent@9.0.2:
+    resolution: {integrity: sha512-xuW7dzkUpcJq7QnhOsnNUgtYp3xRwpt2F7abdRYIpCsAt0hhUqia0EdxyXZQQpNmGtsCzYHryaKSV3q3GJnq7w==}
+    engines: {node: '>=14.18.0'}
+
+  supertest@7.1.0:
+    resolution: {integrity: sha512-5QeSO8hSrKghtcWEoPiO036fxH0Ii2wVQfFZSP0oqQhmjk8bOLhDFXr4JrvaFmPuEWUoq4znY3uSi8UzLKxGqw==}
+    engines: {node: '>=14.18.0'}
+
   supports-color@5.5.0:
     resolution: {integrity: sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==}
     engines: {node: '>=4'}
@@ -10850,6 +10892,9 @@ packages:
   vue-component-type-helpers@2.0.16:
     resolution: {integrity: sha512-qisL/iAfdO++7w+SsfYQJVPj6QKvxp4i1MMxvsNO41z/8zu3KuAw9LkhKUfP/kcOWGDxESp+pQObWppXusejCA==}
 
+  vue-component-type-helpers@2.2.10:
+    resolution: {integrity: sha512-iDUO7uQK+Sab2tYuiP9D1oLujCWlhHELHMgV/cB13cuGbG4qwkLHvtfWb6FzvxrIOPDnU0oHsz2MlQjhYDeaHA==}
+
   vue-component-type-helpers@2.2.8:
     resolution: {integrity: sha512-4bjIsC284coDO9om4HPA62M7wfsTvcmZyzdfR0aUlFXqq4tXxM1APyXpNVxPC8QazKw9OhmZNHBVDA6ODaZsrA==}
 
@@ -13341,6 +13386,10 @@ snapshots:
       '@opentelemetry/api': 1.9.0
       '@opentelemetry/core': 1.30.1(@opentelemetry/api@1.9.0)
 
+  '@paralleldrive/cuid2@2.2.2':
+    dependencies:
+      '@noble/hashes': 1.7.1
+
   '@parcel/watcher-android-arm64@2.5.0':
     optional: true
 
@@ -14445,7 +14494,7 @@ snapshots:
       ts-dedent: 2.2.0
       type-fest: 2.19.0
       vue: 3.5.13(typescript@5.8.3)
-      vue-component-type-helpers: 2.2.8
+      vue-component-type-helpers: 2.2.10
 
   '@stylistic/eslint-plugin@2.13.0(eslint@9.22.0)(typescript@5.8.2)':
     dependencies:
@@ -14760,6 +14809,8 @@ snapshots:
 
   '@types/cookie@0.6.0': {}
 
+  '@types/cookiejar@2.1.5': {}
+
   '@types/debug@4.1.12':
     dependencies:
       '@types/ms': 0.7.34
@@ -14855,6 +14906,8 @@ snapshots:
 
   '@types/mdx@2.0.3': {}
 
+  '@types/methods@1.1.4': {}
+
   '@types/micromatch@4.0.9':
     dependencies:
       '@types/braces': 3.0.1
@@ -14998,6 +15051,18 @@ snapshots:
 
   '@types/statuses@2.0.4': {}
 
+  '@types/superagent@8.1.9':
+    dependencies:
+      '@types/cookiejar': 2.1.5
+      '@types/methods': 1.1.4
+      '@types/node': 22.14.0
+      form-data: 4.0.2
+
+  '@types/supertest@6.0.3':
+    dependencies:
+      '@types/methods': 1.1.4
+      '@types/superagent': 8.1.9
+
   '@types/tedious@4.0.14':
     dependencies:
       '@types/node': 22.14.0
@@ -16487,6 +16552,8 @@ snapshots:
 
   compare-versions@6.1.1: {}
 
+  component-emitter@1.3.1: {}
+
   compress-commons@6.0.2:
     dependencies:
       crc-32: 1.2.2
@@ -16539,6 +16606,8 @@ snapshots:
 
   cookie@1.0.1: {}
 
+  cookiejar@2.1.4: {}
+
   core-js@3.29.1: {}
 
   core-util-is@1.0.2: {}
@@ -16922,7 +16991,7 @@ snapshots:
       object-keys: 1.1.1
       object.assign: 4.1.4
       regexp.prototype.flags: 1.5.0
-      side-channel: 1.0.6
+      side-channel: 1.1.0
       which-boxed-primitive: 1.0.2
       which-collection: 1.0.1
       which-typed-array: 1.1.15
@@ -16981,6 +17050,11 @@ snapshots:
     dependencies:
       dequal: 2.0.3
 
+  dezalgo@1.0.4:
+    dependencies:
+      asap: 2.0.6
+      wrappy: 1.0.2
+
   diff-match-patch@1.0.5: {}
 
   diff-sequences@29.6.3: {}
@@ -17967,6 +18041,12 @@ snapshots:
     dependencies:
       fetch-blob: 3.2.0
 
+  formidable@3.5.4:
+    dependencies:
+      '@paralleldrive/cuid2': 2.2.2
+      dezalgo: 1.0.4
+      once: 1.4.0
+
   forwarded-parse@2.1.2: {}
 
   forwarded@0.2.0: {}
@@ -21571,14 +21651,14 @@ snapshots:
     dependencies:
       call-bound: 1.0.4
       es-errors: 1.3.0
-      get-intrinsic: 1.2.7
+      get-intrinsic: 1.3.0
       object-inspect: 1.13.4
 
   side-channel-weakmap@1.0.2:
     dependencies:
       call-bound: 1.0.4
       es-errors: 1.3.0
-      get-intrinsic: 1.2.7
+      get-intrinsic: 1.3.0
       object-inspect: 1.13.4
       side-channel-map: 1.0.1
 
@@ -22026,6 +22106,27 @@ snapshots:
       postcss: 8.5.3
       postcss-selector-parser: 6.1.2
 
+  superagent@9.0.2:
+    dependencies:
+      component-emitter: 1.3.1
+      cookiejar: 2.1.4
+      debug: 4.4.0(supports-color@8.1.1)
+      fast-safe-stringify: 2.1.1
+      form-data: 4.0.2
+      formidable: 3.5.4
+      methods: 1.1.2
+      mime: 2.6.0
+      qs: 6.14.0
+    transitivePeerDependencies:
+      - supports-color
+
+  supertest@7.1.0:
+    dependencies:
+      methods: 1.1.2
+      superagent: 9.0.2
+    transitivePeerDependencies:
+      - supports-color
+
   supports-color@5.5.0:
     dependencies:
       has-flag: 3.0.0
@@ -22699,6 +22800,8 @@ snapshots:
 
   vue-component-type-helpers@2.0.16: {}
 
+  vue-component-type-helpers@2.2.10: {}
+
   vue-component-type-helpers@2.2.8: {}
 
   vue-demi@0.14.7(vue@3.5.13(typescript@5.8.3)):