Sign in

flagon-io/g1t

public

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

gitagentscloudflarerustforgemcp

g1t/apps/web/app/lib/avatar-upload.test.ts

49 lines2,083 bytesCodeBlame
1import assert from "node:assert/strict";
2import { test } from "node:test";
3
4import { MAX_AVATAR_BYTES, readAvatarUpload, sniffImage, toBase64 } from "./avatar-upload.ts";
5
6const PNG = new Uint8Array([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0, 0, 0, 13]);
7const JPEG = new Uint8Array([0xff, 0xd8, 0xff, 0xe0, 0, 16]);
8const text = (value: string) => new TextEncoder().encode(value);
9
10function form(bytes: Uint8Array, name = "icon.png", type = "image/png"): FormData {
11 const data = new FormData();
12 data.set("avatar", new File([bytes], name, { type }));
13 return data;
14}
15
16test("an image is known by its bytes", () => {
17 assert.equal(sniffImage(PNG), "image/png");
18 assert.equal(sniffImage(JPEG), "image/jpeg");
19 assert.equal(sniffImage(text("GIF89a\x01\x00")), "image/gif");
20 assert.equal(sniffImage(text("RIFF\x24\x00\x00\x00WEBPVP8 ")), "image/webp");
21});
22
23test("SVG and anything else is refused, whatever it is called", async () => {
24 assert.equal(sniffImage(text('<svg xmlns="http://www.w3.org/2000/svg"><script>alert(1)</script></svg>')), null);
25 assert.equal(sniffImage(text("RIFF\x00\x00\x00\x00WAVEfmt ")), null);
26 const disguised = await readAvatarUpload(form(text("<svg onload=alert(1)/>"), "icon.png", "image/png"));
27 assert.ok("error" in disguised);
28});
29
30test("more than a megabyte is refused", async () => {
31 const big = new Uint8Array(MAX_AVATAR_BYTES + 1);
32 big.set(PNG);
33 const result = await readAvatarUpload(form(big));
34 assert.deepEqual(result, { error: "Use an image of at most 1 MB." });
35 const exact = new Uint8Array(MAX_AVATAR_BYTES);
36 exact.set(PNG);
37 const fits = await readAvatarUpload(form(exact));
38 assert.ok("image" in fits);
39});
40
41test("an image is sent as base64", async () => {
42 const result = await readAvatarUpload(form(PNG));
43 assert.deepEqual(result, { image: toBase64(PNG) });
44 assert.equal(Buffer.from(toBase64(PNG), "base64").compare(Buffer.from(PNG)), 0);
45});
46
47test("a missing file is asked for", async () => {
48 assert.deepEqual(await readAvatarUpload(new FormData()), { error: "Choose an image to upload." });
49});