import fs from "node:fs/promises"; import type { IncomingMessage } from "node:http"; import os from "node:os"; import path from "node:path"; import { describe, expect, it } from "vitest"; import { CONTROL_UI_BOOTSTRAP_CONFIG_PATH } from "./control-ui-contract.js"; import { handleControlUiAvatarRequest, handleControlUiHttpRequest } from "./control-ui.js"; import { makeMockHttpResponse } from "./test-http-response.js"; describe("handleControlUiHttpRequest", () => { async function withControlUiRoot(params: { indexHtml?: string; fn: (tmp: string) => Promise; }) { const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "openclaw-ui-")); try { await fs.writeFile(path.join(tmp, "index.html"), params.indexHtml ?? "\n"); return await params.fn(tmp); } finally { await fs.rm(tmp, { recursive: true, force: true }); } } function parseBootstrapPayload(end: ReturnType["end"]) { return JSON.parse(String(end.mock.calls[0]?.[0] ?? "")) as { basePath: string; assistantName: string; assistantAvatar: string; assistantAgentId: string; }; } function expectNotFoundResponse(params: { handled: boolean; res: ReturnType["res"]; end: ReturnType["end"]; }) { expect(params.handled).toBe(true); expect(params.res.statusCode).toBe(404); expect(params.end).toHaveBeenCalledWith("Not Found"); } function runControlUiRequest(params: { url: string; method: "GET" | "HEAD"; rootPath: string; basePath?: string; }) { const { res, end } = makeMockHttpResponse(); const handled = handleControlUiHttpRequest( { url: params.url, method: params.method } as IncomingMessage, res, { ...(params.basePath ? { basePath: params.basePath } : {}), root: { kind: "resolved", path: params.rootPath }, }, ); return { res, end, handled }; } function runAvatarRequest(params: { url: string; method: "GET" | "HEAD"; resolveAvatar: Parameters[2]["resolveAvatar"]; basePath?: string; }) { const { res, end } = makeMockHttpResponse(); const handled = handleControlUiAvatarRequest( { url: params.url, method: params.method } as IncomingMessage, res, { ...(params.basePath ? { basePath: params.basePath } : {}), resolveAvatar: params.resolveAvatar, }, ); return { res, end, handled }; } async function writeAssetFile(rootPath: string, filename: string, contents: string) { const assetsDir = path.join(rootPath, "assets"); await fs.mkdir(assetsDir, { recursive: true }); const filePath = path.join(assetsDir, filename); await fs.writeFile(filePath, contents); return { assetsDir, filePath }; } async function withBasePathRootFixture(params: { siblingDir: string; fn: (paths: { root: string; sibling: string }) => Promise; }) { const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "openclaw-ui-root-")); try { const root = path.join(tmp, "ui"); const sibling = path.join(tmp, params.siblingDir); await fs.mkdir(root, { recursive: true }); await fs.mkdir(sibling, { recursive: true }); await fs.writeFile(path.join(root, "index.html"), "ok\n"); return await params.fn({ root, sibling }); } finally { await fs.rm(tmp, { recursive: true, force: true }); } } it("sets security headers for Control UI responses", async () => { await withControlUiRoot({ fn: async (tmp) => { const { res, setHeader } = makeMockHttpResponse(); const handled = handleControlUiHttpRequest( { url: "/", method: "GET" } as IncomingMessage, res, { root: { kind: "resolved", path: tmp }, }, ); expect(handled).toBe(true); expect(setHeader).toHaveBeenCalledWith("X-Frame-Options", "DENY"); const csp = setHeader.mock.calls.find((call) => call[0] === "Content-Security-Policy")?.[1]; expect(typeof csp).toBe("string"); expect(String(csp)).toContain("frame-ancestors 'none'"); expect(String(csp)).toContain("script-src 'self'"); expect(String(csp)).not.toContain("script-src 'self' 'unsafe-inline'"); }, }); }); it("does not inject inline scripts into index.html", async () => { const html = "Hello\n"; await withControlUiRoot({ indexHtml: html, fn: async (tmp) => { const { res, end } = makeMockHttpResponse(); const handled = handleControlUiHttpRequest( { url: "/", method: "GET" } as IncomingMessage, res, { root: { kind: "resolved", path: tmp }, config: { agents: { defaults: { workspace: tmp } }, ui: { assistant: { name: ".png" } }, }, }, ); expect(handled).toBe(true); const parsed = parseBootstrapPayload(end); expect(parsed.basePath).toBe(""); expect(parsed.assistantName).toBe("