| 1 | package xlsx_test |
| 2 | |
| 3 | import ( |
| 4 | "bytes" |
| 5 | "context" |
| 6 | "path/filepath" |
| 7 | "testing" |
| 8 | |
| 9 | rdb "amadan.net/rastrillo/rastrillo/db" |
| 10 | "amadan.net/rastrillo/rastrillo/migrate" |
| 11 | |
| 12 | "amadan.net/oficina/sheets/internal/sheets" |
| 13 | "amadan.net/oficina/sheets/internal/sheets/sealtest" |
| 14 | "amadan.net/oficina/sheets/internal/sheets/xlsx" |
| 15 | ) |
| 16 | |
| 17 | // XLSX import is where fresh, previously-untrusted content first enters |
| 18 | // this app's storage. Everything it writes goes through Handle.Set, |
| 19 | // which is already gated by store's own TestSetDoesNotLeakPlaintext — |
| 20 | // this test re-proves the same guarantee specifically on the import |
| 21 | // path, against a real cell value drawn from an actual XLSX file rather |
| 22 | // than a hand-built raw string, closing the loop on "the one rule" at |
| 23 | // the boundary where content most freshly enters the system. |
| 24 | func TestImportDoesNotLeakPlaintext(t *testing.T) { |
| 25 | canary := string(sealtest.Canaries[0]) |
| 26 | |
| 27 | dir := t.TempDir() |
| 28 | dbPath := filepath.Join(dir, "test.db") |
| 29 | d, err := rdb.Open(dbPath, nil) |
| 30 | if err != nil { |
| 31 | t.Fatalf("open db: %v", err) |
| 32 | } |
| 33 | defer d.Close() |
| 34 | if _, err := migrate.Apply(context.Background(), d, sheets.BootSchema); err != nil { |
| 35 | t.Fatalf("migrate: %v", err) |
| 36 | } |
| 37 | sealer := testSealer(t) |
| 38 | |
| 39 | // A workbook whose one cell holds the canary text, built by hand |
| 40 | // through this app's own Set/Export rather than a raw excelize call, |
| 41 | // so the fixture itself carries the canary as ordinary cell content. |
| 42 | source := newTab(t, d.G, sealer) |
| 43 | rowID, err := source.EnsureRow(0) |
| 44 | if err != nil { |
| 45 | t.Fatalf("EnsureRow: %v", err) |
| 46 | } |
| 47 | colID, err := source.EnsureCol(0) |
| 48 | if err != nil { |
| 49 | t.Fatalf("EnsureCol: %v", err) |
| 50 | } |
| 51 | if err := source.Set(rowID, colID, canary, 1); err != nil { |
| 52 | t.Fatalf("Set: %v", err) |
| 53 | } |
| 54 | var buf bytes.Buffer |
| 55 | if err := xlsx.Export(source, &buf); err != nil { |
| 56 | t.Fatalf("Export: %v", err) |
| 57 | } |
| 58 | |
| 59 | // Import that workbook into a second tab in the SAME database, then |
| 60 | // checkpoint so the gate reads settled bytes (sealtest.AssertNoPlaintext |
| 61 | // also checks the WAL directly, but a checkpoint proves the main file |
| 62 | // itself is clean too). |
| 63 | target := newTab(t, d.G, sealer) |
| 64 | if err := xlsx.Import(&buf, target); err != nil { |
| 65 | t.Fatalf("Import: %v", err) |
| 66 | } |
| 67 | if err := d.G.Exec("PRAGMA wal_checkpoint(TRUNCATE)").Error; err != nil { |
| 68 | t.Fatalf("checkpoint: %v", err) |
| 69 | } |
| 70 | sealtest.AssertNoPlaintext(t, dbPath) |
| 71 | } |
| 72 | |
amadan