Release v1.4.31 with full bug-audit hardening

tests/container.test.ts

@@ -16,16 +16,66 @@ afterEach(() => {
 });
 
 describe("container", () => {
-  it("rejects oversized DLC files before network access", async () => {
+  it("skips oversized DLC files without throwing and blocking other files", async () => {
     const dir = fs.mkdtempSync(path.join(os.tmpdir(), "rd-dlc-"));
     tempDirs.push(dir);
-    const filePath = path.join(dir, "oversized.dlc");
-    fs.writeFileSync(filePath, Buffer.alloc((8 * 1024 * 1024) + 1, 1));
+    const oversizedFilePath = path.join(dir, "oversized.dlc");
+    fs.writeFileSync(oversizedFilePath, Buffer.alloc((8 * 1024 * 1024) + 1, 1));
+    
+    // Create a valid mockup DLC that would be skipped if an error was thrown
+    const validFilePath = path.join(dir, "valid.dlc");
+    // Just needs to be short enough to pass file limits but fail parsing, triggering dcrypt fallback
+    fs.writeFileSync(validFilePath, Buffer.from("Valid but not real DLC content..."));
 
-    const fetchSpy = vi.fn(async () => new Response("should-not-run", { status: 500 }));
+    const fetchSpy = vi.fn(async () => {
+      // Mock dcrypt response for valid.dlc
+      return new Response("http://example.com/file1.rar\nhttp://example.com/file2.rar", { status: 200 });
+    });
     globalThis.fetch = fetchSpy as unknown as typeof fetch;
 
-    await expect(importDlcContainers([filePath])).rejects.toThrow(/zu groß/i);
-    expect(fetchSpy).toHaveBeenCalledTimes(0);
+    const result = await importDlcContainers([oversizedFilePath, validFilePath]);
+    
+    // Expect the oversized to be silently skipped, and valid to be parsed into 2 packages (one per link name)
+    expect(result).toHaveLength(2);
+    expect(result[0].links).toEqual(["http://example.com/file1.rar"]);
+    expect(result[1].links).toEqual(["http://example.com/file2.rar"]);
+    expect(fetchSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it("skips non-dlc files completely", async () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "rd-dlc-non-"));
+    tempDirs.push(dir);
+    const txtPath = path.join(dir, "links.txt");
+    fs.writeFileSync(txtPath, "http://link.com/1");
+
+    const result = await importDlcContainers([txtPath]);
+    expect(result).toEqual([]);
+  });
+
+  it("falls back to dcrypt if local decryption returns empty", async () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "rd-dlc-"));
+    tempDirs.push(dir);
+    const filePath = path.join(dir, "fallback.dlc");
+    
+    // A file large enough to trigger local decryption attempt (needs > 89 bytes to pass the slice check)
+    fs.writeFileSync(filePath, Buffer.alloc(100, 1).toString("base64"));
+
+    const fetchSpy = vi.fn(async (url: string | URL | Request) => {
+      const urlStr = String(url);
+      if (urlStr.includes("rc")) {
+        // Mock local RC service failure (returning 404 or empty string)
+        return new Response("", { status: 404 });
+      } else {
+        // Mock dcrypt fallback success
+        return new Response("http://fallback.com/1", { status: 200 });
+      }
+    });
+    globalThis.fetch = fetchSpy as unknown as typeof fetch;
+
+    const result = await importDlcContainers([filePath]);
+    expect(result).toHaveLength(1);
+    expect(result[0].links).toEqual(["http://fallback.com/1"]);
+    // Should have tried both!
+    expect(fetchSpy).toHaveBeenCalledTimes(2);
   });
 });

tests/link-parser.test.ts

@@ -0,0 +1,74 @@
+import { describe, expect, it } from "vitest";
+import { mergePackageInputs, parseCollectorInput } from "../src/main/link-parser";
+
+describe("link-parser", () => {
+  describe("mergePackageInputs", () => {
+    it("merges packages with the same name and preserves order", () => {
+      const input = [
+        { name: "Package A", links: ["http://link1", "http://link2"] },
+        { name: "Package B", links: ["http://link3"] },
+        { name: "Package A", links: ["http://link4", "http://link1"] },
+        { name: "", links: ["http://link5"] } // empty name will be inferred
+      ];
+
+      const result = mergePackageInputs(input);
+      
+      expect(result).toHaveLength(3); // Package A, Package B, and inferred 'Paket'
+      
+      const pkgA = result.find(p => p.name === "Package A");
+      expect(pkgA?.links).toEqual(["http://link1", "http://link2", "http://link4"]); // link1 deduplicated
+      
+      const pkgB = result.find(p => p.name === "Package B");
+      expect(pkgB?.links).toEqual(["http://link3"]);
+    });
+
+    it("sanitizes names during merge", () => {
+      const input = [
+        { name: "Valid_Name", links: ["http://link1"] },
+        { name: "Valid?Name*", links: ["http://link2"] }
+      ];
+
+      const result = mergePackageInputs(input);
+      
+      // "Valid?Name*" becomes "Valid Name " -> trimmed to "Valid Name"
+      expect(result.map(p => p.name).sort()).toEqual(["Valid Name", "Valid_Name"]);
+    });
+  });
+
+  describe("parseCollectorInput", () => {
+    it("returns empty array for empty or invalid input", () => {
+      expect(parseCollectorInput("")).toEqual([]);
+      expect(parseCollectorInput("just some text without links")).toEqual([]);
+      expect(parseCollectorInput("ftp://notsupported")).toEqual([]);
+    });
+
+    it("parses and merges links from raw text", () => {
+      const rawText = `
+        Here are some links:
+        http://example.com/part1.rar
+        http://example.com/part2.rar
+        
+        # package: Custom_Name
+        http://other.com/file1
+        http://other.com/file2
+      `;
+
+      const result = parseCollectorInput(rawText, "DefaultFallback");
+      
+      // Should have 2 packages: "DefaultFallback" and "Custom_Name"
+      expect(result).toHaveLength(2);
+      
+      const defaultPkg = result.find(p => p.name === "DefaultFallback");
+      expect(defaultPkg?.links).toEqual([
+        "http://example.com/part1.rar",
+        "http://example.com/part2.rar"
+      ]);
+      
+      const customPkg = result.find(p => p.name === "Custom_Name"); // sanitized!
+      expect(customPkg?.links).toEqual([
+        "http://other.com/file1",
+        "http://other.com/file2"
+      ]);
+    });
+  });
+});

tests/mega-web-fallback.test.ts

@@ -0,0 +1,127 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { MegaWebFallback } from "../src/main/mega-web-fallback";
+
+const originalFetch = globalThis.fetch;
+
+describe("mega-web-fallback", () => {
+  afterEach(() => {
+    globalThis.fetch = originalFetch;
+    vi.restoreAllMocks();
+  });
+
+  describe("MegaWebFallback class", () => {
+    it("returns null when credentials are empty", async () => {
+      const fallback = new MegaWebFallback(() => ({ login: "", password: "" }));
+      const result = await fallback.unrestrict("https://mega.debrid/test");
+      expect(result).toBeNull();
+    });
+
+    it("logs in, fetches HTML, parses code, and polls AJAX for direct url", async () => {
+      let fetchCallCount = 0;
+      globalThis.fetch = vi.fn(async (url: string | URL | Request) => {
+        const urlStr = String(url);
+        fetchCallCount += 1;
+        
+        if (urlStr.includes("form=login")) {
+          const headers = new Headers();
+          headers.append("set-cookie", "session=goodcookie; path=/");
+          return new Response("", { headers, status: 200 });
+        }
+        
+        if (urlStr.includes("page=debrideur")) {
+          return new Response('<form id="debridForm"></form>', { status: 200 });
+        }
+        
+        if (urlStr.includes("form=debrid")) {
+          // The POST to generate the code
+          return new Response(`
+            <div class="acp-box">
+              <h3>Link: https://mega.debrid/link1</h3>
+              <a href="javascript:processDebrid(1,'secretcode123',0)">Download</a>
+            </div>
+          `, { status: 200 });
+        }
+        
+        if (urlStr.includes("ajax=debrid")) {
+          // Polling endpoint
+          return new Response(JSON.stringify({ link: "https://mega.direct/123" }), { status: 200 });
+        }
+        
+        return new Response("Not found", { status: 404 });
+      }) as unknown as typeof fetch;
+
+      const fallback = new MegaWebFallback(() => ({ login: "user", password: "pwd" }));
+      
+      const result = await fallback.unrestrict("https://mega.debrid/link1");
+      expect(result).not.toBeNull();
+      expect(result?.directUrl).toBe("https://mega.direct/123");
+      expect(result?.fileName).toBe("link1");
+      // Calls: 1. Login POST, 2. Verify GET, 3. Generate POST, 4. Polling POST
+      expect(fetchCallCount).toBe(4);
+    });
+
+    it("throws if login fails to set cookie", async () => {
+      globalThis.fetch = vi.fn(async (url: string | URL | Request) => {
+        const urlStr = String(url);
+        if (urlStr.includes("form=login")) {
+          const headers = new Headers(); // No cookie
+          return new Response("", { headers, status: 200 });
+        }
+        return new Response("Not found", { status: 404 });
+      }) as unknown as typeof fetch;
+
+      const fallback = new MegaWebFallback(() => ({ login: "bad", password: "bad" }));
+      
+      await expect(fallback.unrestrict("http://mega.debrid/file"))
+        .rejects.toThrow("Mega-Web Login liefert kein Session-Cookie");
+    });
+
+    it("throws if login verify check fails (no form found)", async () => {
+      globalThis.fetch = vi.fn(async (url: string | URL | Request) => {
+        const urlStr = String(url);
+        if (urlStr.includes("form=login")) {
+          const headers = new Headers();
+          headers.append("set-cookie", "session=goodcookie; path=/");
+          return new Response("", { headers, status: 200 });
+        }
+        if (urlStr.includes("page=debrideur")) {
+          // Missing form!
+          return new Response('<html><body>Nothing here</body></html>', { status: 200 });
+        }
+        return new Response("Not found", { status: 404 });
+      }) as unknown as typeof fetch;
+
+      const fallback = new MegaWebFallback(() => ({ login: "a", password: "b" }));
+      
+      await expect(fallback.unrestrict("http://mega.debrid/file"))
+        .rejects.toThrow("Mega-Web Login ungültig oder Session blockiert");
+    });
+    
+    it("returns null if generation fails to find a code", async () => {
+      let callCount = 0;
+      globalThis.fetch = vi.fn(async (url: string | URL | Request) => {
+        const urlStr = String(url);
+        callCount++;
+        if (urlStr.includes("form=login")) {
+          const headers = new Headers();
+          headers.append("set-cookie", "session=goodcookie; path=/");
+          return new Response("", { headers, status: 200 });
+        }
+        if (urlStr.includes("page=debrideur")) {
+          return new Response('<form id="debridForm"></form>', { status: 200 });
+        }
+        if (urlStr.includes("form=debrid")) {
+          // The generate POST returns HTML without any codes
+          return new Response(`<div>No links here</div>`, { status: 200 });
+        }
+        return new Response("Not found", { status: 404 });
+      }) as unknown as typeof fetch;
+
+      const fallback = new MegaWebFallback(() => ({ login: "a", password: "b" }));
+      const result = await fallback.unrestrict("http://mega.debrid/file");
+      
+      // Generation fails -> resets cookie -> tries again -> fails again -> returns null
+      expect(result).toBeNull();
+    });
+  });
+});