From 8d4efa86d82aafcd0a448e7d75294fbe89847951 Mon Sep 17 00:00:00 2001
From: Nicolas Meienberger <github@thisprops.com>
Date: Fri, 19 Dec 2025 19:05:28 +0100
Subject: [PATCH] test: controllers security tests

---
 .../__tests__/backups.controller.test.ts      |   2 +-
 .../__tests__/events.controller.test.ts       |  53 +++++++++
 .../notifications.controller.test.ts          | 110 ++++++++++++++++++
 .../__tests__/repositories.controller.test.ts | 105 +++++++++++++++++
 .../__tests__/system.controller.test.ts       |  89 ++++++++++++++
 .../__tests__/volumes.controller.test.ts      | 104 +++++++++++++++++
 6 files changed, 462 insertions(+), 1 deletion(-)
 create mode 100644 app/server/modules/events/__tests__/events.controller.test.ts
 create mode 100644 app/server/modules/notifications/__tests__/notifications.controller.test.ts
 create mode 100644 app/server/modules/repositories/__tests__/repositories.controller.test.ts
 create mode 100644 app/server/modules/system/__tests__/system.controller.test.ts
 create mode 100644 app/server/modules/volumes/__tests__/volumes.controller.test.ts

diff --git a/app/server/modules/backups/__tests__/backups.controller.test.ts b/app/server/modules/backups/__tests__/backups.controller.test.ts
index eceda5d1..3c415004 100644
--- a/app/server/modules/backups/__tests__/backups.controller.test.ts
+++ b/app/server/modules/backups/__tests__/backups.controller.test.ts
@@ -37,7 +37,7 @@ describe("backups security", () => {
 		expect(res.status).toBe(200);
 	});
 
-	describe("unauthenticated access to all endpoints", () => {
+	describe("unauthenticated access", () => {
 		const endpoints: { method: string; path: string }[] = [
 			{ method: "GET", path: "/api/v1/backups" },
 			{ method: "GET", path: "/api/v1/backups/1" },
diff --git a/app/server/modules/events/__tests__/events.controller.test.ts b/app/server/modules/events/__tests__/events.controller.test.ts
new file mode 100644
index 00000000..c40793fe
--- /dev/null
+++ b/app/server/modules/events/__tests__/events.controller.test.ts
@@ -0,0 +1,53 @@
+import { test, describe, expect } from "bun:test";
+import { createApp } from "~/server/app";
+import { createTestSession } from "~/test/helpers/auth";
+
+const app = createApp();
+
+describe("events security", () => {
+	test("should return 401 if no session cookie is provided", async () => {
+		const res = await app.request("/api/v1/events");
+		expect(res.status).toBe(401);
+		const body = await res.json();
+		expect(body.message).toBe("Authentication required");
+	});
+
+	test("should return 401 if session is invalid", async () => {
+		const res = await app.request("/api/v1/events", {
+			headers: {
+				Cookie: "session_id=invalid-session",
+			},
+		});
+		expect(res.status).toBe(401);
+		const body = await res.json();
+		expect(body.message).toBe("Invalid or expired session");
+
+		expect(res.headers.get("Set-Cookie")).toContain("session_id=;");
+	});
+
+	test("should return 200 if session is valid", async () => {
+		const { sessionId } = await createTestSession();
+
+		const res = await app.request("/api/v1/events", {
+			headers: {
+				Cookie: `session_id=${sessionId}`,
+			},
+		});
+
+		expect(res.status).toBe(200);
+		expect(res.headers.get("Content-Type")).toBe("text/event-stream");
+	});
+
+	describe("unauthenticated access", () => {
+		const endpoints: { method: string; path: string }[] = [{ method: "GET", path: "/api/v1/events" }];
+
+		for (const { method, path } of endpoints) {
+			test(`${method} ${path} should return 401`, async () => {
+				const res = await app.request(path, { method });
+				expect(res.status).toBe(401);
+				const body = await res.json();
+				expect(body.message).toBe("Authentication required");
+			});
+		}
+	});
+});
diff --git a/app/server/modules/notifications/__tests__/notifications.controller.test.ts b/app/server/modules/notifications/__tests__/notifications.controller.test.ts
new file mode 100644
index 00000000..02834267
--- /dev/null
+++ b/app/server/modules/notifications/__tests__/notifications.controller.test.ts
@@ -0,0 +1,110 @@
+import { test, describe, expect } from "bun:test";
+import { createApp } from "~/server/app";
+import { createTestSession } from "~/test/helpers/auth";
+
+const app = createApp();
+
+describe("notifications security", () => {
+	test("should return 401 if no session cookie is provided", async () => {
+		const res = await app.request("/api/v1/notifications/destinations");
+		expect(res.status).toBe(401);
+		const body = await res.json();
+		expect(body.message).toBe("Authentication required");
+	});
+
+	test("should return 401 if session is invalid", async () => {
+		const res = await app.request("/api/v1/notifications/destinations", {
+			headers: {
+				Cookie: "session_id=invalid-session",
+			},
+		});
+		expect(res.status).toBe(401);
+		const body = await res.json();
+		expect(body.message).toBe("Invalid or expired session");
+
+		expect(res.headers.get("Set-Cookie")).toContain("session_id=;");
+	});
+
+	test("should return 200 if session is valid", async () => {
+		const { sessionId } = await createTestSession();
+
+		const res = await app.request("/api/v1/notifications/destinations", {
+			headers: {
+				Cookie: `session_id=${sessionId}`,
+			},
+		});
+
+		expect(res.status).toBe(200);
+	});
+
+	describe("unauthenticated access", () => {
+		const endpoints: { method: string; path: string }[] = [
+			{ method: "GET", path: "/api/v1/notifications/destinations" },
+			{ method: "POST", path: "/api/v1/notifications/destinations" },
+			{ method: "GET", path: "/api/v1/notifications/destinations/1" },
+			{ method: "PATCH", path: "/api/v1/notifications/destinations/1" },
+			{ method: "DELETE", path: "/api/v1/notifications/destinations/1" },
+			{ method: "POST", path: "/api/v1/notifications/destinations/1/test" },
+		];
+
+		for (const { method, path } of endpoints) {
+			test(`${method} ${path} should return 401`, async () => {
+				const res = await app.request(path, { method });
+				expect(res.status).toBe(401);
+				const body = await res.json();
+				expect(body.message).toBe("Authentication required");
+			});
+		}
+	});
+
+	describe("information disclosure", () => {
+		test("should not disclose if a destination exists when unauthenticated", async () => {
+			const res = await app.request("/api/v1/notifications/destinations/999999");
+			expect(res.status).toBe(401);
+			const body = await res.json();
+			expect(body.message).toBe("Authentication required");
+		});
+	});
+
+	describe("input validation", () => {
+		test("should return 404 for malformed destination ID", async () => {
+			const { sessionId } = await createTestSession();
+			const res = await app.request("/api/v1/notifications/destinations/not-a-number", {
+				headers: {
+					Cookie: `session_id=${sessionId}`,
+				},
+			});
+
+			expect(res.status).toBe(404);
+		});
+
+		test("should return 404 for non-existent destination ID", async () => {
+			const { sessionId } = await createTestSession();
+			const res = await app.request("/api/v1/notifications/destinations/999999", {
+				headers: {
+					Cookie: `session_id=${sessionId}`,
+				},
+			});
+
+			expect(res.status).toBe(404);
+			const body = await res.json();
+			expect(body.message).toBe("Notification destination not found");
+		});
+
+		test("should return 400 for invalid payload on create", async () => {
+			const { sessionId } = await createTestSession();
+			const res = await app.request("/api/v1/notifications/destinations", {
+				method: "POST",
+				headers: {
+					Cookie: `session_id=${sessionId}`,
+					"Content-Type": "application/json",
+				},
+				body: JSON.stringify({
+					name: "Test",
+				}),
+			});
+
+			expect(res.status).toBe(400);
+		});
+	});
+});
diff --git a/app/server/modules/repositories/__tests__/repositories.controller.test.ts b/app/server/modules/repositories/__tests__/repositories.controller.test.ts
new file mode 100644
index 00000000..d7afc68d
--- /dev/null
+++ b/app/server/modules/repositories/__tests__/repositories.controller.test.ts
@@ -0,0 +1,105 @@
+import { test, describe, expect } from "bun:test";
+import { createApp } from "~/server/app";
+import { createTestSession } from "~/test/helpers/auth";
+
+const app = createApp();
+
+describe("repositories security", () => {
+	test("should return 401 if no session cookie is provided", async () => {
+		const res = await app.request("/api/v1/repositories");
+		expect(res.status).toBe(401);
+		const body = await res.json();
+		expect(body.message).toBe("Authentication required");
+	});
+
+	test("should return 401 if session is invalid", async () => {
+		const res = await app.request("/api/v1/repositories", {
+			headers: {
+				Cookie: "session_id=invalid-session",
+			},
+		});
+		expect(res.status).toBe(401);
+		const body = await res.json();
+		expect(body.message).toBe("Invalid or expired session");
+
+		expect(res.headers.get("Set-Cookie")).toContain("session_id=;");
+	});
+
+	test("should return 200 if session is valid", async () => {
+		const { sessionId } = await createTestSession();
+
+		const res = await app.request("/api/v1/repositories", {
+			headers: {
+				Cookie: `session_id=${sessionId}`,
+			},
+		});
+
+		expect(res.status).toBe(200);
+	});
+
+	describe("unauthenticated access", () => {
+		const endpoints: { method: string; path: string }[] = [
+			{ method: "GET", path: "/api/v1/repositories" },
+			{ method: "POST", path: "/api/v1/repositories" },
+			{ method: "GET", path: "/api/v1/repositories/rclone-remotes" },
+			{ method: "GET", path: "/api/v1/repositories/test-repo" },
+			{ method: "DELETE", path: "/api/v1/repositories/test-repo" },
+			{ method: "GET", path: "/api/v1/repositories/test-repo/snapshots" },
+			{ method: "GET", path: "/api/v1/repositories/test-repo/snapshots/test-snapshot" },
+			{ method: "GET", path: "/api/v1/repositories/test-repo/snapshots/test-snapshot/files" },
+			{ method: "POST", path: "/api/v1/repositories/test-repo/restore" },
+			{ method: "POST", path: "/api/v1/repositories/test-repo/doctor" },
+			{ method: "DELETE", path: "/api/v1/repositories/test-repo/snapshots/test-snapshot" },
+			{ method: "PATCH", path: "/api/v1/repositories/test-repo" },
+		];
+
+		for (const { method, path } of endpoints) {
+			test(`${method} ${path} should return 401`, async () => {
+				const res = await app.request(path, { method });
+				expect(res.status).toBe(401);
+				const body = await res.json();
+				expect(body.message).toBe("Authentication required");
+			});
+		}
+	});
+
+	describe("information disclosure", () => {
+		test("should not disclose if a repository exists when unauthenticated", async () => {
+			const res = await app.request("/api/v1/repositories/non-existent-repo");
+			expect(res.status).toBe(401);
+			const body = await res.json();
+			expect(body.message).toBe("Authentication required");
+		});
+	});
+
+	describe("input validation", () => {
+		test("should return 404 for non-existent repository", async () => {
+			const { sessionId } = await createTestSession();
+			const res = await app.request("/api/v1/repositories/non-existent-repo", {
+				headers: {
+					Cookie: `session_id=${sessionId}`,
+				},
+			});
+
+			expect(res.status).toBe(404);
+			const body = await res.json();
+			expect(body.message).toBe("Repository not found");
+		});
+
+		test("should return 400 for invalid payload on create", async () => {
+			const { sessionId } = await createTestSession();
+			const res = await app.request("/api/v1/repositories", {
+				method: "POST",
+				headers: {
+					Cookie: `session_id=${sessionId}`,
+					"Content-Type": "application/json",
+				},
+				body: JSON.stringify({
+					name: "Test",
+				}),
+			});
+
+			expect(res.status).toBe(400);
+		});
+	});
+});
diff --git a/app/server/modules/system/__tests__/system.controller.test.ts b/app/server/modules/system/__tests__/system.controller.test.ts
new file mode 100644
index 00000000..5ce3d51e
--- /dev/null
+++ b/app/server/modules/system/__tests__/system.controller.test.ts
@@ -0,0 +1,89 @@
+import { test, describe, expect } from "bun:test";
+import { createApp } from "~/server/app";
+import { createTestSession } from "~/test/helpers/auth";
+
+const app = createApp();
+
+describe("system security", () => {
+	test("should return 401 if no session cookie is provided", async () => {
+		const res = await app.request("/api/v1/system/info");
+		expect(res.status).toBe(401);
+		const body = await res.json();
+		expect(body.message).toBe("Authentication required");
+	});
+
+	test("should return 401 if session is invalid", async () => {
+		const res = await app.request("/api/v1/system/info", {
+			headers: {
+				Cookie: "session_id=invalid-session",
+			},
+		});
+		expect(res.status).toBe(401);
+		const body = await res.json();
+		expect(body.message).toBe("Invalid or expired session");
+
+		expect(res.headers.get("Set-Cookie")).toContain("session_id=;");
+	});
+
+	test("should return 200 if session is valid", async () => {
+		const { sessionId } = await createTestSession();
+
+		const res = await app.request("/api/v1/system/info", {
+			headers: {
+				Cookie: `session_id=${sessionId}`,
+			},
+		});
+
+		expect(res.status).toBe(200);
+	});
+
+	describe("unauthenticated access", () => {
+		const endpoints: { method: string; path: string }[] = [
+			{ method: "GET", path: "/api/v1/system/info" },
+			{ method: "POST", path: "/api/v1/system/restic-password" },
+		];
+
+		for (const { method, path } of endpoints) {
+			test(`${method} ${path} should return 401`, async () => {
+				const res = await app.request(path, { method });
+				expect(res.status).toBe(401);
+				const body = await res.json();
+				expect(body.message).toBe("Authentication required");
+			});
+		}
+	});
+
+	describe("input validation", () => {
+		test("should return 400 for invalid payload on restic-password", async () => {
+			const { sessionId } = await createTestSession();
+			const res = await app.request("/api/v1/system/restic-password", {
+				method: "POST",
+				headers: {
+					Cookie: `session_id=${sessionId}`,
+					"Content-Type": "application/json",
+				},
+				body: JSON.stringify({}),
+			});
+
+			expect(res.status).toBe(400);
+		});
+
+		test("should return 401 for incorrect password on restic-password", async () => {
+			const { sessionId } = await createTestSession();
+			const res = await app.request("/api/v1/system/restic-password", {
+				method: "POST",
+				headers: {
+					Cookie: `session_id=${sessionId}`,
+					"Content-Type": "application/json",
+				},
+				body: JSON.stringify({
+					password: "wrong-password",
+				}),
+			});
+
+			expect(res.status).toBe(401);
+			const body = await res.json();
+			expect(body.message).toBe("Incorrect password");
+		});
+	});
+});
diff --git a/app/server/modules/volumes/__tests__/volumes.controller.test.ts b/app/server/modules/volumes/__tests__/volumes.controller.test.ts
new file mode 100644
index 00000000..04b05776
--- /dev/null
+++ b/app/server/modules/volumes/__tests__/volumes.controller.test.ts
@@ -0,0 +1,104 @@
+import { test, describe, expect } from "bun:test";
+import { createApp } from "~/server/app";
+import { createTestSession } from "~/test/helpers/auth";
+
+const app = createApp();
+
+describe("volumes security", () => {
+	test("should return 401 if no session cookie is provided", async () => {
+		const res = await app.request("/api/v1/volumes");
+		expect(res.status).toBe(401);
+		const body = await res.json();
+		expect(body.message).toBe("Authentication required");
+	});
+
+	test("should return 401 if session is invalid", async () => {
+		const res = await app.request("/api/v1/volumes", {
+			headers: {
+				Cookie: "session_id=invalid-session",
+			},
+		});
+		expect(res.status).toBe(401);
+		const body = await res.json();
+		expect(body.message).toBe("Invalid or expired session");
+
+		expect(res.headers.get("Set-Cookie")).toContain("session_id=;");
+	});
+
+	test("should return 200 if session is valid", async () => {
+		const { sessionId } = await createTestSession();
+
+		const res = await app.request("/api/v1/volumes", {
+			headers: {
+				Cookie: `session_id=${sessionId}`,
+			},
+		});
+
+		expect(res.status).toBe(200);
+	});
+
+	describe("unauthenticated access", () => {
+		const endpoints: { method: string; path: string }[] = [
+			{ method: "GET", path: "/api/v1/volumes" },
+			{ method: "POST", path: "/api/v1/volumes" },
+			{ method: "POST", path: "/api/v1/volumes/test-connection" },
+			{ method: "DELETE", path: "/api/v1/volumes/test-volume" },
+			{ method: "GET", path: "/api/v1/volumes/test-volume" },
+			{ method: "PUT", path: "/api/v1/volumes/test-volume" },
+			{ method: "POST", path: "/api/v1/volumes/test-volume/mount" },
+			{ method: "POST", path: "/api/v1/volumes/test-volume/unmount" },
+			{ method: "POST", path: "/api/v1/volumes/test-volume/health-check" },
+			{ method: "GET", path: "/api/v1/volumes/test-volume/files" },
+			{ method: "GET", path: "/api/v1/volumes/filesystem/browse" },
+		];
+
+		for (const { method, path } of endpoints) {
+			test(`${method} ${path} should return 401`, async () => {
+				const res = await app.request(path, { method });
+				expect(res.status).toBe(401);
+				const body = await res.json();
+				expect(body.message).toBe("Authentication required");
+			});
+		}
+	});
+
+	describe("information disclosure", () => {
+		test("should not disclose if a volume exists when unauthenticated", async () => {
+			const res = await app.request("/api/v1/volumes/non-existent-volume");
+			expect(res.status).toBe(401);
+			const body = await res.json();
+			expect(body.message).toBe("Authentication required");
+		});
+	});
+
+	describe("input validation", () => {
+		test("should return 404 for non-existent volume", async () => {
+			const { sessionId } = await createTestSession();
+			const res = await app.request("/api/v1/volumes/non-existent-volume", {
+				headers: {
+					Cookie: `session_id=${sessionId}`,
+				},
+			});
+
+			expect(res.status).toBe(404);
+			const body = await res.json();
+			expect(body.message).toBe("Volume not found");
+		});
+
+		test("should return 400 for invalid payload on create", async () => {
+			const { sessionId } = await createTestSession();
+			const res = await app.request("/api/v1/volumes", {
+				method: "POST",
+				headers: {
+					Cookie: `session_id=${sessionId}`,
+					"Content-Type": "application/json",
+				},
+				body: JSON.stringify({
+					name: "Test",
+				}),
+			});
+
+			expect(res.status).toBe(400);
+		});
+	});
+});