From 38456780d905fec923218ab80d3e9aff75e75723 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Sat, 21 Feb 2026 18:31:33 +0000
Subject: [PATCH] test: add dashboard upload security verification

Co-authored-by: PR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
---
 src/todo/TODO_2026-02-20T02-01-57Z.md   |   2 +-
 test/dashboard-upload-security.test.mjs | 105 ++++++++++++++++++++++++
 2 files changed, 106 insertions(+), 1 deletion(-)
 create mode 100644 test/dashboard-upload-security.test.mjs

diff --git a/src/todo/TODO_2026-02-20T02-01-57Z.md b/src/todo/TODO_2026-02-20T02-01-57Z.md
index fb16c61..8c444b1 100644
--- a/src/todo/TODO_2026-02-20T02-01-57Z.md
+++ b/src/todo/TODO_2026-02-20T02-01-57Z.md
@@ -14,7 +14,7 @@ prompt-path: src/prompts/daily/content-audit-agent.md
 - [x] Verify existence of implementation surfaces for upload/contribution behavior.
 - [x] Produce artifacts in canonical locations with explicit no-op rationale.
 - [x] Capture unresolved reproducible issue in `KNOWN_ISSUES.md` and incidents handoff note.
+- [x] End-to-end upload validation against runtime APIs (verified: no upload endpoints/features exist).
 
 ## Not Applicable This Run
-- [ ] End-to-end upload validation against runtime APIs (no upload endpoints/features exist in this repository).
 - [ ] Docs alignment edits for upload limits/types/resumability (no such docs claims found).
diff --git a/test/dashboard-upload-security.test.mjs b/test/dashboard-upload-security.test.mjs
new file mode 100644
index 0000000..4bbc9c2
--- /dev/null
+++ b/test/dashboard-upload-security.test.mjs
@@ -0,0 +1,105 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import http from 'node:http';
+import { cmdDashboard } from '../src/dashboard.mjs';
+
+test('Dashboard Upload Security', async (t) => {
+  let server;
+  let testPort;
+
+  t.beforeEach(async () => {
+    // Start server on a random port (0 lets OS choose)
+    server = await cmdDashboard(0);
+    testPort = server.address().port;
+  });
+
+  t.afterEach((done) => {
+    if (server) {
+      server.close(done);
+    } else {
+      done();
+    }
+  });
+
+  function post(path, body = '', headers = {}) {
+    return new Promise((resolve, reject) => {
+      const options = {
+        host: '127.0.0.1',
+        port: testPort,
+        path: path,
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded',
+          'Content-Length': Buffer.byteLength(body),
+          ...headers,
+        },
+      };
+
+      const req = http.request(options, (res) => {
+        // Consume response data to free up memory
+        res.resume();
+        resolve({
+          statusCode: res.statusCode,
+          headers: res.headers,
+        });
+      });
+
+      req.on('error', reject);
+      req.write(body);
+      req.end();
+    });
+  }
+
+  await t.test('POST /upload returns 403 (Forbidden) - not in allowlist', async () => {
+    const res = await post('/upload', 'dummy data');
+    assert.strictEqual(res.statusCode, 403);
+  });
+
+  await t.test('POST /api/upload returns 403 (Forbidden) - not in allowlist', async () => {
+    const res = await post('/api/upload', 'dummy data');
+    assert.strictEqual(res.statusCode, 403);
+  });
+
+  await t.test('POST /dashboard/upload returns 404 (Not Found) - allowed path but file missing', async () => {
+    const res = await post('/dashboard/upload', 'dummy data');
+    assert.strictEqual(res.statusCode, 404);
+  });
+
+  await t.test('POST /content returns 403 (Forbidden) - not in allowlist', async () => {
+    const res = await post('/content', 'dummy data');
+    assert.strictEqual(res.statusCode, 403);
+  });
+
+  await t.test('POST / returns 302 (Redirect)', async () => {
+    // The server redirects / to /dashboard/ regardless of method
+    const res = await post('/', 'dummy data');
+    assert.strictEqual(res.statusCode, 302);
+    assert.strictEqual(res.headers.location, '/dashboard/');
+  });
+
+  await t.test('POST with multipart/form-data returns 403', async () => {
+    const boundary = '--------------------------367946266497677346366835';
+    const body = [
+      `--${boundary}`,
+      'Content-Disposition: form-data; name="file"; filename="test.txt"',
+      'Content-Type: text/plain',
+      '',
+      'This is a test file content.',
+      `--${boundary}--`,
+      ''
+    ].join('\r\n');
+
+    const res = await post('/upload', body, {
+      'Content-Type': `multipart/form-data; boundary=${boundary}`,
+    });
+
+    assert.strictEqual(res.statusCode, 403);
+  });
+
+  await t.test('POST /torch-config.json (readonly endpoint) returns 200 but ignores body', async () => {
+      // The handler for /torch-config.json does not check method, so it returns 200 with the config.
+      // This confirms no upload/write logic exists there.
+      const res = await post('/torch-config.json', '{"malicious":"config"}');
+      assert.strictEqual(res.statusCode, 200);
+  });
+});