Merge feat/unified-group-management: wizard, public groups, activity sidebar

1 files changed, 66 insertions, 1 deletions

diff --git a/packages/meshbay-node/tests/test_roots.py b/packages/meshbay-node/tests/test_roots.py
index ea4ba6a..fc5bd64 100644
--- a/packages/meshbay-node/tests/test_roots.py
+++ b/packages/meshbay-node/tests/test_roots.py
@@ -11,7 +11,10 @@ from pathlib import Path
 
 import pytest
 
-from meshbay_node.roots import Root, RootError, RootSet, entry_abs_path
+from meshbay_node.roots import (
+    Root, RootError, RootSet, entry_abs_path,
+    SAFE_UPLOAD_NAME, safe_subdir, _free_name,
+)
 from meshbay_common.protocol import IndexEntry
 
 
@@ -240,3 +243,65 @@ def test_describe_reports_what_a_member_needs(tmp_path):
     # Deliberately no paths: a member is told what exists and whether it is
     # readable, not where on the operator's disk it lives.
     assert not any("path" in d for d in described)
+
+
+# ── SAFE_UPLOAD_NAME ────────────────────────────────────────────────────────
+
+def test_safe_name_accepts_unicode_letters():
+    assert SAFE_UPLOAD_NAME.match("rapport (1).pdf")
+    assert SAFE_UPLOAD_NAME.match("hello.txt")
+
+
+def test_safe_name_rejects_dotfiles():
+    assert not SAFE_UPLOAD_NAME.match(".hidden")
+    assert not SAFE_UPLOAD_NAME.match("..secret")
+
+
+def test_safe_name_rejects_trailing_dot_or_space():
+    assert not SAFE_UPLOAD_NAME.match("file.")
+    assert not SAFE_UPLOAD_NAME.match("file ")
+
+
+# ── _free_name ──────────────────────────────────────────────────────────────
+
+def test_free_name_returns_original_when_not_taken(tmp_path):
+    assert _free_name(tmp_path, "photo.jpg") == "photo.jpg"
+
+
+def test_free_name_appends_counter_on_collision(tmp_path):
+    (tmp_path / "photo.jpg").write_text("x")
+    assert _free_name(tmp_path, "photo.jpg") == "photo (2).jpg"
+
+
+def test_free_name_increments_past_multiple_collisions(tmp_path):
+    (tmp_path / "photo.jpg").write_text("x")
+    (tmp_path / "photo (2).jpg").write_text("x")
+    assert _free_name(tmp_path, "photo.jpg") == "photo (3).jpg"
+
+
+# ── safe_subdir ─────────────────────────────────────────────────────────────
+
+def test_safe_subdir_resolves_valid_path(tmp_path):
+    (tmp_path / "Films").mkdir()
+    (tmp_path / "Films" / "2024").mkdir()
+    roots = RootSet.build([_spec(tmp_path / "Films")])
+    assert safe_subdir(roots, "Films/2024") == (tmp_path / "Films" / "2024").resolve()
+
+
+def test_safe_subdir_refuses_traversal(tmp_path):
+    (tmp_path / "Films").mkdir()
+    roots = RootSet.build([_spec(tmp_path / "Films")])
+    assert safe_subdir(roots, "Films/../../etc") is None
+
+
+def test_safe_subdir_refuses_empty_virtual_root(tmp_path):
+    (tmp_path / "Films").mkdir()
+    roots = RootSet.build([_spec(tmp_path / "Films")])
+    assert safe_subdir(roots, "") is None
+
+
+def test_safe_subdir_refuses_unavailable_root(tmp_path):
+    (tmp_path / "Films").mkdir()
+    roots = RootSet.build([_spec(tmp_path / "Films")])
+    roots.roots[0].available = False
+    assert safe_subdir(roots, "Films/2024") is None