test(landing): cover the /open route whitelist with vitest

.github/workflows/landing.yml

@@ -0,0 +1,28 @@
+name: landing
+
+on:
+  push:
+    branches: [main]
+    paths: ["landing/**", ".github/workflows/landing.yml"]
+  pull_request:
+    paths: ["landing/**", ".github/workflows/landing.yml"]
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: landing
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 11
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+          cache-dependency-path: landing/pnpm-lock.yaml
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm lint
+      - run: pnpm test

landing/app/open/fragment.test.ts

@@ -0,0 +1,85 @@
+import { describe, expect, it } from "vitest";
+import { readFragment } from "./fragment";
+
+const UUID = "3f2504e0-4f89-11d3-9a0c-0305e82c3301";
+
+describe("readFragment", () => {
+  it("builds a join target and the paste-able code", () => {
+    expect(readFragment(`#join?s=${UUID}&t=tok3n`)).toEqual({
+      url: `voltius://join?s=${UUID}&t=tok3n`,
+      code: `${UUID}:tok3n`,
+    });
+  });
+
+  it("accepts a fragment body without the leading hash", () => {
+    expect(readFragment(`join?s=${UUID}&t=tok3n`)?.url).toBe(
+      `voltius://join?s=${UUID}&t=tok3n`,
+    );
+  });
+
+  it("accepts an upper-case session id", () => {
+    expect(readFragment(`#join?s=${UUID.toUpperCase()}&t=tok3n`)).not.toBeNull();
+  });
+
+  it("builds a verified target with no code", () => {
+    expect(readFragment(`#verified?u=${UUID}`)).toEqual({
+      url: `voltius://verified?u=${UUID}`,
+      code: null,
+    });
+  });
+
+  describe("route whitelist", () => {
+    // Every route the app understands must also be listed here before a link to
+    // it can work; an unlisted one has to fail closed rather than hop.
+    it.each([
+      "#settings?section=mcp",
+      "#plugin/install?id=evil",
+      "#snippet/install?id=evil",
+      "#notification/1",
+      "#connect?host=evil.example",
+      "#JOIN?s=" + UUID + "&t=tok3n",
+      "#join/../verified?u=" + UUID,
+      "#unknown",
+    ])("rejects %s", (hash) => {
+      expect(readFragment(hash)).toBeNull();
+    });
+
+    it("rejects an empty fragment", () => {
+      expect(readFragment("")).toBeNull();
+      expect(readFragment("#")).toBeNull();
+    });
+  });
+
+  describe("parameter validation", () => {
+    it.each([
+      `#join?s=${UUID}`,
+      `#join?t=tok3n`,
+      `#join?s=${UUID}&t=`,
+      "#join?s=not-a-uuid&t=tok3n",
+      `#join?s=${UUID}x&t=tok3n`,
+      "#join",
+      "#verified",
+      "#verified?u=not-a-uuid",
+    ])("rejects %s", (hash) => {
+      expect(readFragment(hash)).toBeNull();
+    });
+  });
+
+  describe("hostile input", () => {
+    it("re-encodes parameters instead of letting one close the query", () => {
+      const target = readFragment(`#join?s=${UUID}&t=a%26u%3D${UUID}`);
+      expect(target?.url).toBe(`voltius://join?s=${UUID}&t=a%26u%3D${UUID}`);
+    });
+
+    it("cannot inject another scheme or authority through a parameter", () => {
+      const target = readFragment(`#join?s=${UUID}&t=%2F%2Fevil.example`);
+      expect(target?.url.startsWith(`voltius://join?`)).toBe(true);
+      expect(target?.url).not.toContain("//evil.example");
+    });
+
+    it("keeps a nested hash inside the token value", () => {
+      const target = readFragment(`#join?s=${UUID}&t=tok3n%23x`);
+      expect(target?.code).toBe(`${UUID}:tok3n#x`);
+    });
+  });
+});

landing/package.json

@@ -5,7 +5,8 @@
     "dev": "next dev",
     "build": "next build",
     "start": "next start",
-    "lint": "eslint"
+    "lint": "eslint",
+    "test": "vitest run"
   },
   "dependencies": {
     "@iconify-json/devicon-plain": "^1.2.57",
@@ -27,6 +28,7 @@
     "eslint": "^9",
     "eslint-config-next": "16.2.4",
     "tailwindcss": "^4",
-    "typescript": "^5"
+    "typescript": "^5",
+    "vitest": "^4.1.10"
   }
 }