상위 디렉터리 및 카테고리의 소유권을 검증하지 않던 문제 등 버그 수정 및 Vitest 기반 테스트 추가

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/server/ownership.test.ts

@@ -0,0 +1,64 @@
+import { beforeEach, describe, expect, it } from "vitest";
+import { CategoryRepo, DirectoryRepo, UploadRepo, IntegrityError } from "#lib/server/db/index.js";
+import {
+  createCategory,
+  createDirectory,
+  createUser,
+  newEntryParams,
+  resetDatabase,
+  ciphertext,
+} from "../helpers/database";
+
+beforeEach(resetDatabase);
+
+describe("parent ownership", () => {
+  it("allows creating a directory under the user's own directory", async () => {
+    const { userId } = await createUser();
+    const parentId = await createDirectory(userId);
+
+    await DirectoryRepo.registerDirectory(newEntryParams(userId, parentId));
+
+    const directories = await DirectoryRepo.getAllDirectoriesByParent(userId, parentId);
+    expect(directories).toHaveLength(1);
+  });
+
+  it("rejects creating a directory under another user's directory", async () => {
+    const { userId: victimId } = await createUser();
+    const { userId: attackerId } = await createUser();
+    const victimDirectoryId = await createDirectory(victimId);
+
+    await expect(
+      DirectoryRepo.registerDirectory(newEntryParams(attackerId, victimDirectoryId)),
+    ).rejects.toThrow(new IntegrityError("Directory not found"));
+  });
+
+  it("rejects creating a category under another user's category", async () => {
+    const { userId: victimId } = await createUser();
+    const { userId: attackerId } = await createUser();
+    const victimCategoryId = await createCategory(victimId);
+
+    await expect(
+      CategoryRepo.registerCategory(newEntryParams(attackerId, victimCategoryId)),
+    ).rejects.toThrow(new IntegrityError("Category not found"));
+  });
+
+  it("rejects uploading a file into another user's directory", async () => {
+    const { userId: victimId } = await createUser();
+    const { userId: attackerId } = await createUser();
+    const victimDirectoryId = await createDirectory(victimId);
+
+    await expect(
+      UploadRepo.createFileUploadSession({
+        ...newEntryParams(attackerId, victimDirectoryId),
+        id: crypto.randomUUID(),
+        path: "unused",
+        totalChunks: 1,
+        expiresAt: new Date(Date.now() + 60_000),
+        hskVersion: null,
+        contentType: "image/png",
+        encCreatedAt: null,
+        encLastModifiedAt: ciphertext(),
+      }),
+    ).rejects.toThrow(new IntegrityError("Directory not found"));
+  });
+});