From 360c458144148c1f578cdb076dc2d2668dd449e8 Mon Sep 17 00:00:00 2001 From: Jarek Krochmalski Date: Sun, 6 Sep 2026 15:43:05 +0530 Subject: [PATCH] test: restore DATA_DIR after fs-guard so it doesn't leak /app/data into later tests (#1535) fs-guard.test.ts pins process.env.DATA_DIR=/app/data at module load (needed before the fs-guard import) but never restored it. Under Bun's single-process run this leaked into every later test file; selfhst-icons then did mkdirSync('/app/data/icon-cache/...') and failed EACCES on CI, turning main red in a file-order-dependent way. Save and restore DATA_DIR in an afterAll. --- tests/fs-guard.test.ts | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/tests/fs-guard.test.ts b/tests/fs-guard.test.ts index a4ce01f..617d7b9 100644 --- a/tests/fs-guard.test.ts +++ b/tests/fs-guard.test.ts @@ -3,12 +3,20 @@ import { mkdtempSync, mkdirSync, symlinkSync, writeFileSync, rmSync } from 'node import { join } from 'node:path'; import { tmpdir } from 'node:os'; -// Pin DATA_DIR before importing so the guard computes /app/data paths. -beforeAll(() => { process.env.DATA_DIR = '/app/data'; }); +// Pin DATA_DIR before the import below so the guard computes /app/data paths. This runs +// at module load (Bun runs all test files in one process), so it must be RESTORED after +// this file or it leaks /app/data into every later file - e.g. selfhst-icons then does +// mkdirSync('/app/data/...') and fails EACCES on CI (#1535). +const __prevDataDir = process.env.DATA_DIR; process.env.DATA_DIR = '/app/data'; const { isProtectedPath } = await import('../src/lib/server/fs-guard'); +afterAll(() => { + if (__prevDataDir === undefined) delete process.env.DATA_DIR; + else process.env.DATA_DIR = __prevDataDir; +}); + describe('isProtectedPath (file-browser secret guard, H1)', () => { test('blocks the database directory and its contents', () => { expect(isProtectedPath('/app/data/db')).toBe(true);