test: add missing tag key/value path traversal tests (#412)

[stack72]

Summary

• Adds two missing path traversal tests for tagKey and tagValue validation in indexTagBasedData(), closing the test coverage gap identified in test: add missing tag key/value path traversal test vectors for symlink_repo_index_service #412
• Extends createIndexService() test helper to accept an optional UnifiedDataRepository stub
• Adds createStubUnifiedDataRepo() helper that returns controlled Data items for testing tag-based indexing

Context

PR #403 added assertPathContained() checks for custom tag keys and tag values inside indexTagBasedData(), but explicitly skipped writing tests because the test helper had no way to inject a UnifiedDataRepository. Without tests, regressions in these security checks (e.g., accidentally removing the re-throw guard in the catch block, or removing the assertPathContained calls) would be completely silent.

What the tests verify

Test 1 — malicious tag key: Creates a Data item with tag { "type": "resource", "../../../malicious": "value" }. Asserts that handleModelCreated → indexModel → indexTagBasedData rejects with "Path traversal detected" when the tag key would escape the model directory.

Test 2 — malicious tag value: Creates a Data item with tag { "type": "resource", "safe-key": "../../../malicious" }. Asserts the same rejection when the tag value would escape the tag key directory.

Both tests also implicitly verify the re-throw guard in the catch block of indexTagBasedData(), since the error must propagate through try-catch to reach assertRejects.

Test plan

• deno run test src/infrastructure/repo/symlink_repo_index_service_test.ts — 19/19 pass
• deno run test — full suite 1809/1809 pass
• deno check — passes
• deno lint — passes
• deno fmt --check — passes

Closes #412

🤖 Generated with Claude Code

[github-actions]

Review Summary

This PR adds two important security tests for path traversal protection in indexTagBasedData(). The tests close a coverage gap identified in #412 by verifying that the assertPathContained() checks added in PR #403 work correctly for custom tag keys and tag values.

Blocking Issues

None.

Code Quality Assessment

✅ TypeScript strict mode: No any types; proper type imports used (type UnifiedDataRepository)

✅ Code style (CLAUDE.md): Named exports used, copyright header present, tests follow foo.ts → foo_test.ts pattern

✅ Domain-driven design:

• SymlinkRepoIndexService correctly positioned in infrastructure layer
• UnifiedDataRepository follows repository pattern
• Data entity used correctly with factory method

✅ Test coverage:

• Tests verify path traversal protection for malicious tag keys ("../../../malicious": "value")
• Tests verify path traversal protection for malicious tag values ("safe-key": "../../../malicious")
• Tests implicitly verify the re-throw guard in the catch block (lines 585-593)

✅ Security: These tests prevent silent regressions in critical path traversal protection code

Test Design Review

The stub implementation is well-designed:

• findAllForModel() returns controlled test data
• listVersions() returns [] which is correct since path traversal checks occur before listVersions is called
• Other methods throw "not implemented" which is appropriate for a focused test stub

The test flow correctly validates:

1. Malicious tag key → assertPathContained() throws at line 547-551
2. Malicious tag value → assertPathContained() throws at line 556-560
3. Path traversal errors propagate through the catch block re-throw guard (lines 588-590)

CI Status

✅ Lint, Test, and Format Check: passed

LGTM! 🔒