Merge pull request #36222 from overleaf/jpa-zod-web-core-1

[web] core-1: adopt strict zod schema and extend test coverage

GitOrigin-RevId: 6dc74a100989e6eca1565480a9ecb5f24404ef96

services/web/test/acceptance/src/ChatTests.mjs

@@ -0,0 +1,177 @@
+import { expect } from 'chai'
+import UserHelper from './helpers/User.mjs'
+import { expectValidationErrorRaw } from '@overleaf/validation-tools/testUtils.js'
+
+const User = UserHelper.promises
+
+describe('Chat', function () {
+  let owner, projectId
+
+  beforeEach(async function () {
+    owner = new User()
+    await owner.login()
+    projectId = await owner.createProject('chat-test', { template: 'blank' })
+  })
+
+  describe('GET /project/:project_id/messages', function () {
+    it('should return an empty list of messages initially', async function () {
+      const { response, body } = await owner.doRequest('get', {
+        url: `/project/${projectId}/messages`,
+        json: true,
+      })
+      expect(response.statusCode).to.equal(200)
+      expect(body).to.deep.equal([])
+    })
+
+    it('should reject a malformed project id with 404', async function () {
+      const { response, body } = await owner.doRequest('get', {
+        url: `/project/not-an-object-id/messages`,
+        json: true,
+      })
+      expectValidationErrorRaw(
+        { statusCode: response.statusCode, body },
+        404,
+        'project_id'
+      )
+    })
+  })
+
+  describe('POST /project/:project_id/messages', function () {
+    it('should send a message and return it in later gets', async function () {
+      const sendResult = await owner.doRequest('post', {
+        url: `/project/${projectId}/messages`,
+        json: { content: 'hello world' },
+      })
+      expect(sendResult.response.statusCode).to.equal(204)
+
+      const { response, body } = await owner.doRequest('get', {
+        url: `/project/${projectId}/messages`,
+        json: true,
+      })
+      expect(response.statusCode).to.equal(200)
+      expect(body).to.have.length(1)
+      expect(body[0].content).to.equal('hello world')
+      expect(body[0].user.id).to.equal(owner._id.toString())
+    })
+
+    it('should reject a missing content field', async function () {
+      const { response, body } = await owner.doRequest('post', {
+        url: `/project/${projectId}/messages`,
+        json: {},
+      })
+      expectValidationErrorRaw(
+        { statusCode: response.statusCode, body },
+        400,
+        'content'
+      )
+    })
+
+    it('should accept numeric limit and before query params', async function () {
+      // MockChatApi does not implement limit/before filtering itself; this
+      // only exercises that the coerced numeric values are accepted and
+      // forwarded rather than rejected by validation.
+      const { response, body } = await owner.doRequest('get', {
+        url: `/project/${projectId}/messages?limit=2&before=99999999999`,
+        json: true,
+      })
+      expect(response.statusCode).to.equal(200)
+      expect(body).to.deep.equal([])
+    })
+
+    it('should reject a non-numeric limit', async function () {
+      const { response, body } = await owner.doRequest('get', {
+        url: `/project/${projectId}/messages?limit=not-a-number`,
+        json: true,
+      })
+      expectValidationErrorRaw(
+        { statusCode: response.statusCode, body },
+        400,
+        'limit'
+      )
+    })
+  })
+
+  describe('POST /project/:project_id/messages/:message_id/edit', function () {
+    let messageId
+
+    beforeEach(async function () {
+      await owner.doRequest('post', {
+        url: `/project/${projectId}/messages`,
+        json: { content: 'original content' },
+      })
+      const { body } = await owner.doRequest('get', {
+        url: `/project/${projectId}/messages`,
+        json: true,
+      })
+      messageId = body[0].id
+    })
+
+    it('should edit the message content', async function () {
+      const editResult = await owner.doRequest('post', {
+        url: `/project/${projectId}/messages/${messageId}/edit`,
+        json: { content: 'edited content' },
+      })
+      expect(editResult.response.statusCode).to.equal(204)
+
+      const { body } = await owner.doRequest('get', {
+        url: `/project/${projectId}/messages`,
+        json: true,
+      })
+      expect(body[0].content).to.equal('edited content')
+    })
+
+    it('should reject a malformed message id with 404', async function () {
+      const { response, body } = await owner.doRequest('post', {
+        url: `/project/${projectId}/messages/not-an-object-id/edit`,
+        json: { content: 'edited content' },
+      })
+      expectValidationErrorRaw(
+        { statusCode: response.statusCode, body },
+        404,
+        'message_id'
+      )
+    })
+  })
+
+  describe('DELETE /project/:project_id/messages/:message_id', function () {
+    let messageId
+
+    beforeEach(async function () {
+      await owner.doRequest('post', {
+        url: `/project/${projectId}/messages`,
+        json: { content: 'to be deleted' },
+      })
+      const { body } = await owner.doRequest('get', {
+        url: `/project/${projectId}/messages`,
+        json: true,
+      })
+      messageId = body[0].id
+    })
+
+    it('should delete the message', async function () {
+      const deleteResult = await owner.doRequest('delete', {
+        url: `/project/${projectId}/messages/${messageId}`,
+        json: true,
+      })
+      expect(deleteResult.response.statusCode).to.equal(204)
+
+      const { body } = await owner.doRequest('get', {
+        url: `/project/${projectId}/messages`,
+        json: true,
+      })
+      expect(body).to.deep.equal([])
+    })
+
+    it('should reject a malformed message id with 404', async function () {
+      const { response, body } = await owner.doRequest('delete', {
+        url: `/project/${projectId}/messages/not-an-object-id`,
+        json: true,
+      })
+      expectValidationErrorRaw(
+        { statusCode: response.statusCode, body },
+        404,
+        'message_id'
+      )
+    })
+  })
+})

services/web/test/acceptance/src/DocUpdateTests.mjs

@@ -86,7 +86,7 @@ describe('DocUpdate', function () {
       lines: ['a'],
       version: 1,
       ranges: {},
-      lastUpdatedAt: new Date(),
+      lastUpdatedAt: String(Date.now()),
       lastUpdatedBy: this.user.id,
     }
   })

services/web/test/acceptance/src/EditorHttpControllerTests.mjs

@@ -1,5 +1,9 @@
 import User from './helpers/User.mjs'
 import { expect } from 'chai'
+import settings from '@overleaf/settings'
+import { expectValidationErrorRaw } from '@overleaf/validation-tools/testUtils.js'
+
+const UserPromises = User.promises
 
 describe('EditorHttpController', function () {
   beforeEach('login', function (done) {
@@ -25,3 +29,153 @@ describe('EditorHttpController', function () {
     })
   })
 })
+
+describe('EditorHttpController validation', function () {
+  let owner, projectId, rootFolderId
+
+  beforeEach(async function () {
+    owner = new UserPromises()
+    await owner.login()
+    projectId = await owner.createProject('editor-http-controller-test', {
+      template: 'blank',
+    })
+    const project = await owner.getProject(projectId)
+    rootFolderId = project.rootFolder[0]._id.toString()
+  })
+
+  describe('POST /project/:Project_id/doc', function () {
+    it('should add a doc', async function () {
+      const { response, body } = await owner.doRequest('post', {
+        url: `/project/${projectId}/doc`,
+        json: { name: 'another.tex', parent_folder_id: rootFolderId },
+      })
+      expect(response.statusCode).to.equal(200)
+      expect(body.name).to.equal('another.tex')
+    })
+
+    it('should reject a malformed project id with 404', async function () {
+      const { response, body } = await owner.doRequest('post', {
+        url: '/project/not-an-object-id/doc',
+        json: { name: 'another.tex', parent_folder_id: rootFolderId },
+      })
+      expectValidationErrorRaw(
+        { statusCode: response.statusCode, body },
+        404,
+        'Project_id'
+      )
+    })
+  })
+
+  describe('POST /project/:Project_id/folder', function () {
+    it('should reject a malformed project id with 404', async function () {
+      const { response, body } = await owner.doRequest('post', {
+        url: '/project/not-an-object-id/folder',
+        json: { name: 'a-folder', parent_folder_id: rootFolderId },
+      })
+      expectValidationErrorRaw(
+        { statusCode: response.statusCode, body },
+        404,
+        'Project_id'
+      )
+    })
+  })
+
+  describe('POST /project/:Project_id/:entity_type/:entity_id/rename', function () {
+    it('should reject a malformed project id with 404', async function () {
+      const { response, body } = await owner.doRequest('post', {
+        url: `/project/not-an-object-id/doc/${projectId}/rename`,
+        json: { name: 'renamed.tex' },
+      })
+      expectValidationErrorRaw(
+        { statusCode: response.statusCode, body },
+        404,
+        'Project_id'
+      )
+    })
+
+    it('should reject an invalid entity_type with 404', async function () {
+      const { response, body } = await owner.doRequest('post', {
+        url: `/project/${projectId}/not-a-type/${projectId}/rename`,
+        json: { name: 'renamed.tex' },
+      })
+      expectValidationErrorRaw(
+        { statusCode: response.statusCode, body },
+        404,
+        'entity_type'
+      )
+    })
+  })
+
+  describe('POST /project/:Project_id/:entity_type/:entity_id/move', function () {
+    it('should reject a malformed project id with 404', async function () {
+      const { response, body } = await owner.doRequest('post', {
+        url: `/project/not-an-object-id/doc/${projectId}/move`,
+        json: { folder_id: projectId },
+      })
+      expectValidationErrorRaw(
+        { statusCode: response.statusCode, body },
+        404,
+        'Project_id'
+      )
+    })
+  })
+
+  describe('DELETE /project/:Project_id/doc/:entity_id', function () {
+    it('should reject a malformed project id with 404', async function () {
+      const { response, body } = await owner.doRequest('delete', {
+        url: `/project/not-an-object-id/doc/${projectId}`,
+      })
+      expectValidationErrorRaw(
+        { statusCode: response.statusCode, body },
+        404,
+        'Project_id'
+      )
+    })
+  })
+
+  describe('DELETE /project/:Project_id/file/:entity_id', function () {
+    it('should reject a malformed project id with 404', async function () {
+      const { response, body } = await owner.doRequest('delete', {
+        url: `/project/not-an-object-id/file/${projectId}`,
+      })
+      expectValidationErrorRaw(
+        { statusCode: response.statusCode, body },
+        404,
+        'Project_id'
+      )
+    })
+  })
+
+  describe('DELETE /project/:Project_id/folder/:entity_id', function () {
+    it('should reject a malformed project id with 404', async function () {
+      const { response, body } = await owner.doRequest('delete', {
+        url: `/project/not-an-object-id/folder/${projectId}`,
+      })
+      expectValidationErrorRaw(
+        { statusCode: response.statusCode, body },
+        404,
+        'Project_id'
+      )
+    })
+  })
+
+  describe('POST /project/:Project_id/join', function () {
+    it('should reject a userId that is neither an ObjectId nor "anonymous-user" with 400', async function () {
+      const { response, body } = await owner.doRequest('post', {
+        url: `/project/${projectId}/join`,
+        auth: {
+          user: settings.apis.web.user,
+          pass: settings.apis.web.pass,
+          sendImmediately: true,
+        },
+        json: { userId: 'not-a-valid-user-id' },
+        jar: false,
+      })
+      expectValidationErrorRaw(
+        { statusCode: response.statusCode, body },
+        400,
+        'userId'
+      )
+    })
+  })
+})

services/web/test/acceptance/src/MalformedFiletreesTests.mjs

@@ -9,10 +9,22 @@ const lastUpdated = new Date(42)
 const lastUpdatedBy = new ObjectId()
 const lastUpdatedChanged = new Date(1337)
 
+// Deprecation warnings (e.g. node:punycode's DEP0040) print as an extra
+// logger line on the script's stdout, which breaks the deep-equal
+// assertions below on the captured output; suppress them for this child
+// process only, not the main app/test process.
+const runScriptEnv = {
+  ...process.env,
+  NODE_OPTIONS: [process.env.NODE_OPTIONS, '--no-deprecation']
+    .filter(Boolean)
+    .join(' '),
+}
+
 async function runScriptFind() {
   try {
     const result = await promisify(exec)(
-      ['node', 'scripts/find_malformed_filetrees.mjs'].join(' ')
+      ['node', 'scripts/find_malformed_filetrees.mjs'].join(' '),
+      { env: runScriptEnv }
     )
     return result.stdout.split('\n').filter(filterOutput)
   } catch (error) {
@@ -30,7 +42,7 @@ async function runScriptFix(instructions) {
         'scripts/fix_malformed_filetree.mjs',
         `--logs=<(echo '${adhocFile}')`,
       ].join(' '),
-      { shell: '/bin/bash' }
+      { shell: '/bin/bash', env: runScriptEnv }
     )
   } catch (error) {
     logger.error({ error }, 'fix script failed unexpectedly')

services/web/test/acceptance/src/ProjectCRUDTests.mjs

@@ -172,6 +172,14 @@ describe('Project CRUD', function () {
         expectObjectIdArrayEqual(trashedProject.archived, [])
       })
     })
+
+    it('should return 404 for a malformed project id', async function () {
+      const { response } = await this.user.doRequest(
+        'POST',
+        '/project/not-an-object-id/trash'
+      )
+      expect(response.statusCode).to.equal(404)
+    })
   })
 
   describe('when untrashing a project', function () {
@@ -211,6 +219,108 @@ describe('Project CRUD', function () {
       const trashedProject = await Project.findById(this.projectId).exec()
       expectObjectIdArrayEqual(trashedProject.trashed, [])
     })
+
+    it('should return 404 for a malformed project id', async function () {
+      const { response } = await this.user.doRequest(
+        'DELETE',
+        '/project/not-an-object-id/trash'
+      )
+      expect(response.statusCode).to.equal(404)
+    })
+  })
+
+  describe('archiving and unarchiving a project', function () {
+    it('should archive the project', async function () {
+      const { response } = await this.user.doRequest(
+        'POST',
+        `/Project/${this.projectId}/archive`
+      )
+      expect(response.statusCode).to.equal(200)
+    })
+
+    it('should unarchive the project', async function () {
+      await this.user.doRequest('POST', `/Project/${this.projectId}/archive`)
+
+      const { response } = await this.user.doRequest(
+        'DELETE',
+        `/Project/${this.projectId}/archive`
+      )
+      expect(response.statusCode).to.equal(200)
+    })
+
+    it('should return 404 for a malformed project id when archiving', async function () {
+      const { response } = await this.user.doRequest(
+        'POST',
+        '/Project/not-an-object-id/archive'
+      )
+      expect(response.statusCode).to.equal(404)
+    })
+
+    it('should return 404 for a malformed project id when unarchiving', async function () {
+      const { response } = await this.user.doRequest(
+        'DELETE',
+        '/Project/not-an-object-id/archive'
+      )
+      expect(response.statusCode).to.equal(404)
+    })
+  })
+
+  describe('deleting and restoring a project', function () {
+    it('should return 404 for a malformed project id when deleting', async function () {
+      const { response } = await this.user.doRequest(
+        'DELETE',
+        '/Project/not-an-object-id'
+      )
+      expect(response.statusCode).to.equal(404)
+    })
+
+    it('should return 404 for a malformed project id when restoring', async function () {
+      const { response } = await this.user.doRequest(
+        'POST',
+        '/Project/not-an-object-id/restore'
+      )
+      expect(response.statusCode).to.equal(404)
+    })
+  })
+
+  describe('renaming a project', function () {
+    it('should return 404 for a malformed project id', async function () {
+      const { response } = await this.user.doRequest('POST', {
+        url: '/project/not-an-object-id/rename',
+        json: { newProjectName: 'a new name' },
+      })
+      expect(response.statusCode).to.equal(404)
+    })
+  })
+
+  describe('project entities', function () {
+    it('should return 404 for a malformed project id', async function () {
+      const { response } = await this.user.doRequest(
+        'GET',
+        '/project/not-an-object-id/entities'
+      )
+      expect(response.statusCode).to.equal(404)
+    })
+  })
+
+  describe('updateProjectSettings', function () {
+    it('should update the compiler', async function () {
+      const { response } = await this.user.doRequest('POST', {
+        url: `/project/${this.projectId}/settings`,
+        json: { compiler: 'pdflatex' },
+      })
+      expect(response.statusCode).to.equal(204)
+      const project = await Project.findById(this.projectId).exec()
+      expect(project.compiler).to.equal('pdflatex')
+    })
+
+    it('should return 400 for a malformed mainBibliographyDocId', async function () {
+      const { response } = await this.user.doRequest('POST', {
+        url: `/project/${this.projectId}/settings`,
+        json: { mainBibliographyDocId: 'not-an-object-id' },
+      })
+      expect(response.statusCode).to.equal(400)
+    })
   })
 
   describe('ProjectAdminSettings', async function () {
@@ -258,6 +368,31 @@ describe('Project CRUD', function () {
       expect(body).to.equal('Internal Server Error')
     })
   })
+
+  describe('cloning a project', function () {
+    it('should create a new project owned by the same user', async function () {
+      const { response, body } = await this.user.doRequest('POST', {
+        url: `/Project/${this.projectId}/clone`,
+        json: { projectName: 'cloned project' },
+      })
+      expect(response.statusCode).to.equal(200)
+      expect(body.project_id).to.exist
+      expect(body.name).to.equal('cloned project')
+
+      const clonedProject = await Project.findById(body.project_id).exec()
+      expect(clonedProject.owner_ref.toString()).to.equal(
+        this.user._id.toString()
+      )
+    })
+
+    it('should return 404 for a malformed project id', async function () {
+      const { response } = await this.user.doRequest('POST', {
+        url: '/Project/not-an-object-id/clone',
+        json: { projectName: 'cloned project' },
+      })
+      expect(response.statusCode).to.equal(404)
+    })
+  })
 })
 
 function expectObjectIdArrayEqual(objectIdArray, stringArray) {

services/web/test/acceptance/src/ProjectDuplicateNameTests.mjs

@@ -189,7 +189,6 @@ describe('ProjectDuplicateNames', function () {
               json: true,
               qs: {
                 folder_id: this.rootFolderId,
-                qqfilename: 'frog.jpg',
               },
               formData: {
                 name: 'frog.jpg',
@@ -276,7 +275,6 @@ describe('ProjectDuplicateNames', function () {
               json: true,
               qs: {
                 folder_id: this.rootFolderId,
-                qqfilename: 'frog.jpg',
               },
               formData: {
                 qqfile: {

services/web/test/acceptance/src/ProjectInviteTests.mjs

@@ -532,6 +532,112 @@ describe('ProjectInviteTests', function () {
         })
       })
 
+      it('should reject an unrecognized field in the invite request body', function (done) {
+        this.sendingUser.getCsrfToken(err => {
+          if (err) {
+            return done(err)
+          }
+          this.sendingUser.request.post(
+            {
+              uri: `/project/${this.projectId}/invite`,
+              json: {
+                email: this.email,
+                privileges: 'readAndWrite',
+                notARealField: 'nope',
+              },
+            },
+            (err, response) => {
+              if (err) {
+                return done(err)
+              }
+              expect(response.statusCode).to.equal(400)
+              done()
+            }
+          )
+        })
+      })
+
+      it('should reject an invalid invite id when revoking an invite', function (done) {
+        this.sendingUser.getCsrfToken(err => {
+          if (err) {
+            return done(err)
+          }
+          this.sendingUser.request.delete(
+            {
+              uri: `/project/${this.projectId}/invite/not-a-valid-invite-id`,
+            },
+            (err, response) => {
+              if (err) {
+                return done(err)
+              }
+              expect(response.statusCode).to.equal(404)
+              done()
+            }
+          )
+        })
+      })
+
+      it('should reject an invalid invite id when resending an invite', function (done) {
+        this.sendingUser.getCsrfToken(err => {
+          if (err) {
+            return done(err)
+          }
+          this.sendingUser.request.post(
+            {
+              uri: `/project/${this.projectId}/invite/not-a-valid-invite-id/resend`,
+            },
+            (err, response) => {
+              if (err) {
+                return done(err)
+              }
+              expect(response.statusCode).to.equal(404)
+              done()
+            }
+          )
+        })
+      })
+
+      it('should allow the project owner to resend an invite', function (done) {
+        Async.series(
+          [
+            cb => {
+              createInvite(
+                this.sendingUser,
+                this.projectId,
+                this.email,
+                (err, invite) => {
+                  if (err) {
+                    return cb(err)
+                  }
+                  this.invite = invite
+                  cb()
+                }
+              )
+            },
+            cb => {
+              this.sendingUser.getCsrfToken(err => {
+                if (err) {
+                  return cb(err)
+                }
+                this.sendingUser.request.post(
+                  {
+                    uri: `/project/${this.projectId}/invite/${this.invite._id}/resend`,
+                  },
+                  (err, response) => {
+                    if (err) {
+                      return cb(err)
+                    }
+                    expect(response.statusCode).to.equal(201)
+                    cb()
+                  }
+                )
+              })
+            },
+          ],
+          done
+        )
+      })
+
       it('should allow the project owner to create and remove invites', function (done) {
         Async.series(
           [
@@ -835,6 +941,70 @@ describe('ProjectInviteTests', function () {
             done
           )
         })
+
+        it('should reject a malformed project id when viewing the invite', function (done) {
+          const link = this.link.replace(
+            this.projectId,
+            'not-a-valid-project-id'
+          )
+          tryFollowInviteLink(this.user, link, (err, response) => {
+            if (err) {
+              return done(err)
+            }
+            expect(response.statusCode).to.equal(404)
+            done()
+          })
+        })
+
+        it('should accept a genuine native HTML form submission (form-encoded body, no CSRF header)', function (done) {
+          // views/project/invite/show-legacy.pug submits this as a plain
+          // native HTML form (data-ol-regular-form): no JS involved, so
+          // the token only ever travels as a hidden _csrf form field,
+          // never as a header.
+          this.user.getCsrfToken(err => {
+            if (err) {
+              return done(err)
+            }
+            this.user.submitNativeForm(
+              `/project/${this.projectId}/invite/token/${this.invite.token}/accept`,
+              { token: this.invite.token },
+              (err, response) => {
+                if (err) {
+                  return done(err)
+                }
+                expect(response.statusCode).to.equal(302)
+                expect(response.headers.location).to.equal(
+                  `/project/${this.projectId}`
+                )
+                done()
+              }
+            )
+          })
+        })
+
+        it('should still reject an unrecognized field in the body', function (done) {
+          this.user.getCsrfToken(err => {
+            if (err) {
+              return done(err)
+            }
+            this.user.request.post(
+              {
+                uri: `/project/${this.projectId}/invite/token/${this.invite.token}/accept`,
+                json: {
+                  token: this.invite.token,
+                  notARealField: 'nope',
+                },
+              },
+              (err, response) => {
+                if (err) {
+                  return done(err)
+                }
+                expect(response.statusCode).to.equal(400)
+                done()
+              }
+            )
+          })
+        })
       })
     })
 
@@ -1041,6 +1211,91 @@ describe('ProjectInviteTests', function () {
       )
     })
 
+    it('should reject an unrecognized field when updating a sharing link', function (done) {
+      this.sendingUser.getCsrfToken(err => {
+        if (err) {
+          return done(err)
+        }
+        this.sendingUser.request.post(
+          {
+            uri: `/project/${this.projectId}/sharing-link`,
+            json: {
+              privileges: 'readOnly',
+              notARealField: 'nope',
+            },
+          },
+          (err, response) => {
+            if (err) {
+              return done(err)
+            }
+            expect(response.statusCode).to.equal(400)
+            done()
+          }
+        )
+      })
+    })
+
+    it('should reject a malformed project id when viewing the sharing-link page', function (done) {
+      this.sendingUser.request.get(
+        {
+          uri: '/project/not-a-valid-project-id/share',
+        },
+        (err, response) => {
+          if (err) {
+            return done(err)
+          }
+          expect(response.statusCode).to.equal(404)
+          done()
+        }
+      )
+    })
+
+    it('should reject an unrecognized field when validating a sharing link', function (done) {
+      Async.series(
+        [
+          cb => this.user.login(cb),
+          cb => {
+            updateSharingLink(
+              this.sendingUser,
+              this.projectId,
+              'readOnly',
+              (err, link) => {
+                if (err) {
+                  return cb(err)
+                }
+                this.sharingLink = link
+                cb()
+              }
+            )
+          },
+          cb => {
+            this.user.getCsrfToken(err => {
+              if (err) {
+                return cb(err)
+              }
+              this.user.request.post(
+                {
+                  uri: `/project/${this.projectId}/share/validate`,
+                  json: {
+                    token: this.sharingLink.token,
+                    notARealField: 'nope',
+                  },
+                },
+                (err, response) => {
+                  if (err) {
+                    return cb(err)
+                  }
+                  expect(response.statusCode).to.equal(400)
+                  cb()
+                }
+              )
+            })
+          },
+        ],
+        done
+      )
+    })
+
     it('should validate and accept sharing link via /share flow', function (done) {
       Async.series(
         [

services/web/test/acceptance/src/ProjectStructureTests.mjs

@@ -101,6 +101,29 @@ describe('ProjectStructureChanges', function () {
     return await owner.deleteItemInProject(projectId, type, itemId)
   }
 
+  describe('uploading a project with relativePath set to the literal "null" string', function () {
+    it('should create the project successfully', async function () {
+      const zipFilename = 'test_project_with_name.zip'
+      const zipFile = fs.createReadStream(
+        Path.resolve(Path.join(import.meta.dirname, '..', 'files', zipFilename))
+      )
+
+      const { response, body } = await owner.doRequest('POST', {
+        uri: 'project/new/upload',
+        formData: {
+          name: zipFilename,
+          qqfile: zipFile,
+          relativePath: 'null',
+        },
+      })
+
+      expect(response.statusCode).to.be.within(200, 299)
+      const parsedBody = JSON.parse(body)
+      expect(parsedBody.success).to.equal(true)
+      expect(parsedBody.project_id).to.be.a('string')
+    })
+  })
+
   describe('uploading a project with a name', function () {
     let exampleProjectId
     const testProjectName = 'wombat'

services/web/test/acceptance/src/SharingTests.mjs

@@ -149,4 +149,193 @@ describe('Sharing', function () {
       expect(project.readOnly_refs).to.deep.equal([this.reviewer._id])
     })
   })
+
+  describe('validation', function () {
+    it('rejects an unrecognized field in the body when setting collaborator info', async function () {
+      await this.ownerSession.addUserToProject(
+        this.projectId,
+        this.collaborator,
+        'readOnly'
+      )
+      await expect(
+        this.ownerSession.setCollaboratorInfo(
+          this.projectId,
+          this.collaborator._id,
+          { privilegeLevel: 'readOnly', notARealField: 'nope' }
+        )
+      ).to.be.rejectedWith(/failed: status=400 /)
+    })
+
+    it('rejects an unrecognized field in the body when transferring ownership', async function () {
+      await this.ownerSession.addUserToProject(
+        this.projectId,
+        this.collaborator,
+        'readAndWrite'
+      )
+      const { response } = await this.ownerSession.doRequest('POST', {
+        url: `/project/${this.projectId}/transfer-ownership`,
+        json: {
+          user_id: this.collaborator._id.toString(),
+          notARealField: 'nope',
+        },
+      })
+      expect(response.statusCode).to.equal(400)
+    })
+  })
+
+  describe('removing a collaborator', function () {
+    beforeEach(async function () {
+      await this.ownerSession.addUserToProject(
+        this.projectId,
+        this.collaborator,
+        'readAndWrite'
+      )
+    })
+
+    it('lets the owner remove a collaborator', async function () {
+      const { response } = await this.ownerSession.doRequest('DELETE', {
+        url: `/project/${this.projectId}/users/${this.collaborator._id}`,
+      })
+      expect(response.statusCode).to.equal(204)
+      const project = await this.ownerSession.getProject(this.projectId)
+      expect(project.collaberator_refs).to.deep.equal([])
+    })
+
+    it('prevents non-owners from removing a collaborator', async function () {
+      const { response } = await this.collaboratorSession.doRequest('DELETE', {
+        url: `/project/${this.projectId}/users/${this.collaborator._id}`,
+      })
+      expect(response.statusCode).to.equal(403)
+    })
+  })
+
+  describe('leaving a project', function () {
+    beforeEach(async function () {
+      await this.ownerSession.addUserToProject(
+        this.projectId,
+        this.collaborator,
+        'readAndWrite'
+      )
+    })
+
+    it('lets a collaborator leave the project', async function () {
+      const { response } = await this.collaboratorSession.doRequest('POST', {
+        url: `/project/${this.projectId}/leave`,
+      })
+      expect(response.statusCode).to.equal(204)
+      const project = await this.ownerSession.getProject(this.projectId)
+      expect(project.collaberator_refs).to.deep.equal([])
+    })
+
+    it('rejects a malformed project id', async function () {
+      const { response } = await this.collaboratorSession.doRequest('POST', {
+        url: '/project/not-a-valid-project-id/leave',
+      })
+      expect(response.statusCode).to.equal(404)
+    })
+  })
+
+  describe('listing project members', function () {
+    beforeEach(async function () {
+      await this.ownerSession.addUserToProject(
+        this.projectId,
+        this.collaborator,
+        'readAndWrite'
+      )
+    })
+
+    it('lists invited members for a collaborator', async function () {
+      const { response, body } = await this.collaboratorSession.doRequest(
+        'GET',
+        { url: `/project/${this.projectId}/members`, json: true }
+      )
+      expect(response.statusCode).to.equal(200)
+      expect(body.members.map(member => member._id.toString())).to.have.members(
+        [this.collaborator._id.toString()]
+      )
+    })
+  })
+
+  describe('access requests', function () {
+    beforeEach(async function () {
+      await this.ownerSession.addUserToProject(
+        this.projectId,
+        this.stranger,
+        'readOnly'
+      )
+    })
+
+    it('lets a viewer request edit access, visible to the owner', async function () {
+      const requested = await this.strangerSession.doRequest('POST', {
+        url: `/project/${this.projectId}/request-access`,
+        json: { privilegeLevel: 'readAndWrite' },
+      })
+      expect(requested.response.statusCode).to.equal(204)
+
+      const { response, body } = await this.ownerSession.doRequest('GET', {
+        url: `/project/${this.projectId}/access-requests`,
+        json: true,
+      })
+      expect(response.statusCode).to.equal(200)
+      expect(
+        body.editAccessRequests.map(request => request._id.toString())
+      ).to.have.members([this.stranger._id.toString()])
+    })
+
+    it('prevents non-owners from listing access requests', async function () {
+      const { response } = await this.collaboratorSession.doRequest('GET', {
+        url: `/project/${this.projectId}/access-requests`,
+        json: true,
+      })
+      expect(response.statusCode).to.equal(403)
+    })
+
+    it('lets the owner grant a pending access request', async function () {
+      await this.strangerSession.doRequest('POST', {
+        url: `/project/${this.projectId}/request-access`,
+        json: { privilegeLevel: 'readAndWrite' },
+      })
+      const { response } = await this.ownerSession.doRequest('POST', {
+        url: `/project/${this.projectId}/access-requests/${this.stranger._id}/grant`,
+        json: { privilegeLevel: 'readAndWrite' },
+      })
+      expect(response.statusCode).to.equal(204)
+      const project = await this.ownerSession.getProject(this.projectId)
+      expect(project.collaberator_refs.map(id => id.toString())).to.include(
+        this.stranger._id.toString()
+      )
+    })
+
+    it('lets the owner decline a pending access request', async function () {
+      await this.strangerSession.doRequest('POST', {
+        url: `/project/${this.projectId}/request-access`,
+        json: { privilegeLevel: 'readAndWrite' },
+      })
+      const declined = await this.ownerSession.doRequest('DELETE', {
+        url: `/project/${this.projectId}/access-requests/${this.stranger._id}`,
+      })
+      expect(declined.response.statusCode).to.equal(204)
+
+      const { body } = await this.ownerSession.doRequest('GET', {
+        url: `/project/${this.projectId}/access-requests`,
+        json: true,
+      })
+      expect(body.editAccessRequests).to.deep.equal([])
+    })
+
+    it('rejects a malformed user id when declining an access request', async function () {
+      const { response } = await this.ownerSession.doRequest('DELETE', {
+        url: `/project/${this.projectId}/access-requests/not-a-valid-user-id`,
+      })
+      expect(response.statusCode).to.equal(404)
+    })
+
+    it('rejects a malformed user id when granting an access request', async function () {
+      const { response } = await this.ownerSession.doRequest('POST', {
+        url: `/project/${this.projectId}/access-requests/not-a-valid-user-id/grant`,
+        json: { privilegeLevel: 'readAndWrite' },
+      })
+      expect(response.statusCode).to.equal(404)
+    })
+  })
 })

services/web/test/acceptance/src/TagsTests.mjs

@@ -4,6 +4,7 @@ import { expect } from 'chai'
 import _ from 'lodash'
 import request from './helpers/request.js'
 import expectErrorResponse from './helpers/expectErrorResponse.mjs'
+import { expectValidationErrorRaw } from '@overleaf/validation-tools/testUtils.js'
 
 const _initUser = (user, callback) => {
   async.series([cb => user.login(cb), cb => user.getCsrfToken(cb)], callback)
@@ -177,6 +178,41 @@ describe('Tags', function () {
         )
       })
     })
+
+    it('should reject a malformed userId', function (done) {
+      authedRequest.get(
+        { url: `/user/not-an-object-id/tag`, json: true },
+        (err, response) => {
+          expect(err).to.not.exist
+          expectValidationErrorRaw(response, 404, 'userId')
+          done()
+        }
+      )
+    })
+  })
+
+  describe('create tag validation', function () {
+    it('should reject an empty name', function (done) {
+      this.user.request.post(
+        { url: `/tag`, json: { name: '' } },
+        (err, response) => {
+          expect(err).to.not.exist
+          expectValidationErrorRaw(response, 400, 'name')
+          done()
+        }
+      )
+    })
+
+    it('should reject an invalid color', function (done) {
+      this.user.request.post(
+        { url: `/tag`, json: { name: 'a-tag', color: 'red' } },
+        (err, response) => {
+          expect(err).to.not.exist
+          expectValidationErrorRaw(response, 400, 'color')
+          done()
+        }
+      )
+    })
   })
 
   describe('rename tag', function () {
@@ -185,7 +221,7 @@ describe('Tags', function () {
         { url: `/tag/lol/rename`, json: { name: 'five' } },
         (err, response) => {
           expect(err).to.not.exist
-          expect(response.statusCode).to.equal(500)
+          expectValidationErrorRaw(response, 404, 'tagId')
           done()
         }
       )
@@ -253,7 +289,7 @@ describe('Tags', function () {
         { url: `/tag/lol`, json: { name: 'five' } },
         (err, response) => {
           expect(err).to.not.exist
-          expect(response.statusCode).to.equal(500)
+          expectValidationErrorRaw(response, 404, 'tagId')
           done()
         }
       )
@@ -298,7 +334,7 @@ describe('Tags', function () {
         { url: `/tag/lol/project/bad` },
         (err, response) => {
           expect(err).to.not.exist
-          expect(response.statusCode).to.equal(500)
+          expectValidationErrorRaw(response, 404, 'tagId')
           done()
         }
       )
@@ -384,5 +420,238 @@ describe('Tags', function () {
         })
       })
     })
+
+    it('should reject malformed tag id when removing a project', function (done) {
+      this.user.request.delete(
+        { url: `/tag/lol/project/${this.projectId}` },
+        (err, response) => {
+          expect(err).to.not.exist
+          expectValidationErrorRaw(response, 404, 'tagId')
+          done()
+        }
+      )
+    })
+  })
+
+  describe('add projects to tag, bulk', function () {
+    beforeEach(function (done) {
+      async.series(
+        [
+          cb =>
+            this.user.createProject('bulk 1', (err, id) => {
+              this.projectId1 = id
+              cb(err)
+            }),
+          cb =>
+            this.user.createProject('bulk 2', (err, id) => {
+              this.projectId2 = id
+              cb(err)
+            }),
+        ],
+        done
+      )
+    })
+
+    it('should reject malformed tag id', function (done) {
+      this.user.request.post(
+        { url: `/tag/lol/projects`, json: { projectIds: [] } },
+        (err, response) => {
+          expect(err).to.not.exist
+          expectValidationErrorRaw(response, 404, 'tagId')
+          done()
+        }
+      )
+    })
+
+    it('should reject a malformed project id in the list', function (done) {
+      _createTags(this.user, ['bulk-tag'], (err, tags) => {
+        expect(err).to.not.exist
+        const tagId = tags[0]._id
+        this.user.request.post(
+          {
+            url: `/tag/${tagId}/projects`,
+            json: { projectIds: ['not-an-object-id'] },
+          },
+          (err, response) => {
+            expect(err).to.not.exist
+            expectValidationErrorRaw(response, 400, 'projectIds')
+            done()
+          }
+        )
+      })
+    })
+
+    it('should add multiple projects to a tag', function (done) {
+      _createTags(this.user, ['bulk-tag'], (err, tags) => {
+        expect(err).to.not.exist
+        const tagId = tags[0]._id
+        this.user.request.post(
+          {
+            url: `/tag/${tagId}/projects`,
+            json: { projectIds: [this.projectId1, this.projectId2] },
+          },
+          (err, response) => {
+            _expect204(err, response)
+            _getTags(this.user, (err, response, body) => {
+              _expect200(err, response)
+              const tag = _.find(body, t => t.name === 'bulk-tag')
+              expect(_.sortBy(tag.project_ids)).to.deep.equal(
+                _.sortBy([this.projectId1, this.projectId2])
+              )
+              done()
+            })
+          }
+        )
+      })
+    })
+  })
+
+  describe('remove projects from tag, bulk', function () {
+    beforeEach(function (done) {
+      async.series(
+        [
+          cb =>
+            this.user.createProject('bulk-remove 1', (err, id) => {
+              this.projectId1 = id
+              cb(err)
+            }),
+          cb =>
+            this.user.createProject('bulk-remove 2', (err, id) => {
+              this.projectId2 = id
+              cb(err)
+            }),
+        ],
+        done
+      )
+    })
+
+    it('should reject malformed tag id', function (done) {
+      this.user.request.post(
+        { url: `/tag/lol/projects/remove`, json: { projectIds: [] } },
+        (err, response) => {
+          expect(err).to.not.exist
+          expectValidationErrorRaw(response, 404, 'tagId')
+          done()
+        }
+      )
+    })
+
+    it('should reject a malformed project id in the list', function (done) {
+      _createTags(this.user, ['bulk-remove-tag'], (err, tags) => {
+        expect(err).to.not.exist
+        const tagId = tags[0]._id
+        this.user.request.post(
+          {
+            url: `/tag/${tagId}/projects/remove`,
+            json: { projectIds: ['not-an-object-id'] },
+          },
+          (err, response) => {
+            expect(err).to.not.exist
+            expectValidationErrorRaw(response, 400, 'projectIds')
+            done()
+          }
+        )
+      })
+    })
+
+    it('should remove multiple projects from a tag', function (done) {
+      _createTags(this.user, ['bulk-remove-tag'], (err, tags) => {
+        expect(err).to.not.exist
+        const tagId = tags[0]._id
+        this.user.request.post(
+          {
+            url: `/tag/${tagId}/projects`,
+            json: { projectIds: [this.projectId1, this.projectId2] },
+          },
+          (err, response) => {
+            _expect204(err, response)
+            this.user.request.post(
+              {
+                url: `/tag/${tagId}/projects/remove`,
+                json: { projectIds: [this.projectId1] },
+              },
+              (err, response) => {
+                _expect204(err, response)
+                _getTags(this.user, (err, response, body) => {
+                  _expect200(err, response)
+                  const tag = _.find(body, t => t.name === 'bulk-remove-tag')
+                  expect(tag.project_ids).to.deep.equal([this.projectId2])
+                  done()
+                })
+              }
+            )
+          }
+        )
+      })
+    })
+  })
+
+  describe('edit tag', function () {
+    it('should reject malformed tag id', function (done) {
+      this.user.request.post(
+        { url: `/tag/lol/edit`, json: { name: 'five' } },
+        (err, response) => {
+          expect(err).to.not.exist
+          expectValidationErrorRaw(response, 404, 'tagId')
+          done()
+        }
+      )
+    })
+
+    it('should reject an empty name', function (done) {
+      _createTags(this.user, ['editable'], (err, tags) => {
+        expect(err).to.not.exist
+        const tagId = tags[0]._id
+        this.user.request.post(
+          { url: `/tag/${tagId}/edit`, json: { name: '' } },
+          (err, response) => {
+            expect(err).to.not.exist
+            expectValidationErrorRaw(response, 400, 'name')
+            done()
+          }
+        )
+      })
+    })
+
+    it('should reject an invalid color', function (done) {
+      _createTags(this.user, ['editable'], (err, tags) => {
+        expect(err).to.not.exist
+        const tagId = tags[0]._id
+        this.user.request.post(
+          {
+            url: `/tag/${tagId}/edit`,
+            json: { name: 'editable', color: 'blue' },
+          },
+          (err, response) => {
+            expect(err).to.not.exist
+            expectValidationErrorRaw(response, 400, 'color')
+            done()
+          }
+        )
+      })
+    })
+
+    it('should allow user to edit a tag name and color', function (done) {
+      _createTags(this.user, ['editable'], (err, tags) => {
+        expect(err).to.not.exist
+        const tagId = tags[0]._id
+        this.user.request.post(
+          {
+            url: `/tag/${tagId}/edit`,
+            json: { name: 'edited', color: '#abcdef' },
+          },
+          (err, response) => {
+            _expect204(err, response)
+            _getTags(this.user, (err, response, body) => {
+              _expect200(err, response)
+              const tag = _.find(body, t => t._id === tagId)
+              expect(tag.name).to.equal('edited')
+              expect(tag.color).to.equal('#abcdef')
+              done()
+            })
+          }
+        )
+      })
+    })
   })
 })

services/web/test/acceptance/src/mocks/MockClsiCache.mjs

@@ -14,18 +14,8 @@ const lookupSchema = z.object({
     // matches clsi-cache's own getLastOutputFileParamsSchema /
     // getLatestOutputFileParamsSchema (HTTPController.js)
     editorBuildId: zz.editorBuildId().optional(),
-    // this is a wildcard `:filename(.*)` param forwarded to a storage
-    // lookup key, so it gets the same zz.filepath() traversal hardening as
-    // clsi-cache's own filenameSchema
+    // matches clsi-cache's own filenameSchema (HTTPController.js)
     filename: zz.filepath(),
-    // this repo's patched Express additionally populates req.params[0]
-    // (the filename minus its first character) for a *named* regex
-    // wildcard like `:filename(.*)` -- unlike a bare `*` (see
-    // MockClsiNginxApi.mjs's outputWildcardSchema, which only gets the
-    // numeric key). A strictObject that doesn't account for this key
-    // rejects every real (non-empty filename) request with a 404
-    // "Unrecognized key: 0" before it ever reaches the lookup below.
-    0: z.string(),
   }),
 })
 
@@ -106,21 +96,20 @@ class MockClsiCache extends AbstractMockApi {
   applyRoutes() {
     // getOutputFile's two routes (with/without the per-user segment)
     this.app.get(
-      '/project/:project_id/user/:user_id/build/:editorBuildId/search/output/:filename(.*)',
+      '/project/:project_id/user/:user_id/build/:editorBuildId/search/output/:filename',
       (req, res) => this._lookup(req, res)
     )
     this.app.get(
-      '/project/:project_id/build/:editorBuildId/search/output/:filename(.*)',
+      '/project/:project_id/build/:editorBuildId/search/output/:filename',
       (req, res) => this._lookup(req, res)
     )
     // getLatestOutputFile's two routes (with/without the per-user segment)
     this.app.get(
-      '/project/:project_id/user/:user_id/latest/output/:filename(.*)',
+      '/project/:project_id/user/:user_id/latest/output/:filename',
       (req, res) => this._lookup(req, res)
     )
-    this.app.get(
-      '/project/:project_id/latest/output/:filename(.*)',
-      (req, res) => this._lookup(req, res)
+    this.app.get('/project/:project_id/latest/output/:filename', (req, res) =>
+      this._lookup(req, res)
     )
 
     this.app.get('/content/:contentId', (req, res) => {

services/web/test/acceptance/src/mocks/MockClsiNginxApi.mjs

@@ -8,18 +8,17 @@ const outputWildcardSchema = z.object({
   params: z.strictObject({
     project_id: zz.objectId().or(zz.submissionId()),
     build_id: zz.buildId(),
-    // bare `*` wildcard -- Express populates the match under numeric key 0
-    0: zz.filepath(),
+    file: zz.filepath(),
   }),
 })
 
 class MockClsiNginxApi extends AbstractMockApi {
   applyRoutes() {
     this.app.get(
-      '/project/:project_id/build/:build_id/output/*',
+      '/project/:project_id/build/:build_id/output/:file(.+)',
       (req, res) => {
         const { params } = parseReq(req, outputWildcardSchema)
-        const filename = params[0]
+        const filename = params.file
         if (filename === 'output.pdf') {
           plainTextResponse(res, 'mock-pdf')
         } else if (filename === 'output.log') {

services/web/test/unit/src/Chat/ChatController.test.mjs

@@ -6,6 +6,9 @@ const MODULE_PATH = '../../../../app/src/Features/Chat/ChatController.mjs'
 describe('ChatController', function () {
   beforeEach(async function (ctx) {
     ctx.user_id = 'mock-user-id'
+    // project_id/message_id are validated as Mongo ObjectIds
+    ctx.project_id = '507f191e810c19729de860ea'
+    ctx.message_id = '507f191e810c19729de860eb'
     ctx.settings = {}
     ctx.ChatApiHandler = { promises: {} }
     ctx.ChatManager = { promises: {} }
@@ -126,10 +129,11 @@ describe('ChatController', function () {
 
   describe('getMessages', function () {
     beforeEach(async function (ctx) {
-      ctx.req.query = {
-        limit: (ctx.limit = '30'),
-        before: (ctx.before = '12345'),
-      }
+      // sent over the wire as query-string values, but coerced to numbers
+      // by the schema before being passed on
+      ctx.req.query = { limit: '30', before: '12345' }
+      ctx.limit = 30
+      ctx.before = 12345
       ctx.ChatManager.promises.injectUserInfoIntoThreads = sinon
         .stub()
         .resolves()
@@ -149,4 +153,60 @@ describe('ChatController', function () {
       ctx.res.json.calledWith(ctx.messages).should.equal(true)
     })
   })
+
+  describe('deleteMessage', function () {
+    beforeEach(async function (ctx) {
+      ctx.req.params.message_id = ctx.message_id
+      ctx.ChatApiHandler.promises.deleteGlobalMessage = sinon.stub().resolves()
+      await ctx.ChatController.deleteMessage(ctx.req, ctx.res)
+    })
+
+    it('should tell the chat handler to delete the message', function (ctx) {
+      ctx.ChatApiHandler.promises.deleteGlobalMessage
+        .calledWith(ctx.project_id, ctx.message_id)
+        .should.equal(true)
+    })
+
+    it('should tell the editor real time controller about the deletion', function (ctx) {
+      ctx.EditorRealTimeController.emitToRoom
+        .calledWith(ctx.project_id, 'delete-global-message', {
+          messageId: ctx.message_id,
+          userId: ctx.user_id,
+        })
+        .should.equal(true)
+    })
+
+    it('should return a 204 status code', function (ctx) {
+      ctx.res.sendStatus.calledWith(204).should.equal(true)
+    })
+  })
+
+  describe('editMessage', function () {
+    beforeEach(async function (ctx) {
+      ctx.req.params.message_id = ctx.message_id
+      ctx.req.body = { content: (ctx.content = 'edited-content') }
+      ctx.ChatApiHandler.promises.editGlobalMessage = sinon.stub().resolves()
+      await ctx.ChatController.editMessage(ctx.req, ctx.res, sinon.stub())
+    })
+
+    it('should tell the chat handler to edit the message', function (ctx) {
+      ctx.ChatApiHandler.promises.editGlobalMessage
+        .calledWith(ctx.project_id, ctx.message_id, ctx.user_id, ctx.content)
+        .should.equal(true)
+    })
+
+    it('should tell the editor real time controller about the edit', function (ctx) {
+      ctx.EditorRealTimeController.emitToRoom
+        .calledWith(ctx.project_id, 'edit-global-message', {
+          messageId: ctx.message_id,
+          userId: ctx.user_id,
+          content: ctx.content,
+        })
+        .should.equal(true)
+    })
+
+    it('should return a 204 status code', function (ctx) {
+      ctx.res.sendStatus.calledWith(204).should.equal(true)
+    })
+  })
 })

services/web/test/unit/src/Collaborators/CollaboratorsController.test.mjs

@@ -1,6 +1,10 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import sinon from 'sinon'
 import mongodb from 'mongodb-legacy'
+import {
+  InvalidParamsError,
+  InvalidRequestError,
+} from '@overleaf/validation-tools'
 import Errors from '../../../../app/src/Features/Errors/Errors.js'
 import MockRequest from '../helpers/MockRequest.mjs'
 import MockResponse from '../helpers/MockResponse.mjs'
@@ -51,8 +55,12 @@ describe('CollaboratorsController', function () {
       promises: {
         getAllInvitedMembers: sinon.stub(),
         getProjectAccess: sinon.stub().resolves(ctx.projectAccess),
+        getPublicShareTokens: sinon.stub(),
       },
     }
+    ctx.Features = {
+      hasFeature: sinon.stub().returns(true),
+    }
     ctx.AuthorizationManager = {
       promises: {
         getPrivilegeLevelForProject: sinon.stub().resolves('readOnly'),
@@ -100,6 +108,7 @@ describe('CollaboratorsController', function () {
     }
     ctx.TokenAccessHandler = {
       getRequestToken: sinon.stub().returns('access-token'),
+      createTokenHashPrefix: sinon.stub().returns('hash-prefix'),
     }
 
     ctx.ProjectAuditLogHandler = {
@@ -236,6 +245,10 @@ describe('CollaboratorsController', function () {
       default: ctx.EmailHandler,
     }))
 
+    vi.doMock('../../../../app/src/infrastructure/Features.mjs', () => ({
+      default: ctx.Features,
+    }))
+
     ctx.CollaboratorsController = (await import(MODULE_PATH)).default
   })
 
@@ -243,8 +256,8 @@ describe('CollaboratorsController', function () {
     beforeEach(async function (ctx) {
       await new Promise(resolve => {
         ctx.req.params = {
-          Project_id: ctx.projectId,
-          user_id: ctx.user._id,
+          Project_id: ctx.projectId.toString(),
+          user_id: ctx.user._id.toString(),
         }
         ctx.res.sendStatus = sinon.spy(() => {
           resolve()
@@ -256,14 +269,17 @@ describe('CollaboratorsController', function () {
     it('should from the user from the project', function (ctx) {
       expect(
         ctx.CollaboratorsHandler.promises.removeUserFromProject
-      ).to.have.been.calledWith(ctx.projectId, ctx.user._id)
+      ).to.have.been.calledWith(
+        ctx.projectId.toString(),
+        ctx.user._id.toString()
+      )
     })
 
     it('should emit a userRemovedFromProject event to the proejct', function (ctx) {
       expect(ctx.EditorRealTimeController.emitToRoom).to.have.been.calledWith(
-        ctx.projectId,
+        ctx.projectId.toString(),
         'userRemovedFromProject',
-        ctx.user._id
+        ctx.user._id.toString()
       )
     })
 
@@ -273,36 +289,51 @@ describe('CollaboratorsController', function () {
 
     it('should have called emitToRoom', function (ctx) {
       expect(ctx.EditorRealTimeController.emitToRoom).to.have.been.calledWith(
-        ctx.projectId,
+        ctx.projectId.toString(),
         'project:membership:changed'
       )
     })
 
     it('should look up the collaborator email', function (ctx) {
       expect(ctx.UserGetter.promises.getUser).to.have.been.calledWith(
-        { _id: ctx.user._id },
+        { _id: ctx.user._id.toString() },
         { email: 1 }
       )
     })
 
     it('should write a project audit log', function (ctx) {
       ctx.ProjectAuditLogHandler.addEntryInBackground.should.have.been.calledWith(
-        ctx.projectId,
+        ctx.projectId.toString(),
         'remove-collaborator',
         ctx.user._id,
         ctx.req.ip,
         {
-          userId: ctx.user._id,
+          userId: ctx.user._id.toString(),
           collaboratorEmail: 'user@example.com',
         }
       )
     })
   })
 
+  describe('removeUserFromProject with a malformed project id', function () {
+    it('rejects the request instead of removing anyone', async function (ctx) {
+      ctx.req.params = {
+        Project_id: 'not-an-object-id',
+        user_id: ctx.user._id.toString(),
+      }
+      await ctx.CollaboratorsController.removeUserFromProject(
+        ctx.req,
+        ctx.res
+      ).should.be.rejectedWith(InvalidParamsError)
+      expect(ctx.CollaboratorsHandler.promises.removeUserFromProject).to.not
+        .have.been.called
+    })
+  })
+
   describe('removeSelfFromProject', function () {
     beforeEach(async function (ctx) {
       await new Promise(resolve => {
-        ctx.req.params = { Project_id: ctx.projectId }
+        ctx.req.params = { Project_id: ctx.projectId.toString() }
         ctx.res.sendStatus = sinon.spy(() => {
           resolve()
         })
@@ -313,12 +344,12 @@ describe('CollaboratorsController', function () {
     it('should remove the logged in user from the project', function (ctx) {
       expect(
         ctx.CollaboratorsHandler.promises.removeUserFromProject
-      ).to.have.been.calledWith(ctx.projectId, ctx.user._id)
+      ).to.have.been.calledWith(ctx.projectId.toString(), ctx.user._id)
     })
 
     it('should emit a userRemovedFromProject event to the proejct', function (ctx) {
       expect(ctx.EditorRealTimeController.emitToRoom).to.have.been.calledWith(
-        ctx.projectId,
+        ctx.projectId.toString(),
         'userRemovedFromProject',
         ctx.user._id
       )
@@ -327,7 +358,7 @@ describe('CollaboratorsController', function () {
     it('should remove the project from all tags', function (ctx) {
       expect(
         ctx.TagsHandler.promises.removeProjectFromAllTags
-      ).to.have.been.calledWith(ctx.user._id, ctx.projectId)
+      ).to.have.been.calledWith(ctx.user._id, ctx.projectId.toString())
     })
 
     it('should return a success code', function (ctx) {
@@ -336,7 +367,7 @@ describe('CollaboratorsController', function () {
 
     it('should emit a project:membership:changed event to the project', function (ctx) {
       expect(ctx.EditorRealTimeController.emitToRoom).to.have.been.calledWith(
-        ctx.projectId,
+        ctx.projectId.toString(),
         'project:membership:changed',
         { members: true }
       )
@@ -344,7 +375,7 @@ describe('CollaboratorsController', function () {
 
     it('should write a project audit log', function (ctx) {
       ctx.ProjectAuditLogHandler.addEntryInBackground.should.have.been.calledWith(
-        ctx.projectId,
+        ctx.projectId.toString(),
         'leave-project',
         ctx.user._id,
         ctx.req.ip
@@ -352,10 +383,22 @@ describe('CollaboratorsController', function () {
     })
   })
 
+  describe('removeSelfFromProject with a malformed project id', function () {
+    it('rejects the request instead of removing anyone', async function (ctx) {
+      ctx.req.params = { Project_id: 'not-an-object-id' }
+      await ctx.CollaboratorsController.removeSelfFromProject(
+        ctx.req,
+        ctx.res
+      ).should.be.rejectedWith(InvalidParamsError)
+      expect(ctx.CollaboratorsHandler.promises.removeUserFromProject).to.not
+        .have.been.called
+    })
+  })
+
   describe('getAllMembers', function () {
     beforeEach(async function (ctx) {
       await new Promise(resolve => {
-        ctx.req.params = { Project_id: ctx.projectId }
+        ctx.req.params = { Project_id: ctx.projectId.toString() }
         ctx.res.json = sinon.spy(() => {
           resolve()
         })
@@ -409,6 +452,18 @@ describe('CollaboratorsController', function () {
     })
   })
 
+  describe('getAllMembers with a malformed project id', function () {
+    it('rejects the request instead of listing members', async function (ctx) {
+      ctx.req.params = { Project_id: 'not-an-object-id' }
+      await ctx.CollaboratorsController.getAllMembers(
+        ctx.req,
+        ctx.res
+      ).should.be.rejectedWith(InvalidParamsError)
+      expect(ctx.CollaboratorsGetter.promises.getAllInvitedMembers).to.not.have
+        .been.called
+    })
+  })
+
   describe('getAccessRequests', function () {
     beforeEach(async function (ctx) {
       ctx.requesterId = new ObjectId()
@@ -443,6 +498,18 @@ describe('CollaboratorsController', function () {
     })
   })
 
+  describe('getAccessRequests with a malformed project id', function () {
+    it('rejects the request instead of listing access requests', async function (ctx) {
+      ctx.req.params = { Project_id: 'not-an-object-id' }
+      await ctx.CollaboratorsController.getAccessRequests(
+        ctx.req,
+        ctx.res
+      ).should.be.rejectedWith(InvalidParamsError)
+      expect(ctx.CollaboratorsGetter.promises.getProjectAccess).to.not.have.been
+        .called
+    })
+  })
+
   describe('setCollaboratorInfo', function () {
     beforeEach(function (ctx) {
       ctx.req.params = {
@@ -502,6 +569,23 @@ describe('CollaboratorsController', function () {
       })
     })
 
+    it('rejects an unrecognized field in the body instead of falling back', async function (ctx) {
+      ctx.req.body = { privilegeLevel: 'readOnly', notARealField: 'nope' }
+      await new Promise(resolve => {
+        ctx.next = sinon.spy(err => {
+          expect(err).to.be.instanceOf(InvalidRequestError)
+          resolve()
+        })
+        ctx.CollaboratorsController.setCollaboratorInfo(
+          ctx.req,
+          ctx.res,
+          ctx.next
+        )
+      })
+      expect(ctx.CollaboratorsHandler.promises.setCollaboratorPrivilegeLevel).to
+        .not.have.been.called
+    })
+
     describe('when setting privilege level to readAndWrite', function () {
       beforeEach(function (ctx) {
         ctx.req.body = { privilegeLevel: 'readAndWrite' }
@@ -644,6 +728,19 @@ describe('CollaboratorsController', function () {
         ctx.CollaboratorsController.transferOwnership(ctx.req, ctx.res)
       })
     })
+
+    it('rejects an unrecognized field in the body instead of falling back', async function (ctx) {
+      ctx.req.body = {
+        user_id: ctx.user._id.toString(),
+        notARealField: 'nope',
+      }
+      await ctx.CollaboratorsController.transferOwnership(
+        ctx.req,
+        ctx.res
+      ).should.be.rejectedWith(InvalidRequestError)
+      expect(ctx.OwnershipTransferHandler.promises.transferOwnership).to.not
+        .have.been.called
+    })
   })
 
   describe('requestAccess', function () {
@@ -758,6 +855,19 @@ describe('CollaboratorsController', function () {
     })
   })
 
+  describe('requestAccess with a malformed project id', function () {
+    it('rejects the request instead of recording it', async function (ctx) {
+      ctx.req.params = { Project_id: 'not-an-object-id' }
+      ctx.req.body = { privilegeLevel: 'readAndWrite' }
+      await ctx.CollaboratorsController.requestAccess(
+        ctx.req,
+        ctx.res
+      ).should.be.rejectedWith(InvalidParamsError)
+      expect(ctx.CollaboratorsHandler.promises.requestAccess).to.not.have.been
+        .called
+    })
+  })
+
   describe('declineAccessRequest', function () {
     beforeEach(function (ctx) {
       ctx.requesterId = new ObjectId()
@@ -850,6 +960,21 @@ describe('CollaboratorsController', function () {
     })
   })
 
+  describe('declineAccessRequest with a malformed project id', function () {
+    it('rejects the request instead of declining it', async function (ctx) {
+      ctx.req.params = {
+        Project_id: 'not-an-object-id',
+        user_id: new ObjectId().toString(),
+      }
+      await ctx.CollaboratorsController.declineAccessRequest(
+        ctx.req,
+        ctx.res
+      ).should.be.rejectedWith(InvalidParamsError)
+      expect(ctx.CollaboratorsHandler.promises.declineAccessRequest).to.not.have
+        .been.called
+    })
+  })
+
   describe('grantAccessRequest', function () {
     beforeEach(function (ctx) {
       ctx.requesterId = new ObjectId()
@@ -1006,4 +1131,100 @@ describe('CollaboratorsController', function () {
       )
     })
   })
+
+  describe('grantAccessRequest with a malformed project id', function () {
+    it('rejects the request instead of granting it', async function (ctx) {
+      ctx.req.params = {
+        Project_id: 'not-an-object-id',
+        user_id: new ObjectId().toString(),
+      }
+      ctx.req.body = { privilegeLevel: 'readAndWrite' }
+      await ctx.CollaboratorsController.grantAccessRequest(
+        ctx.req,
+        ctx.res
+      ).should.be.rejectedWith(InvalidParamsError)
+      expect(ctx.CollaboratorsHandler.promises.setCollaboratorPrivilegeLevel).to
+        .not.have.been.called
+    })
+  })
+
+  describe('getShareTokens', function () {
+    beforeEach(function (ctx) {
+      ctx.req.params = { Project_id: ctx.projectId.toString() }
+    })
+
+    it('rejects a malformed project id before checking anything else', async function (ctx) {
+      ctx.req.params = { Project_id: 'not-an-object-id' }
+      await ctx.CollaboratorsController.getShareTokens(
+        ctx.req,
+        ctx.res
+      ).should.be.rejectedWith(InvalidParamsError)
+      expect(ctx.CollaboratorsGetter.promises.getPublicShareTokens).to.not.have
+        .been.called
+    })
+
+    it('returns 403 when link sharing is disabled', async function (ctx) {
+      ctx.Features.hasFeature.withArgs('link-sharing').returns(false)
+      await new Promise(resolve => {
+        ctx.res.sendStatus = sinon.spy(() => resolve())
+        ctx.CollaboratorsController.getShareTokens(ctx.req, ctx.res)
+      })
+      expect(ctx.res.sendStatus).to.have.been.calledWith(403)
+      expect(ctx.CollaboratorsGetter.promises.getPublicShareTokens).to.not.have
+        .been.called
+    })
+
+    it('returns 403 when the logged in user has no share tokens', async function (ctx) {
+      ctx.CollaboratorsGetter.promises.getPublicShareTokens.resolves(null)
+      await new Promise(resolve => {
+        ctx.res.sendStatus = sinon.spy(() => resolve())
+        ctx.CollaboratorsController.getShareTokens(ctx.req, ctx.res)
+      })
+      expect(ctx.res.sendStatus).to.have.been.calledWith(403)
+    })
+
+    it('returns the hashed tokens for a logged in user', async function (ctx) {
+      ctx.CollaboratorsGetter.promises.getPublicShareTokens.resolves({
+        readOnly: 'ro-token',
+        readAndWrite: 'rw-token',
+      })
+      await new Promise(resolve => {
+        ctx.res.json = sinon.spy(() => resolve())
+        ctx.CollaboratorsController.getShareTokens(ctx.req, ctx.res)
+      })
+      expect(
+        ctx.CollaboratorsGetter.promises.getPublicShareTokens
+      ).to.have.been.calledWith(
+        new ObjectId(ctx.user._id.toString()),
+        new ObjectId(ctx.projectId.toString())
+      )
+      expect(ctx.res.json).to.have.been.calledWith({
+        readOnly: 'ro-token',
+        readAndWrite: 'rw-token',
+        readOnlyHashPrefix: 'hash-prefix',
+        readAndWriteHashPrefix: 'hash-prefix',
+      })
+    })
+
+    it('falls back to the session token for an anonymous request', async function (ctx) {
+      ctx.SessionManager.getLoggedInUserId = sinon.stub().returns(null)
+      ctx.TokenAccessHandler.getRequestToken = sinon
+        .stub()
+        .returns('anon-ro-token')
+      await new Promise(resolve => {
+        ctx.res.json = sinon.spy(() => resolve())
+        ctx.CollaboratorsController.getShareTokens(ctx.req, ctx.res)
+      })
+      expect(ctx.CollaboratorsGetter.promises.getPublicShareTokens).to.not.have
+        .been.called
+      expect(ctx.TokenAccessHandler.getRequestToken).to.have.been.calledWith(
+        ctx.req,
+        ctx.projectId.toString()
+      )
+      expect(ctx.res.json).to.have.been.calledWith({
+        readOnly: 'anon-ro-token',
+        readOnlyHashPrefix: 'hash-prefix',
+      })
+    })
+  })
 })

services/web/test/unit/src/DocumentUpdater/DocumentUpdaterController.test.mjs

@@ -37,7 +37,9 @@ describe('DocumentUpdaterController', function () {
     )
 
     ctx.controller = (await import(MODULE_PATH)).default
-    ctx.projectId = '2k3j1lk3j21lk3j'
+    // Project_id/Doc_id are validated as Mongo ObjectIds
+    ctx.projectId = '507f191e810c19729de860ea'
+    ctx.docId = '507f191e810c19729de860eb'
     ctx.fileId = '12321kklj1lk3jk12'
     ctx.req = {
       params: {

services/web/test/unit/src/Documents/DocumentController.test.mjs

@@ -12,7 +12,7 @@ describe('DocumentController', function () {
     ctx.res = new MockResponse(vi)
     ctx.req = new MockRequest(vi)
     ctx.next = sinon.stub()
-    ctx.doc = { _id: 'doc-id-123' }
+    ctx.doc = { _id: '5c9a5d5b0000000000000002' }
     ctx.doc_lines = ['one', 'two', 'three']
     ctx.version = 42
     ctx.ranges = {
@@ -36,11 +36,15 @@ describe('DocumentController', function () {
       ],
     }
     ctx.pathname = '/a/b/c/file.tex'
-    ctx.lastUpdatedAt = new Date().getTime()
-    ctx.lastUpdatedBy = 'fake-last-updater-id'
+    // stored/read back as a string -- Redis (ioredis mget) always returns
+    // strings, and document-updater's RedisManager never parses this key
+    // back to a number, so this is a numeric-looking string on the wire,
+    // not a JS number.
+    ctx.lastUpdatedAt = String(new Date().getTime())
+    ctx.lastUpdatedBy = '5c9a5d5b0000000000000003'
     ctx.rev = 5
     ctx.project = {
-      _id: 'project-id-123',
+      _id: '5c9a5d5b0000000000000001',
       overleaf: {
         history: {
           id: 1234,
@@ -212,7 +216,7 @@ describe('DocumentController', function () {
           ctx.doc_lines,
           ctx.version,
           ctx.ranges,
-          ctx.lastUpdatedAt,
+          Number(ctx.lastUpdatedAt),
           ctx.lastUpdatedBy
         )
       })
@@ -237,7 +241,11 @@ describe('DocumentController', function () {
           ctx.ProjectEntityUpdateHandler.promises.updateDocLines.rejects(
             new Errors.NotFoundError('document does not exist')
           )
-          ctx.req.body = { lines: ctx.doc_lines }
+          ctx.req.body = {
+            lines: ctx.doc_lines,
+            version: ctx.version,
+            ranges: ctx.ranges,
+          }
           ctx.next.callsFake(() => {
             resolve()
           })

services/web/test/unit/src/Downloads/ProjectDownloadsController.test.mjs

@@ -1,4 +1,4 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 // TODO: This file was created by bulk-decaffeinate.
 // Fix any style issues and re-enable lint.
 /*
@@ -10,6 +10,7 @@ import sinon from 'sinon'
 import MockRequest from '../helpers/MockRequest.mjs'
 import MockResponse from '../helpers/MockResponse.mjs'
 import { DocumentConversionError } from '../../../../app/src/Features/Errors/Errors.js'
+import { setReqValidationModeForTests } from '@overleaf/validation-tools'
 
 vi.mock('../../../../app/src/Features/Errors/Errors.js', () =>
   vi.importActual('../../../../app/src/Features/Errors/Errors.js')
@@ -19,7 +20,7 @@ const modulePath =
 
 describe('ProjectDownloadsController', function () {
   beforeEach(async function (ctx) {
-    ctx.project_id = 'project-id-123'
+    ctx.project_id = '507f191e810c19729de860ea'
     ctx.req = new MockRequest(vi)
     ctx.res = new MockResponse(vi)
     ctx.next = sinon.stub()
@@ -113,6 +114,10 @@ describe('ProjectDownloadsController', function () {
     ctx.ProjectDownloadsController = (await import(modulePath)).default
   })
 
+  afterEach(function () {
+    setReqValidationModeForTests(null)
+  })
+
   describe('downloadProject', function () {
     beforeEach(function (ctx) {
       ctx.stream = { pipe: sinon.stub() }
@@ -194,13 +199,72 @@ describe('ProjectDownloadsController', function () {
     })
   })
 
+  describe('downloadProject with an invalid Project_id', function () {
+    beforeEach(function (ctx) {
+      ctx.stream = { pipe: sinon.stub() }
+      ctx.ProjectZipStreamManager.createZipStreamForProject = sinon
+        .stub()
+        .yields(null, ctx.stream)
+      ctx.req.params = { Project_id: 'not-a-valid-object-id' }
+      ctx.req.ip = '192.168.1.1'
+      ctx.req.session = {
+        user: {
+          _id: 'user-id-123',
+          email: 'user@example.com',
+        },
+      }
+      ctx.ProjectGetter.getProject = sinon.stub().callsArgWith(2, null, {
+        name: 'a project',
+        overleaf: { history: { id: 123 } },
+      })
+      ctx.DocumentUpdaterHandler.flushProjectToMongo = sinon
+        .stub()
+        .callsArgWith(1)
+    })
+
+    it('should still process the request in log mode', function (ctx) {
+      setReqValidationModeForTests('log')
+      ctx.ProjectDownloadsController.downloadProject(ctx.req, ctx.res, ctx.next)
+      sinon.assert.notCalled(ctx.next)
+      sinon.assert.calledWith(
+        ctx.ProjectZipStreamManager.createZipStreamForProject,
+        'not-a-valid-object-id'
+      )
+    })
+
+    describe('when enforced', function () {
+      afterEach(function () {
+        setReqValidationModeForTests(null)
+      })
+
+      it('should reject the request', function (ctx) {
+        setReqValidationModeForTests('enforce')
+        let error
+        try {
+          ctx.ProjectDownloadsController.downloadProject(
+            ctx.req,
+            ctx.res,
+            ctx.next
+          )
+        } catch (err) {
+          error = err
+        }
+        expect(error).to.exist
+        expect(error.name).to.equal('InvalidParamsError')
+        sinon.assert.notCalled(
+          ctx.ProjectZipStreamManager.createZipStreamForProject
+        )
+      })
+    })
+  })
+
   describe('downloadMultipleProjects', function () {
     beforeEach(function (ctx) {
       ctx.stream = { pipe: sinon.stub() }
       ctx.ProjectZipStreamManager.createZipStreamForMultipleProjects = sinon
         .stub()
         .yields(null, ctx.stream)
-      ctx.project_ids = ['project-1', 'project-2']
+      ctx.project_ids = ['507f191e810c19729de860ea', '507f191e810c19729de860eb']
       ctx.req.query = { project_ids: ctx.project_ids.join(',') }
       ctx.req.ip = '192.168.1.1'
       ctx.req.session = {
@@ -273,6 +337,67 @@ describe('ProjectDownloadsController', function () {
     })
   })
 
+  describe('downloadMultipleProjects with an invalid project id', function () {
+    beforeEach(function (ctx) {
+      ctx.stream = { pipe: sinon.stub() }
+      ctx.ProjectZipStreamManager.createZipStreamForMultipleProjects = sinon
+        .stub()
+        .yields(null, ctx.stream)
+      ctx.req.query = {
+        project_ids: 'not-a-valid-object-id,507f191e810c19729de860eb',
+      }
+      ctx.req.ip = '192.168.1.1'
+      ctx.req.session = {
+        user: {
+          _id: 'user-id-123',
+          email: 'user@example.com',
+        },
+      }
+      ctx.DocumentUpdaterHandler.flushMultipleProjectsToMongo = sinon
+        .stub()
+        .callsArgWith(1)
+    })
+
+    it('should still process the request via the fallback schema in log mode', function (ctx) {
+      setReqValidationModeForTests('log')
+      ctx.ProjectDownloadsController.downloadMultipleProjects(
+        ctx.req,
+        ctx.res,
+        ctx.next
+      )
+      sinon.assert.notCalled(ctx.next)
+      sinon.assert.calledWith(
+        ctx.ProjectZipStreamManager.createZipStreamForMultipleProjects,
+        ['not-a-valid-object-id', '507f191e810c19729de860eb']
+      )
+    })
+
+    describe('when enforced', function () {
+      afterEach(function () {
+        setReqValidationModeForTests(null)
+      })
+
+      it('should reject the request', function (ctx) {
+        setReqValidationModeForTests('enforce')
+        let error
+        try {
+          ctx.ProjectDownloadsController.downloadMultipleProjects(
+            ctx.req,
+            ctx.res,
+            ctx.next
+          )
+        } catch (err) {
+          error = err
+        }
+        expect(error).to.exist
+        expect(error.name).to.equal('InvalidRequestError')
+        sinon.assert.notCalled(
+          ctx.ProjectZipStreamManager.createZipStreamForMultipleProjects
+        )
+      })
+    })
+  })
+
   describe('exportProjectConversion', function () {
     describe('with a supported type (default streaming)', function () {
       beforeEach(async function (ctx) {

services/web/test/unit/src/Editor/EditorHttpController.test.mjs

@@ -51,7 +51,8 @@ describe('EditorHttpController', function () {
     ctx.folder = { _id: new ObjectId() }
     ctx.source = 'editor'
 
-    ctx.parentFolderId = 'mock-folder-id'
+    // parent_folder_id/entity_id/folder_id are all validated as Mongo ObjectIds
+    ctx.parentFolderId = new ObjectId().toString()
     ctx.req = new MockRequest(vi)
     ctx.res = new MockResponse(vi)
     ctx.next = sinon.stub()
@@ -526,7 +527,7 @@ describe('EditorHttpController', function () {
 
   describe('addDoc', function () {
     beforeEach(function (ctx) {
-      ctx.req.params = { Project_id: ctx.project._id }
+      ctx.req.params = { Project_id: ctx.project._id.toString() }
       ctx.req.body = {
         name: (ctx.docName = 'doc-name'),
         parent_folder_id: ctx.parentFolderId,
@@ -543,7 +544,7 @@ describe('EditorHttpController', function () {
 
       it('should call EditorController.addDoc', function (ctx) {
         expect(ctx.EditorController.promises.addDoc).to.have.been.calledWith(
-          ctx.project._id,
+          ctx.project._id.toString(),
           ctx.parentFolderId,
           ctx.docName,
           [],
@@ -588,7 +589,7 @@ describe('EditorHttpController', function () {
   describe('addFolder', function () {
     beforeEach(function (ctx) {
       ctx.folderName = 'folder-name'
-      ctx.req.params = { Project_id: ctx.project._id }
+      ctx.req.params = { Project_id: ctx.project._id.toString() }
       ctx.req.body = {
         name: ctx.folderName,
         parent_folder_id: ctx.parentFolderId,
@@ -605,7 +606,7 @@ describe('EditorHttpController', function () {
 
       it('should call EditorController.addFolder', function (ctx) {
         expect(ctx.EditorController.promises.addFolder).to.have.been.calledWith(
-          ctx.project._id,
+          ctx.project._id.toString(),
           ctx.parentFolderId,
           ctx.folderName,
           'editor'
@@ -661,10 +662,11 @@ describe('EditorHttpController', function () {
 
   describe('renameEntity', function () {
     beforeEach(function (ctx) {
-      ctx.entityId = 'entity-id-123'
-      ctx.entityType = 'entity-type'
+      // entity_id is validated as a Mongo ObjectId; entity_type as an enum
+      ctx.entityId = new ObjectId().toString()
+      ctx.entityType = 'doc'
       ctx.req.params = {
-        Project_id: ctx.project._id,
+        Project_id: ctx.project._id.toString(),
         entity_id: ctx.entityId,
         entity_type: ctx.entityType,
       }
@@ -684,7 +686,7 @@ describe('EditorHttpController', function () {
         expect(
           ctx.EditorController.promises.renameEntity
         ).to.have.been.calledWith(
-          ctx.project._id,
+          ctx.project._id.toString(),
           ctx.entityId,
           ctx.entityType,
           ctx.newName,
@@ -725,11 +727,13 @@ describe('EditorHttpController', function () {
   describe('moveEntity', function () {
     beforeEach(async function (ctx) {
       await new Promise(resolve => {
-        ctx.entityId = 'entity-id-123'
-        ctx.entityType = 'entity-type'
-        ctx.folderId = 'folder-id-123'
+        // entity_id/folder_id are validated as Mongo ObjectIds; entity_type
+        // as an enum
+        ctx.entityId = new ObjectId().toString()
+        ctx.entityType = 'doc'
+        ctx.folderId = new ObjectId().toString()
         ctx.req.params = {
-          Project_id: ctx.project._id,
+          Project_id: ctx.project._id.toString(),
           entity_id: ctx.entityId,
           entity_type: ctx.entityType,
         }
@@ -741,7 +745,7 @@ describe('EditorHttpController', function () {
 
     it('should call EditorController.moveEntity', function (ctx) {
       expect(ctx.EditorController.promises.moveEntity).to.have.been.calledWith(
-        ctx.project._id,
+        ctx.project._id.toString(),
         ctx.entityId,
         ctx.folderId,
         ctx.entityType,
@@ -755,35 +759,40 @@ describe('EditorHttpController', function () {
     })
   })
 
-  describe('deleteEntity', function () {
-    beforeEach(async function (ctx) {
-      await new Promise(resolve => {
-        ctx.entityId = 'entity-id-123'
-        ctx.entityType = 'entity-type'
-        ctx.req.params = {
-          Project_id: ctx.project._id,
-          entity_id: ctx.entityId,
-          entity_type: ctx.entityType,
-        }
-        ctx.res.callback = resolve
-        ctx.EditorHttpController.deleteEntity(ctx.req, ctx.res)
+  for (const [name, entityType] of [
+    ['deleteDoc', 'doc'],
+    ['deleteFile', 'file'],
+    ['deleteFolder', 'folder'],
+  ]) {
+    describe(name, function () {
+      beforeEach(async function (ctx) {
+        await new Promise(resolve => {
+          // entity_id is validated as a Mongo ObjectId
+          ctx.entityId = new ObjectId().toString()
+          ctx.req.params = {
+            Project_id: ctx.project._id.toString(),
+            entity_id: ctx.entityId,
+          }
+          ctx.res.callback = resolve
+          ctx.EditorHttpController[name](ctx.req, ctx.res)
+        })
+      })
+
+      it('should call EditorController.deleteEntity', function (ctx) {
+        expect(
+          ctx.EditorController.promises.deleteEntity
+        ).to.have.been.calledWith(
+          ctx.project._id.toString(),
+          ctx.entityId,
+          entityType,
+          'editor',
+          ctx.user._id
+        )
+      })
+
+      it('should send back a success response', function (ctx) {
+        expect(ctx.res.statusCode).to.equal(204)
       })
     })
-
-    it('should call EditorController.deleteEntity', function (ctx) {
-      expect(
-        ctx.EditorController.promises.deleteEntity
-      ).to.have.been.calledWith(
-        ctx.project._id,
-        ctx.entityId,
-        ctx.entityType,
-        'editor',
-        ctx.user._id
-      )
-    })
-
-    it('should send back a success response', function (ctx) {
-      expect(ctx.res.statusCode).to.equal(204)
-    })
-  })
+  }
 })

services/web/test/unit/src/History/HistoryController.test.mjs

@@ -201,6 +201,25 @@ describe('HistoryController', function () {
     })
   })
 
+  describe('proxyToHistoryApi (with an invalid request)', function () {
+    beforeEach(async function (ctx) {
+      ctx.req = {
+        url: '/mock/url',
+        method: 'GET',
+        session: sinon.stub(),
+        params: { Project_id: 'not-an-object-id' },
+      }
+      ctx.res = { set: sinon.stub() }
+      await ctx.HistoryController.proxyToHistoryApi(ctx.req, ctx.res, ctx.next)
+    })
+
+    it('rejects the request without calling the history api', function (ctx) {
+      ctx.next.should.have.been.calledOnce
+      ctx.next.firstCall.args[0].should.be.an.instanceof(Error)
+      ctx.fetchStreamWithResponse.should.not.have.been.called
+    })
+  })
+
   describe('proxyToHistoryApiAndInjectUserDetails', function () {
     beforeEach(async function (ctx) {
       ctx.req = {
@@ -280,6 +299,28 @@ describe('HistoryController', function () {
     })
   })
 
+  describe('proxyToHistoryApiAndInjectUserDetails (with an invalid request)', function () {
+    beforeEach(async function (ctx) {
+      ctx.req = {
+        url: '/mock/url',
+        method: 'GET',
+        params: { Project_id: 'not-an-object-id' },
+      }
+      ctx.res = { json: sinon.stub() }
+      await ctx.HistoryController.proxyToHistoryApiAndInjectUserDetails(
+        ctx.req,
+        ctx.res,
+        ctx.next
+      )
+    })
+
+    it('rejects the request without calling the history api', function (ctx) {
+      ctx.next.should.have.been.calledOnce
+      ctx.next.firstCall.args[0].should.be.an.instanceof(Error)
+      ctx.fetchJson.should.not.have.been.called
+    })
+  })
+
   describe('resyncProjectHistory', function () {
     describe('for a project without project-history enabled', function () {
       beforeEach(async function (ctx) {
@@ -329,6 +370,29 @@ describe('HistoryController', function () {
         ctx.res.sendStatus.should.have.been.calledWith(204)
       })
     })
+
+    describe('with an invalid historyRangesMigration value', function () {
+      beforeEach(async function (ctx) {
+        ctx.req = {
+          params: { Project_id: ctx.project_id },
+          body: { historyRangesMigration: 'sideways' },
+        }
+        ctx.res = { setTimeout: sinon.stub(), sendStatus: sinon.stub() }
+
+        await ctx.HistoryController.resyncProjectHistory(
+          ctx.req,
+          ctx.res,
+          ctx.next
+        )
+      })
+
+      it('rejects the request without resyncing', function (ctx) {
+        ctx.next.should.have.been.calledOnce
+        ctx.next.firstCall.args[0].should.be.an.instanceof(Error)
+        ctx.ProjectEntityUpdateHandler.promises.resyncProjectHistory.should.not
+          .have.been.called
+      })
+    })
   })
 
   describe('restoreFileFromV2', function () {
@@ -490,6 +554,106 @@ describe('HistoryController', function () {
     })
   })
 
+  describe('getLabels', function () {
+    beforeEach(function (ctx) {
+      ctx.res = { json: sinon.stub() }
+      ctx.labels = [{ id: 'label-1', comment: 'a label' }]
+      ctx.fetchJson.resolves(ctx.labels)
+    })
+
+    it('fetches and returns the labels for a valid request', async function (ctx) {
+      ctx.req = { params: { Project_id: ctx.project_id } }
+      await ctx.HistoryController.getLabels(ctx.req, ctx.res, ctx.next)
+      ctx.fetchJson.should.have.been.calledWith(
+        `${ctx.settings.apis.project_history.url}/project/${ctx.project_id}/labels`
+      )
+      ctx.res.json.should.have.been.calledWith(ctx.labels)
+    })
+
+    it('rejects a malformed Project_id without calling the history api', async function (ctx) {
+      ctx.req = { params: { Project_id: 'not-an-object-id' } }
+      await ctx.HistoryController.getLabels(ctx.req, ctx.res, ctx.next)
+      ctx.next.should.have.been.calledOnce
+      ctx.next.firstCall.args[0].should.be.an.instanceof(Error)
+      ctx.fetchJson.should.not.have.been.called
+    })
+  })
+
+  describe('createLabel', function () {
+    beforeEach(function (ctx) {
+      ctx.res = { json: sinon.stub() }
+    })
+
+    it('creates and returns the label for a valid request', async function (ctx) {
+      ctx.req = {
+        params: { Project_id: ctx.project_id },
+        body: { comment: 'a label', version: 3 },
+        session: {},
+      }
+      ctx.label = { id: 'label-1', comment: 'a label', version: 3 }
+      ctx.fetchJson.resolves(ctx.label)
+      await ctx.HistoryController.createLabel(ctx.req, ctx.res, ctx.next)
+      ctx.fetchJson.should.have.been.calledWith(
+        `${ctx.settings.apis.project_history.url}/project/${ctx.project_id}/labels`,
+        {
+          method: 'POST',
+          json: { comment: 'a label', version: 3, user_id: ctx.user_id },
+        }
+      )
+      ctx.res.json.should.have.been.calledWith(
+        sinon.match({ comment: 'a label', version: 3 })
+      )
+    })
+
+    it('rejects a negative version without calling the history api', async function (ctx) {
+      ctx.req = {
+        params: { Project_id: ctx.project_id },
+        body: { comment: 'a label', version: -1 },
+        session: {},
+      }
+      await ctx.HistoryController.createLabel(ctx.req, ctx.res, ctx.next)
+      ctx.next.should.have.been.calledOnce
+      ctx.next.firstCall.args[0].should.be.an.instanceof(Error)
+      ctx.fetchJson.should.not.have.been.called
+    })
+  })
+
+  describe('deleteLabel', function () {
+    beforeEach(function (ctx) {
+      ctx.res = { sendStatus: sinon.stub() }
+      ctx.labelId = '000000000000000087654321'
+      ctx.ProjectGetter.promises = {
+        getProject: sinon.stub().resolves({
+          owner_ref: { equals: sinon.stub().returns(true) },
+        }),
+      }
+    })
+
+    it('deletes the label for a valid request', async function (ctx) {
+      ctx.req = {
+        params: { Project_id: ctx.project_id, label_id: ctx.labelId },
+        session: {},
+      }
+      await ctx.HistoryController.deleteLabel(ctx.req, ctx.res, ctx.next)
+      ctx.fetchNothing.should.have.been.calledWith(
+        `${ctx.settings.apis.project_history.url}/project/${ctx.project_id}/labels/${ctx.labelId}`,
+        { method: 'DELETE' }
+      )
+      ctx.res.sendStatus.should.have.been.calledWith(204)
+    })
+
+    it('rejects a malformed label_id without calling the history api', async function (ctx) {
+      ctx.req = {
+        params: { Project_id: ctx.project_id, label_id: 'not-an-object-id' },
+        session: {},
+      }
+      await ctx.HistoryController.deleteLabel(ctx.req, ctx.res, ctx.next)
+      ctx.next.should.have.been.calledOnce
+      ctx.next.firstCall.args[0].should.be.an.instanceof(Error)
+      ctx.fetchNothing.should.not.have.been.called
+    })
+  })
+
   describe('requestBlob', function () {
     describe('With Range header', function () {
       beforeEach(async function (ctx) {

services/web/test/unit/src/Metadata/MetaController.test.mjs

@@ -1,8 +1,12 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import sinon from 'sinon'
 import MockResponse from '../helpers/MockResponse.mjs'
+import { setReqValidationModeForTests } from '@overleaf/validation-tools'
 const modulePath = '../../../../app/src/Features/Metadata/MetaController.mjs'
 
+const PROJECT_ID = '507f1f77bcf86cd799439011'
+const DOC_ID = '507f191e810c19729de860ea'
+
 describe('MetaController', function () {
   beforeEach(async function (ctx) {
     ctx.EditorRealTimeController = {
@@ -46,6 +50,10 @@ describe('MetaController', function () {
     ctx.MetadataController = (await import(modulePath)).default
   })
 
+  afterEach(function () {
+    setReqValidationModeForTests(null)
+  })
+
   describe('getMetadata', function () {
     it('should respond with json', async function (ctx) {
       const projectMeta = {
@@ -60,18 +68,18 @@ describe('MetaController', function () {
         .stub()
         .resolves(projectMeta)
 
-      const req = { params: { project_id: 'project-id' } }
+      const req = { params: { project_id: PROJECT_ID } }
       const res = new MockResponse(vi)
       const next = sinon.stub()
 
       await ctx.MetadataController.getMetadata(req, res, next)
 
       ctx.MetaHandler.promises.getAllMetaForProject.should.have.been.calledWith(
-        'project-id'
+        PROJECT_ID
       )
       expect(res.json).toHaveBeenCalledTimes(1)
       expect(res.json).toHaveBeenCalledWith({
-        projectId: 'project-id',
+        projectId: PROJECT_ID,
         projectMeta,
       })
       next.should.not.have.been.called
@@ -82,18 +90,33 @@ describe('MetaController', function () {
         .stub()
         .throws(new Error('woops'))
 
-      const req = { params: { project_id: 'project-id' } }
+      const req = { params: { project_id: PROJECT_ID } }
       const res = new MockResponse(vi)
       const next = sinon.stub()
 
       await ctx.MetadataController.getMetadata(req, res, next)
 
       ctx.MetaHandler.promises.getAllMetaForProject.should.have.been.calledWith(
-        'project-id'
+        PROJECT_ID
       )
       expect(res.json).not.toHaveBeenCalled()
       next.should.have.been.calledWithMatch(error => error instanceof Error)
     })
+
+    it('should reject a malformed project id', async function (ctx) {
+      const req = { params: { project_id: 'not-an-object-id' } }
+      const res = new MockResponse(vi)
+      const next = sinon.stub()
+
+      await ctx.MetadataController.getMetadata(req, res, next)
+
+      expect(ctx.MetaHandler.promises.getAllMetaForProject.called).to.equal(
+        false
+      )
+      next.should.have.been.calledWithMatch(
+        error => error.name === 'InvalidParamsError'
+      )
+    })
   })
 
   describe('broadcastMetadataForDoc', function () {
@@ -107,7 +130,7 @@ describe('MetaController', function () {
       ctx.EditorRealTimeController.emitToRoom = sinon.stub()
 
       const req = {
-        params: { project_id: 'project-id', doc_id: 'doc-id' },
+        params: { project_id: PROJECT_ID, doc_id: DOC_ID },
         body: { broadcast: true },
       }
       const res = new MockResponse(vi)
@@ -116,7 +139,7 @@ describe('MetaController', function () {
       await ctx.MetadataController.broadcastMetadataForDoc(req, res, next)
 
       ctx.MetaHandler.promises.getMetaForDoc.should.have.been.calledWith(
-        'project-id'
+        PROJECT_ID
       )
       expect(res.json).not.toHaveBeenCalled()
       expect(res.sendStatus).toHaveBeenCalledTimes(1)
@@ -125,7 +148,7 @@ describe('MetaController', function () {
 
       ctx.EditorRealTimeController.emitToRoom.should.have.been.calledOnce
       const { lastCall } = ctx.EditorRealTimeController.emitToRoom
-      expect(lastCall.args[0]).to.equal('project-id')
+      expect(lastCall.args[0]).to.equal(PROJECT_ID)
       expect(lastCall.args[1]).to.equal('broadcastDocMeta')
       expect(lastCall.args[2]).to.have.all.keys(['docId', 'meta'])
     })
@@ -142,7 +165,7 @@ describe('MetaController', function () {
       ctx.EditorRealTimeController.emitToRoom = sinon.stub()
 
       const req = {
-        params: { project_id: 'project-id', doc_id: 'doc-id' },
+        params: { project_id: PROJECT_ID, doc_id: DOC_ID },
         body: { broadcast: false },
       }
       const res = new MockResponse(vi)
@@ -151,12 +174,12 @@ describe('MetaController', function () {
       await ctx.MetadataController.broadcastMetadataForDoc(req, res, next)
 
       ctx.MetaHandler.promises.getMetaForDoc.should.have.been.calledWith(
-        'project-id'
+        PROJECT_ID
       )
       ctx.EditorRealTimeController.emitToRoom.should.not.have.been.called
       expect(res.json).toHaveBeenCalledTimes(1)
       expect(res.json).toHaveBeenCalledWith({
-        docId: 'doc-id',
+        docId: DOC_ID,
         meta: docMeta,
       })
       next.should.not.have.been.called
@@ -170,7 +193,7 @@ describe('MetaController', function () {
       ctx.EditorRealTimeController.emitToRoom = sinon.stub()
 
       const req = {
-        params: { project_id: 'project-id', doc_id: 'doc-id' },
+        params: { project_id: PROJECT_ID, doc_id: DOC_ID },
         body: { broadcast: true },
       }
       const res = new MockResponse(vi)
@@ -179,10 +202,48 @@ describe('MetaController', function () {
       await ctx.MetadataController.broadcastMetadataForDoc(req, res, next)
 
       ctx.MetaHandler.promises.getMetaForDoc.should.have.been.calledWith(
-        'project-id'
+        PROJECT_ID
       )
       expect(res.json).not.toHaveBeenCalled()
       next.should.have.been.calledWithMatch(error => error instanceof Error)
     })
+
+    describe('request validation', function () {
+      beforeEach(function () {
+        setReqValidationModeForTests('enforce')
+      })
+
+      it('should reject a malformed doc id', async function (ctx) {
+        const req = {
+          params: { project_id: PROJECT_ID, doc_id: 'not-an-object-id' },
+          body: { broadcast: true },
+        }
+        const res = new MockResponse(vi)
+        const next = sinon.stub()
+
+        await ctx.MetadataController.broadcastMetadataForDoc(req, res, next)
+
+        expect(ctx.MetaHandler.promises.getMetaForDoc.called).to.equal(false)
+        next.should.have.been.calledWithMatch(
+          error => error.name === 'InvalidParamsError'
+        )
+      })
+
+      it('should reject an unrecognized body field', async function (ctx) {
+        const req = {
+          params: { project_id: PROJECT_ID, doc_id: DOC_ID },
+          body: { broadcast: true, evil: 'x' },
+        }
+        const res = new MockResponse(vi)
+        const next = sinon.stub()
+
+        await ctx.MetadataController.broadcastMetadataForDoc(req, res, next)
+
+        expect(ctx.MetaHandler.promises.getMetaForDoc.called).to.equal(false)
+        next.should.have.been.calledWithMatch(
+          error => error.name === 'InvalidRequestError'
+        )
+      })
+    })
   })
 })

services/web/test/unit/src/Notifications/NotificationsController.test.mjs

@@ -1,5 +1,6 @@
-import { beforeEach, describe, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, it, vi } from 'vitest'
 import sinon from 'sinon'
+import { setReqValidationModeForTests } from '@overleaf/validation-tools'
 
 const modulePath = new URL(
   '../../../../app/src/Features/Notifications/NotificationsController.mjs',
@@ -8,7 +9,7 @@ const modulePath = new URL(
 
 describe('NotificationsController', function () {
   const userId = '123nd3ijdks'
-  const notificationId = '123njdskj9jlk'
+  const notificationId = '507f1f77bcf86cd799439011'
 
   beforeEach(async function (ctx) {
     ctx.handler = {
@@ -52,6 +53,10 @@ describe('NotificationsController', function () {
     ctx.controller = (await import(modulePath)).default
   })
 
+  afterEach(function () {
+    setReqValidationModeForTests(null)
+  })
+
   it('should ask the handler for all unread notifications', async function (ctx) {
     await new Promise(resolve => {
       const allNotifications = [{ _id: notificationId, user_id: userId }]
@@ -98,4 +103,26 @@ describe('NotificationsController', function () {
       })
     })
   })
+
+  describe('request validation', function () {
+    beforeEach(function () {
+      setReqValidationModeForTests('enforce')
+    })
+
+    it('should reject a malformed notification id on markNotificationAsRead', function (ctx) {
+      ctx.req.params.notificationId = 'not-an-object-id'
+      ;(() =>
+        ctx.controller.markNotificationAsRead(ctx.req, {
+          sendStatus: sinon.stub(),
+        })).should.throw()
+    })
+
+    it('should reject a malformed notification id on getNotification', function (ctx) {
+      ctx.req.params.notificationId = 'not-an-object-id'
+      ;(() =>
+        ctx.controller.getNotification(ctx.req, {
+          json: sinon.stub(),
+        })).should.throw()
+    })
+  })
 })

services/web/test/unit/src/Project/ProjectApiController.test.mjs

@@ -1,5 +1,6 @@
-import { beforeEach, describe, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import sinon from 'sinon'
+import { setReqValidationModeForTests } from '@overleaf/validation-tools'
 
 const modulePath = '../../../../app/src/Features/Project/ProjectApiController'
 
@@ -15,7 +16,7 @@ describe('Project api controller', function () {
     )
 
     ctx.controller = (await import(modulePath)).default
-    ctx.project_id = '321l3j1kjkjl'
+    ctx.project_id = '507f191e810c19729de860ea'
     ctx.req = {
       params: {
         project_id: ctx.project_id,
@@ -29,6 +30,10 @@ describe('Project api controller', function () {
     return (ctx.projDetails = { name: 'something' })
   })
 
+  afterEach(function () {
+    setReqValidationModeForTests(null)
+  })
+
   describe('getProjectDetails', function () {
     it('should ask the project details handler for proj details', async function (ctx) {
       await new Promise(resolve => {
@@ -53,5 +58,46 @@ describe('Project api controller', function () {
       ctx.controller.getProjectDetails(ctx.req, ctx.res, ctx.next)
       return ctx.next.calledWith('error').should.equal(true)
     })
+
+    describe('with a malformed project_id', function () {
+      beforeEach(function (ctx) {
+        ctx.req.params.project_id = 'not-a-valid-object-id'
+      })
+
+      it('should still process the request in log mode', function (ctx) {
+        setReqValidationModeForTests('log')
+        ctx.ProjectDetailsHandler.getDetails.callsArgWith(
+          1,
+          null,
+          ctx.projDetails
+        )
+        ctx.res.json = sinon.stub()
+        ctx.controller.getProjectDetails(ctx.req, ctx.res, ctx.next)
+        sinon.assert.notCalled(ctx.next)
+        sinon.assert.calledWith(
+          ctx.ProjectDetailsHandler.getDetails,
+          'not-a-valid-object-id'
+        )
+      })
+
+      describe('when enforced', function () {
+        afterEach(function () {
+          setReqValidationModeForTests(null)
+        })
+
+        it('should reject the request', function (ctx) {
+          setReqValidationModeForTests('enforce')
+          let error
+          try {
+            ctx.controller.getProjectDetails(ctx.req, ctx.res, ctx.next)
+          } catch (err) {
+            error = err
+          }
+          expect(error).to.exist
+          expect(error.name).to.equal('InvalidParamsError')
+          sinon.assert.notCalled(ctx.ProjectDetailsHandler.getDetails)
+        })
+      })
+    })
   })
 })

services/web/test/unit/src/Project/ProjectController.test.mjs

@@ -59,6 +59,8 @@ describe('ProjectController', function () {
       promises: {
         deleteProject: sinon.stub().resolves(),
         restoreProject: sinon.stub().resolves(),
+        archiveProject: sinon.stub().resolves(),
+        unarchiveProject: sinon.stub().resolves(),
       },
       findArchivedProjects: sinon.stub(),
     }
@@ -543,7 +545,8 @@ describe('ProjectController', function () {
     ctx.req = {
       query: {},
       params: {
-        Project_id: ctx.project_id,
+        // real Express req.params are always strings
+        Project_id: ctx.project_id.toString(),
       },
       headers: {},
       connection: {
@@ -652,6 +655,16 @@ describe('ProjectController', function () {
         ctx.ProjectController.updateProjectSettings(ctx.req, ctx.res)
       })
     })
+
+    it('should reject a malformed mainBibliographyDocId', async function (ctx) {
+      await new Promise(resolve => {
+        ctx.req.body = { mainBibliographyDocId: 'not-an-object-id' }
+        ctx.ProjectController.updateProjectSettings(ctx.req, ctx.res, err => {
+          expect(err).to.exist
+          resolve()
+        })
+      })
+    })
   })
 
   describe('updateProjectAdminSettings', function () {
@@ -733,7 +746,7 @@ describe('ProjectController', function () {
       await new Promise(resolve => {
         ctx.res.sendStatus = code => {
           ctx.ProjectDeleter.promises.deleteProject
-            .calledWith(ctx.project_id, {
+            .calledWith(ctx.project_id.toString(), {
               deleterUser: ctx.user,
               ipAddress: ctx.req.ip,
               deletedReason: 'user',
@@ -747,12 +760,42 @@ describe('ProjectController', function () {
     })
   })
 
+  describe('archiveProject', function () {
+    it('should call the project deleter', async function (ctx) {
+      await new Promise(resolve => {
+        ctx.res.sendStatus = code => {
+          ctx.ProjectDeleter.promises.archiveProject
+            .calledWith(ctx.project_id.toString(), ctx.user._id)
+            .should.equal(true)
+          code.should.equal(200)
+          resolve()
+        }
+        ctx.ProjectController.archiveProject(ctx.req, ctx.res)
+      })
+    })
+  })
+
+  describe('unarchiveProject', function () {
+    it('should call the project deleter', async function (ctx) {
+      await new Promise(resolve => {
+        ctx.res.sendStatus = code => {
+          ctx.ProjectDeleter.promises.unarchiveProject
+            .calledWith(ctx.project_id.toString(), ctx.user._id)
+            .should.equal(true)
+          code.should.equal(200)
+          resolve()
+        }
+        ctx.ProjectController.unarchiveProject(ctx.req, ctx.res)
+      })
+    })
+  })
+
   describe('restoreProject', function () {
     it('should tell the project deleter', async function (ctx) {
       await new Promise(resolve => {
         ctx.res.sendStatus = code => {
           ctx.ProjectDeleter.promises.restoreProject
-            .calledWith(ctx.project_id)
+            .calledWith(ctx.project_id.toString())
             .should.equal(true)
           code.should.equal(200)
           resolve()
@@ -767,7 +810,7 @@ describe('ProjectController', function () {
       await new Promise(resolve => {
         ctx.res.json = json => {
           ctx.ProjectDuplicator.promises.duplicate
-            .calledWith(ctx.user, ctx.project_id, ctx.projectName)
+            .calledWith(ctx.user, ctx.project_id.toString(), ctx.projectName)
             .should.equal(true)
           json.project_id.should.equal(ctx.project_id)
           resolve()
@@ -873,7 +916,7 @@ describe('ProjectController', function () {
   describe('renameProject', function () {
     beforeEach(function (ctx) {
       ctx.newProjectName = 'my supper great new project'
-      ctx.req.body.newProjectName = ctx.newProjectName
+      ctx.req.body = { newProjectName: ctx.newProjectName }
       ctx.req.params.Project_id = ctx.project_id.toString()
     })
 
@@ -1101,7 +1144,7 @@ describe('ProjectController', function () {
           resCode.should.equal(401)
           ctx.AuthorizationManager.promises.getPrivilegeLevelForProject.should.have.been.calledWith(
             ctx.user._id,
-            ctx.project_id,
+            ctx.project_id.toString(),
             'some-token'
           )
           resolve()
@@ -1140,7 +1183,7 @@ describe('ProjectController', function () {
       await new Promise(resolve => {
         ctx.res.render = (pageName, opts) => {
           ctx.ProjectUpdateHandler.promises.markAsOpened
-            .calledWith(ctx.project_id)
+            .calledWith(ctx.project_id.toString())
             .should.equal(true)
           resolve()
         }
@@ -1357,13 +1400,13 @@ describe('ProjectController', function () {
           })
           describe('when the projectId does not match (0)', function () {
             beforeEach(function (ctx) {
-              ctx.req.params.Project_id = ObjectId.createFromTime(0)
+              ctx.req.params.Project_id = ObjectId.createFromTime(0).toString()
             })
             checkNonMatch()
           })
           describe('when the projectId does not match (42)', function () {
             beforeEach(function (ctx) {
-              ctx.req.params.Project_id = ObjectId.createFromTime(42)
+              ctx.req.params.Project_id = ObjectId.createFromTime(42).toString()
             })
             checkNonMatch()
           })
@@ -1375,21 +1418,21 @@ describe('ProjectController', function () {
           })
           describe('when the projectId matches (0)', function () {
             beforeEach(function (ctx) {
-              ctx.req.params.Project_id = ObjectId.createFromTime(0)
+              ctx.req.params.Project_id = ObjectId.createFromTime(0).toString()
             })
             checkMatch()
             checkForBetaUser()
           })
           describe('when the projectId does not match (1)', function () {
             beforeEach(function (ctx) {
-              ctx.req.params.Project_id = ObjectId.createFromTime(1)
+              ctx.req.params.Project_id = ObjectId.createFromTime(1).toString()
             })
             checkNonMatch()
             checkForBetaUser()
           })
           describe('when the projectId does not match (42)', function () {
             beforeEach(function (ctx) {
-              ctx.req.params.Project_id = ObjectId.createFromTime(42)
+              ctx.req.params.Project_id = ObjectId.createFromTime(42).toString()
             })
             checkNonMatch()
           })
@@ -1400,26 +1443,26 @@ describe('ProjectController', function () {
           })
           describe('when the projectId matches (0)', function () {
             beforeEach(function (ctx) {
-              ctx.req.params.Project_id = ObjectId.createFromTime(0)
+              ctx.req.params.Project_id = ObjectId.createFromTime(0).toString()
             })
             checkMatch()
           })
           describe('when the projectId matches (9)', function () {
             beforeEach(function (ctx) {
-              ctx.req.params.Project_id = ObjectId.createFromTime(9)
+              ctx.req.params.Project_id = ObjectId.createFromTime(9).toString()
             })
             checkMatch()
             checkForBetaUser()
           })
           describe('when the projectId does not match (10)', function () {
             beforeEach(function (ctx) {
-              ctx.req.params.Project_id = ObjectId.createFromTime(10)
+              ctx.req.params.Project_id = ObjectId.createFromTime(10).toString()
             })
             checkNonMatch()
           })
           describe('when the projectId does not match (42)', function () {
             beforeEach(function (ctx) {
-              ctx.req.params.Project_id = ObjectId.createFromTime(42)
+              ctx.req.params.Project_id = ObjectId.createFromTime(42).toString()
             })
             checkNonMatch()
             checkForBetaUser()
@@ -1431,26 +1474,26 @@ describe('ProjectController', function () {
           })
           describe('when the projectId matches (0)', function () {
             beforeEach(function (ctx) {
-              ctx.req.params.Project_id = ObjectId.createFromTime(0)
+              ctx.req.params.Project_id = ObjectId.createFromTime(0).toString()
             })
             checkMatch()
             checkForBetaUser()
           })
           describe('when the projectId matches (10)', function () {
             beforeEach(function (ctx) {
-              ctx.req.params.Project_id = ObjectId.createFromTime(10)
+              ctx.req.params.Project_id = ObjectId.createFromTime(10).toString()
             })
             checkMatch()
           })
           describe('when the projectId matches (42)', function () {
             beforeEach(function (ctx) {
-              ctx.req.params.Project_id = ObjectId.createFromTime(42)
+              ctx.req.params.Project_id = ObjectId.createFromTime(42).toString()
             })
             checkMatch()
           })
           describe('when the projectId matches (99)', function () {
             beforeEach(function (ctx) {
-              ctx.req.params.Project_id = ObjectId.createFromTime(99)
+              ctx.req.params.Project_id = ObjectId.createFromTime(99).toString()
             })
             checkMatch()
           })
@@ -1570,7 +1613,7 @@ describe('ProjectController', function () {
           ctx.res.render = (pageName, opts) => {
             ctx.Modules.promises.hooks.fire.should.have.been.calledWith(
               'enforceCollaboratorLimit',
-              ctx.project_id
+              ctx.project_id.toString()
             )
             resolve()
           }
@@ -1928,8 +1971,8 @@ describe('ProjectController', function () {
   describe('projectEntitiesJson', function () {
     beforeEach(function (ctx) {
       ctx.SessionManager.getLoggedInUserId = sinon.stub().returns('abc')
-      ctx.req.params = { Project_id: 'abcd' }
-      ctx.project = { _id: 'abcd' }
+      ctx.req.params = { Project_id: '507f191e810c19729de860ea' }
+      ctx.project = { _id: '507f191e810c19729de860ea' }
       ctx.docs = [
         { path: '/things/b.txt', doc: true },
         { path: '/main.tex', doc: true },
@@ -1945,7 +1988,7 @@ describe('ProjectController', function () {
       await new Promise(resolve => {
         ctx.res.json = data => {
           expect(data).to.deep.equal({
-            project_id: 'abcd',
+            project_id: '507f191e810c19729de860ea',
             entities: [
               { path: '/main.tex', type: 'doc' },
               { path: '/things/a.txt', type: 'file' },

services/web/test/unit/src/Project/ProjectListController.test.mjs

@@ -1,8 +1,12 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import sinon from 'sinon'
 import mongodb from 'mongodb-legacy'
 import Errors from '../../../../app/src/Features/Errors/Errors.js'
 import Settings from '@overleaf/settings'
+import {
+  InvalidRequestError,
+  setReqValidationModeForTests,
+} from '@overleaf/validation-tools'
 
 const ObjectId = mongodb.ObjectId
 
@@ -335,6 +339,10 @@ describe('ProjectListController', function () {
     ctx.res = {}
   })
 
+  afterEach(function () {
+    setReqValidationModeForTests(null)
+  })
+
   describe('projectListPage', function () {
     beforeEach(function (ctx) {
       ctx.projects = [
@@ -1319,4 +1327,110 @@ describe('ProjectListController', function () {
       await ctx.ProjectListController.projectListPage(ctx.req, ctx.res)
     })
   })
+
+  describe('getProjectsJson', function () {
+    beforeEach(function (ctx) {
+      ctx.projects = [
+        { _id: 1, lastUpdated: new Date(1), owner_ref: 'user-1' },
+        { _id: 2, lastUpdated: new Date(2), owner_ref: 'user-2' },
+      ]
+      ctx.allProjects = {
+        owned: ctx.projects,
+        readAndWrite: [],
+        readOnly: [],
+        tokenReadAndWrite: [],
+        tokenReadOnly: [],
+        review: [],
+      }
+      ctx.ProjectGetter.promises.findAllUsersProjects.resolves(ctx.allProjects)
+      ctx.next = sinon.stub()
+    })
+
+    it('should respond with the paginated/filtered/sorted projects', async function (ctx) {
+      ctx.req.body = {
+        filters: { ownedByUser: true },
+        sort: { by: 'lastUpdated', order: 'desc' },
+        page: { size: 20 },
+      }
+      await new Promise(resolve => {
+        ctx.res.json = data => {
+          expect(data.totalSize).to.equal(ctx.projects.length)
+          expect(data.projects).to.have.length(ctx.projects.length)
+          resolve()
+        }
+        ctx.ProjectListController.getProjectsJson(ctx.req, ctx.res, ctx.next)
+      })
+      sinon.assert.notCalled(ctx.next)
+    })
+
+    it('should work with only a sort and no filters/page', async function (ctx) {
+      ctx.req.body = { sort: { by: 'title', order: 'asc' } }
+      await new Promise(resolve => {
+        ctx.res.json = data => {
+          expect(data.totalSize).to.equal(ctx.projects.length)
+          resolve()
+        }
+        ctx.ProjectListController.getProjectsJson(ctx.req, ctx.res, ctx.next)
+      })
+    })
+
+    it('should not reject an unsupported sort.by value in log mode', async function (ctx) {
+      setReqValidationModeForTests('log')
+      ctx.req.body = { sort: { by: 'not-a-real-field', order: 'asc' } }
+      await ctx.ProjectListController.getProjectsJson(
+        ctx.req,
+        ctx.res,
+        ctx.next
+      )
+      sinon.assert.calledOnce(ctx.next)
+      const err = ctx.next.firstCall.args[0]
+      expect(err).to.not.be.instanceOf(InvalidRequestError)
+      expect(err.message).to.equal('Invalid sorting criteria')
+    })
+
+    it('should not reject an unknown filter key in log mode', async function (ctx) {
+      setReqValidationModeForTests('log')
+      ctx.req.body = { filters: { notARealFilter: true } }
+      await new Promise(resolve => {
+        ctx.res.json = data => {
+          expect(data.totalSize).to.equal(ctx.projects.length)
+          resolve()
+        }
+        ctx.ProjectListController.getProjectsJson(ctx.req, ctx.res, ctx.next)
+      })
+      sinon.assert.notCalled(ctx.next)
+    })
+
+    describe('request validation', function () {
+      beforeEach(function () {
+        setReqValidationModeForTests('enforce')
+      })
+
+      it('rejects an unsupported sort.by value', async function (ctx) {
+        ctx.req.body = { sort: { by: 'not-a-real-field', order: 'asc' } }
+        await ctx.ProjectListController.getProjectsJson(
+          ctx.req,
+          ctx.res,
+          ctx.next
+        )
+        sinon.assert.calledWith(
+          ctx.next,
+          sinon.match.instanceOf(InvalidRequestError)
+        )
+      })
+
+      it('rejects an unknown filter key', async function (ctx) {
+        ctx.req.body = { filters: { notARealFilter: true } }
+        await ctx.ProjectListController.getProjectsJson(
+          ctx.req,
+          ctx.res,
+          ctx.next
+        )
+        sinon.assert.calledWith(
+          ctx.next,
+          sinon.match.instanceOf(InvalidRequestError)
+        )
+      })
+    })
+  })
 })

services/web/test/unit/src/Tags/TagsController.test.mjs

@@ -1,12 +1,17 @@
-import { assert, beforeEach, describe, it, vi } from 'vitest'
+import { afterEach, assert, beforeEach, describe, it, vi } from 'vitest'
 import sinon from 'sinon'
-import { InvalidRequestError } from '@overleaf/validation-tools'
+import {
+  InvalidRequestError,
+  setReqValidationModeForTests,
+} from '@overleaf/validation-tools'
 
 const modulePath = '../../../../app/src/Features/Tags/TagsController.mjs'
 
 describe('TagsController', function () {
-  const userId = '123nd3ijdks'
-  const projectId = '123njdskj9jlk'
+  const userId = '507f191e810c19729de860ea'
+  const projectId = '507f191e810c19729de860eb'
+  const tagId = '507f191e810c19729de860ec'
+  const projectId2 = '507f191e810c19729de860ed'
 
   beforeEach(async function (ctx) {
     ctx.TagsHandler = {
@@ -40,9 +45,7 @@ describe('TagsController', function () {
 
     ctx.TagsController = (await import(modulePath)).default
     ctx.req = {
-      params: {
-        projectId,
-      },
+      params: {},
       session: {
         user: {
           _id: userId,
@@ -57,6 +60,10 @@ describe('TagsController', function () {
     ctx.res.json = sinon.stub()
   })
 
+  afterEach(function () {
+    setReqValidationModeForTests(null)
+  })
+
   it('get all tags', async function (ctx) {
     await new Promise(resolve => {
       const allTags = [{ name: 'tag', projects: ['123423', '423423'] }]
@@ -126,8 +133,8 @@ describe('TagsController', function () {
 
   it('delete a tag', async function (ctx) {
     await new Promise(resolve => {
-      ctx.req.params.tagId = ctx.tagId = 'tag-id-123'
-      ctx.req.session.user._id = ctx.userId = 'user-id-123'
+      ctx.req.params.tagId = ctx.tagId = tagId
+      ctx.req.session.user._id = ctx.userId = userId
       ctx.TagsController.deleteTag(ctx.req, {
         status: code => {
           assert.equal(code, 204)
@@ -145,10 +152,48 @@ describe('TagsController', function () {
     })
   })
 
+  describe('rename a tag', function () {
+    beforeEach(function (ctx) {
+      ctx.req.params.tagId = ctx.tagId = tagId
+      ctx.req.session.user._id = ctx.userId = userId
+    })
+
+    it('with a name', async function (ctx) {
+      await new Promise(resolve => {
+        ctx.req.body = {
+          name: (ctx.tagName = 'new-name'),
+        }
+        ctx.TagsController.renameTag(ctx.req, {
+          status: code => {
+            assert.equal(code, 204)
+            sinon.assert.calledWith(
+              ctx.TagsHandler.promises.renameTag,
+              ctx.userId,
+              ctx.tagId,
+              ctx.tagName
+            )
+            resolve()
+            return {
+              end: () => {},
+            }
+          },
+        })
+      })
+    })
+
+    it('with an empty name, even when the schema is in log-only mode', async function (ctx) {
+      setReqValidationModeForTests('log')
+      ctx.req.body = { name: '' }
+      await ctx.TagsController.renameTag(ctx.req, ctx.res)
+      sinon.assert.calledWith(ctx.res.status, 400)
+      sinon.assert.notCalled(ctx.TagsHandler.promises.renameTag)
+    })
+  })
+
   describe('edit a tag', function () {
     beforeEach(function (ctx) {
-      ctx.req.params.tagId = ctx.tagId = 'tag-id-123'
-      ctx.req.session.user._id = ctx.userId = 'user-id-123'
+      ctx.req.params.tagId = ctx.tagId = tagId
+      ctx.req.session.user._id = ctx.userId = userId
     })
 
     it('with a name and no color', async function (ctx) {
@@ -201,17 +246,25 @@ describe('TagsController', function () {
 
     it('without a name', function (ctx) {
       ctx.req.body = { name: undefined }
-      ctx.TagsController.renameTag(ctx.req, ctx.res).should.be.rejectedWith(
+      ctx.TagsController.editTag(ctx.req, ctx.res).should.be.rejectedWith(
         InvalidRequestError
       )
     })
+
+    it('with an empty name, even when the schema is in log-only mode', async function (ctx) {
+      setReqValidationModeForTests('log')
+      ctx.req.body = { name: '' }
+      await ctx.TagsController.editTag(ctx.req, ctx.res)
+      sinon.assert.calledWith(ctx.res.status, 400)
+      sinon.assert.notCalled(ctx.TagsHandler.promises.editTag)
+    })
   })
 
   it('add a project to a tag', async function (ctx) {
     await new Promise(resolve => {
-      ctx.req.params.tagId = ctx.tagId = 'tag-id-123'
-      ctx.req.params.projectId = ctx.projectId = 'project-id-123'
-      ctx.req.session.user._id = ctx.userId = 'user-id-123'
+      ctx.req.params.tagId = ctx.tagId = tagId
+      ctx.req.params.projectId = ctx.projectId = projectId
+      ctx.req.session.user._id = ctx.userId = userId
       ctx.TagsController.addProjectToTag(ctx.req, {
         status: code => {
           assert.equal(code, 204)
@@ -232,12 +285,9 @@ describe('TagsController', function () {
 
   it('add projects to a tag', async function (ctx) {
     await new Promise(resolve => {
-      ctx.req.params.tagId = ctx.tagId = 'tag-id-123'
-      ctx.req.body.projectIds = ctx.projectIds = [
-        'project-id-123',
-        'project-id-234',
-      ]
-      ctx.req.session.user._id = ctx.userId = 'user-id-123'
+      ctx.req.params.tagId = ctx.tagId = tagId
+      ctx.req.body.projectIds = ctx.projectIds = [projectId, projectId2]
+      ctx.req.session.user._id = ctx.userId = userId
       ctx.TagsController.addProjectsToTag(ctx.req, {
         status: code => {
           assert.equal(code, 204)
@@ -258,9 +308,9 @@ describe('TagsController', function () {
 
   it('remove a project from a tag', async function (ctx) {
     await new Promise(resolve => {
-      ctx.req.params.tagId = ctx.tagId = 'tag-id-123'
-      ctx.req.params.projectId = ctx.projectId = 'project-id-123'
-      ctx.req.session.user._id = ctx.userId = 'user-id-123'
+      ctx.req.params.tagId = ctx.tagId = tagId
+      ctx.req.params.projectId = ctx.projectId = projectId
+      ctx.req.session.user._id = ctx.userId = userId
       ctx.TagsController.removeProjectFromTag(ctx.req, {
         status: code => {
           assert.equal(code, 204)
@@ -281,12 +331,9 @@ describe('TagsController', function () {
 
   it('remove projects from a tag', async function (ctx) {
     await new Promise(resolve => {
-      ctx.req.params.tagId = ctx.tagId = 'tag-id-123'
-      ctx.req.body.projectIds = ctx.projectIds = [
-        'project-id-123',
-        'project-id-234',
-      ]
-      ctx.req.session.user._id = ctx.userId = 'user-id-123'
+      ctx.req.params.tagId = ctx.tagId = tagId
+      ctx.req.body.projectIds = ctx.projectIds = [projectId, projectId2]
+      ctx.req.session.user._id = ctx.userId = userId
       ctx.TagsController.removeProjectsFromTag(ctx.req, {
         status: code => {
           assert.equal(code, 204)

services/web/test/unit/src/Uploads/ProjectUploadController.test.mjs

@@ -5,11 +5,18 @@
  * DS206: Consider reworking classes to avoid initClass
  * Full docs: https://github.com/decaffeinate/decaffeinate/blob/master/docs/suggestions.md
  */
-import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import sinon from 'sinon'
+import Path from 'node:path'
 import MockRequest from '../helpers/MockRequest.mjs'
 import MockResponse from '../helpers/MockResponse.mjs'
 import ArchiveErrors from '../../../../app/src/Features/Uploads/ArchiveErrors.mjs'
+import {
+  InvalidParamsError,
+  InvalidRequestError,
+  setReqValidationModeForTests,
+} from '@overleaf/validation-tools'
+import { asZodError } from '@overleaf/validation-tools/testUtils.js'
 import {
   FileTooLargeError,
   DocumentConversionError,
@@ -23,6 +30,21 @@ vi.mock('../../../../app/src/Features/Errors/Errors.js', () =>
 const modulePath =
   '../../../../app/src/Features/Uploads/ProjectUploadController.mjs'
 
+// A minimal but schema-valid multer file object (zz.uploadedFile()), keyed
+// off the temp path used throughout these tests.
+function uploadedFile(path) {
+  return {
+    fieldname: 'qqfile',
+    originalname: Path.basename(path),
+    encoding: '7bit',
+    mimetype: 'application/octet-stream',
+    size: 1234,
+    destination: Path.dirname(path),
+    filename: Path.basename(path),
+    path,
+  }
+}
+
 describe('ProjectUploadController', function () {
   beforeEach(async function (ctx) {
     let Timer
@@ -142,13 +164,15 @@ describe('ProjectUploadController', function () {
     ctx.ProjectUploadController = (await import(modulePath)).default
   })
 
+  afterEach(function () {
+    setReqValidationModeForTests(null)
+  })
+
   describe('uploadProject', function () {
     beforeEach(function (ctx) {
       ctx.path = '/path/to/file/on/disk.zip'
       ctx.fileName = 'filename.zip'
-      ctx.req.file = {
-        path: ctx.path,
-      }
+      ctx.req.file = uploadedFile(ctx.path)
       ctx.req.body = {
         name: ctx.fileName,
       }
@@ -157,7 +181,7 @@ describe('ProjectUploadController', function () {
           _id: ctx.user_id,
         },
       }
-      ctx.project = { _id: (ctx.project_id = 'project-id-123') }
+      ctx.project = { _id: (ctx.project_id = '507f191e810c19729de860ea') }
 
       ctx.fs.unlink = sinon.stub()
       ctx.fsPromises.unlink = sinon.stub().resolves()
@@ -253,17 +277,80 @@ describe('ProjectUploadController', function () {
         ctx.fs.unlink.calledWith(ctx.path).should.equal(true)
       })
     })
+
+    describe('request validation', function () {
+      beforeEach(function () {
+        setReqValidationModeForTests('enforce')
+      })
+
+      it('rejects an unrecognized body field', function (ctx) {
+        ctx.req.body.extraField = 'nope'
+        expect(() =>
+          ctx.ProjectUploadController.uploadProject(ctx.req, ctx.res)
+        ).to.throw(InvalidRequestError)
+        expect(ctx.fs.unlink).not.to.have.been.called
+      })
+
+      it('accepts relativePath set to the literal "null" string', function (ctx) {
+        ctx.req.body.relativePath = 'null'
+        ctx.ProjectUploadManager.createProjectFromZipArchive = sinon
+          .stub()
+          .callsArgWith(3, null, ctx.project)
+        ctx.ProjectUploadController.uploadProject(ctx.req, ctx.res)
+        expect(ctx.res.body).to.deep.equal(
+          JSON.stringify({
+            success: true,
+            project_id: ctx.project_id,
+          })
+        )
+      })
+
+      it('accepts a nested relativePath', function (ctx) {
+        ctx.req.body.relativePath = 'folder/main.tex'
+        ctx.ProjectUploadManager.createProjectFromZipArchive = sinon
+          .stub()
+          .callsArgWith(3, null, ctx.project)
+        ctx.ProjectUploadController.uploadProject(ctx.req, ctx.res)
+        expect(ctx.res.body).to.deep.equal(
+          JSON.stringify({
+            success: true,
+            project_id: ctx.project_id,
+          })
+        )
+      })
+
+      it('rejects a relativePath that attempts path traversal', function (ctx) {
+        ctx.req.body.relativePath = '../../etc/passwd'
+        let error
+        try {
+          ctx.ProjectUploadController.uploadProject(ctx.req, ctx.res)
+        } catch (err) {
+          error = err
+        }
+        expect(
+          sinon
+            .match({
+              name: 'InvalidRequestError',
+              zodError: asZodError({
+                code: 'custom',
+                path: ['body', 'relativePath'],
+                message: 'path traversal detected',
+              }),
+            })
+            .test(error)
+        ).to.be.true
+        expect(ctx.fs.unlink).not.to.have.been.called
+      })
+    })
   })
 
   describe('uploadFile', function () {
     beforeEach(function (ctx) {
-      ctx.project_id = 'project-id-123'
-      ctx.folder_id = 'folder-id-123'
+      ctx.project_id = '507f191e810c19729de860ea'
+      ctx.folder_id = '507f191e810c19729de860eb'
       ctx.path = '/path/to/file/on/disk.png'
       ctx.fileName = 'filename.png'
-      ctx.req.file = {
-        path: ctx.path,
-      }
+      ctx.req.file = uploadedFile(ctx.path)
       ctx.req.body = {
         name: ctx.fileName,
       }
@@ -480,13 +567,25 @@ describe('ProjectUploadController', function () {
         ctx.fsPromises.unlink.calledWith(ctx.path).should.equal(true)
       })
     })
+
+    describe('request validation', function () {
+      beforeEach(function () {
+        setReqValidationModeForTests('enforce')
+      })
+
+      it('rejects a malformed Project_id param', async function (ctx) {
+        ctx.req.params.Project_id = 'not-an-object-id'
+        await expect(
+          ctx.ProjectUploadController.uploadFile(ctx.req, ctx.res)
+        ).to.be.rejectedWith(InvalidParamsError)
+        expect(ctx.fsPromises.unlink).not.to.have.been.called
+      })
+    })
   })
 
   describe('importDocument', function () {
     beforeEach(async function (ctx) {
-      ctx.req.file = {
-        path: '/path/to/uploaded/file.docx',
-      }
+      ctx.req.file = uploadedFile('/path/to/uploaded/file.docx')
       ctx.req.body = {
         name: 'file.docx',
       }
@@ -563,9 +662,7 @@ describe('ProjectUploadController', function () {
 
     describe('with conversionType=markdown', async function () {
       beforeEach(async function (ctx) {
-        ctx.req.file = {
-          path: '/path/to/uploaded/file.md',
-        }
+        ctx.req.file = uploadedFile('/path/to/uploaded/file.md')
         ctx.req.body = {
           name: 'file.md',
         }
@@ -775,6 +872,23 @@ describe('ProjectUploadController', function () {
         expect(ctx.fsPromises.unlink).to.have.been.calledWith(ctx.req.file.path)
       })
     })
+
+    describe('request validation', function () {
+      beforeEach(function () {
+        setReqValidationModeForTests('enforce')
+      })
+
+      it('rejects an unrecognized body field', async function (ctx) {
+        ctx.req.body.extraField = 'nope'
+        await expect(
+          ctx.ProjectUploadController.importDocument(ctx.req, ctx.res)
+        ).to.be.rejectedWith(InvalidRequestError)
+        expect(
+          ctx.DocumentConversionManager.promises
+            .convertDocumentToLaTeXZipArchive
+        ).not.to.have.been.called
+      })
+    })
   })
 
   describe('multerMiddleware', function () {