test/cli: content blocking tests for CARs

test/cli/content_blocking_test.go

@@ -12,7 +12,9 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/ipfs/go-cid"
 	"github.com/ipfs/kubo/test/cli/harness"
+	cbs "github.com/ipld/go-car/v2/blockstore"
 	"github.com/libp2p/go-libp2p"
 	"github.com/libp2p/go-libp2p/core/peer"
 	libp2phttp "github.com/libp2p/go-libp2p/p2p/http"
@@ -36,6 +38,7 @@ func TestContentBlocking(t *testing.T) {
 	// Create CIDs we use in test
 	h.WriteFile("blocked-dir/subdir/indirectly-blocked-file.txt", "indirectly blocked file content")
 	parentDirCID := node.IPFS("add", "--raw-leaves", "-Q", "-r", filepath.Join(h.Dir, "blocked-dir")).Stdout.Trimmed()
+	blockedCIDInParentDirCID := node.IPFS("add", "--raw-leaves", "-Q", "-r", filepath.Join(h.Dir, "blocked-dir", "subdir")).Stdout.Trimmed()
 
 	h.WriteFile("directly-blocked-file.txt", "directly blocked file content")
 	blockedCID := node.IPFS("add", "--raw-leaves", "-Q", filepath.Join(h.Dir, "directly-blocked-file.txt")).Stdout.Trimmed()
@@ -98,6 +101,28 @@ func TestContentBlocking(t *testing.T) {
 		assert.Equal(t, http.StatusOK, resp.StatusCode)
 	})
 
+	// Does the gateway deny indirectly blocked CID?
+	t.Run("Gateway Denies indirectly blocked CID", func(t *testing.T) {
+		t.Parallel()
+		resp := client.Get("/ipfs/" + blockedCIDInParentDirCID)
+		assert.Equal(t, http.StatusGone, resp.StatusCode, statusExpl)
+		assert.NotEqual(t, "directly blocked file content", resp.Body)
+		assert.Contains(t, resp.Body, blockedMsg, bodyExpl)
+	})
+
+	// Does the gateway return CAR
+	t.Run("Gateway returns parent path CAR without blocked CID", func(t *testing.T) {
+		resp := client.Get("/ipfs/" + parentDirCID + "?format=car")
+		require.Equal(t, http.StatusOK, resp.StatusCode)
+
+		bs, err := cbs.NewReadOnly(strings.NewReader(resp.Body), nil)
+		require.NoError(t, err)
+
+		has, err := bs.Has(context.Background(), cid.MustParse(blockedCIDInParentDirCID))
+		require.NoError(t, err)
+		require.False(t, has)
+	})
+
 	// Ok, now the full list of test cases we want to cover in both CLI and Gateway
 	testCases := []struct {
 		name string
@@ -168,18 +193,18 @@ func TestContentBlocking(t *testing.T) {
 			})
 		}
 
-		// Confirm that denylist is active for every content path in 'testCases'
-		gwTestName := fmt.Sprintf("Gateway denies %s", testCase.name)
-		t.Run(gwTestName, func(t *testing.T) {
-			resp := client.Get(testCase.path)
-			assert.Equal(t, http.StatusGone, resp.StatusCode, statusExpl)
-			assert.Contains(t, resp.Body, blockedMsg, bodyExpl)
-		})
-
+		for _, format := range []string{"", "raw", "car"} { // CARs should also fail immediately since we access the file directly.
+			// Confirm that denylist is active for every content path in 'testCases' with different formats
+			gwTestName := fmt.Sprintf("Gateway denies %s with format %s", testCase.name, format)
+			t.Run(gwTestName, func(t *testing.T) {
+				resp := client.Get(testCase.path + "?format=" + format)
+				assert.Equal(t, http.StatusGone, resp.StatusCode, statusExpl)
+				assert.Contains(t, resp.Body, blockedMsg, bodyExpl)
+			})
+		}
 	}
 
 	// Extra edge cases on subdomain gateway
-
 	t.Run("Gateway Denies /ipns Path that is blocked by DNSLink name (subdomain redirect)", func(t *testing.T) {
 		t.Parallel()
 
@@ -299,5 +324,17 @@ func TestContentBlocking(t *testing.T) {
 			assert.NotEqual(t, string(body), "directly blocked file content")
 			assert.Contains(t, string(body), blockedMsg, bodyExpl)
 		})
+
+		t.Run("Denies Blocked CID (CAR)", func(t *testing.T) {
+			t.Parallel()
+			resp, err := libp2pClient.Get(fmt.Sprintf("/ipfs/%s?format=car", blockedCID))
+			require.NoError(t, err)
+			defer resp.Body.Close()
+			assert.Equal(t, http.StatusGone, resp.StatusCode, statusExpl)
+			body, err := io.ReadAll(resp.Body)
+			require.NoError(t, err)
+			assert.NotEqual(t, string(body), "directly blocked file content")
+			assert.Contains(t, string(body), blockedMsg, bodyExpl)
+		})
 	})
 }