feat: integrate XSLT Tools with toolbox portal

tests/releasePackaging.test.ts

@@ -0,0 +1,125 @@
+import { execFileSync } from 'node:child_process';
+import {
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync,
+} from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { describe, expect, it } from 'vitest';
+import {
+  collectRuntimeDependencyLicenseEntries,
+  createDeterministicZip,
+  listFiles,
+  writeReleaseFiles,
+} from '../scripts/package-release.mjs';
+
+describe('release packaging', () => {
+  it('creates byte-for-byte deterministic ZIP files', () => {
+    const entries = [
+      { name: 'index.html', data: Buffer.from('<h1>XSLT tools</h1>') },
+      { name: 'toolbox-app.json', data: Buffer.from('{"schemaVersion":1}') },
+    ];
+
+    expect(createDeterministicZip(entries)).toEqual(
+      createDeterministicZip(entries)
+    );
+  });
+
+  it('creates the same archive in different host time zones', () => {
+    const moduleUrl = pathToFileURL(
+      join(process.cwd(), 'scripts/package-release.mjs')
+    ).href;
+    const program = `
+      import { createDeterministicZip } from ${JSON.stringify(moduleUrl)};
+      const archive = createDeterministicZip([
+        { name: 'index.html', data: Buffer.from('timezone invariant') }
+      ]);
+      process.stdout.write(archive.toString('base64'));
+    `;
+    const createInTimezone = (timezone: string) =>
+      execFileSync(
+        process.execPath,
+        ['--input-type=module', '--eval', program],
+        {
+          encoding: 'utf8',
+          env: { ...process.env, TZ: timezone },
+        }
+      );
+
+    expect(createInTimezone('UTC')).toBe(createInTimezone('Pacific/Honolulu'));
+  });
+
+  it('includes legal files for production dependencies but not test tooling', () => {
+    const names = collectRuntimeDependencyLicenseEntries().map(
+      (entry) => entry.name
+    );
+
+    expect(
+      names.some((name) =>
+        /^LICENSES\/npm\/add-ideas--toolbox-contract-[^/]+\/LICENSE$/.test(name)
+      )
+    ).toBe(true);
+    expect(
+      names.some((name) =>
+        /^LICENSES\/npm\/add-ideas--toolbox-shell-react-[^/]+\/LICENSE$/.test(
+          name
+        )
+      )
+    ).toBe(true);
+    expect(names.some((name) => /\/react-[^/]+\/LICENSE$/.test(name))).toBe(
+      true
+    );
+    expect(names.some((name) => name.includes('toolbox-testkit'))).toBe(false);
+  });
+
+  it('refuses same-version overwrites unless force is explicit', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'xslt-release-test-'));
+    const archiveTarget = join(directory, 'xslt-tools.zip');
+    const checksumTarget = join(directory, 'xslt-tools.sha256');
+    writeFileSync(archiveTarget, 'existing archive');
+    writeFileSync(checksumTarget, 'existing checksum');
+
+    try {
+      expect(() =>
+        writeReleaseFiles({
+          archive: Buffer.from('new archive'),
+          archiveTarget,
+          checksum: 'new checksum',
+          checksumTarget,
+        })
+      ).toThrow(/Refusing to overwrite/);
+      expect(readFileSync(archiveTarget, 'utf8')).toBe('existing archive');
+      expect(readFileSync(checksumTarget, 'utf8')).toBe('existing checksum');
+
+      writeReleaseFiles({
+        archive: Buffer.from('new archive'),
+        archiveTarget,
+        checksum: 'new checksum',
+        checksumTarget,
+        force: true,
+      });
+      expect(readFileSync(archiveTarget, 'utf8')).toBe('new archive');
+      expect(readFileSync(checksumTarget, 'utf8')).toBe('new checksum');
+    } finally {
+      rmSync(directory, { recursive: true, force: true });
+    }
+  });
+
+  it('rejects symlinks instead of following them into an archive', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'xslt-release-tree-test-'));
+    const target = join(directory, 'target.txt');
+    const link = join(directory, 'linked.txt');
+    writeFileSync(target, 'must not be followed through a link');
+    symlinkSync(target, link);
+
+    try {
+      expect(() => listFiles(directory)).toThrow(/symlink or special/i);
+    } finally {
+      rmSync(directory, { recursive: true, force: true });
+    }
+  });
+});

tests/stylesheetTrustUi.test.tsx

@@ -0,0 +1,51 @@
+import { cleanup, fireEvent, render, screen } from '@testing-library/react';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import Toolbar from '../src/components/Toolbar';
+
+afterEach(cleanup);
+
+describe('stylesheet trust UI gate', () => {
+  it.each(['saxon-js-dynamic', 'native-xsltprocessor'] as const)(
+    'keeps the %s engine disabled until the exact stylesheet is trusted',
+    (selectedEngine) => {
+      const applyTransformation = vi.fn();
+      const trustStylesheet = vi.fn();
+      const props = {
+        selectedEngine,
+        onEngineChange: vi.fn(),
+        onApplyTransformation: applyTransformation,
+        onTrustStylesheet: trustStylesheet,
+        onMoveOutputToInput: vi.fn(),
+        onValidate: vi.fn(),
+        onReset: vi.fn(),
+        prettifyOutputAfterTransform: true,
+        onPrettifyOutputAfterTransformChange: vi.fn(),
+        askBeforeOverwritingOutput: true,
+        onAskBeforeOverwritingOutputChange: vi.fn(),
+        stylesheetTrusted: false,
+      };
+      const { rerender } = render(<Toolbar {...props} />);
+
+      const applyButton = screen.getByRole('button', {
+        name: 'Apply transformation',
+      }) as HTMLButtonElement;
+      expect(applyButton.disabled).toBe(true);
+      fireEvent.click(applyButton);
+      expect(applyTransformation).not.toHaveBeenCalled();
+
+      fireEvent.click(
+        screen.getByRole('button', { name: 'Review & trust stylesheet' })
+      );
+      expect(trustStylesheet).toHaveBeenCalledOnce();
+
+      rerender(<Toolbar {...props} stylesheetTrusted />);
+      expect(
+        (
+          screen.getByRole('button', {
+            name: 'Apply transformation',
+          }) as HTMLButtonElement
+        ).disabled
+      ).toBe(false);
+    }
+  );
+});

tests/toolboxIntegration.test.tsx

@@ -0,0 +1,143 @@
+import { cleanup, render, screen, waitFor } from '@testing-library/react';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { AppShell } from '@add-ideas/toolbox-shell-react';
+import type {
+  ToolboxAppManifest,
+  ToolboxCatalog,
+} from '@add-ideas/toolbox-contract';
+import { toolboxApp } from '../src/toolboxApp';
+
+afterEach(cleanup);
+
+const pdfApp: ToolboxAppManifest = {
+  ...toolboxApp,
+  id: 'de.add-ideas.pdf-tools',
+  name: 'PDF Workbench',
+  version: '0.3.4',
+  description: 'Local PDF page operations in your browser.',
+  categories: ['documents', 'pdf'],
+  tags: ['merge', 'split', 'rotate', 'reorder'],
+  requirements: {
+    ...toolboxApp.requirements,
+    workers: true,
+    indexedDb: true,
+  },
+};
+
+const catalog: ToolboxCatalog = {
+  schemaVersion: 1,
+  id: 'integration-test',
+  name: 'Integration test toolbox',
+  home: './',
+  theme: {
+    mode: 'system',
+    brand: 'Test Toolbox',
+  },
+  apps: [
+    {
+      manifest: './apps/xslt/toolbox-app.json',
+      enabled: true,
+    },
+    {
+      manifest: './apps/pdf/toolbox-app.json',
+      enabled: true,
+    },
+  ],
+};
+
+describe('toolbox shell integration', () => {
+  it('keeps the app usable standalone with its XSLT Help action', () => {
+    render(
+      <AppShell
+        app={toolboxApp}
+        contextOptions={{ location: 'https://example.test/deep/nested/app/' }}
+        appActions={<button type="button">Help</button>}
+      >
+        <p>XSLT workbench</p>
+      </AppShell>
+    );
+
+    expect(screen.getByText('XSLT workbench')).toBeTruthy();
+    expect(screen.getByRole('button', { name: 'Help' })).toBeTruthy();
+    expect(
+      screen.getByRole('link', { name: 'Source' }).getAttribute('href')
+    ).toBe('https://git.add-ideas.de/zemion/xslt-tools/src/tag/v0.3.2');
+    expect(
+      screen.queryByRole('navigation', { name: 'Toolbox applications' })
+    ).toBeNull();
+  });
+
+  it('loads a same-origin catalogue and carries context through switcher links', async () => {
+    const location =
+      'https://example.test/deep/nested/app/?toolbox=/toolbox.catalog.json';
+    const fetch = vi.fn(createCatalogFetch());
+    const { container } = render(
+      <AppShell
+        app={toolboxApp}
+        manifestUrl="https://example.test/deep/nested/app/toolbox-app.json"
+        contextOptions={{ location, fetch }}
+      >
+        <p>XSLT workbench</p>
+      </AppShell>
+    );
+
+    const navigation = await screen.findByRole('navigation', {
+      name: 'Toolbox applications',
+    });
+    expect(navigation).toBeTruthy();
+    expect(
+      container.firstElementChild?.getAttribute('data-toolbox-context')
+    ).toBe('connected');
+    expect(
+      screen.getByRole('link', { name: 'Test Toolbox' }).getAttribute('href')
+    ).toBe('https://example.test/');
+
+    const pdfLink = screen.getByRole('link', { name: 'PDF Workbench' });
+    const pdfUrl = new URL(pdfLink.getAttribute('href') ?? '');
+    expect(pdfUrl.pathname).toBe('/apps/pdf/');
+    expect(pdfUrl.searchParams.get('toolbox')).toBe(
+      'https://example.test/toolbox.catalog.json'
+    );
+    expect(fetch).toHaveBeenCalledTimes(3);
+
+    await waitFor(() => {
+      expect(
+        screen
+          .getByRole('link', { name: 'XSLT tools' })
+          .getAttribute('aria-current')
+      ).toBe('page');
+    });
+  });
+});
+
+function createCatalogFetch() {
+  return async (input: string | URL | Request): Promise<Response> => {
+    const url = new URL(
+      typeof input === 'string'
+        ? input
+        : input instanceof URL
+          ? input.href
+          : input.url
+    );
+    const documents = new Map<string, unknown>([
+      ['/toolbox.catalog.json', catalog],
+      ['/apps/xslt/toolbox-app.json', toolboxApp],
+      ['/apps/pdf/toolbox-app.json', pdfApp],
+    ]);
+    const document = documents.get(url.pathname);
+
+    if (document === undefined) {
+      return {
+        ok: false,
+        status: 404,
+        json: async () => ({}),
+      } as Response;
+    }
+
+    return {
+      ok: true,
+      status: 200,
+      json: async () => document,
+    } as Response;
+  };
+}

tests/transformEngines.test.ts

@@ -6,7 +6,12 @@ import {
   availableTransformEngines,
   runTransformation,
 } from '../src/transform/transformService';
-import { compileXsltTextToSefJson } from '../src/transform/saxonJsDynamicCompiler';
+import { createSha256Hash } from '../src/transform/hash';
+import type { TransformRequest } from '../src/transform/transformTypes';
+import {
+  compileXsltTextToSefJson,
+  resolveSaxonScriptUrl,
+} from '../src/transform/saxonJsDynamicCompiler';
 
 const xmlText = `<?xml version="1.0" encoding="UTF-8"?>
 <library>
@@ -36,6 +41,17 @@ const xslt30Text = `<xsl:stylesheet version="3.0" xmlns:xsl="http://www.w3.org/1
   </xsl:template>
 </xsl:stylesheet>`;
 
+async function runTrustedTransformation(request: TransformRequest) {
+  const revision = 1;
+  return runTransformation(request, {
+    trustedStylesheet: {
+      hash: await createSha256Hash(request.xsltText),
+      revision,
+    },
+    currentRevision: revision,
+  });
+}
+
 beforeAll(() => {
   if (window.SaxonJS) return;
 
@@ -59,6 +75,12 @@ describe('transform engine registry', () => {
 });
 
 describe('SaxonJS dynamic compiler', () => {
+  it('resolves the vendored runtime relative to a nested app deployment', () => {
+    expect(
+      resolveSaxonScriptUrl('./', 'https://example.test/deep/nested/app/')
+    ).toBe('https://example.test/deep/nested/app/vendor/saxon/SaxonJS2.js');
+  });
+
   it('compiles raw XSLT text to SEF JSON', async () => {
     const sef = await compileXsltTextToSefJson(xslt30Text);
     const parsed = JSON.parse(sef) as { N?: string; target?: string };
@@ -68,7 +90,7 @@ describe('SaxonJS dynamic compiler', () => {
   });
 
   it('runs an XSLT 1.0 stylesheet', async () => {
-    const result = await runTransformation({
+    const result = await runTrustedTransformation({
       xmlText,
       xsltText: xslt10Text,
       engine: 'saxon-js-dynamic',
@@ -82,7 +104,7 @@ describe('SaxonJS dynamic compiler', () => {
   });
 
   it('runs an XSLT 2.0 stylesheet with XPath 2.0 functions', async () => {
-    const result = await runTransformation({
+    const result = await runTrustedTransformation({
       xmlText,
       xsltText: xslt20Text,
       engine: 'saxon-js-dynamic',
@@ -95,7 +117,7 @@ describe('SaxonJS dynamic compiler', () => {
   });
 
   it('runs an XSLT 3.0 stylesheet with xsl:mode on-no-match', async () => {
-    const result = await runTransformation({
+    const result = await runTrustedTransformation({
       xmlText,
       xsltText: xslt30Text,
       engine: 'saxon-js-dynamic',
@@ -109,7 +131,7 @@ describe('SaxonJS dynamic compiler', () => {
   });
 
   it('returns diagnostics for invalid XSLT', async () => {
-    const result = await runTransformation({
+    const result = await runTrustedTransformation({
       xmlText,
       xsltText: '<xsl:stylesheet version="3.0">',
       engine: 'saxon-js-dynamic',

tests/transformationSecurity.test.ts

@@ -0,0 +1,80 @@
+import { describe, expect, it, vi } from 'vitest';
+import { isStylesheetExecutionTrusted } from '../src/transform/stylesheetTrust';
+import { runTransformation } from '../src/transform/transformService';
+import {
+  TRANSFORM_LIMITS,
+  assertTransformInputWithinLimits,
+  assertTransformOutputWithinLimits,
+  withTransformationTimeout,
+} from '../src/transform/transformLimits';
+
+describe('stylesheet execution trust', () => {
+  it('requires both the exact SHA-256 and the current edit revision', () => {
+    const trust = { hash: 'sha256-a', revision: 4 };
+    expect(isStylesheetExecutionTrusted(trust, 'sha256-a', 4)).toBe(true);
+    expect(isStylesheetExecutionTrusted(trust, 'sha256-b', 4)).toBe(false);
+    expect(isStylesheetExecutionTrusted(trust, 'sha256-a', 5)).toBe(false);
+    expect(isStylesheetExecutionTrusted(null, 'sha256-a', 4)).toBe(false);
+  });
+
+  it.each(['saxon-js-dynamic', 'native-xsltprocessor'] as const)(
+    'refuses the %s service path when authorization does not match',
+    async (engine) => {
+      await expect(
+        runTransformation(
+          {
+            engine,
+            xmlText: '<root/>',
+            xsltText: '<xsl:stylesheet/>',
+          },
+          {
+            trustedStylesheet: { hash: 'not-the-stylesheet-hash', revision: 7 },
+            currentRevision: 7,
+          }
+        )
+      ).rejects.toThrow(/review and trust this exact stylesheet/i);
+    }
+  );
+});
+
+describe('transformation resource limits', () => {
+  it('rejects oversized XML, XSLT, and result strings', () => {
+    expect(() =>
+      assertTransformInputWithinLimits({
+        engine: 'native-xsltprocessor',
+        xmlText: 'x'.repeat(TRANSFORM_LIMITS.maxXmlBytes + 1),
+        xsltText: '<xsl:stylesheet/>',
+      })
+    ).toThrow(/XML input exceeds/i);
+    expect(() =>
+      assertTransformInputWithinLimits({
+        engine: 'saxon-js-dynamic',
+        xmlText: '<root/>',
+        xsltText: 'x'.repeat(TRANSFORM_LIMITS.maxXsltBytes + 1),
+      })
+    ).toThrow(/stylesheet exceeds/i);
+    expect(() =>
+      assertTransformOutputWithinLimits({
+        engine: 'saxon-js-dynamic',
+        output: 'x'.repeat(TRANSFORM_LIMITS.maxOutputBytes + 1),
+        diagnostics: [],
+        transformedAt: '2026-01-01T00:00:00.000Z',
+      })
+    ).toThrow(/output exceeds/i);
+  });
+
+  it('rejects an asynchronous execution that exceeds its deadline', async () => {
+    vi.useFakeTimers();
+    try {
+      const result = withTransformationTimeout(
+        () => new Promise<never>(() => undefined),
+        25
+      );
+      const rejection = expect(result).rejects.toThrow(/25-millisecond/i);
+      await vi.advanceTimersByTimeAsync(25);
+      await rejection;
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+});