fix(security): harden auth and outbound fetches

tests/unit/doc-engine/pandoc.test.ts

@@ -2,7 +2,7 @@ import { readFileSync } from "node:fs";
 import { mkdtemp, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { pandocAvailable, runPandoc } from "@snapotter/doc-engine";
+import { buildPandocArgs, pandocAvailable, runPandoc } from "@snapotter/doc-engine";
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 
 describe("pandocAvailable", () => {
@@ -11,6 +11,27 @@ describe("pandocAvailable", () => {
   });
 });
 
+describe("buildPandocArgs", () => {
+  it("runs conversions inside the pandoc sandbox", () => {
+    expect(buildPandocArgs("input.md", "out.docx")).toEqual([
+      "--sandbox",
+      "input.md",
+      "-o",
+      "out.docx",
+    ]);
+  });
+
+  it("keeps extra args after the sandboxed input/output args", () => {
+    expect(buildPandocArgs("input.md", "out.html", { extraArgs: ["--standalone"] })).toEqual([
+      "--sandbox",
+      "input.md",
+      "-o",
+      "out.html",
+      "--standalone",
+    ]);
+  });
+});
+
 describe.skipIf(!pandocAvailable())("runPandoc (requires pandoc)", () => {
   let tmpDir: string;