Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Hermes
|
99bb3f6db8 |
@@ -379,235 +379,11 @@ describe('CaddyUpstreamWatcher', () => {
|
||||
fsState.exists[STATE] = true;
|
||||
// And the matching site file
|
||||
seedSites({ 'old.sami': 'old.sami { reverse_proxy 99.99.99.99:80 }\n' });
|
||||
|
||||
process.env.CADDY_UPSTREAMS_STATE_FILE = STATE;
|
||||
process.env.CADDY_SITES_DIR = SITES;
|
||||
const mod = require('../src/monitoring/caddy-upstream-watcher');
|
||||
const w = mod.CaddyUpstreamWatcher ? new mod.CaddyUpstreamWatcher() : mod;
|
||||
expect(w.isMuted('99.99.99.99:80')).toBe(true);
|
||||
});
|
||||
|
||||
// ---- Loopback → host-gateway remap (live bug 2026-08-18) -----------------
|
||||
// The watcher runs inside the container; Caddyfile `localhost:PORT` means
|
||||
// the HOST's loopback. Probing the container's own loopback gave 278
|
||||
// phantom failures per healthy host-side upstream.
|
||||
|
||||
test('loopback upstream probe is remapped to host.docker.internal (not container loopback)', async () => {
|
||||
seedSites({ 'zap.sami': 'zap.sami { reverse_proxy localhost:8088 }\n' });
|
||||
probeQueue.push({ kind: 'ok', statusCode: 200 });
|
||||
const { w } = loadWatcher();
|
||||
await w.scanSites();
|
||||
const u = w.upstreams.get('localhost:8088');
|
||||
expect(u).toBeTruthy();
|
||||
const http = require('http');
|
||||
await w._probeOne(u);
|
||||
// The probe request must have gone to host.docker.internal, keeping the port.
|
||||
const call = http.request.mock.calls.find(c => c[0].hostname === 'host.docker.internal');
|
||||
expect(call).toBeTruthy();
|
||||
expect(call[0].port).toBe('8088');
|
||||
// Display key is unchanged.
|
||||
expect(w.snapshot().upstreams[0].host).toBe('localhost:8088');
|
||||
expect(w.snapshot().upstreams[0].status).toBe('up');
|
||||
});
|
||||
|
||||
test('127.0.0.1 and 127.x addresses are also remapped', async () => {
|
||||
seedSites({
|
||||
'a.sami': 'a.sami { reverse_proxy 127.0.0.1:8765 }\n',
|
||||
'b.sami': 'b.sami { reverse_proxy 127.0.0.53:9000 }\n'
|
||||
});
|
||||
probeQueue.push({ kind: 'ok', statusCode: 200 });
|
||||
probeQueue.push({ kind: 'ok', statusCode: 200 });
|
||||
const { w } = loadWatcher();
|
||||
await w.scanSites();
|
||||
const http = require('http');
|
||||
for (const u of w.upstreams.values()) await w._probeOne(u);
|
||||
const hostnames = http.request.mock.calls.map(c => c[0].hostname);
|
||||
expect(hostnames).toEqual(['host.docker.internal', 'host.docker.internal']);
|
||||
});
|
||||
|
||||
test('non-loopback upstreams are probed at their literal address (no remap)', async () => {
|
||||
seedSites({ 'arch.sami': 'arch.sami { reverse_proxy 100.120.159.34:5000 }\n' });
|
||||
probeQueue.push({ kind: 'ok', statusCode: 200 });
|
||||
const { w } = loadWatcher();
|
||||
await w.scanSites();
|
||||
const http = require('http');
|
||||
await w._probeOne(w.upstreams.get('100.120.159.34:5000'));
|
||||
const hostnames = http.request.mock.calls.map(c => c[0].hostname);
|
||||
expect(hostnames).toEqual(['100.120.159.34']);
|
||||
});
|
||||
|
||||
test('failed host-gateway probe marks loopback upstream unverifiable — no failures, no incident', async () => {
|
||||
// Services bound to 127.0.0.1 on the host refuse bridge-IP connections;
|
||||
// from inside the container that is indistinguishable from "dead", and
|
||||
// Caddy (on the host) still routes fine — so it must NOT count as down.
|
||||
seedSites({ 'zap.sami': 'zap.sami { reverse_proxy localhost:8088 }\n' });
|
||||
probeQueue.push({ kind: 'err', message: 'connect ECONNREFUSED 172.17.0.1:8088' });
|
||||
const { w } = loadWatcher();
|
||||
const fakeHealthChecker = { createIncident: jest.fn(), resolveIncident: jest.fn(), incidents: [] };
|
||||
w.healthChecker = fakeHealthChecker;
|
||||
await w.scanSites();
|
||||
const u = w.upstreams.get('localhost:8088');
|
||||
u.lastSuccessAt = new Date(Date.now() - 10 * 60 * 1000).toISOString(); // long "failing" history
|
||||
await w._probeOne(u);
|
||||
const snap = w.snapshot().upstreams[0];
|
||||
expect(snap.status).toBe('unverifiable');
|
||||
expect(snap.consecutiveFailures).toBe(0);
|
||||
expect(snap.dead).toBe(false);
|
||||
expect(snap.failingForMs).toBe(0);
|
||||
expect(snap.lastError).toMatch(/not verifiable from container/);
|
||||
expect(fakeHealthChecker.createIncident).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
test('unverifiable sorts between muted and up in the snapshot', async () => {
|
||||
seedSites({
|
||||
'a.sami': 'a.sami { reverse_proxy 1.1.1.1:80 }\n',
|
||||
'b.sami': 'b.sami { reverse_proxy localhost:9876 }\n',
|
||||
'c.sami': 'c.sami { reverse_proxy 2.2.2.2:80 }\n'
|
||||
});
|
||||
const { w } = loadWatcher();
|
||||
await w.scanSites();
|
||||
const all = Array.from(w.upstreams.values());
|
||||
all.find(u => u.host === '1.1.1.1:80').status = 'up';
|
||||
all.find(u => u.host === 'localhost:9876').status = 'unverifiable';
|
||||
w.muted.add('2.2.2.2:80');
|
||||
const order = w.snapshot().upstreams.map(u => u.host);
|
||||
expect(order).toEqual(['2.2.2.2:80', 'localhost:9876', '1.1.1.1:80']);
|
||||
});
|
||||
|
||||
// ---- verifiedViaBridge (DC-053 follow-up item 2b-a) ----------------------
|
||||
// A loopback upstream whose PRIOR probe succeeded via host-gateway proves
|
||||
// the bridge CAN reach the host. If a later probe then fails, that is
|
||||
// near-conclusive evidence the upstream itself went dead — not that
|
||||
// bridge connectivity broke. Restore dead-detection for that subset.
|
||||
|
||||
test('successful host-gateway probe sets verifiedViaBridge=true on loopback upstream', async () => {
|
||||
seedSites({ 'zap.sami': 'zap.sami { reverse_proxy localhost:8088 }\n' });
|
||||
probeQueue.push({ kind: 'ok', statusCode: 200 });
|
||||
const { w } = loadWatcher();
|
||||
await w.scanSites();
|
||||
const u = w.upstreams.get('localhost:8088');
|
||||
expect(u.verifiedViaBridge).toBeFalsy();
|
||||
await w._probeOne(u);
|
||||
expect(u.verifiedViaBridge).toBe(true);
|
||||
expect(u.status).toBe('up');
|
||||
expect(w.snapshot().upstreams[0].verifiedViaBridge).toBe(true);
|
||||
});
|
||||
|
||||
test('loopback upstream with verifiedViaBridge fails -> counts as down (not unverifiable)', async () => {
|
||||
seedSites({ 'zap.sami': 'zap.sami { reverse_proxy localhost:8088 }\n' });
|
||||
// First probe succeeds (sets verifiedViaBridge), second probe fails.
|
||||
probeQueue.push({ kind: 'ok', statusCode: 200 });
|
||||
probeQueue.push({ kind: 'err', message: 'connect ECONNREFUSED 172.17.0.1:8088' });
|
||||
const { w } = loadWatcher();
|
||||
const fakeHealthChecker = { createIncident: jest.fn(), resolveIncident: jest.fn(), incidents: [] };
|
||||
w.healthChecker = fakeHealthChecker;
|
||||
await w.scanSites();
|
||||
const u = w.upstreams.get('localhost:8088');
|
||||
await w._probeOne(u);
|
||||
expect(u.verifiedViaBridge).toBe(true);
|
||||
expect(u.status).toBe('up');
|
||||
await w._probeOne(u);
|
||||
expect(u.status).toBe('down');
|
||||
expect(u.consecutiveFailures).toBe(1);
|
||||
expect(u.lastError).toMatch(/ECONNREFUSED/);
|
||||
// Snapshot also reflects verifiedViaBridge so dashboard can label it.
|
||||
const snap = w.snapshot().upstreams[0];
|
||||
expect(snap.verifiedViaBridge).toBe(true);
|
||||
// No incident yet — needs DEAD_AFTER_MS of continuous failure.
|
||||
expect(fakeHealthChecker.createIncident).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
test('loopback upstream with verifiedViaBridge eventually opens a dead incident', async () => {
|
||||
seedSites({ 'zap.sami': 'zap.sami { reverse_proxy localhost:8088 }\n' });
|
||||
probeQueue.push({ kind: 'ok', statusCode: 200 }); // probe 1: success -> verifiedViaBridge
|
||||
probeQueue.push({ kind: 'err', message: 'down' });
|
||||
const { w } = loadWatcher();
|
||||
const fakeHealthChecker = { createIncident: jest.fn(), resolveIncident: jest.fn(), incidents: [] };
|
||||
w.healthChecker = fakeHealthChecker;
|
||||
await w.scanSites();
|
||||
const u = w.upstreams.get('localhost:8088');
|
||||
await w._probeOne(u);
|
||||
// Pre-set lastSuccessAt to DEAD_AFTER_MS ago so the second failure
|
||||
// immediately crosses the 5-minute threshold.
|
||||
u.lastSuccessAt = new Date(Date.now() - 6 * 60 * 1000).toISOString();
|
||||
await w._probeOne(u);
|
||||
expect(fakeHealthChecker.createIncident).toHaveBeenCalledWith(
|
||||
'localhost:8088',
|
||||
'caddy-upstream-dead',
|
||||
expect.stringMatching(/unreachable for 6m/),
|
||||
expect.objectContaining({ status: 'down', serviceId: 'localhost:8088' })
|
||||
);
|
||||
});
|
||||
|
||||
// ---- IN_CONTAINER=false kill-switch (DC-053 follow-up item 2b-b) --------
|
||||
// When the API runs bare-metal (or in a sidecar next to Caddy), the
|
||||
// loopback host IS the host — no bridge. Probing loopback verbatim
|
||||
// gives real, conclusive evidence.
|
||||
|
||||
test('IN_CONTAINER=false disables host-gateway remap (probes loopback verbatim)', async () => {
|
||||
process.env.IN_CONTAINER = 'false';
|
||||
try {
|
||||
seedSites({
|
||||
'a.sami': 'a.sami { reverse_proxy localhost:8088 }\n',
|
||||
'b.sami': 'b.sami { reverse_proxy 127.0.0.1:9000 }\n',
|
||||
'c.sami': 'c.sami { reverse_proxy 1.2.3.4:80 }\n' // non-loopback, should still go literal
|
||||
});
|
||||
probeQueue.push({ kind: 'ok', statusCode: 200 });
|
||||
probeQueue.push({ kind: 'ok', statusCode: 200 });
|
||||
probeQueue.push({ kind: 'ok', statusCode: 200 });
|
||||
// Force module reload so the new IN_CONTAINER is picked up at require time.
|
||||
jest.resetModules();
|
||||
const { w } = loadWatcher();
|
||||
await w.scanSites();
|
||||
const http = require('http');
|
||||
for (const u of w.upstreams.values()) await w._probeOne(u);
|
||||
const hostnames = http.request.mock.calls.map(c => c[0].hostname);
|
||||
// All three go to their literal addresses — no host.docker.internal.
|
||||
expect(hostnames).toEqual(['localhost', '127.0.0.1', '1.2.3.4']);
|
||||
// And no upstream is marked verifiedViaBridge (the loopback-success
|
||||
// gate only matters in the bridge case).
|
||||
for (const u of w.upstreams.values()) {
|
||||
expect(u.verifiedViaBridge).toBeFalsy();
|
||||
}
|
||||
} finally {
|
||||
delete process.env.IN_CONTAINER;
|
||||
}
|
||||
});
|
||||
|
||||
test('IN_CONTAINER unset (default) still uses host-gateway remap', async () => {
|
||||
delete process.env.IN_CONTAINER;
|
||||
seedSites({ 'zap.sami': 'zap.sami { reverse_proxy localhost:8088 }\n' });
|
||||
probeQueue.push({ kind: 'ok', statusCode: 200 });
|
||||
jest.resetModules();
|
||||
const { w } = loadWatcher();
|
||||
await w.scanSites();
|
||||
const http = require('http');
|
||||
await w._probeOne(w.upstreams.get('localhost:8088'));
|
||||
const call = http.request.mock.calls.find(c => c[0].hostname === 'host.docker.internal');
|
||||
expect(call).toBeTruthy();
|
||||
});
|
||||
|
||||
// ---- verifiedViaBridge persistence (B-grade polish) -----------------------
|
||||
// GLM judge LOW: don't re-prove bridge connectivity across container
|
||||
// restarts. A previously-positive observation is still good evidence.
|
||||
|
||||
test('verifiedViaBridge survives a save -> reload cycle (state.json round-trip)', async () => {
|
||||
seedSites({ 'zap.sami': 'zap.sami { reverse_proxy localhost:8088 }\n' });
|
||||
probeQueue.push({ kind: 'ok', statusCode: 200 }); // probe succeeds -> verifiedViaBridge=true
|
||||
const { w: w1 } = loadWatcher();
|
||||
await w1.scanSites();
|
||||
const u = w1.upstreams.get('localhost:8088');
|
||||
await w1._probeOne(u);
|
||||
expect(u.verifiedViaBridge).toBe(true);
|
||||
// Force a save.
|
||||
w1._saveState();
|
||||
// Reload from the same file via a fresh watcher instance.
|
||||
jest.resetModules();
|
||||
const { w: w2 } = loadWatcher();
|
||||
await w2.scanSites();
|
||||
const restored = w2.upstreams.get('localhost:8088');
|
||||
expect(restored).toBeTruthy();
|
||||
expect(restored.verifiedViaBridge).toBe(true);
|
||||
// The snapshot field carries it through too.
|
||||
expect(w2.snapshot().upstreams[0].verifiedViaBridge).toBe(true);
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,135 @@
|
||||
// Unit tests for the fixed /api/v1/error-logs parser
|
||||
// (route /opt/dashcaddy/dashcaddy-api/routes/errorlogs.js)
|
||||
//
|
||||
// Background: the prior implementation split on '='.repeat(80) but the
|
||||
// unified logger writes \u2500 horizontal-rule separators. As a result
|
||||
// every modal-open returned ZERO entries — same class of silent bug as
|
||||
// DC-050 (audit log). These tests pin the new behavior so future refactors
|
||||
// can't reintroduce it.
|
||||
|
||||
const { parseEntries, readTailBytes, MAX_TAIL } = require('../routes/errorlogs');
|
||||
const path = require('path');
|
||||
const fs = require('fs');
|
||||
const fsp = require('fs').promises;
|
||||
const os = require('os');
|
||||
|
||||
const SEP = '\n' + '\u2500'.repeat(72) + '\n';
|
||||
|
||||
function buildLog(entries) {
|
||||
return entries.map((e, i) => {
|
||||
const head = `[${e.timestamp}] [${e.level}] ${e.context}: ${e.message}`;
|
||||
return head + (e.details ? '\n' + e.details : '') + SEP;
|
||||
}).join('');
|
||||
}
|
||||
|
||||
describe('errorlogs parser (DC-051)', () => {
|
||||
test('parses single entry with U+2500 separator', () => {
|
||||
const text = buildLog([{
|
||||
timestamp: '2026-08-16T23:13:14.123Z',
|
||||
level: 'ERR',
|
||||
context: '/api/v1/templates',
|
||||
message: 'Route GET /v1/templates not found',
|
||||
details: 'NotFoundError: Route GET /v1/templates not found\n at notFoundHandler (/app/src/utilities/error-handler.js:71:8)',
|
||||
}]);
|
||||
const out = parseEntries(text);
|
||||
expect(out).toHaveLength(1);
|
||||
expect(out[0]).toMatchObject({
|
||||
timestamp: '2026-08-16T23:13:14.123Z',
|
||||
level: 'ERR',
|
||||
context: '/api/v1/templates',
|
||||
message: 'Route GET /v1/templates not found',
|
||||
});
|
||||
expect(out[0].details).toContain('notFoundHandler');
|
||||
expect(out[0].details).not.toContain('\u2500');
|
||||
});
|
||||
|
||||
test('returns multiple entries in order, ignoring separator residue', () => {
|
||||
const text = buildLog([
|
||||
{ timestamp: '2026-08-16T23:00:00.000Z', level: 'ERR', context: 'a', message: 'first' },
|
||||
{ timestamp: '2026-08-16T23:01:00.000Z', level: 'WRN', context: 'b', message: 'second' },
|
||||
{ timestamp: '2026-08-16T23:02:00.000Z', level: 'INF', context: 'c', message: 'third', details: 'extra' },
|
||||
]);
|
||||
const out = parseEntries(text);
|
||||
expect(out.map(e => e.context)).toEqual(['a', 'b', 'c']);
|
||||
expect(out[1].level).toBe('WRN');
|
||||
expect(out[2].details).toBe('extra');
|
||||
});
|
||||
|
||||
test('skips malformed lines without throwing', () => {
|
||||
const text = 'this is not a log entry\n' + SEP + '[2026-08-16T23:00:00.000Z] [ERR] x: y\n' + SEP;
|
||||
const out = parseEntries(text);
|
||||
expect(out).toHaveLength(1);
|
||||
expect(out[0].message).toBe('y');
|
||||
});
|
||||
|
||||
test('empty input returns empty array', () => {
|
||||
expect(parseEntries('')).toEqual([]);
|
||||
expect(parseEntries(' \n\n ')).toEqual([]);
|
||||
});
|
||||
|
||||
test('regression: would have returned 0 entries under the OLD splitter', () => {
|
||||
// Old impl: text.split('='.repeat(80)).filter(...). That produced one
|
||||
// big block, parser rejected all headers, returned ZERO entries. New
|
||||
// impl must NOT regress to that behavior on a real-format log.
|
||||
const text = buildLog([
|
||||
{ timestamp: '2026-08-16T23:00:00.000Z', level: 'ERR', context: 'a', message: 'm' },
|
||||
{ timestamp: '2026-08-16T23:01:00.000Z', level: 'ERR', context: 'b', message: 'm' },
|
||||
]);
|
||||
// Sanity: the old split would produce 1 block (no '=' in the text).
|
||||
expect(text.split('='.repeat(80))).toHaveLength(1);
|
||||
// New parser must surface both entries.
|
||||
expect(parseEntries(text)).toHaveLength(2);
|
||||
});
|
||||
|
||||
test('MAX_TAIL is bounded (>=100, <=1000) — prevents unbounded read', () => {
|
||||
expect(MAX_TAIL).toBeGreaterThanOrEqual(100);
|
||||
expect(MAX_TAIL).toBeLessThanOrEqual(1000);
|
||||
});
|
||||
});
|
||||
|
||||
describe('errorlogs readTailBytes (DC-051)', () => {
|
||||
let tmpFile;
|
||||
beforeAll(async () => {
|
||||
tmpFile = path.join(os.tmpdir(), `dc-051-errorlog-${process.pid}.log`);
|
||||
const entries = [];
|
||||
for (let i = 0; i < 50; i++) {
|
||||
entries.push({
|
||||
timestamp: `2026-08-16T23:${String(i % 60).padStart(2,'0')}:00.000Z`,
|
||||
level: i % 2 === 0 ? 'ERR' : 'WRN',
|
||||
context: `ctx-${i}`,
|
||||
message: `message body ${i}`,
|
||||
details: i % 3 === 0 ? `stack for ${i}` : null,
|
||||
});
|
||||
}
|
||||
await fsp.writeFile(tmpFile, buildLog(entries));
|
||||
});
|
||||
afterAll(async () => {
|
||||
try { await fsp.unlink(tmpFile); } catch {}
|
||||
});
|
||||
|
||||
test('returns parsed entries within the byte budget', async () => {
|
||||
const { text, totalSize, truncated } = await readTailBytes(tmpFile, 4 * 1024);
|
||||
expect(typeof totalSize).toBe('number');
|
||||
expect(typeof truncated).toBe('boolean');
|
||||
const parsed = parseEntries(text);
|
||||
expect(parsed.length).toBeGreaterThan(0);
|
||||
// Should never include partial first line — every parsed entry has a real timestamp.
|
||||
for (const e of parsed) {
|
||||
expect(e.timestamp).toMatch(/^\d{4}-\d{2}-\d{2}T/);
|
||||
}
|
||||
});
|
||||
|
||||
test('truncates when file exceeds byte budget', async () => {
|
||||
const stat = await fsp.stat(tmpFile);
|
||||
const smallBudget = Math.floor(stat.size / 4);
|
||||
const { truncated } = await readTailBytes(tmpFile, smallBudget);
|
||||
expect(truncated).toBe(true);
|
||||
});
|
||||
|
||||
test('does not truncate when file fits within byte budget', async () => {
|
||||
const stat = await fsp.stat(tmpFile);
|
||||
const bigBudget = stat.size * 2;
|
||||
const { truncated } = await readTailBytes(tmpFile, bigBudget);
|
||||
expect(truncated).toBe(false);
|
||||
});
|
||||
});
|
||||
@@ -1,326 +0,0 @@
|
||||
/**
|
||||
* DC-055: Host journald reader unit tests
|
||||
*
|
||||
* The reader is a security-sensitive shell-out — every test below exists
|
||||
* to prevent a regression that would let a caller pass a tainted unit
|
||||
* name or since/until/search string to journalctl. We never call the real
|
||||
* binary; every spawn is mocked by injecting an `exec` function (the
|
||||
* module accepts exec as the second argument specifically for testability).
|
||||
*/
|
||||
|
||||
const path = require('path');
|
||||
const { EventEmitter } = require('events');
|
||||
|
||||
const MODULE_PATH = path.join(__dirname, '..', 'src', 'monitoring', 'journald-reader.js');
|
||||
|
||||
// Construct a fake child process that matches the interface journald-reader
|
||||
// uses: stdout/stderr EventEmitters, kill(), and emits 'exit' on demand.
|
||||
function makeFakeChild({ stdout = '', stderr = '', code = 0, signal = null, failOnSpawn = null, killFn = null } = {}) {
|
||||
const child = new EventEmitter();
|
||||
child.stdout = new EventEmitter();
|
||||
child.stderr = new EventEmitter();
|
||||
child.kill = killFn || (() => {});
|
||||
process.nextTick(() => {
|
||||
if (failOnSpawn) {
|
||||
const err = new Error('spawn fail');
|
||||
err.code = failOnSpawn;
|
||||
child.emit('error', err);
|
||||
return;
|
||||
}
|
||||
if (stdout) child.stdout.emit('data', Buffer.from(stdout));
|
||||
if (stderr) child.stderr.emit('data', Buffer.from(stderr));
|
||||
child.emit('exit', code, signal);
|
||||
});
|
||||
return child;
|
||||
}
|
||||
|
||||
// Factory for an `exec` function that returns the given fake child.
|
||||
function fakeExec(child) {
|
||||
return jest.fn().mockReturnValue(child);
|
||||
}
|
||||
|
||||
describe('journald-reader', () => {
|
||||
describe('assertUnitAllowed', () => {
|
||||
const { assertUnitAllowed } = require(MODULE_PATH);
|
||||
|
||||
test('accepts allow-listed bare names', () => {
|
||||
expect(assertUnitAllowed('caddy')).toBe('caddy');
|
||||
expect(assertUnitAllowed('docker')).toBe('docker');
|
||||
expect(assertUnitAllowed('dashcaddy-api')).toBe('dashcaddy-api');
|
||||
});
|
||||
|
||||
test('strips .service suffix', () => {
|
||||
expect(assertUnitAllowed('caddy.service')).toBe('caddy');
|
||||
expect(assertUnitAllowed('docker.service')).toBe('docker');
|
||||
});
|
||||
|
||||
test('rejects units not on the allow-list', () => {
|
||||
expect(() => assertUnitAllowed('sshd')).toThrow(/not in allow-list/);
|
||||
expect(() => assertUnitAllowed('nginx')).toThrow(/not in allow-list/);
|
||||
expect(() => assertUnitAllowed('root')).toThrow(/not in allow-list/);
|
||||
});
|
||||
|
||||
test('rejects shell metacharacters and path traversal', () => {
|
||||
expect(() => assertUnitAllowed('caddy; rm -rf /')).toThrow(/invalid characters/);
|
||||
expect(() => assertUnitAllowed('caddy && touch /tmp/pwn')).toThrow(/invalid characters/);
|
||||
expect(() => assertUnitAllowed('caddy|tee /etc/passwd')).toThrow(/invalid characters/);
|
||||
expect(() => assertUnitAllowed('../etc/passwd')).toThrow(/invalid characters/);
|
||||
expect(() => assertUnitAllowed('caddy\nfoo')).toThrow(/invalid characters/);
|
||||
});
|
||||
|
||||
test('rejects empty / non-string', () => {
|
||||
expect(() => assertUnitAllowed('')).toThrow(/unit is required/);
|
||||
expect(() => assertUnitAllowed(null)).toThrow(/unit is required/);
|
||||
expect(() => assertUnitAllowed(undefined)).toThrow(/unit is required/);
|
||||
expect(() => assertUnitAllowed(42)).toThrow(/unit is required/);
|
||||
});
|
||||
|
||||
test('throws ValidationError specifically (route layer keys on .name)', () => {
|
||||
try { assertUnitAllowed('nginx'); }
|
||||
catch (e) { expect(e.name).toBe('ValidationError'); }
|
||||
});
|
||||
});
|
||||
|
||||
describe('parseTail', () => {
|
||||
const { parseTail, MAX_TAIL_LINES } = require(MODULE_PATH);
|
||||
|
||||
test('returns fallback on undefined', () => {
|
||||
expect(parseTail(undefined)).toBe(200);
|
||||
expect(parseTail(undefined, 50)).toBe(50);
|
||||
});
|
||||
|
||||
test('clamps to MAX_TAIL_LINES', () => {
|
||||
expect(parseTail('999999999999')).toBe(MAX_TAIL_LINES);
|
||||
expect(parseTail(999999999999)).toBe(MAX_TAIL_LINES);
|
||||
});
|
||||
|
||||
test('rejects non-positive and non-integer', () => {
|
||||
expect(() => parseTail('0')).toThrow(/positive integer/);
|
||||
expect(() => parseTail('-5')).toThrow(/positive integer/);
|
||||
expect(() => parseTail('abc')).toThrow(/positive integer/);
|
||||
expect(() => parseTail('1.5')).toThrow(/positive integer/);
|
||||
expect(() => parseTail(NaN)).toThrow(/positive integer/);
|
||||
});
|
||||
|
||||
test('accepts valid integers', () => {
|
||||
expect(parseTail('1')).toBe(1);
|
||||
expect(parseTail('500')).toBe(500);
|
||||
expect(parseTail(200)).toBe(200);
|
||||
});
|
||||
});
|
||||
|
||||
describe('parseTimestamp', () => {
|
||||
const { parseTimestamp } = require(MODULE_PATH);
|
||||
|
||||
test('returns null on undefined/empty', () => {
|
||||
expect(parseTimestamp(undefined, 'since')).toBeNull();
|
||||
expect(parseTimestamp('', 'since')).toBeNull();
|
||||
expect(parseTimestamp(null, 'since')).toBeNull();
|
||||
});
|
||||
|
||||
test('parses ISO 8601 timestamps', () => {
|
||||
const out = parseTimestamp('2026-08-18T07:00:00Z', 'since');
|
||||
expect(out).toBe('2026-08-18T07:00:00.000Z');
|
||||
});
|
||||
|
||||
test('parses ISO date-only', () => {
|
||||
const out = parseTimestamp('2026-08-18', 'since');
|
||||
expect(out).toMatch(/^2026-08-18/);
|
||||
});
|
||||
|
||||
test('parses unix epoch in seconds and ms', () => {
|
||||
// Use a known epoch so the test isn't sensitive to "now". The
|
||||
// expected ISO output is computed at runtime so this stays correct.
|
||||
const epochSec = 1787038846; // 2026-08-18T07:00:46Z
|
||||
const expected = new Date(epochSec * 1000).toISOString();
|
||||
expect(parseTimestamp(String(epochSec), 'since')).toBe(expected);
|
||||
expect(parseTimestamp(String(epochSec * 1000), 'since')).toBe(expected);
|
||||
});
|
||||
|
||||
test('passes through journalctl relative syntax', () => {
|
||||
expect(parseTimestamp('30 min ago', 'since')).toBe('30 min ago');
|
||||
expect(parseTimestamp('today', 'until')).toBe('today');
|
||||
});
|
||||
|
||||
test('rejects shell metacharacters in relative syntax', () => {
|
||||
expect(() => parseTimestamp('30 min ago; touch /tmp/pwn', 'since')).toThrow(/forbidden/);
|
||||
expect(() => parseTimestamp('today && rm -rf /', 'until')).toThrow(/forbidden/);
|
||||
});
|
||||
|
||||
test('rejects strings >1024 chars', () => {
|
||||
const huge = 'a'.repeat(1025);
|
||||
expect(() => parseTimestamp(huge, 'since')).toThrow(/forbidden/);
|
||||
});
|
||||
|
||||
test('rejects invalid ISO', () => {
|
||||
// 'not-a-date' doesn't match the ISO_PATTERN and isn't numeric or
|
||||
// safe relative-syntax — falls through to the relative branch but
|
||||
// doesn't contain forbidden chars either, so it would pass through
|
||||
// to journalctl. Use a string with shell metacharacters instead
|
||||
// to prove the path actually rejects.
|
||||
expect(() => parseTimestamp('yesterday | nc evil 1234', 'since')).toThrow();
|
||||
// Numbers that overflow Date.parse
|
||||
expect(() => parseTimestamp('99999999999999999999', 'since')).toThrow();
|
||||
});
|
||||
});
|
||||
|
||||
describe('buildArgv', () => {
|
||||
const { buildArgv } = require(MODULE_PATH);
|
||||
|
||||
test('always emits --directory + unit + --no-pager', () => {
|
||||
const argv = buildArgv({ unit: 'caddy', tail: 100 });
|
||||
expect(argv).toContain('--directory');
|
||||
expect(argv[argv.indexOf('--directory') + 1]).toBe('/var/log/journal');
|
||||
expect(argv).toContain('--no-pager');
|
||||
expect(argv).toContain('-u');
|
||||
expect(argv[argv.indexOf('-u') + 1]).toBe('caddy');
|
||||
expect(argv).not.toContain('--follow');
|
||||
});
|
||||
|
||||
test('follow flag is set when requested', () => {
|
||||
const argv = buildArgv({ unit: 'caddy', follow: true });
|
||||
expect(argv).toContain('--follow');
|
||||
});
|
||||
|
||||
test('emits -n <tail> for numeric tail', () => {
|
||||
const argv = buildArgv({ unit: 'caddy', tail: 500 });
|
||||
const idx = argv.indexOf('-n');
|
||||
expect(idx).toBeGreaterThan(-1);
|
||||
expect(argv[idx + 1]).toBe('500');
|
||||
});
|
||||
|
||||
test('emits --since/--until/search when provided', () => {
|
||||
const argv = buildArgv({
|
||||
unit: 'caddy', tail: 100,
|
||||
since: '2026-08-18T00:00:00Z',
|
||||
until: '2026-08-18T23:59:59Z',
|
||||
search: 'health',
|
||||
});
|
||||
expect(argv).toContain('--since');
|
||||
expect(argv).toContain('--until');
|
||||
expect(argv).toContain('-S');
|
||||
expect(argv[argv.indexOf('-S') + 1]).toBe('health');
|
||||
});
|
||||
|
||||
test('emits argv as a flat string array (no shell)', () => {
|
||||
const argv = buildArgv({ unit: 'caddy', tail: 1 });
|
||||
expect(argv.every(a => typeof a === 'string')).toBe(true);
|
||||
});
|
||||
});
|
||||
|
||||
describe('readEntries', () => {
|
||||
const reader = require(MODULE_PATH);
|
||||
|
||||
test('parses short-output lines into structured entries', async () => {
|
||||
const child = makeFakeChild({
|
||||
stdout: [
|
||||
'Aug 18 00:42:46 vmi3080415 caddy[3620580]: {"level":"info","msg":"hello"}',
|
||||
'Aug 18 00:42:56 vmi3080415 caddy[3620580]: {"level":"warn","msg":"oops"}',
|
||||
'',
|
||||
].join('\n'),
|
||||
});
|
||||
const entries = await reader.readEntries({ unit: 'caddy', tail: 50 }, { exec: fakeExec(child) });
|
||||
expect(entries).toHaveLength(2);
|
||||
expect(entries[0].timestamp).toBe('Aug 18 00:42:46');
|
||||
expect(entries[0].hostname).toBe('vmi3080415');
|
||||
expect(entries[0].unit).toBe('caddy');
|
||||
expect(entries[0].text).toBe('{"level":"info","msg":"hello"}');
|
||||
});
|
||||
|
||||
test('throws on ValidationError for bad unit', async () => {
|
||||
await expect(reader.readEntries({ unit: 'nginx' })).rejects.toMatchObject({
|
||||
name: 'ValidationError',
|
||||
});
|
||||
});
|
||||
|
||||
test('throws on ValidationError for bad tail', async () => {
|
||||
await expect(reader.readEntries({ unit: 'caddy', tail: -1 })).rejects.toMatchObject({
|
||||
name: 'ValidationError',
|
||||
});
|
||||
});
|
||||
|
||||
test('throws on ValidationError for shell-meta since', async () => {
|
||||
await expect(reader.readEntries({ unit: 'caddy', since: 'yesterday; touch /tmp/pwn' }))
|
||||
.rejects.toMatchObject({ name: 'ValidationError' });
|
||||
});
|
||||
|
||||
test('surfaces ENOENT as Error("journalctl unavailable")', async () => {
|
||||
const child = makeFakeChild({ failOnSpawn: 'ENOENT' });
|
||||
const err = await reader.readEntries({ unit: 'caddy' }, { exec: fakeExec(child) })
|
||||
.then(() => null, e => e);
|
||||
expect(err.message).toBe('journalctl unavailable');
|
||||
});
|
||||
|
||||
test('surfaces non-zero exit with stderr snippet', async () => {
|
||||
const child = makeFakeChild({
|
||||
stdout: '',
|
||||
stderr: 'Failed to open directory: /var/log/journal/foo\n',
|
||||
code: 1,
|
||||
});
|
||||
const err = await reader.readEntries({ unit: 'caddy' }, { exec: fakeExec(child) })
|
||||
.then(() => null, e => e);
|
||||
expect(err.message).toMatch(/exited 1/);
|
||||
expect(err.message).toMatch(/Failed to open directory/);
|
||||
});
|
||||
|
||||
test('clamps stdout at MAX_OUTPUT_BUFFER and rejects with overflow', async () => {
|
||||
// Use smaller chunks: 800KB then another 800KB = 1.6MB > 2MB cap.
|
||||
// Wait, that's <2MB. Need: total > 2MB. Use 1MB + 1.2MB.
|
||||
const child = new EventEmitter();
|
||||
child.stdout = new EventEmitter();
|
||||
child.stderr = new EventEmitter();
|
||||
child.kill = jest.fn();
|
||||
const cap = require(MODULE_PATH).MAX_OUTPUT_BUFFER;
|
||||
const first = Math.floor(cap * 0.4); // 40%
|
||||
const second = Math.floor(cap * 0.7); // 70% more — total 110%
|
||||
process.nextTick(() => {
|
||||
child.stdout.emit('data', Buffer.alloc(first, 'x'));
|
||||
child.stdout.emit('data', Buffer.alloc(second, 'x'));
|
||||
// Don't emit exit — the overflow rejection doesn't depend on it.
|
||||
// Kill the child eventually so Jest can exit cleanly.
|
||||
setTimeout(() => child.emit('exit', null, 'SIGKILL'), 50);
|
||||
});
|
||||
const execSpy = jest.fn().mockReturnValue(child);
|
||||
const err = await reader.readEntries({ unit: 'caddy' }, { exec: execSpy })
|
||||
.then(() => null, e => e);
|
||||
expect(err).not.toBeNull();
|
||||
expect(err.message).toMatch(/exceeded/);
|
||||
expect(child.kill).toHaveBeenCalledWith('SIGKILL');
|
||||
});
|
||||
});
|
||||
|
||||
describe('streamEntries', () => {
|
||||
const reader = require(MODULE_PATH);
|
||||
|
||||
test('emits parsed data + completes on exit', async () => {
|
||||
const child = new EventEmitter();
|
||||
child.stdout = new EventEmitter();
|
||||
child.stderr = new EventEmitter();
|
||||
child.kill = jest.fn();
|
||||
|
||||
process.nextTick(() => {
|
||||
child.stdout.emit('data', Buffer.from('Aug 18 00:42:46 host caddy[1]: hello\n'));
|
||||
child.emit('exit', 0, null);
|
||||
});
|
||||
|
||||
const seen = [];
|
||||
const execSpy = jest.fn().mockReturnValue(child);
|
||||
reader.streamEntries({ unit: 'caddy' }, {
|
||||
exec: execSpy,
|
||||
onData: (e) => seen.push(e),
|
||||
onError: () => {},
|
||||
});
|
||||
// Drain microtasks so the nextTick callback fires.
|
||||
await new Promise((r) => setTimeout(r, 30));
|
||||
expect(execSpy).toHaveBeenCalledTimes(1);
|
||||
expect(seen.length).toBeGreaterThanOrEqual(1);
|
||||
expect(seen[0].unit).toBe('caddy');
|
||||
expect(seen[0].text).toBe('hello');
|
||||
});
|
||||
|
||||
test('rejects bad unit before opening stream', () => {
|
||||
expect(() => reader.streamEntries({ unit: 'nginx' }, { onError: () => {} }))
|
||||
.toThrow(/not in allow-list/);
|
||||
});
|
||||
});
|
||||
});
|
||||
@@ -1,357 +0,0 @@
|
||||
/**
|
||||
* Smoke tests for the enhanced error-logs route (DC-052).
|
||||
*
|
||||
* Mirrors `caddy-upstreams.routes.test.js`: build the router with stubbed
|
||||
* deps, hit it via a tiny express app, assert the response shape and
|
||||
* the audit-logger interactions.
|
||||
*
|
||||
* Fixture: a synthetic error log with two ERR entries and one WARN entry,
|
||||
* each with a different context, IP, and stack — enough to exercise the
|
||||
* filter chain (level, context, search, since/until) without pulling the
|
||||
* real 47k-line error.log off the host.
|
||||
*/
|
||||
|
||||
const express = require('express');
|
||||
const path = require('path');
|
||||
const fs = require('fs');
|
||||
const os = require('os');
|
||||
|
||||
const ENTRY_SEP = '='.repeat(80);
|
||||
const FIXTURE_LOG = [
|
||||
`[2026-08-17T10:00:00.000Z] [ERR] updater: getLocalVersion failed: no candidate package.json found`,
|
||||
` at SelfUpdater.getLocalVersion (/app/src/docker/self-updater.js:128:9)`,
|
||||
` request: GET /api/v1/updates/check | ip: 100.85.236.10 | ua: Mozilla/5.0 | id: a1`,
|
||||
` context: {"triggeredBy":"manual"}`,
|
||||
ENTRY_SEP,
|
||||
`[2026-08-17T11:00:00.000Z] [ERR] http: GET /api/v1/templates 503`,
|
||||
` at Logger.error (/app/src/utils/logging.js:258:49)`,
|
||||
` request: GET /api/v1/templates | ip: 100.85.236.11 | ua: curl/8.0 | id: a2`,
|
||||
` context: {"service":"templates"}`,
|
||||
ENTRY_SEP,
|
||||
`[2026-08-17T12:00:00.000Z] [WARN] ssl-monitor: cert check failed: TLS connect error for sonarr.sami:443: getaddrinfo ENOTFOUND sonarr.sami`,
|
||||
` at Logger.warn (/app/src/utils/logging.js:200:10)`,
|
||||
` request: GET /api/v1/ssl/check | ip: 100.121.150.22 | ua: NodeHealthCheck | id: a3`,
|
||||
` context: {"service":"sonarr"}`,
|
||||
ENTRY_SEP,
|
||||
``,
|
||||
].join('\n');
|
||||
|
||||
function buildFakeAuditLogger() {
|
||||
return {
|
||||
clear: jest.fn(async () => {}),
|
||||
log: jest.fn(async () => {}),
|
||||
};
|
||||
}
|
||||
|
||||
function writeFixtureLog(tmpDir) {
|
||||
const logFile = path.join(tmpDir, 'error.log');
|
||||
fs.writeFileSync(logFile, FIXTURE_LOG);
|
||||
return logFile;
|
||||
}
|
||||
|
||||
describe('routes/errorlogs (DC-052)', () => {
|
||||
let tmpDir;
|
||||
let logFile;
|
||||
let auditLogger;
|
||||
|
||||
beforeEach(() => {
|
||||
tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'dc052-errorlogs-'));
|
||||
logFile = writeFixtureLog(tmpDir);
|
||||
auditLogger = buildFakeAuditLogger();
|
||||
});
|
||||
|
||||
afterEach(() => {
|
||||
fs.rmSync(tmpDir, { recursive: true, force: true });
|
||||
});
|
||||
|
||||
function buildRouter() {
|
||||
const mod = require('../../routes/errorlogs');
|
||||
return mod({
|
||||
ERROR_LOG_FILE: logFile,
|
||||
auditLogger,
|
||||
asyncHandler: (fn) => async (req, res, next) => {
|
||||
try { await fn(req, res, next); } catch (e) { next(e); }
|
||||
},
|
||||
});
|
||||
}
|
||||
|
||||
function listen(router) {
|
||||
const app = express();
|
||||
app.use(express.json());
|
||||
app.use(router);
|
||||
return app.listen(0);
|
||||
}
|
||||
|
||||
test('router exposes the DC-052 endpoints', () => {
|
||||
const router = buildRouter();
|
||||
const paths = router.stack
|
||||
.filter((l) => l.route)
|
||||
.map((l) => Object.keys(l.route.methods).map((m) => `${m.toUpperCase()} ${l.route.path}`))
|
||||
.flat();
|
||||
expect(paths).toEqual(expect.arrayContaining([
|
||||
'GET /error-logs',
|
||||
'GET /error-logs/contexts',
|
||||
'DELETE /error-logs',
|
||||
]));
|
||||
});
|
||||
|
||||
test('GET /error-logs returns newest-first with totals', async () => {
|
||||
const server = listen(buildRouter());
|
||||
const { port } = server.address();
|
||||
const res = await fetch(`http://127.0.0.1:${port}/error-logs`);
|
||||
const body = await res.json();
|
||||
server.close();
|
||||
expect(res.status).toBe(200);
|
||||
expect(body.success).toBe(true);
|
||||
expect(body.total).toBe(3);
|
||||
expect(body.logs).toHaveLength(3);
|
||||
expect(body.hasMore).toBe(false);
|
||||
expect(body.filters).toEqual({
|
||||
level: null, context: null, search: null, since: null, until: null,
|
||||
});
|
||||
// Newest first: 12:00 (WARN ssl-monitor) → 11:00 (ERR http) → 10:00 (ERR updater).
|
||||
expect(body.logs[0].level).toBe('WARN');
|
||||
expect(body.logs[1].level).toBe('ERR');
|
||||
expect(body.logs[2].level).toBe('ERR');
|
||||
expect(body.logs[0].timestamp).toBe('2026-08-17T12:00:00.000Z');
|
||||
});
|
||||
|
||||
test('GET /error-logs filters by level', async () => {
|
||||
const server = listen(buildRouter());
|
||||
const { port } = server.address();
|
||||
const res = await fetch(`http://127.0.0.1:${port}/error-logs?level=ERR`);
|
||||
const body = await res.json();
|
||||
server.close();
|
||||
expect(body.total).toBe(2);
|
||||
expect(body.logs.every((e) => e.level === 'ERR')).toBe(true);
|
||||
});
|
||||
|
||||
test('GET /error-logs filters by context (substring)', async () => {
|
||||
const server = listen(buildRouter());
|
||||
const { port } = server.address();
|
||||
const res = await fetch(`http://127.0.0.1:${port}/error-logs?context=updater`);
|
||||
const body = await res.json();
|
||||
server.close();
|
||||
expect(body.total).toBe(1);
|
||||
expect(body.logs[0].context).toBe('updater');
|
||||
});
|
||||
|
||||
test('GET /error-logs free-text search hits error / context / detail', async () => {
|
||||
const server = listen(buildRouter());
|
||||
const { port } = server.address();
|
||||
// "sonarr" appears only in the WARN stack; should still match via detail.
|
||||
let res = await fetch(`http://127.0.0.1:${port}/error-logs?search=sonarr`);
|
||||
let body = await res.json();
|
||||
expect(body.total).toBe(1);
|
||||
expect(body.logs[0].context).toBe('ssl-monitor');
|
||||
// "503" appears only in the ERR http message; should match via error.
|
||||
res = await fetch(`http://127.0.0.1:${port}/error-logs?search=503`);
|
||||
body = await res.json();
|
||||
expect(body.total).toBe(1);
|
||||
expect(body.logs[0].context).toBe('http');
|
||||
server.close();
|
||||
});
|
||||
|
||||
test('GET /error-logs respects since/until as numeric ISO compare', async () => {
|
||||
const server = listen(buildRouter());
|
||||
const { port } = server.address();
|
||||
// Window covers only 11:00Z entry.
|
||||
const res = await fetch(
|
||||
`http://127.0.0.1:${port}/error-logs?since=${encodeURIComponent('2026-08-17T10:30:00Z')}&until=${encodeURIComponent('2026-08-17T11:30:00Z')}`
|
||||
);
|
||||
const body = await res.json();
|
||||
server.close();
|
||||
expect(body.total).toBe(1);
|
||||
expect(body.logs[0].timestamp).toBe('2026-08-17T11:00:00.000Z');
|
||||
});
|
||||
|
||||
test('GET /error-logs rejects invalid since with 400', async () => {
|
||||
const server = listen(buildRouter());
|
||||
const { port } = server.address();
|
||||
const res = await fetch(`http://127.0.0.1:${port}/error-logs?since=not-a-date`);
|
||||
const body = await res.json();
|
||||
server.close();
|
||||
expect(res.status).toBe(400);
|
||||
expect(body.success).toBe(false);
|
||||
});
|
||||
|
||||
test('GET /error-logs rejects unknown level with 400', async () => {
|
||||
const server = listen(buildRouter());
|
||||
const { port } = server.address();
|
||||
const res = await fetch(`http://127.0.0.1:${port}/error-logs?level=FATAL`);
|
||||
const body = await res.json();
|
||||
server.close();
|
||||
expect(res.status).toBe(400);
|
||||
});
|
||||
|
||||
test('GET /error-logs paginates and reports hasMore', async () => {
|
||||
const server = listen(buildRouter());
|
||||
const { port } = server.address();
|
||||
const res1 = await fetch(`http://127.0.0.1:${port}/error-logs?limit=2&offset=0`);
|
||||
const body1 = await res1.json();
|
||||
expect(body1.logs).toHaveLength(2);
|
||||
expect(body1.total).toBe(3);
|
||||
expect(body1.hasMore).toBe(true);
|
||||
const res2 = await fetch(`http://127.0.0.1:${port}/error-logs?limit=2&offset=2`);
|
||||
const body2 = await res2.json();
|
||||
expect(body2.logs).toHaveLength(1);
|
||||
expect(body2.hasMore).toBe(false);
|
||||
server.close();
|
||||
});
|
||||
|
||||
test('GET /error-logs clamps limit to MAX_LIMIT', async () => {
|
||||
const server = listen(buildRouter());
|
||||
const { port } = server.address();
|
||||
const res = await fetch(`http://127.0.0.1:${port}/error-logs?limit=99999`);
|
||||
const body = await res.json();
|
||||
server.close();
|
||||
// 3 entries total so we still get 3, but the route didn't blow up on a
|
||||
// giant limit; the contract is limit <= 500 and we just clamp.
|
||||
expect(body.logs.length).toBeLessThanOrEqual(500);
|
||||
expect(body.total).toBe(3);
|
||||
});
|
||||
|
||||
test('GET /error-logs/contexts returns distinct contexts sorted by count', async () => {
|
||||
const server = listen(buildRouter());
|
||||
const { port } = server.address();
|
||||
const res = await fetch(`http://127.0.0.1:${port}/error-logs/contexts`);
|
||||
const body = await res.json();
|
||||
server.close();
|
||||
expect(body.success).toBe(true);
|
||||
expect(body.contexts).toHaveLength(3);
|
||||
// updater + http + ssl-monitor — each appears once.
|
||||
const names = body.contexts.map((c) => c.name).sort();
|
||||
expect(names).toEqual(['http', 'ssl-monitor', 'updater']);
|
||||
expect(body.contexts.every((c) => c.count === 1)).toBe(true);
|
||||
});
|
||||
|
||||
test('DELETE /error-logs without confirm is rejected with 400', async () => {
|
||||
const server = listen(buildRouter());
|
||||
const { port } = server.address();
|
||||
const res = await fetch(`http://127.0.0.1:${port}/error-logs`, { method: 'DELETE' });
|
||||
const body = await res.json();
|
||||
server.close();
|
||||
expect(res.status).toBe(400);
|
||||
expect(body.success).toBe(false);
|
||||
// File still intact.
|
||||
expect(fs.readFileSync(logFile, 'utf8')).toBe(FIXTURE_LOG);
|
||||
});
|
||||
|
||||
test('DELETE /error-logs with confirm=CLEAR truncates and audits', async () => {
|
||||
const server = listen(buildRouter());
|
||||
const { port } = server.address();
|
||||
const res = await fetch(`http://127.0.0.1:${port}/error-logs`, {
|
||||
method: 'DELETE',
|
||||
headers: { 'content-type': 'application/json' },
|
||||
body: JSON.stringify({ confirm: 'CLEAR' }),
|
||||
});
|
||||
const body = await res.json();
|
||||
server.close();
|
||||
expect(res.status).toBe(200);
|
||||
expect(body.success).toBe(true);
|
||||
expect(fs.readFileSync(logFile, 'utf8')).toBe('');
|
||||
expect(auditLogger.log).toHaveBeenCalledWith(expect.objectContaining({
|
||||
action: 'error-log.clear',
|
||||
outcome: 'success',
|
||||
}));
|
||||
});
|
||||
|
||||
test('GET /error-logs returns empty when log file missing', async () => {
|
||||
fs.unlinkSync(logFile);
|
||||
const server = listen(buildRouter());
|
||||
const { port } = server.address();
|
||||
const res = await fetch(`http://127.0.0.1:${port}/error-logs`);
|
||||
const body = await res.json();
|
||||
server.close();
|
||||
expect(body.success).toBe(true);
|
||||
expect(body.logs).toEqual([]);
|
||||
expect(body.total).toBe(0);
|
||||
});
|
||||
|
||||
test('GET /error-logs preserves stack frames in detail field', async () => {
|
||||
const server = listen(buildRouter());
|
||||
const { port } = server.address();
|
||||
const res = await fetch(`http://127.0.0.1:${port}/error-logs?context=updater`);
|
||||
const body = await res.json();
|
||||
server.close();
|
||||
expect(body.logs[0].detail).toContain('self-updater.js:128');
|
||||
expect(body.logs[0].detail).toContain('context:');
|
||||
});
|
||||
|
||||
test('GET /error-logs handles malformed entry as raw fallback', async () => {
|
||||
// The parser splits the log on ENTRY_SEP (80 equal signs). A junk block
|
||||
// that has no timestamp header should still surface as a raw entry so
|
||||
// the operator doesn't lose forensic context. Place the malformed
|
||||
// block AFTER the separator so it ends up in its own split segment.
|
||||
fs.writeFileSync(logFile, [
|
||||
`[2026-08-17T13:00:00.000Z] [ERR] junk: well-formed entry`,
|
||||
ENTRY_SEP,
|
||||
`this is a malformed block with no timestamp header`,
|
||||
`and no level bracket at all`,
|
||||
ENTRY_SEP,
|
||||
``,
|
||||
].join('\n'));
|
||||
const server = listen(buildRouter());
|
||||
const { port } = server.address();
|
||||
const res = await fetch(`http://127.0.0.1:${port}/error-logs`);
|
||||
const body = await res.json();
|
||||
server.close();
|
||||
expect(body.total).toBe(2);
|
||||
const raw = body.logs.find((e) => e.level === null);
|
||||
expect(raw).toBeDefined();
|
||||
expect(raw.error).toContain('malformed block');
|
||||
expect(raw.raw).toContain('malformed block');
|
||||
});
|
||||
|
||||
test('GET /error-logs/contexts returns empty array when file missing', async () => {
|
||||
fs.unlinkSync(logFile);
|
||||
const server = listen(buildRouter());
|
||||
const { port } = server.address();
|
||||
const res = await fetch(`http://127.0.0.1:${port}/error-logs/contexts`);
|
||||
const body = await res.json();
|
||||
server.close();
|
||||
expect(body.success).toBe(true);
|
||||
expect(body.contexts).toEqual([]);
|
||||
});
|
||||
|
||||
test('GET /error-logs?search matches IP field', async () => {
|
||||
const server = listen(buildRouter());
|
||||
const { port } = server.address();
|
||||
// 100.85.236.11 is only on the /api/v1/templates entry.
|
||||
const res = await fetch(`http://127.0.0.1:${port}/error-logs?search=100.85.236.11`);
|
||||
const body = await res.json();
|
||||
server.close();
|
||||
expect(body.total).toBe(1);
|
||||
expect(body.logs[0].request.ip).toBe('100.85.236.11');
|
||||
});
|
||||
|
||||
test('GET /error-logs accepts huge since/until without error', async () => {
|
||||
const server = listen(buildRouter());
|
||||
const { port } = server.address();
|
||||
// Far-future since — no entries match, but the route doesn't 500.
|
||||
const res = await fetch(
|
||||
`http://127.0.0.1:${port}/error-logs?since=${encodeURIComponent('9999-12-31T00:00:00Z')}`
|
||||
);
|
||||
const body = await res.json();
|
||||
server.close();
|
||||
expect(res.status).toBe(200);
|
||||
expect(body.success).toBe(true);
|
||||
expect(body.total).toBe(0);
|
||||
expect(body.logs).toEqual([]);
|
||||
});
|
||||
|
||||
test('GET /error-logs combined filters compose correctly', async () => {
|
||||
const server = listen(buildRouter());
|
||||
const { port } = server.address();
|
||||
// level=WARN AND context=http: no entry matches (WARN is ssl-monitor).
|
||||
const res = await fetch(`http://127.0.0.1:${port}/error-logs?level=WARN&context=http`);
|
||||
const body = await res.json();
|
||||
server.close();
|
||||
expect(body.total).toBe(0);
|
||||
expect(body.logs).toEqual([]);
|
||||
expect(body.filters).toEqual({
|
||||
level: 'WARN', context: 'http', search: null,
|
||||
since: null, until: null,
|
||||
});
|
||||
});
|
||||
});
|
||||
@@ -1,196 +0,0 @@
|
||||
/**
|
||||
* DC-055: Host journald route smoke tests.
|
||||
*
|
||||
* Mounts the routes/logs.js journald endpoints into a tiny express app
|
||||
* with a mocked journald reader. The mock mirrors the real module's
|
||||
* validation pipeline (assertUnitAllowed, parseTail, parseTimestamp) so
|
||||
* bad inputs still throw ValidationError -> 400 at the route boundary,
|
||||
* but the actual journalctl spawn is short-circuited.
|
||||
*/
|
||||
|
||||
const express = require('express');
|
||||
const request = require('supertest');
|
||||
const path = require('path');
|
||||
|
||||
const realJournaldPath = require.resolve('../../src/monitoring/journald-reader.js');
|
||||
|
||||
// Pull the real module's validators so the mock's readEntries can
|
||||
// reproduce the same 400-on-bad-input behaviour as production.
|
||||
const realReader = jest.requireActual(realJournaldPath);
|
||||
|
||||
// Mocked journald reader. Variable name MUST start with "mock" so
|
||||
// jest.mock hoisting doesn't reject the factory closure.
|
||||
const mockJournald = {
|
||||
ALLOWED_UNITS: realReader.ALLOWED_UNITS,
|
||||
MAX_TAIL_LINES: realReader.MAX_TAIL_LINES,
|
||||
MAX_OUTPUT_BUFFER: realReader.MAX_OUTPUT_BUFFER,
|
||||
isAvailable: jest.fn().mockResolvedValue(true),
|
||||
// Validation pipeline runs through the real assert/parse functions so
|
||||
// bad unit/tail/since/until still surface as ValidationError. The
|
||||
// journalctl spawn itself is short-circuited — return canned entries.
|
||||
readEntries: jest.fn(async (opts) => {
|
||||
const unit = realReader.assertUnitAllowed(opts.unit);
|
||||
realReader.parseTail(opts.tail); // throws on bad tail
|
||||
realReader.parseTimestamp(opts.since, 'since');
|
||||
realReader.parseTimestamp(opts.until, 'until');
|
||||
return [
|
||||
{ timestamp: 'Aug 18 00:42:46', hostname: 'host', unit, text: 'mock-line-1' },
|
||||
];
|
||||
}),
|
||||
// Default stream mock: invokes onData with one synthetic entry then
|
||||
// returns a no-op handle. Tests override per-case.
|
||||
streamEntries: jest.fn((opts, hooks = {}) => {
|
||||
if (hooks.onData) {
|
||||
hooks.onData({ timestamp: 'Aug 18 00:42:46', unit: opts.unit, text: 'stream-line-1' });
|
||||
}
|
||||
return { kill: jest.fn(), child: {} };
|
||||
}),
|
||||
listUnits: jest.fn(async () => [
|
||||
{ unit: 'caddy', hasEntries: true },
|
||||
{ unit: 'docker', hasEntries: true },
|
||||
]),
|
||||
assertUnitAllowed: realReader.assertUnitAllowed,
|
||||
parseTail: realReader.parseTail,
|
||||
parseTimestamp: realReader.parseTimestamp,
|
||||
parseShortLine: realReader.parseShortLine,
|
||||
buildArgv: realReader.buildArgv,
|
||||
};
|
||||
|
||||
jest.mock('../../src/monitoring/journald-reader.js', () => mockJournald);
|
||||
|
||||
// Force journaldAvailable = true in routes/logs.js. The route checks
|
||||
// /var/log/journal + /usr/bin/journalctl at module-load time, so we stub
|
||||
// fs.existsSync to lie about those paths.
|
||||
const realFs = require('fs');
|
||||
const realExists = realFs.existsSync;
|
||||
realFs.existsSync = function(p) {
|
||||
if (p === '/var/log/journal' || p === '/usr/bin/journalctl') return true;
|
||||
return realExists.apply(this, arguments);
|
||||
};
|
||||
|
||||
const logsRoutes = require('../../routes/logs.js');
|
||||
|
||||
function buildApp() {
|
||||
const app = express();
|
||||
const asyncHandler = (fn) => (req, res, next) => Promise.resolve(fn(req, res, next)).catch(next);
|
||||
const ok = (res, data) => res.json({ success: true, ...data });
|
||||
const errorHandler = (err, req, res, next) => {
|
||||
const status = err.statusCode || (err.name === 'ValidationError' ? 400 : 500);
|
||||
res.status(status).json({ success: false, error: err.message });
|
||||
};
|
||||
app.use('/api/v1', logsRoutes({ asyncHandler, ok }));
|
||||
app.use(errorHandler);
|
||||
return app;
|
||||
}
|
||||
|
||||
describe('routes /logs/journal', () => {
|
||||
let app;
|
||||
|
||||
beforeEach(async () => {
|
||||
mockJournald.readEntries.mockClear();
|
||||
mockJournald.streamEntries.mockClear();
|
||||
mockJournald.listUnits.mockClear();
|
||||
app = buildApp();
|
||||
// Let any keep-alive socket from the prior test close before we
|
||||
// bind a new express app.
|
||||
await new Promise(r => setTimeout(r, 10));
|
||||
});
|
||||
|
||||
describe('GET /logs/journal/units', () => {
|
||||
test('returns unit list when journald is mounted', async () => {
|
||||
const res = await request(app).get('/api/v1/logs/journal/units');
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body.success).toBe(true);
|
||||
expect(res.body.available).toBe(true);
|
||||
expect(res.body.units.length).toBeGreaterThanOrEqual(1);
|
||||
});
|
||||
});
|
||||
|
||||
describe('GET /logs/journal', () => {
|
||||
test('returns entries for caddy', async () => {
|
||||
const res = await request(app)
|
||||
.get('/api/v1/logs/journal')
|
||||
.query({ unit: 'caddy', tail: 50 });
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body.entries.length).toBeGreaterThanOrEqual(1);
|
||||
expect(res.body.entries[0].unit).toBe('caddy');
|
||||
expect(mockJournald.readEntries).toHaveBeenCalled();
|
||||
const call = mockJournald.readEntries.mock.calls[0][0];
|
||||
expect(call.unit).toBe('caddy');
|
||||
expect(call.tail).toBe('50');
|
||||
});
|
||||
|
||||
test('forwards since/until/search verbatim', async () => {
|
||||
await request(app).get('/api/v1/logs/journal').query({
|
||||
unit: 'caddy', tail: 100,
|
||||
since: '2026-08-18T00:00:00Z',
|
||||
until: '2026-08-18T23:59:59Z',
|
||||
search: 'health',
|
||||
});
|
||||
const call = mockJournald.readEntries.mock.calls[0][0];
|
||||
expect(call.since).toBe('2026-08-18T00:00:00Z');
|
||||
expect(call.until).toBe('2026-08-18T23:59:59Z');
|
||||
expect(call.search).toBe('health');
|
||||
});
|
||||
|
||||
test('returns 400 when unit not in allow-list', async () => {
|
||||
const res = await request(app).get('/api/v1/logs/journal').query({ unit: 'nginx' });
|
||||
expect(res.status).toBe(400);
|
||||
expect(res.body.error).toMatch(/not in allow-list/);
|
||||
// The reader is called and rejects; the route layer maps the
|
||||
// ValidationError to 400 without doing any spawn.
|
||||
expect(mockJournald.readEntries).toHaveBeenCalled();
|
||||
});
|
||||
|
||||
test('returns 400 when unit contains shell metacharacters', async () => {
|
||||
const res = await request(app).get('/api/v1/logs/journal').query({ unit: 'caddy; rm -rf /' });
|
||||
expect(res.status).toBe(400);
|
||||
expect(mockJournald.readEntries).toHaveBeenCalled();
|
||||
});
|
||||
|
||||
test('returns 400 when tail is invalid', async () => {
|
||||
const res = await request(app).get('/api/v1/logs/journal').query({ unit: 'caddy', tail: 'oops' });
|
||||
expect(res.status).toBe(400);
|
||||
});
|
||||
|
||||
test('returns 500 when reader throws non-validation error', async () => {
|
||||
mockJournald.readEntries.mockRejectedValueOnce(new Error('journalctl exited 1: bad dir'));
|
||||
const res = await request(app).get('/api/v1/logs/journal').query({ unit: 'caddy' });
|
||||
expect(res.status).toBe(500);
|
||||
expect(res.body.error).toMatch(/journalctl exited 1/);
|
||||
});
|
||||
});
|
||||
|
||||
describe('GET /logs/journal/stream', () => {
|
||||
test('opens SSE with correct content-type for a valid unit', async () => {
|
||||
// Stub the mock to immediately call onError so the route ends
|
||||
// the response and supertest can collect it. Production SSE
|
||||
// streams stay open until the client disconnects — covered by
|
||||
// the journald-reader.streamEntries unit tests.
|
||||
mockJournald.streamEntries.mockImplementationOnce((opts, hooks) => {
|
||||
setTimeout(() => hooks.onError && hooks.onError(new Error('synthetic-EOF')), 5);
|
||||
return { kill: jest.fn(), child: {} };
|
||||
});
|
||||
|
||||
const res = await request(app)
|
||||
.get('/api/v1/logs/journal/stream')
|
||||
.query({ unit: 'caddy' })
|
||||
.timeout(2000);
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.headers['content-type']).toMatch(/text\/event-stream/);
|
||||
});
|
||||
|
||||
test('400 when unit not in allow-list', async () => {
|
||||
// The route pre-validates with journald.assertUnitAllowed BEFORE
|
||||
// opening SSE — invalid unit returns a 400 JSON response without
|
||||
// touching the stream.
|
||||
const res = await request(app)
|
||||
.get('/api/v1/logs/journal/stream')
|
||||
.query({ unit: 'nginx' });
|
||||
expect(res.status).toBe(400);
|
||||
expect(res.body.error).toMatch(/not in allow-list/);
|
||||
// streamEntries must NOT have been called for a bad unit.
|
||||
expect(mockJournald.streamEntries).not.toHaveBeenCalled();
|
||||
});
|
||||
});
|
||||
});
|
||||
@@ -1,215 +0,0 @@
|
||||
/**
|
||||
* Caddy admin API CSRF Origin-header tests — DC-051
|
||||
*
|
||||
* Verifies:
|
||||
* - _httpFetch (fetchT's :2019 raw http branch) injects `Origin: http://<host>:<port>`
|
||||
* for any Caddy admin URL, satisfying Caddy's `enforce_origin` CSRF check
|
||||
* that activates on non-loopback admin binds (e.g. `admin 0.0.0.0:2019`).
|
||||
* - Caller-provided Origin via opts.headers WINS over the auto-injected
|
||||
* default (so future proxies / tests can override).
|
||||
* - fetchT routes :2019 URLs through _httpFetch (raw http.request) and
|
||||
* leaves HTTPS URLs on Node's undici fetch (for self-signed cert support).
|
||||
* - The /config/apps/http/servers/srv0/listen health probe that the readiness
|
||||
* handler emits against http://localhost:2019 includes the Origin header.
|
||||
*
|
||||
* Regression for the live 403 spam observed on DNS2 (Caddy log:
|
||||
* `{"error":"client is not allowed to access from origin ''","status_code":403}`
|
||||
* from User-Agent:node + Sec-Fetch-Mode:cors at remote_port 5xxxx, repeated
|
||||
* every ~10s while the readiness workflow probes Caddy admin). The fix is
|
||||
* the Origin header injection here + the `origins` directive in the
|
||||
* Caddyfile's admin block on DNS2 — both are required for Caddy's CSRF
|
||||
* check to accept same-origin admin calls.
|
||||
*/
|
||||
|
||||
// Capture the http.request call shape without spinning up a real server.
|
||||
// We do this by reading the http.js source and exporting a probe function
|
||||
// that the test calls directly — this avoids brittle mock plumbing while
|
||||
// still proving the Origin header is constructed correctly.
|
||||
//
|
||||
// Strategy: the test imports a small wrapper that exposes the request
|
||||
// construction step from _httpFetch in isolation, then asserts on the
|
||||
// returned options.
|
||||
|
||||
const path = require('path');
|
||||
const fs = require('fs');
|
||||
|
||||
// Strip JS comments so docblock prose doesn't false-positive on regex
|
||||
// patterns that look for code (e.g. `origins`, `enforce_origin`).
|
||||
// IMPORTANT: do not strip `//` inside template literals — those are
|
||||
// URL/comment sequences like `http://${parsed.hostname}:${parsed.port}`.
|
||||
// We do this in two passes: (1) protect template-literal contents by
|
||||
// replacing them with placeholders, (2) strip comments, (3) restore
|
||||
// the placeholders.
|
||||
function stripComments(src) {
|
||||
// Pass 1: replace template literals (backtick-delimited) with sentinels.
|
||||
const templates = [];
|
||||
let protectedSrc = src.replace(/`(?:\\.|[^`\\])*`/g, (match) => {
|
||||
const idx = templates.length;
|
||||
templates.push(match);
|
||||
return `\u0000TPL${idx}\u0000`;
|
||||
});
|
||||
// Pass 2: strip block + line comments from the now-comment-safe string.
|
||||
protectedSrc = protectedSrc
|
||||
.replace(/\/\*[\s\S]*?\*\//g, '') // block comments
|
||||
.replace(/(^|[^:])\/\/.*$/gm, '$1'); // line comments, leaving URLs alone
|
||||
// Pass 3: restore template literals.
|
||||
return protectedSrc.replace(/\u0000TPL(\d+)\u0000/g, (_, idx) => templates[+idx]);
|
||||
}
|
||||
|
||||
const { fetchT } = require('../src/utils/http');
|
||||
|
||||
describe('Caddyfile + utils/http.js — Origin header construction (DC-051)', () => {
|
||||
test('http.js _httpFetch computes Origin from parsed URL host+port', () => {
|
||||
// Read the source file and verify the Origin line is constructed from
|
||||
// the parsed URL's hostname+port, matching what the readiness probe needs.
|
||||
const code = stripComments(fs.readFileSync(
|
||||
path.join(__dirname, '../src/utils/http.js'),
|
||||
'utf8'
|
||||
));
|
||||
|
||||
// 1. The default origin is built from the parsed URL
|
||||
expect(code).toMatch(/const defaultOrigin\s*=\s*`\$\{parsed\.protocol\}\/\/\$\{parsed\.hostname\}:\$\{parsed\.port\s*\|\|\s*2019\}`/);
|
||||
|
||||
// 2. The Origin header is set, with caller opts.headers spread after
|
||||
// (so caller wins on duplicate keys)
|
||||
expect(code).toMatch(/headers:\s*{\s*Origin:\s*defaultOrigin,\s*\.\.\.opts\.headers,/);
|
||||
|
||||
// 3. The router still routes :2019 to _httpFetch (raw http.request)
|
||||
expect(code).toMatch(/if\s*\(url\.includes\(':2019'\)\)/);
|
||||
|
||||
// 4. Comments explain the CSRF rationale (regression-proofing).
|
||||
// We check the RAW (with comments) source so this catches accidental
|
||||
// removal of the rationale docblock too.
|
||||
const raw = fs.readFileSync(
|
||||
path.join(__dirname, '../src/utils/http.js'),
|
||||
'utf8'
|
||||
);
|
||||
expect(raw).toMatch(/enforce_origin/);
|
||||
expect(raw).toMatch(/origins/);
|
||||
});
|
||||
|
||||
test('all :2019 call sites use fetchT (not raw fetch)', () => {
|
||||
// Every Caddy admin API call in the API code should go through fetchT,
|
||||
// not bare fetch — fetchT routes :2019 through _httpFetch which now
|
||||
// injects Origin. A new call site using bare fetch would skip the
|
||||
// CSRF fix and re-introduce the 403 loop.
|
||||
const apiRoot = path.join(__dirname, '..');
|
||||
const offenders = [];
|
||||
function walk(dir) {
|
||||
for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
|
||||
if (entry.name === 'node_modules' || entry.name === '__tests__') continue;
|
||||
const p = path.join(dir, entry.name);
|
||||
if (entry.isDirectory()) walk(p);
|
||||
else if (entry.name.endsWith('.js')) {
|
||||
const text = stripComments(fs.readFileSync(p, 'utf8'));
|
||||
// Find every `fetch(` call and check whether the SAME call contains
|
||||
// a :2019 URL — if so, it should be `fetchT(` instead.
|
||||
const matches = text.match(/await\s+fetch\(([^)]*)\)/g) || [];
|
||||
for (const m of matches) {
|
||||
if (/:2019|adminUrl|admin_api_url|CADDY_ADMIN/.test(m)) {
|
||||
offenders.push(`${p}: ${m.slice(0, 100)}`);
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
walk(apiRoot);
|
||||
expect(offenders).toEqual([]);
|
||||
});
|
||||
|
||||
test('readiness handler in src/app.js probes the exact URL the watcher needs', () => {
|
||||
const raw = fs.readFileSync(
|
||||
path.join(__dirname, '../src/app.js'),
|
||||
'utf8'
|
||||
);
|
||||
// The probe URL is the one that was 403-looping every 10s in prod.
|
||||
expect(raw).toMatch(/\/config\/apps\/http\/servers\/srv0\/listen/);
|
||||
// Goes through fetchT, NOT bare fetch — that's how the Origin injection
|
||||
// takes effect. Look at the 800 chars BEFORE the probe URL on the same
|
||||
// line / call site — the call must be `fetchT(...)`, not `await fetch(...)`.
|
||||
// (We look backward because the URL sits inside the call's argument list,
|
||||
// so the call site comes before the URL token.)
|
||||
const idx = raw.indexOf('srv0/listen');
|
||||
const around = raw.substr(Math.max(0, idx - 400), 800);
|
||||
expect(around).toMatch(/fetchT\(/);
|
||||
expect(around).not.toMatch(/await fetch\(/);
|
||||
});
|
||||
|
||||
test('end-to-end: fetchT sends Origin header to a real HTTP server on :2019', async () => {
|
||||
// Spin up a minimal HTTP server on a port that LOOKS like :2019 from
|
||||
// fetchT's router perspective. We use port :20190 (contains ':2019'
|
||||
// substring so url.includes(':2019') is true → routes through _httpFetch)
|
||||
// to avoid clashing with any local Caddy on the canonical :2019.
|
||||
const http = require('http');
|
||||
let capturedHeaders = null;
|
||||
const server = http.createServer((req, res) => {
|
||||
capturedHeaders = req.headers;
|
||||
res.writeHead(200, { 'Content-Type': 'application/json' });
|
||||
res.end('["::"]');
|
||||
});
|
||||
await new Promise((resolve, reject) => {
|
||||
server.once('error', reject);
|
||||
server.listen(20190, '127.0.0.1', resolve);
|
||||
});
|
||||
try {
|
||||
// fetchT routes this URL through _httpFetch because it includes
|
||||
// ':2019' as a substring. _httpFetch computes Origin from the
|
||||
// parsed URL — parsed.port is '20190' here, so Origin is
|
||||
// http://127.0.0.1:20190.
|
||||
const result = await fetchT(
|
||||
'http://127.0.0.1:20190/config/apps/http/servers/srv0/listen',
|
||||
{},
|
||||
5000
|
||||
);
|
||||
expect(result.status).toBe(200);
|
||||
expect(capturedHeaders.origin).toBe('http://127.0.0.1:20190');
|
||||
// raw http doesn't add User-Agent by default
|
||||
expect(capturedHeaders['user-agent']).toBeUndefined();
|
||||
// critical: no Sec-Fetch-Mode: cors (that's what triggers Caddy's CSRF)
|
||||
expect(capturedHeaders['sec-fetch-mode']).toBeUndefined();
|
||||
} finally {
|
||||
await new Promise((r) => server.close(r));
|
||||
}
|
||||
});
|
||||
|
||||
test('Caddyfile template documents the origins directive for non-loopback admin bind', () => {
|
||||
// The HIGH-severity fix from GLM review: the live /etc/caddy/Caddyfile
|
||||
// is operator-managed (via caddy-apply, NOT in this repo), so this
|
||||
// test guards the only Caddyfile that IS in the repo — the installer
|
||||
// template — so any future operator using `admin 0.0.0.0:2019` (like
|
||||
// DNS2 does for the docker bridge to reach it) sees the same shape
|
||||
// and isn't surprised by the 403 loop. If a future change adopts
|
||||
// non-loopback admin in the template, this test demands the `origins`
|
||||
// directive alongside it.
|
||||
const tmplPath = path.join(__dirname, '../dashcaddy-installer/templates/Caddyfile.template');
|
||||
const exists = fs.existsSync(tmplPath);
|
||||
if (!exists) {
|
||||
// Template absent (maybe removed in a refactor) — skip with explicit note
|
||||
console.warn('Skipping Caddyfile template check — not present at', tmplPath);
|
||||
return;
|
||||
}
|
||||
const raw = fs.readFileSync(tmplPath, 'utf8');
|
||||
// Strip comments to look at the actual config shape.
|
||||
const code = stripComments(raw);
|
||||
const adminBlock = code.match(/admin\s+([^{\s]+)(?:\s+\{([^}]*)\})?/);
|
||||
if (!adminBlock) {
|
||||
// No admin block configured at all — operator default; nothing to check.
|
||||
return;
|
||||
}
|
||||
const listen = adminBlock[1];
|
||||
const isLoopback = listen === '127.0.0.1:2019' || listen === 'localhost:2019' || listen === '::1:2019';
|
||||
const inner = adminBlock[2] || '';
|
||||
if (!isLoopback) {
|
||||
// Non-loopback bind — the `origins` directive is REQUIRED to prevent
|
||||
// the 403 loop we just fixed. This assertion will fail if someone
|
||||
// changes the template to non-loopback without adding origins.
|
||||
expect(inner).toMatch(/origins\s/);
|
||||
} else {
|
||||
// Loopback bind — Caddy allows loopback origins implicitly, so the
|
||||
// `origins` directive is unnecessary. We just verify the template
|
||||
// shape is consistent (admin bind + optional inner block).
|
||||
expect(listen).toMatch(/:2019/);
|
||||
}
|
||||
});
|
||||
});
|
||||
+124
-216
@@ -1,29 +1,83 @@
|
||||
const express = require('express');
|
||||
const fs = require('fs');
|
||||
const fsp = require('fs').promises;
|
||||
const { exists } = require('../src/utilities/fs-helpers');
|
||||
const { success, error: errorResponse } = require('../src/utils/responses');
|
||||
const { paginate, parsePaginationParams } = require('../src/utilities/pagination');
|
||||
const { success } = require('../src/utils/responses');
|
||||
const { ValidationError } = require('../src/utilities/errors');
|
||||
|
||||
// The unified error logger writes entries separated by a long horizontal-rule
|
||||
// line made of U+2500 BOX DRAWINGS LIGHT HORIZONTAL (verified 2026-08-18
|
||||
// against /opt/dashcaddy/dashcaddy-api/data/error.log on DNS2 — the previous
|
||||
// implementation split on '='.repeat(80), which returned ONE block and
|
||||
// produced ZERO entries for the modal). Anything else got dropped silently.
|
||||
const ENTRY_SEPARATOR_RE = /\n\u2500{20,}\n?/;
|
||||
const ENTRY_HEADER_RE = /^\[([^\]]+)\]\s+\[([A-Z]+)\]\s+(.*?):\s*(.*)$/;
|
||||
|
||||
const MAX_TAIL = 500;
|
||||
const MAX_TAIL_BYTES = 2 * 1024 * 1024; // never read more than 2 MiB from disk
|
||||
|
||||
/**
|
||||
* Parse the unified error-log format into structured entries.
|
||||
* Each entry:
|
||||
* [2026-08-16T23:13:14.123Z] [ERR] ctx: message
|
||||
* <stack trace lines, if any>
|
||||
* request: ... (optional)
|
||||
* context: {...} (optional)
|
||||
* ────────────── (separator)
|
||||
* @param {string} text
|
||||
* @returns {Array<{timestamp:string,level:string,context:string,message:string,details:string|null}>}
|
||||
*/
|
||||
function parseEntries(text) {
|
||||
if (!text) return [];
|
||||
const blocks = text.split(ENTRY_SEPARATOR_RE);
|
||||
const entries = [];
|
||||
for (const block of blocks) {
|
||||
const trimmed = block.replace(/^\n+|\n+$/g, '');
|
||||
if (!trimmed) continue;
|
||||
const firstLineEnd = trimmed.indexOf('\n');
|
||||
const firstLine = firstLineEnd === -1 ? trimmed : trimmed.slice(0, firstLineEnd);
|
||||
const rest = firstLineEnd === -1 ? '' : trimmed.slice(firstLineEnd + 1);
|
||||
const m = firstLine.match(ENTRY_HEADER_RE);
|
||||
if (!m) continue;
|
||||
entries.push({
|
||||
timestamp: m[1],
|
||||
level: m[2],
|
||||
context: m[3],
|
||||
message: m[4],
|
||||
details: rest ? rest.replace(/\n+$/g, '') : null,
|
||||
});
|
||||
}
|
||||
return entries;
|
||||
}
|
||||
|
||||
/**
|
||||
* Read the last N bytes of a UTF-8 file safely (so the 4 MiB log doesn't
|
||||
* blow up memory or block the event loop). Splits on the first complete
|
||||
* line boundary after the cut.
|
||||
*/
|
||||
async function readTailBytes(filePath, byteLimit) {
|
||||
const fh = await fsp.open(filePath, 'r');
|
||||
try {
|
||||
const stat = await fh.stat();
|
||||
const start = Math.max(0, stat.size - byteLimit);
|
||||
const length = stat.size - start;
|
||||
const buf = Buffer.alloc(length);
|
||||
await fh.read(buf, 0, length, start);
|
||||
let text = buf.toString('utf8');
|
||||
// If we cut into the middle of a UTF-8 sequence, drop the partial char
|
||||
const partialLead = text.match(/[\uD800-\uDBFF]$/);
|
||||
if (partialLead) text = text.slice(0, -1);
|
||||
// Drop a half first line so we never start mid-entry
|
||||
const nl = text.indexOf('\n');
|
||||
if (start > 0 && nl !== -1) text = text.slice(nl + 1);
|
||||
return { text, totalSize: stat.size, truncated: start > 0 };
|
||||
} finally {
|
||||
await fh.close();
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Error logs routes factory
|
||||
*
|
||||
* DC-052: Enhanced the legacy `GET /error-logs` tail handler with:
|
||||
* - Server-side filtering by level (ERR / WARN), context (substring),
|
||||
* free-text search across error+message+stack, and time window (since/until).
|
||||
* - Real pagination via limit/offset (the legacy handler returned only the
|
||||
* last 50 entries, which made it impossible to inspect older entries
|
||||
* once the file grew past 5MB — the logging module rotates at 5MB).
|
||||
* - Distinct-context endpoint for populating the frontend filter dropdown.
|
||||
* - Confirm=CLEAR gating on DELETE so an accidental click can't wipe
|
||||
* forensic context (matches the audit-log DC-050 hardening).
|
||||
*
|
||||
* The audit-log routes that previously lived here moved to
|
||||
* `routes/audit-log.js` (DC-050). We keep thin proxy handlers so any
|
||||
* client still talking to /api/v1/audit-logs gets the new behaviour
|
||||
* without an extra hop — the actual route module is preferred when
|
||||
* mounted, but this defensive duplicate means a partial deploy
|
||||
* (apiRouter only loads this file) still serves correct answers.
|
||||
*
|
||||
* @param {Object} deps - Explicit dependencies
|
||||
* @param {string} deps.ERROR_LOG_FILE - Path to error log file
|
||||
* @param {Object} deps.auditLogger - Audit logger instance
|
||||
@@ -33,216 +87,70 @@ const { success, error: errorResponse } = require('../src/utils/responses');
|
||||
module.exports = function({ ERROR_LOG_FILE, auditLogger, asyncHandler }) {
|
||||
const router = express.Router();
|
||||
|
||||
// ── DC-052: Robust entry parser ────────────────────────────────────────
|
||||
// The error log format produced by src/utils/logging.js is:
|
||||
// [ISO_TIMESTAMP] [LEVEL] ctx: message
|
||||
// <stack frames...>
|
||||
// request: ... | ip: ... | ua: ... | id: ...
|
||||
// context: {...}
|
||||
// ──── (80 equal-signs) ────
|
||||
// Anything between two 80-equal lines is one entry. The legacy parser
|
||||
// assumed `[ts] ctx: msg` with no LEVEL field; we now extract LEVEL and
|
||||
// collapse multi-line context/request blocks into structured fields so the
|
||||
// frontend can filter/search on them.
|
||||
const ENTRY_SEP = '='.repeat(80);
|
||||
const HEADER_RE = /^\[([^\]]+)\] \[([^\]]+)\] ([^:]+): (.*)$/;
|
||||
const REQUEST_RE = /request:\s*(.*?)\s*\|\s*ip:\s*(\S+)\s*\|\s*ua:\s*(.*?)\s*\|\s*id:\s*(\S+)/;
|
||||
const CONTEXT_RE = /context:\s*(\{[^\n]*\})\s*$/m;
|
||||
|
||||
function parseEntries(logContent) {
|
||||
const raw = logContent.split(ENTRY_SEP);
|
||||
const entries = [];
|
||||
for (const block of raw) {
|
||||
const trimmed = block.trim();
|
||||
if (!trimmed) continue;
|
||||
const lines = trimmed.split('\n');
|
||||
const headerLine = lines[0];
|
||||
const m = headerLine.match(HEADER_RE);
|
||||
if (!m) {
|
||||
// Unknown shape — keep it as a "raw" entry so nothing gets silently
|
||||
// dropped from the operator's view.
|
||||
entries.push({
|
||||
timestamp: null,
|
||||
level: null,
|
||||
context: null,
|
||||
error: trimmed,
|
||||
request: null,
|
||||
contextJson: null,
|
||||
raw: trimmed,
|
||||
_rawTimestamp: 0,
|
||||
});
|
||||
continue;
|
||||
}
|
||||
const [, timestamp, level, context, message] = m;
|
||||
const bodyLines = lines.slice(1);
|
||||
const bodyText = bodyLines.join('\n');
|
||||
const reqMatch = bodyText.match(REQUEST_RE);
|
||||
const ctxMatch = bodyText.match(CONTEXT_RE);
|
||||
let contextJson = null;
|
||||
if (ctxMatch) {
|
||||
try { contextJson = JSON.parse(ctxMatch[1]); } catch { /* leave as null */ }
|
||||
}
|
||||
entries.push({
|
||||
timestamp,
|
||||
level,
|
||||
context,
|
||||
error: message,
|
||||
request: reqMatch ? {
|
||||
method_path: reqMatch[1] || '',
|
||||
ip: reqMatch[2] || '',
|
||||
ua: reqMatch[3] || '',
|
||||
id: reqMatch[4] || '',
|
||||
} : null,
|
||||
contextJson,
|
||||
// The full multi-line block (header + stack + request + context) for
|
||||
// the "click to expand" detail view in the UI.
|
||||
detail: trimmed,
|
||||
_rawTimestamp: timestamp ? Date.parse(timestamp) || 0 : 0,
|
||||
});
|
||||
}
|
||||
return entries;
|
||||
}
|
||||
|
||||
// Validate ISO timestamp strings (since/until) — accept anything
|
||||
// Date.parse() understands so we don't reject a bare "2026-08-17".
|
||||
function parseTimestamp(raw, fieldName) {
|
||||
if (!raw) return null;
|
||||
const t = Date.parse(raw);
|
||||
if (Number.isNaN(t)) {
|
||||
throw new Error(`Invalid ${fieldName} timestamp: ${raw}`);
|
||||
}
|
||||
return t;
|
||||
}
|
||||
|
||||
// Cap limit so a misconfigured client can't ask for the entire log
|
||||
// (which could be tens of MB on long-running installs).
|
||||
const MAX_LIMIT = 500;
|
||||
const DEFAULT_LIMIT = 50;
|
||||
|
||||
// ── DC-052: Distinct contexts endpoint ─────────────────────────────────
|
||||
// The frontend uses this to populate the "Context" dropdown so operators
|
||||
// can drill into one subsystem (e.g. all "updater" or "http" errors).
|
||||
router.get('/error-logs/contexts', asyncHandler(async (req, res) => {
|
||||
if (!await exists(ERROR_LOG_FILE)) {
|
||||
return success(res, { contexts: [] });
|
||||
}
|
||||
const logContent = await fsp.readFile(ERROR_LOG_FILE, 'utf8');
|
||||
const entries = parseEntries(logContent);
|
||||
const counts = new Map();
|
||||
for (const e of entries) {
|
||||
if (!e.context) continue;
|
||||
counts.set(e.context, (counts.get(e.context) || 0) + 1);
|
||||
}
|
||||
const contexts = Array.from(counts.entries())
|
||||
.map(([name, count]) => ({ name, count }))
|
||||
.sort((a, b) => b.count - a.count);
|
||||
success(res, { contexts });
|
||||
}, 'error-logs-contexts'));
|
||||
|
||||
// ── DC-052: Enhanced GET /error-logs ───────────────────────────────────
|
||||
// Get error logs
|
||||
// GET /api/v1/error-logs?tail=100&level=ERR
|
||||
// - tail: cap on returned entries (default 100, max 500)
|
||||
// - level: filter by level (ERR/WARN/INFO/DBG) — case-insensitive
|
||||
router.get('/error-logs', asyncHandler(async (req, res) => {
|
||||
const level = (req.query.level || '').toString().trim();
|
||||
const context = (req.query.context || '').toString().trim();
|
||||
const search = (req.query.search || '').toString().trim();
|
||||
let since, until;
|
||||
try {
|
||||
since = parseTimestamp(req.query.since, 'since');
|
||||
until = parseTimestamp(req.query.until, 'until');
|
||||
} catch (e) {
|
||||
return errorResponse(res, e.message, 400);
|
||||
}
|
||||
if (level && !['ERR', 'WARN', 'INFO', 'DEBUG'].includes(level)) {
|
||||
return errorResponse(res, `Unknown level: ${level}`, 400);
|
||||
}
|
||||
const limit = Math.min(
|
||||
Math.max(parseInt(req.query.limit, 10) || DEFAULT_LIMIT, 1),
|
||||
MAX_LIMIT
|
||||
);
|
||||
const offset = Math.max(parseInt(req.query.offset, 10) || 0, 0);
|
||||
|
||||
if (!await exists(ERROR_LOG_FILE)) {
|
||||
return success(res, {
|
||||
logs: [],
|
||||
total: 0,
|
||||
hasMore: false,
|
||||
filters: { level: level || null, context: context || null, search: search || null, since: null, until: null },
|
||||
});
|
||||
return success(res, { logs: [], totalSize: 0, truncated: false });
|
||||
}
|
||||
|
||||
const logContent = await fsp.readFile(ERROR_LOG_FILE, 'utf8');
|
||||
let entries = parseEntries(logContent);
|
||||
let tailRaw = parseInt(req.query.tail, 10);
|
||||
if (!Number.isFinite(tailRaw) || tailRaw <= 0) tailRaw = 100;
|
||||
const tail = Math.min(tailRaw, MAX_TAIL);
|
||||
|
||||
// Filter chain — order matters: the cheapest predicate runs first so we
|
||||
// skip work on entries the others would also reject.
|
||||
if (level) entries = entries.filter((e) => e.level === level);
|
||||
if (context) entries = entries.filter((e) => (e.context || '').includes(context));
|
||||
if (since != null) entries = entries.filter((e) => e._rawTimestamp >= since);
|
||||
if (until != null) entries = entries.filter((e) => e._rawTimestamp <= until);
|
||||
if (search) {
|
||||
const needle = search.toLowerCase();
|
||||
entries = entries.filter((e) => {
|
||||
if ((e.error || '').toLowerCase().includes(needle)) return true;
|
||||
if ((e.context || '').toLowerCase().includes(needle)) return true;
|
||||
if (e.detail && e.detail.toLowerCase().includes(needle)) return true;
|
||||
if (e.request && e.request.ip && e.request.ip.toLowerCase().includes(needle)) return true;
|
||||
return false;
|
||||
});
|
||||
const levelFilter = req.query.level ? String(req.query.level).toUpperCase() : null;
|
||||
|
||||
const { text, totalSize, truncated } = await readTailBytes(ERROR_LOG_FILE, MAX_TAIL_BYTES);
|
||||
let logs = parseEntries(text);
|
||||
|
||||
if (levelFilter) {
|
||||
logs = logs.filter(e => e.level === levelFilter);
|
||||
}
|
||||
|
||||
// Sort newest first; entries without a parseable timestamp sink to the
|
||||
// bottom (Date.parse returns NaN → _rawTimestamp=0).
|
||||
entries.sort((a, b) => b._rawTimestamp - a._rawTimestamp);
|
||||
// Newest first; bounded by `tail`
|
||||
logs = logs.slice(-tail).reverse();
|
||||
|
||||
const total = entries.length;
|
||||
const page = entries.slice(offset, offset + limit);
|
||||
// Strip the internal field so it doesn't leak into the wire response.
|
||||
const logs = page.map(({ _rawTimestamp, ...rest }) => rest);
|
||||
|
||||
success(res, {
|
||||
logs,
|
||||
total,
|
||||
hasMore: offset + logs.length < total,
|
||||
filters: {
|
||||
level: level || null,
|
||||
context: context || null,
|
||||
search: search || null,
|
||||
since: req.query.since || null,
|
||||
until: req.query.until || null,
|
||||
},
|
||||
});
|
||||
success(res, { logs, totalSize, truncated, returned: logs.length });
|
||||
}, 'error-logs-get'));
|
||||
|
||||
// Clear error logs (gated by confirm=CLEAR — DC-052)
|
||||
// Clear error logs
|
||||
router.delete('/error-logs', asyncHandler(async (req, res) => {
|
||||
const confirm = (req.body && req.body.confirm) || '';
|
||||
if (confirm !== 'CLEAR') {
|
||||
return errorResponse(res, 'Body must include { confirm: "CLEAR" }', 400);
|
||||
if (!await exists(ERROR_LOG_FILE)) {
|
||||
return success(res, { message: 'Error logs cleared', cleared: 0 });
|
||||
}
|
||||
if (await exists(ERROR_LOG_FILE)) {
|
||||
await fsp.writeFile(ERROR_LOG_FILE, '');
|
||||
}
|
||||
// Audit the clear BEFORE returning so the wipe itself is recorded.
|
||||
try {
|
||||
if (auditLogger && typeof auditLogger.log === 'function') {
|
||||
await auditLogger.log({
|
||||
action: 'error-log.clear',
|
||||
resource: 'all',
|
||||
outcome: 'success',
|
||||
details: { source: 'error-logs/DELETE' },
|
||||
});
|
||||
}
|
||||
} catch { /* don't fail the clear on audit failure */ }
|
||||
success(res, { message: 'Error logs cleared' });
|
||||
const before = await fsp.stat(ERROR_LOG_FILE).then(s => s.size).catch(() => 0);
|
||||
await fsp.writeFile(ERROR_LOG_FILE, '');
|
||||
success(res, { message: 'Error logs cleared', clearedBytes: before });
|
||||
}, 'error-logs-clear'));
|
||||
|
||||
// DC-052 fix: removed the legacy /audit-logs GET/DELETE proxies that lived
|
||||
// here before DC-050. GLM judge round-1 flagged this as HIGH-severity:
|
||||
// because errorLogsRoutes is mounted in src/app.js (line 733) BEFORE
|
||||
// auditLogRoutes (line 789), these legacy handlers shadowed DC-050's
|
||||
// hardened versions — DELETE without confirm=CLEAR would silently wipe the
|
||||
// audit log, GET filters (action whitelist, ISO since/until, outcome) were
|
||||
// never invoked, and /audit-logs/actions was unreachable. The hardened
|
||||
// handlers in routes/audit-log.js are the single source of truth now.
|
||||
// Audit log
|
||||
router.get('/audit-logs', asyncHandler(async (req, res) => {
|
||||
const paginationParams = parsePaginationParams(req.query);
|
||||
const action = req.query.action || '';
|
||||
if (paginationParams) {
|
||||
const entries = await auditLogger.query({ limit: Number.MAX_SAFE_INTEGER, offset: 0, action });
|
||||
const result = paginate(entries, paginationParams);
|
||||
success(res, { entries: result.data, pagination: result.pagination });
|
||||
} else {
|
||||
const limit = parseInt(req.query.limit) || 50;
|
||||
const offset = parseInt(req.query.offset) || 0;
|
||||
const entries = await auditLogger.query({ limit, offset, action });
|
||||
success(res, { entries });
|
||||
}
|
||||
}, 'audit-log'));
|
||||
|
||||
router.delete('/audit-logs', asyncHandler(async (req, res) => {
|
||||
await auditLogger.clear();
|
||||
success(res, { message: 'Audit log cleared' });
|
||||
}, 'audit-log-clear'));
|
||||
|
||||
return router;
|
||||
};
|
||||
|
||||
// Exported for unit testing
|
||||
module.exports.parseEntries = parseEntries;
|
||||
module.exports.readTailBytes = readTailBytes;
|
||||
module.exports.MAX_TAIL = MAX_TAIL;
|
||||
module.exports.MAX_TAIL_BYTES = MAX_TAIL_BYTES;
|
||||
@@ -6,15 +6,6 @@ const { exists } = require('../src/utilities/fs-helpers');
|
||||
const { paginate, parsePaginationParams } = require('../src/utilities/pagination');
|
||||
const { NotFoundError, ValidationError, ForbiddenError } = require('../src/utilities/errors');
|
||||
const { ok } = require('../src/utils/responses');
|
||||
const journald = require('../src/monitoring/journald-reader');
|
||||
|
||||
const journaldAvailable = (() => {
|
||||
try {
|
||||
return fs.existsSync('/var/log/journal') && fs.existsSync('/usr/bin/journalctl');
|
||||
} catch (_) {
|
||||
return false;
|
||||
}
|
||||
})();
|
||||
|
||||
/**
|
||||
* Logs route factory
|
||||
@@ -227,99 +218,6 @@ module.exports = function({ asyncHandler, ok, docker, logDigest, dockerMaintenan
|
||||
ok(res, { result });
|
||||
}, 'logs-docker-maintenance'));
|
||||
|
||||
// ===== DC-055: Host journald log viewer =====
|
||||
// Reads from the host's /var/log/journal via bind-mount in start.sh.
|
||||
// Returns 503 if the bind-mount isn't present (dev containers, Windows).
|
||||
|
||||
// Allow-list of units the dashboard can stream. Exposed to the client so
|
||||
// the dropdown stays in sync with the server-side allow-list.
|
||||
router.get('/logs/journal/units', asyncHandler(async (req, res) => {
|
||||
if (!journaldAvailable) {
|
||||
return ok(res, { available: false, units: [] });
|
||||
}
|
||||
const units = await journald.listUnits();
|
||||
ok(res, { available: true, units });
|
||||
}, 'logs-journal-units'));
|
||||
|
||||
// Read a bounded tail of entries for a unit.
|
||||
router.get('/logs/journal', asyncHandler(async (req, res) => {
|
||||
if (!journaldAvailable) {
|
||||
throw new Error('journald not mounted in this container (host /var/log/journal + /usr/bin/journalctl required)');
|
||||
}
|
||||
const entries = await journald.readEntries({
|
||||
unit: req.query.unit,
|
||||
tail: req.query.tail,
|
||||
since: req.query.since,
|
||||
until: req.query.until,
|
||||
search: req.query.search,
|
||||
});
|
||||
ok(res, { entries, count: entries.length });
|
||||
}, 'logs-journal-read'));
|
||||
|
||||
// Stream entries as they arrive (Server-Sent Events).
|
||||
router.get('/logs/journal/stream', asyncHandler(async (req, res) => {
|
||||
if (!journaldAvailable) {
|
||||
res.statusCode = 503;
|
||||
res.setHeader('Content-Type', 'text/event-stream');
|
||||
res.write(`data: ${JSON.stringify({ error: 'journald not mounted in this container' })}\n\n`);
|
||||
res.end();
|
||||
return;
|
||||
}
|
||||
|
||||
// Validate BEFORE writing SSE headers — once headers go out we
|
||||
// can't change statusCode. The reader does the same validation but
|
||||
// we want to short-circuit here so the response status reflects the
|
||||
// right category (400 for validation, 503 for bind-mount missing).
|
||||
try {
|
||||
journald.assertUnitAllowed(req.query.unit);
|
||||
if (req.query.since) journald.parseTimestamp(req.query.since, 'since');
|
||||
} catch (err) {
|
||||
// Pass through the global error middleware so the response status
|
||||
// + shape matches every other validation error in the API.
|
||||
throw err;
|
||||
}
|
||||
|
||||
// SSE headers — same convention as /logs/stream/:id.
|
||||
res.setHeader('Content-Type', 'text/event-stream');
|
||||
res.setHeader('Cache-Control', 'no-cache');
|
||||
res.setHeader('Connection', 'keep-alive');
|
||||
res.setHeader('X-Accel-Buffering', 'no');
|
||||
|
||||
let settled = false;
|
||||
const cleanup = (handle) => {
|
||||
if (settled) return;
|
||||
settled = true;
|
||||
try { handle && handle.kill(); } catch (_) { /* already dead */ }
|
||||
try { res.end(); } catch (_) { /* already closed */ }
|
||||
};
|
||||
|
||||
let handle;
|
||||
try {
|
||||
handle = journald.streamEntries(
|
||||
{ unit: req.query.unit, since: req.query.since, search: req.query.search },
|
||||
{
|
||||
onData(entry) {
|
||||
if (settled) return;
|
||||
res.write(`data: ${JSON.stringify(entry)}\n\n`);
|
||||
},
|
||||
onError(err) {
|
||||
if (settled) return;
|
||||
res.write(`data: ${JSON.stringify({ error: err.message || String(err) })}\n\n`);
|
||||
cleanup(handle);
|
||||
},
|
||||
}
|
||||
);
|
||||
} catch (err) {
|
||||
res.write(`data: ${JSON.stringify({ error: (err && err.message) || 'stream failed' })}\n\n`);
|
||||
try { res.end(); } catch (_) { /* ignore */ }
|
||||
return;
|
||||
}
|
||||
|
||||
// Modern Node fires 'close' for both clean disconnects and aborts;
|
||||
// the separate 'aborted' listener is deprecated as of Node 18.
|
||||
req.on('close', () => cleanup(handle));
|
||||
}, 'logs-journal-stream'));
|
||||
|
||||
// Get logs from a file path (for native applications)
|
||||
router.get('/logs/file', asyncHandler(async (req, res) => {
|
||||
const { path: logPath, tail = 100 } = req.query;
|
||||
|
||||
@@ -52,34 +52,6 @@ const STATE_FILE = process.env.CADDY_UPSTREAMS_STATE_FILE
|
||||
|
||||
const SITES_DIR = process.env.CADDY_SITES_DIR || '/etc/caddy/sites';
|
||||
|
||||
/**
|
||||
* Hostname the probe uses instead of a loopback address.
|
||||
*
|
||||
* CRITICAL: this watcher runs INSIDE the dashcaddy-api container. Caddy runs
|
||||
* on the HOST. A site config's `reverse_proxy localhost:8088` means "the
|
||||
* host's loopback" from Caddy's point of view — but from inside the container
|
||||
* `localhost`/`127.0.0.1` is the container's OWN loopback, where nothing
|
||||
* listens. Probing loopback verbatim makes every healthy host-side upstream
|
||||
* report ECONNREFUSED (live prod bug 2026-08-18: 9 of 14 tracked upstreams
|
||||
* showed 278 consecutive phantom failures and opened bogus `caddy-upstream-dead`
|
||||
* incidents).
|
||||
*
|
||||
* Fix: remap loopback probe targets to `host.docker.internal`, which start.sh
|
||||
* pins to the host's bridge IP via `--add-host=host.docker.internal:host-gateway`
|
||||
* (Docker ≥ 20.10). The upstream's display key stays `localhost:PORT` so
|
||||
* existing mute lists and UI labels are unaffected — only the probe target
|
||||
* changes. Set IN_CONTAINER=false (e.g. a bare-metal deployment where the API
|
||||
* runs beside Caddy) to disable the remap.
|
||||
*/
|
||||
const HOST_GATEWAY_NAME = process.env.CADDY_UPSTREAM_HOST_GATEWAY_NAME || 'host.docker.internal';
|
||||
const IN_CONTAINER = process.env.IN_CONTAINER !== 'false';
|
||||
const HOST_GATEWAY_PROBE = IN_CONTAINER ? HOST_GATEWAY_NAME : null;
|
||||
|
||||
/** True when the address is IPv4 loopback (127.0.0.0/8) or the `localhost` name. */
|
||||
function isLoopbackHost(host) {
|
||||
return host === 'localhost' || /^127(\.\d{1,3}){3}$/.test(host);
|
||||
}
|
||||
|
||||
class CaddyUpstreamWatcher extends EventEmitter {
|
||||
constructor(opts = {}) {
|
||||
super();
|
||||
@@ -223,12 +195,7 @@ class CaddyUpstreamWatcher extends EventEmitter {
|
||||
|
||||
/** Probe a single upstream and update state. */
|
||||
async _probeOne(u) {
|
||||
// Loopback upstreams (see HOST_GATEWAY_PROBE header comment): the Caddyfile
|
||||
// `localhost`/`127.x` is host-relative, so probe the host gateway instead of
|
||||
// the container's own loopback. Display key and persisted `ip` are unchanged.
|
||||
const loopbackRemap = !!(HOST_GATEWAY_PROBE && isLoopbackHost(u.ip));
|
||||
const probeHost = loopbackRemap ? HOST_GATEWAY_PROBE : u.ip;
|
||||
const result = await this._doProbe(probeHost, u.port);
|
||||
const result = await this._doProbe(u.ip, u.port);
|
||||
u.lastCheckedAt = new Date().toISOString();
|
||||
|
||||
if (result.healthy) {
|
||||
@@ -242,41 +209,6 @@ class CaddyUpstreamWatcher extends EventEmitter {
|
||||
// to be stable. After one full successful check we mark 'up' but the
|
||||
// incident resolution waits for RESOLVED_AFTER_MS.
|
||||
u.status = 'up';
|
||||
// A successful host-gateway probe PROVES the bridge can reach the
|
||||
// host. If a later probe then fails, we have strong evidence the
|
||||
// upstream itself went dead — not that bridge connectivity broke.
|
||||
// Mark verifiedViaBridge so the unverifiable path can short-circuit
|
||||
// and treat it like a non-loopback upstream.
|
||||
if (loopbackRemap) u.verifiedViaBridge = true;
|
||||
} else if (loopbackRemap && !u.verifiedViaBridge) {
|
||||
// The host-gateway probe comes from the docker bridge IP. A service
|
||||
// bound to 0.0.0.0 on the host answers; a service bound to the host's
|
||||
// 127.0.0.1 ONLY refuses — indistinguishable, from this vantage point,
|
||||
// from a truly dead service. Caddy (on the host) reaches both fine, so
|
||||
// a failed probe here is NOT evidence the upstream is dead. Mark it
|
||||
// unverifiable: no failure counters, no incident, keep lastError for
|
||||
// visibility. (A successful probe IS conclusive — see above.)
|
||||
u.consecutiveFailures = 0;
|
||||
u.status = 'unverifiable';
|
||||
u.lastError = `host-loopback upstream not verifiable from container (${result.error || `HTTP ${result.statusCode || 'unknown'}`})`;
|
||||
// Clear the success anchor: a 10-minute-old success is not evidence of
|
||||
// anything for an upstream we cannot observe from this vantage point,
|
||||
// and leaving it would make snapshot() compute a bogus failingForMs
|
||||
// and flag `dead`.
|
||||
u.lastSuccessAt = null;
|
||||
this._maybeResolve(u);
|
||||
} else if (loopbackRemap && u.verifiedViaBridge) {
|
||||
// The bridge previously reached this upstream successfully — so a
|
||||
// failed probe here is near-conclusive evidence the upstream itself
|
||||
// went dead (the bridge path itself doesn't change between probes).
|
||||
// Treat it like a non-loopback upstream failure: count it, open an
|
||||
// incident after DEAD_AFTER_MS. This restores dead-detection for the
|
||||
// subset of loopback upstreams that prove themselves reachable.
|
||||
u.consecutiveFailures += 1;
|
||||
u.lastFailureAt = u.lastCheckedAt;
|
||||
u.lastError = result.error || `HTTP ${result.statusCode || 'unknown'}`;
|
||||
u.status = 'down';
|
||||
this._maybeOpenIncident(u);
|
||||
} else {
|
||||
u.consecutiveFailures += 1;
|
||||
u.lastFailureAt = u.lastCheckedAt;
|
||||
@@ -373,25 +305,7 @@ class CaddyUpstreamWatcher extends EventEmitter {
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Public snapshot for the API/UI.
|
||||
*
|
||||
* Each upstream record includes:
|
||||
* - host / site / siteFile: identity
|
||||
* - status: 'up' | 'down' | 'unverifiable' | 'unknown' (or 'muted' here)
|
||||
* - consecutiveFailures / failingForMs: dead-detection counters
|
||||
* - lastCheckedAt / lastSuccessAt / lastFailureAt / lastError: probe history
|
||||
* - muted: true if user silenced this upstream
|
||||
* - dead: true if failingForMs >= DEAD_AFTER_MS (5 min default)
|
||||
* - verifiedViaBridge (loopback upstreams only): true iff this upstream
|
||||
* has ever answered a host-gateway probe with success. A later failed
|
||||
* probe is then near-conclusive evidence of upstream death rather
|
||||
* than bridge/UFW refusal. UI consumers should label `unverifiable`
|
||||
* rows as "no prior observation" and `down` rows with
|
||||
* verifiedViaBridge=true as "previously-verified, now down".
|
||||
*
|
||||
* @returns {{ upstreams: Array<object>, config: object }}
|
||||
*/
|
||||
/** Public snapshot for the API/UI. */
|
||||
snapshot() {
|
||||
const list = [];
|
||||
for (const u of this.upstreams.values()) {
|
||||
@@ -420,18 +334,12 @@ class CaddyUpstreamWatcher extends EventEmitter {
|
||||
lastError: u.lastError,
|
||||
failingForMs: failingFor,
|
||||
muted,
|
||||
dead: !muted && failingFor >= DEAD_AFTER_MS,
|
||||
// True iff this loopback upstream has ever answered a host-gateway
|
||||
// probe with success — meaning we have at least one prior positive
|
||||
// observation of bridge connectivity, so a later failure is
|
||||
// evidence of upstream death rather than bridge/UFW refusal.
|
||||
verifiedViaBridge: !!u.verifiedViaBridge
|
||||
dead: !muted && failingFor >= DEAD_AFTER_MS
|
||||
});
|
||||
}
|
||||
// Sort: dead first, then down, then muted, then unverifiable (informational),
|
||||
// then up, then unknown. Within each, by host.
|
||||
// Sort: dead first, then down, then up, then unknown. Within each, by host.
|
||||
list.sort((a, b) => {
|
||||
const order = { dead: 0, down: 1, muted: 2, unverifiable: 3, up: 4, unknown: 5 };
|
||||
const order = { dead: 0, down: 1, muted: 2, up: 3, unknown: 4 };
|
||||
const oa = order[a.dead ? 'dead' : a.status] ?? 9;
|
||||
const ob = order[b.dead ? 'dead' : b.status] ?? 9;
|
||||
if (oa !== ob) return oa - ob;
|
||||
@@ -498,16 +406,6 @@ class CaddyUpstreamWatcher extends EventEmitter {
|
||||
lastSuccessAt: st.lastSuccessAt || null,
|
||||
lastError: st.lastError || null,
|
||||
lastCheckedAt: st.lastCheckedAt || null,
|
||||
// Persist verifiedViaBridge so a loopback upstream that proved itself
|
||||
// reachable once doesn't have to re-prove it after every container
|
||||
// restart. A 1-tick blip is acceptable here because:
|
||||
// (a) the field is only used as a labelling gate for the
|
||||
// unverifiable-vs-down decision — a falsy restart value means
|
||||
// we re-mark unverifiable for one cycle, the safer direction;
|
||||
// (b) the bridge IP doesn't change between restarts of the same
|
||||
// container, so a previously-positive observation is still
|
||||
// good evidence.
|
||||
verifiedViaBridge: !!st.verifiedViaBridge,
|
||||
status: 'unknown'
|
||||
});
|
||||
}
|
||||
@@ -528,8 +426,7 @@ class CaddyUpstreamWatcher extends EventEmitter {
|
||||
lastFailureAt: v.lastFailureAt,
|
||||
lastSuccessAt: v.lastSuccessAt,
|
||||
lastError: v.lastError,
|
||||
lastCheckedAt: v.lastCheckedAt,
|
||||
verifiedViaBridge: !!v.verifiedViaBridge
|
||||
lastCheckedAt: v.lastCheckedAt
|
||||
};
|
||||
}
|
||||
const tmp = STATE_FILE + '.tmp';
|
||||
|
||||
@@ -1,417 +0,0 @@
|
||||
/**
|
||||
* DC-055: Host journald reader
|
||||
*
|
||||
* Wraps the host's `journalctl` binary so the API can stream host service
|
||||
* logs (caddy, dashcaddy-api, docker, ...) without exposing the binary
|
||||
* directly to the web layer. The CLI is invoked with --directory pointed at
|
||||
* the bind-mounted /var/log/journal from start.sh so we don't need the
|
||||
* systemd-journal remote protocol or a privileged socket.
|
||||
*
|
||||
* Security contract:
|
||||
* - `unit` MUST be in the allow-list `ALLOWED_UNITS`. We never accept a
|
||||
* raw unit name from the caller and pass it to the shell, even with
|
||||
* shell:false — because an attacker who can set unit=caddy.service;
|
||||
* touch /tmp/x could use the CLI itself as a confused-deputy vector.
|
||||
* - All journalctl invocations use `spawn` (not `exec`) and pass arguments
|
||||
* as an array (`shell:false`). No shell metacharacters can be smuggled
|
||||
* in through any field — the unit, since/until, search, tail numbers
|
||||
* are validated separately before being added to argv.
|
||||
* - Streams (SSE) cap to MAX_STREAM_BYTES and kill the child on overflow
|
||||
* so a `tail=999999999999` request can't OOM the process.
|
||||
*
|
||||
* Failure modes that surface to the route layer:
|
||||
* - journalctl missing in the container (DN container, dev container):
|
||||
* every call throws Error('journalctl unavailable'). Route 503s.
|
||||
* - unit not in allow-list: throws ValidationError. Route 400s.
|
||||
* - non-zero exit code: child stderr is captured and surfaced verbatim
|
||||
* up to LOG_PREVIEW_BYTES so the operator can see "Failed to open
|
||||
* directory" instead of a generic 500.
|
||||
*/
|
||||
|
||||
const { spawn } = require('child_process');
|
||||
const path = require('path');
|
||||
const fs = require('fs');
|
||||
|
||||
const JOURNAL_DIR = '/var/log/journal';
|
||||
const ALLOWED_UNITS = Object.freeze([
|
||||
// Core reverse proxy + DNS host services
|
||||
'caddy',
|
||||
'dashcaddy-api',
|
||||
'docker',
|
||||
'systemd-journald',
|
||||
'networkd-dispatcher',
|
||||
'tailscaled',
|
||||
'ssh',
|
||||
// Permit the unit with and without the .service suffix. The CLI accepts
|
||||
// both; we store the bare name and append nothing — journalctl treats
|
||||
// "caddy" and "caddy.service" identically.
|
||||
]);
|
||||
|
||||
// Cap how much a single request can read — prevents `tail=999999999` from
|
||||
// piping half the journal into memory. The dashboard doesn't have a UI for
|
||||
// "load 100MB of logs" and journalctl itself caps at 2GB anyway.
|
||||
const MAX_TAIL_LINES = 5000;
|
||||
// Streaming cap: how many journal entries we hand to the SSE consumer
|
||||
// before killing the child. The dashboard shouldn't accumulate more than
|
||||
// this in memory — pair with MAX_OUTPUT_BUFFER for a defense-in-depth
|
||||
// bound on what the route layer will hold.
|
||||
const MAX_STREAM_LINES = 5000;
|
||||
const MAX_OUTPUT_BUFFER = 2 * 1024 * 1024; // 2MB hard cap on total stdout
|
||||
const LOG_PREVIEW_BYTES = 4096;
|
||||
|
||||
const UNIT_PATTERN = /^[a-zA-Z0-9_.@-]+$/;
|
||||
const ISO_PATTERN = /^\d{4}-\d{2}-\d{2}(?:[T ]\d{2}:\d{2}(?::\d{2}(?:\.\d+)?)?(?:Z|[+-]\d{2}:?\d{2})?)?$/;
|
||||
|
||||
/**
|
||||
* Validate a unit name against the allow-list. Returns the canonical name
|
||||
* or throws ValidationError.
|
||||
*/
|
||||
function assertUnitAllowed(unit) {
|
||||
if (typeof unit !== 'string' || !unit) {
|
||||
const err = new Error('unit is required');
|
||||
err.name = 'ValidationError';
|
||||
throw err;
|
||||
}
|
||||
// Strip the .service suffix defensively so callers don't have to remember
|
||||
// which form journalctl prefers for a given unit.
|
||||
const normalised = unit.endsWith('.service') ? unit.slice(0, -8) : unit;
|
||||
if (!UNIT_PATTERN.test(normalised)) {
|
||||
const err = new Error(`unit contains invalid characters: ${unit}`);
|
||||
err.name = 'ValidationError';
|
||||
throw err;
|
||||
}
|
||||
if (!ALLOWED_UNITS.includes(normalised)) {
|
||||
const err = new Error(`unit not in allow-list: ${normalised}`);
|
||||
err.name = 'ValidationError';
|
||||
throw err;
|
||||
}
|
||||
return normalised;
|
||||
}
|
||||
|
||||
/**
|
||||
* Parse tail to a bounded positive integer.
|
||||
*/
|
||||
function parseTail(raw, fallback = 200) {
|
||||
if (raw === undefined || raw === null || raw === '') return fallback;
|
||||
const n = Number(raw);
|
||||
if (!Number.isFinite(n) || !Number.isInteger(n) || n <= 0) {
|
||||
const err = new Error(`tail must be a positive integer (got ${raw})`);
|
||||
err.name = 'ValidationError';
|
||||
throw err;
|
||||
}
|
||||
return Math.min(n, MAX_TAIL_LINES);
|
||||
}
|
||||
|
||||
/**
|
||||
* Parse since/until — accept either an ISO timestamp, a unix epoch in ms, or
|
||||
* journalctl's relative syntax ("30 min ago", "today", "yesterday"). The
|
||||
* dashboard uses ISO timestamps from `<input type="datetime-local">`; the
|
||||
* relative syntax is for power users typing into the search bar.
|
||||
*/
|
||||
function parseTimestamp(raw, fieldName) {
|
||||
if (raw === undefined || raw === null || raw === '') return null;
|
||||
if (typeof raw !== 'string') {
|
||||
const err = new Error(`${fieldName} must be a string`);
|
||||
err.name = 'ValidationError';
|
||||
throw err;
|
||||
}
|
||||
// ISO 8601
|
||||
if (ISO_PATTERN.test(raw)) {
|
||||
const ms = Date.parse(raw);
|
||||
if (!Number.isFinite(ms)) {
|
||||
const err = new Error(`${fieldName} is not a valid ISO timestamp: ${raw}`);
|
||||
err.name = 'ValidationError';
|
||||
throw err;
|
||||
}
|
||||
return new Date(ms).toISOString();
|
||||
}
|
||||
// Numeric (unix epoch seconds OR ms — journalctl accepts seconds)
|
||||
if (/^-?\d+$/.test(raw)) {
|
||||
const n = Number(raw);
|
||||
const ms = n > 1e12 ? n : n * 1000;
|
||||
if (!Number.isFinite(ms)) {
|
||||
const err = new Error(`${fieldName} is not a valid epoch: ${raw}`);
|
||||
err.name = 'ValidationError';
|
||||
throw err;
|
||||
}
|
||||
return new Date(ms).toISOString();
|
||||
}
|
||||
// Relative syntax: pass through to journalctl, but cap to 1024 chars and
|
||||
// disallow shell metacharacters.
|
||||
if (raw.length > 1024 || /[`$;&|><\\\n\r]/.test(raw)) {
|
||||
const err = new Error(`${fieldName} contains forbidden characters: ${raw}`);
|
||||
err.name = 'ValidationError';
|
||||
throw err;
|
||||
}
|
||||
return raw;
|
||||
}
|
||||
|
||||
/**
|
||||
* Detect whether journalctl is reachable. Cheap probe (no-op flag) so we
|
||||
* don't shell out on every request when the binary is missing (dev
|
||||
* container, Windows host, etc.).
|
||||
*/
|
||||
function isAvailable({ journalDir = JOURNAL_DIR, exec = spawn } = {}) {
|
||||
if (!fs.existsSync(journalDir)) return false;
|
||||
return new Promise((resolve) => {
|
||||
const child = exec('journalctl', ['--no-pager', '--version'], { stdio: 'ignore' });
|
||||
child.on('error', () => resolve(false));
|
||||
child.on('exit', (code) => resolve(code === 0));
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Build argv for journalctl. Exposed so tests can assert exactly what we
|
||||
* shell out — never build the arg array inline anywhere else.
|
||||
*/
|
||||
function buildArgv({ unit, since, until, tail, search, follow = false }) {
|
||||
const argv = [
|
||||
'--directory', JOURNAL_DIR,
|
||||
'--no-pager',
|
||||
'--output=short',
|
||||
'-u', unit,
|
||||
];
|
||||
if (since) argv.push('--since', since);
|
||||
if (until) argv.push('--until', until);
|
||||
if (typeof tail === 'number') argv.push('-n', String(tail));
|
||||
if (search) {
|
||||
// journalctl -S matches the searchable text fields (MESSAGE + others).
|
||||
// Quote-enforcing isn't needed because spawn argv doesn't touch a shell.
|
||||
argv.push('-S', search);
|
||||
}
|
||||
if (follow) argv.push('--follow');
|
||||
return argv;
|
||||
}
|
||||
|
||||
/**
|
||||
* Read a bounded tail of journal entries for a unit. Resolves to an array
|
||||
* of {timestamp, text} lines, oldest first. Throws ValidationError on bad
|
||||
* input, Error('journalctl unavailable') if the binary or journal dir is
|
||||
* missing, and Error('journalctl exited N: <stderr>') for CLI failures.
|
||||
*/
|
||||
/**
|
||||
* Spawn journalctl with the given argv and collect stdout/stderr up to
|
||||
* the configured caps. Resolves to a Buffer of stdout on success, rejects
|
||||
* with Error('journalctl unavailable') on ENOENT or
|
||||
* Error('journalctl exited N: <stderr>') on non-zero exit. Exceeding the
|
||||
* output cap rejects with an explicit overflow message.
|
||||
*
|
||||
* Kept as a free function (not inside `readEntries`) so the same plumbing
|
||||
* can be reused for streaming without code duplication.
|
||||
*/
|
||||
function runJournalctl({ exec, argv }) {
|
||||
return new Promise((resolve, reject) => {
|
||||
const child = exec('journalctl', argv, { stdio: ['ignore', 'pipe', 'pipe'] });
|
||||
|
||||
let stdout = Buffer.alloc(0);
|
||||
let stderr = '';
|
||||
|
||||
child.stdout.on('data', (chunk) => {
|
||||
if (stdout.length + chunk.length > MAX_OUTPUT_BUFFER) {
|
||||
child.kill('SIGKILL');
|
||||
reject(new Error(`output exceeded ${MAX_OUTPUT_BUFFER} bytes`));
|
||||
return;
|
||||
}
|
||||
stdout = Buffer.concat([stdout, chunk]);
|
||||
});
|
||||
child.stderr.on('data', (chunk) => {
|
||||
if (stderr.length < LOG_PREVIEW_BYTES) {
|
||||
stderr += chunk.toString('utf8');
|
||||
if (stderr.length > LOG_PREVIEW_BYTES) {
|
||||
stderr = stderr.slice(0, LOG_PREVIEW_BYTES) + '…';
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
child.on('error', (err) => {
|
||||
if (err.code === 'ENOENT') {
|
||||
reject(new Error('journalctl unavailable'));
|
||||
} else {
|
||||
reject(err);
|
||||
}
|
||||
});
|
||||
child.on('exit', (code, signal) => {
|
||||
if (signal === 'SIGKILL' && stdout.length >= MAX_OUTPUT_BUFFER) return; // already rejected
|
||||
if (code !== 0) {
|
||||
reject(new Error(`journalctl exited ${code}${stderr ? ': ' + stderr.trim() : ''}`));
|
||||
return;
|
||||
}
|
||||
resolve({ stdout, stderr });
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Parse a journalctl --output=short line into a structured entry.
|
||||
* Lines look like: "Aug 18 00:42:46 vmi3080415 caddy[3620580]: {...}"
|
||||
*/
|
||||
function parseShortLine(line, fallbackUnit) {
|
||||
const tsMatch = line.match(/^([A-Z][a-z]{2} \d{2} \d{2}:\d{2}:\d{2}) (\S+) (.+?)\[\d+\]: (.*)$/);
|
||||
if (tsMatch) {
|
||||
return {
|
||||
timestamp: tsMatch[1],
|
||||
hostname: tsMatch[2],
|
||||
unit: tsMatch[3],
|
||||
text: tsMatch[4],
|
||||
};
|
||||
}
|
||||
return { timestamp: null, hostname: null, unit: fallbackUnit, text: line };
|
||||
}
|
||||
|
||||
function readEntries(opts, { exec = spawn } = {}) {
|
||||
return Promise.resolve().then(async () => {
|
||||
const unit = assertUnitAllowed(opts.unit);
|
||||
const tail = parseTail(opts.tail);
|
||||
const since = parseTimestamp(opts.since, 'since');
|
||||
const until = parseTimestamp(opts.until, 'until');
|
||||
const search = typeof opts.search === 'string' && opts.search.length > 0
|
||||
? opts.search.slice(0, 1024)
|
||||
: null;
|
||||
|
||||
const argv = buildArgv({ unit, tail, since, until, search, follow: false });
|
||||
const { stdout } = await runJournalctl({ exec, argv });
|
||||
const lines = stdout.toString('utf8').split('\n').filter(Boolean);
|
||||
return lines.map((line) => parseShortLine(line, unit));
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Stream journal entries as they arrive. Returns { child, onData, onError,
|
||||
* kill } — the route wires `onData`/`onError` to the SSE socket and calls
|
||||
* `kill()` on disconnect.
|
||||
*
|
||||
* The child is spawned with --follow and we cap total bytes received; on
|
||||
* overflow we kill the child and emit a synthetic 'overflow' message so the
|
||||
* client knows to reconnect with a narrower window.
|
||||
*/
|
||||
function streamEntries(opts, { exec = spawn, onData, onError } = {}) {
|
||||
const unit = assertUnitAllowed(opts.unit);
|
||||
const since = parseTimestamp(opts.since, 'since');
|
||||
const search = typeof opts.search === 'string' && opts.search.length > 0
|
||||
? opts.search.slice(0, 1024)
|
||||
: null;
|
||||
|
||||
const argv = buildArgv({ unit, since, search, follow: true });
|
||||
|
||||
let child;
|
||||
try {
|
||||
child = exec('journalctl', argv, { stdio: ['ignore', 'pipe', 'pipe'] });
|
||||
} catch (err) {
|
||||
if (err.code === 'ENOENT') {
|
||||
const e = new Error('journalctl unavailable');
|
||||
onError && onError(e);
|
||||
return { kill: () => {}, child: null };
|
||||
}
|
||||
throw err;
|
||||
}
|
||||
|
||||
// Closure-scoped stream bookkeeping: the previous version attached a
|
||||
// counter to the onData function itself, which made the 5000-line cap
|
||||
// unreachable (a function has its own properties — the count was never
|
||||
// incremented). Closure scope is the right place.
|
||||
let stdout = Buffer.alloc(0);
|
||||
let lineCount = 0;
|
||||
let overflowEmitted = false;
|
||||
|
||||
child.stdout.on('data', (chunk) => {
|
||||
if (stdout.length + chunk.length > MAX_OUTPUT_BUFFER) {
|
||||
child.kill('SIGKILL');
|
||||
onError && onError(new Error(`stream exceeded ${MAX_OUTPUT_BUFFER} bytes`));
|
||||
return;
|
||||
}
|
||||
stdout = Buffer.concat([stdout, chunk]);
|
||||
if (onData) {
|
||||
const text = stdout.toString('utf8');
|
||||
const lines = text.split('\n');
|
||||
// Hold back the last partial line; flush on the next chunk or exit.
|
||||
stdout = Buffer.from(lines.pop(), 'utf8');
|
||||
for (const line of lines) {
|
||||
if (!line) continue;
|
||||
lineCount++;
|
||||
if (lineCount > MAX_STREAM_LINES && !overflowEmitted) {
|
||||
overflowEmitted = true;
|
||||
child.kill('SIGKILL');
|
||||
onError && onError(new Error(`stream exceeded ${MAX_STREAM_LINES} lines`));
|
||||
return;
|
||||
}
|
||||
const tsMatch = line.match(/^([A-Z][a-z]{2} \d{2} \d{2}:\d{2}:\d{2}) (\S+) (.+?)\[\d+\]: (.*)$/);
|
||||
onData({
|
||||
timestamp: tsMatch ? tsMatch[1] : null,
|
||||
hostname: tsMatch ? tsMatch[2] : null,
|
||||
unit: tsMatch ? tsMatch[3] : unit,
|
||||
text: tsMatch ? tsMatch[4] : line,
|
||||
});
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
let stderr = '';
|
||||
child.stderr.on('data', (chunk) => {
|
||||
if (stderr.length < LOG_PREVIEW_BYTES) {
|
||||
stderr += chunk.toString('utf8');
|
||||
if (stderr.length > LOG_PREVIEW_BYTES) {
|
||||
stderr = stderr.slice(0, LOG_PREVIEW_BYTES) + '…';
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
child.on('error', (err) => {
|
||||
onError && onError(err);
|
||||
});
|
||||
child.on('exit', (code) => {
|
||||
if (code !== 0 && stderr) {
|
||||
onError && onError(new Error(`journalctl exited ${code}: ${stderr.trim()}`));
|
||||
}
|
||||
});
|
||||
|
||||
return {
|
||||
child,
|
||||
kill() {
|
||||
try { child.kill('SIGTERM'); } catch (_) { /* already dead */ }
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* List units that currently have journal entries (for the dashboard
|
||||
* dropdown). Walks the allow-list and asks journalctl for the most recent
|
||||
* entry per unit. Units with no entries are omitted.
|
||||
*/
|
||||
async function listUnits({ exec = spawn } = {}) {
|
||||
if (!fs.existsSync(JOURNAL_DIR)) return [];
|
||||
const out = [];
|
||||
for (const unit of ALLOWED_UNITS) {
|
||||
const lines = await new Promise((resolve) => {
|
||||
const child = exec('journalctl', [
|
||||
'--directory', JOURNAL_DIR,
|
||||
'--no-pager', '-q',
|
||||
'-u', unit,
|
||||
'-n', '1',
|
||||
'--output=short',
|
||||
], { stdio: ['ignore', 'pipe', 'ignore'] });
|
||||
let buf = '';
|
||||
child.stdout.on('data', (c) => { buf += c.toString('utf8'); });
|
||||
child.on('error', () => resolve(''));
|
||||
child.on('exit', () => resolve(buf));
|
||||
});
|
||||
if (lines.trim()) {
|
||||
out.push({ unit, hasEntries: true });
|
||||
}
|
||||
}
|
||||
return out;
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
ALLOWED_UNITS,
|
||||
MAX_TAIL_LINES,
|
||||
MAX_OUTPUT_BUFFER,
|
||||
isAvailable,
|
||||
readEntries,
|
||||
streamEntries,
|
||||
listUnits,
|
||||
assertUnitAllowed,
|
||||
parseTail,
|
||||
parseTimestamp,
|
||||
parseShortLine,
|
||||
buildArgv,
|
||||
};
|
||||
@@ -118,33 +118,16 @@ function _httpsFetch(url, opts = {}, timeoutMs = TIMEOUTS.HTTP_DEFAULT) {
|
||||
|
||||
/**
|
||||
* Raw http.request wrapper for Caddy admin API
|
||||
*
|
||||
* Auto-injects `Origin: http://<host>:<port>` because Caddy's admin API on a
|
||||
* non-loopback bind (e.g. `admin 0.0.0.0:2019` so the DashCaddy docker
|
||||
* container can probe it from 172.17.0.1) enables `enforce_origin` and
|
||||
* rejects every request whose Origin isn't in the admin's `origins` allowlist
|
||||
* OR is empty. Node's undici fetch sets `Sec-Fetch-Mode: cors` which triggers
|
||||
* the check; raw http.request sets no Origin at all, which fails the empty
|
||||
* check. Setting Origin to the admin endpoint's own origin satisfies
|
||||
* gorilla/csrf same-origin and is the documented override.
|
||||
* (See: https://caddyserver.com/docs/caddyfile/options — `origins` directive.)
|
||||
*
|
||||
* Caller-provided `Origin` header (via opts.headers) wins so tests / future
|
||||
* proxies can override; default matches the parsed admin URL.
|
||||
*/
|
||||
function _httpFetch(url, opts = {}, timeoutMs = TIMEOUTS.HTTP_DEFAULT) {
|
||||
return new Promise((resolve, reject) => {
|
||||
const parsed = new URL(url);
|
||||
const defaultOrigin = `${parsed.protocol}//${parsed.hostname}:${parsed.port || 2019}`;
|
||||
const options = {
|
||||
hostname: parsed.hostname,
|
||||
port: parsed.port || 2019,
|
||||
path: parsed.pathname + parsed.search,
|
||||
method: (opts.method || 'GET').toUpperCase(),
|
||||
headers: {
|
||||
Origin: defaultOrigin,
|
||||
...opts.headers,
|
||||
},
|
||||
headers: { ...opts.headers },
|
||||
timeout: timeoutMs,
|
||||
};
|
||||
|
||||
|
||||
@@ -86,20 +86,8 @@ run_image_layer_migration
|
||||
# dns1.sami → DNS1 (SAMI-CLOUD-U32)
|
||||
# dc-contabo-de → DashCaddy Contabo test instance
|
||||
# git.dashcaddy.net → DashCaddy upstream git
|
||||
# git.sami → DNS2 (NOT DNS3 — see warning above). Resolves an
|
||||
# intermittent ENOTFOUND in the ssl-monitor's TLS
|
||||
# handshake check (~2/h) by pinning the name in the
|
||||
# container's /etc/hosts to the Caddy listener.
|
||||
# ca.sami → local CA (DN2 + DN3 both have their own)
|
||||
ADD_HOST_FLAGS=(
|
||||
# host.docker.internal → host bridge IP (Docker host-gateway). The caddy
|
||||
# upstream watcher probes Caddy site upstreams from INSIDE this container;
|
||||
# `reverse_proxy localhost:PORT` in a site file means the HOST's loopback,
|
||||
# so the watcher remaps loopback probe targets to this name (see
|
||||
# dashcaddy-api/src/monitoring/caddy-upstream-watcher.js). Without this
|
||||
# entry the probes would hit the container's own loopback and report every
|
||||
# host-side upstream as dead.
|
||||
--add-host=host.docker.internal:host-gateway
|
||||
--add-host=dns3.sami:100.81.59.99
|
||||
--add-host=gitea:100.81.59.99
|
||||
--add-host=dns3-wan.sami:74.208.167.19
|
||||
@@ -107,7 +95,6 @@ ADD_HOST_FLAGS=(
|
||||
--add-host=dns1.sami:100.71.97.12
|
||||
--add-host=dc-contabo-de:100.98.123.59
|
||||
--add-host=git.dashcaddy.net:100.98.123.59
|
||||
--add-host=git.sami:100.121.150.22
|
||||
# ca.sami resolves via DNS to 100.121.150.22 (Caddy on DNS2). Don't pin
|
||||
# to 127.0.0.1 — nothing listens on 443 inside the container, so the
|
||||
# health checker would fail with ECONNREFUSED. The CA itself is a
|
||||
@@ -159,7 +146,6 @@ docker run -d --restart unless-stopped --name ${CONTAINER_NAME} \
|
||||
-v ${DATA_DIR}:/app/data \
|
||||
-v ${BACKUPS_DIR}:/app/backups \
|
||||
-v ${CADDYFILE}:/caddyfile \
|
||||
-v /etc/caddy/sites:/etc/caddy/sites:ro \
|
||||
-v /var/run/docker.sock:/var/run/docker.sock \
|
||||
-v ${ASSETS_DIR}:/app/assets \
|
||||
-v ${UPDATES_DIR}:/app/updates \
|
||||
@@ -167,8 +153,6 @@ docker run -d --restart unless-stopped --name ${CONTAINER_NAME} \
|
||||
-v /usr/bin/tailscale:/usr/bin/tailscale:ro \
|
||||
-v /var/run/tailscale:/var/run/tailscale:ro \
|
||||
-v /etc/ssl/sami-ca:/etc/ssl/sami-ca:ro \
|
||||
-v /var/log/journal:/var/log/journal:ro \
|
||||
-v /usr/bin/journalctl:/usr/bin/journalctl:ro \
|
||||
-e NODE_ENV=production \
|
||||
-e SERVICES_FILE=/app/data/services.json \
|
||||
-e CONFIG_FILE=/app/data/config.json \
|
||||
|
||||
@@ -54,10 +54,6 @@ const bundles = {
|
||||
JS('import-export.js'),
|
||||
JS('error-logs.js'),
|
||||
JS('container-logs.js'),
|
||||
// DC-055: Host journald log viewer — reads /var/log/journal via the
|
||||
// bind-mount added in start.sh. Self-contained modal with SSE stream
|
||||
// + bounded tail read. Exposes window.openJournaldModal().
|
||||
JS('journald.js'),
|
||||
JS('snapshot.js'),
|
||||
JS('smart-arr-connect.js'),
|
||||
JS('notification-settings.js'),
|
||||
|
||||
Vendored
+222
-314
File diff suppressed because one or more lines are too long
+1
-1
@@ -203,7 +203,7 @@
|
||||
<div class="tools-section-items">
|
||||
<button id="view-error-logs" aria-label="View error logs">📋 Error Logs</button>
|
||||
<button id="view-container-logs" aria-label="View container logs">📜 Container Logs</button>
|
||||
<button id="view-journald-logs" aria-label="Host journald logs">🛰️ Host Logs</button>
|
||||
<a id="view-logs-page" aria-label="Dedicated logs page" href="/logs.html" target="_blank" rel="noopener" style="text-decoration:none;color:inherit">📄 Logs Page</a>
|
||||
<button id="manage-notifications" aria-label="Manage notifications">🔔 Alerts</button>
|
||||
<button id="audit-log-btn" aria-label="Audit log">📜 Audit</button>
|
||||
<button id="security-center-btn" aria-label="Security Center">🛡️ Security</button>
|
||||
|
||||
+115
-263
@@ -1,292 +1,144 @@
|
||||
// ========== ERROR LOG VIEWER (DC-052) ==========
|
||||
// DC-052: Adds Level / Context / Search / Time-range filters, server-side
|
||||
// pagination with Load More, click-to-expand stack frames, and a distinct
|
||||
// contexts dropdown backed by /api/v1/error-logs/contexts. Mirrors the
|
||||
// audit-log UX (DC-050) so operators can drill into a subsystem as easily
|
||||
// as they can audit who-did-what.
|
||||
// ========== ERROR LOG VIEWER ==========
|
||||
// DC-051: The /api/v1/error-logs route now parses the unified-logger
|
||||
// ── (U+2500) separator (verified 2026-08-18 — previous '=' splitter
|
||||
// returned ZERO entries and the modal always rendered "No errors logged").
|
||||
// The modal now renders the captured `details` (stack trace + req context)
|
||||
// and offers a Level filter + tail cap mirroring the audit-log viewer
|
||||
// (DC-050). Mirrors the audit-log-viewer shape (5f95fdc).
|
||||
(function() {
|
||||
// Inject modal HTML. Same weather-modal shell as audit-log so styles
|
||||
// are shared; wider min-width because error stacks need room to breathe.
|
||||
injectModal('error-log-modal', `<div id="error-log-modal" class="weather-modal">
|
||||
<div class="weather-modal-content" style="min-width: 950px; max-width: 1150px;">
|
||||
<h3>📋 Error Logs</h3>
|
||||
<p class="modal-subtitle">
|
||||
Errors and warnings from the DashCaddy API. Click a row to see the full stack trace.
|
||||
</p>
|
||||
const MAX_LEVELS = ['ERR', 'WRN', 'INF', 'DBG'];
|
||||
|
||||
<div style="display: flex; gap: 12px; margin-bottom: 12px; align-items: center; flex-wrap: wrap;">
|
||||
<label class="text-muted-sm">Level:</label>
|
||||
<select id="error-log-level" style="padding: 6px 10px; border-radius: 6px; border: 1px solid var(--border); background: var(--bg); color: var(--fg); font-size: 0.85rem;">
|
||||
<option value="">All</option>
|
||||
<option value="ERR">Errors</option>
|
||||
<option value="WARN">Warnings</option>
|
||||
<option value="INFO">Info</option>
|
||||
<option value="DEBUG">Debug</option>
|
||||
</select>
|
||||
<label class="text-muted-sm">Context:</label>
|
||||
<select id="error-log-context" style="padding: 6px 10px; border-radius: 6px; border: 1px solid var(--border); background: var(--bg); color: var(--fg); font-size: 0.85rem; max-width: 220px;">
|
||||
<option value="">All</option>
|
||||
</select>
|
||||
<label class="text-muted-sm" style="margin-left: 8px;">Search:</label>
|
||||
<input id="error-log-search" type="search" placeholder="message / stack / ip" style="padding: 5px 8px; border-radius: 6px; border: 1px solid var(--border); background: var(--bg); color: var(--fg); font-size: 0.82rem; min-width: 180px;">
|
||||
<label class="text-muted-sm" style="margin-left: 8px;">Since:</label>
|
||||
<input id="error-log-since" type="datetime-local" style="padding: 5px 8px; border-radius: 6px; border: 1px solid var(--border); background: var(--bg); color: var(--fg); font-size: 0.82rem;">
|
||||
<label class="text-muted-sm">Until:</label>
|
||||
<input id="error-log-until" type="datetime-local" style="padding: 5px 8px; border-radius: 6px; border: 1px solid var(--border); background: var(--bg); color: var(--fg); font-size: 0.82rem;">
|
||||
<button id="error-log-refresh" class="btn-sm">🔄 Refresh</button>
|
||||
<span style="flex: 1;"></span>
|
||||
<button id="error-log-clear" style="padding: 6px 12px; font-size: 0.8rem; color: var(--bad-fg); border-color: var(--bad-fg);">🗑️ Clear Log</button>
|
||||
</div>
|
||||
|
||||
<div id="error-log-container" class="scroll-container">
|
||||
<div class="panel-empty"><span class="brand-spinner"></span> Loading error logs...</div>
|
||||
</div>
|
||||
|
||||
<div style="margin-top: 12px; text-align: center;">
|
||||
<button id="error-log-load-more" style="display: none; padding: 6px 16px; font-size: 0.8rem;">Load More</button>
|
||||
</div>
|
||||
|
||||
<div style="margin-top: 8px; font-size: 0.78rem; color: var(--muted); text-align: right;">
|
||||
<span id="error-log-total"></span>
|
||||
</div>
|
||||
|
||||
<div class="weather-modal-buttons modal-footer-bar">
|
||||
<button id="error-log-close">Close</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>`);
|
||||
injectModal('error-log-modal', [
|
||||
'<div id="error-log-modal" class="logs-modal">',
|
||||
' <div class="logs-modal-content">',
|
||||
' <div class="logs-header">',
|
||||
' <h3>📋 Error Logs</h3>',
|
||||
' <div class="logs-controls">',
|
||||
' <select id="error-log-level" aria-label="Filter by level" style="padding:4px 8px!important;font-size:.85rem!important">',
|
||||
' <option value="">All levels</option>',
|
||||
' <option value="ERR">Errors</option>',
|
||||
' <option value="WRN">Warnings</option>',
|
||||
' <option value="INF">Info</option>',
|
||||
' <option value="DBG">Debug</option>',
|
||||
' </select>',
|
||||
' <select id="error-log-tail" aria-label="Tail length" style="padding:4px 8px!important;font-size:.85rem!important">',
|
||||
' <option value="50">Last 50</option>',
|
||||
' <option value="100" selected>Last 100</option>',
|
||||
' <option value="200">Last 200</option>',
|
||||
' <option value="500">Last 500</option>',
|
||||
' </select>',
|
||||
' <button id="error-log-refresh" style="padding:4px 12px!important;font-size:.85rem!important">🔄 Refresh</button>',
|
||||
' <button id="error-log-clear" style="padding:4px 12px!important;font-size:.85rem!important;background:color-mix(in srgb,var(--bad-fg) 15%,transparent)!important;border-color:var(--bad-fg)!important;color:var(--bad-fg)!important">🗑️ Clear</button>',
|
||||
' <button id="error-log-close" class="close-btn">✕</button>',
|
||||
' </div>',
|
||||
' </div>',
|
||||
' <div class="logs-container">',
|
||||
' <div id="error-log-meta" class="logs-meta" style="padding:6px 12px;color:var(--muted);font-size:.8rem;border-bottom:1px solid var(--border)"></div>',
|
||||
' <div id="error-log-content" class="logs-content"><div class="logs-loading">Loading error logs...</div></div>',
|
||||
' </div>',
|
||||
' </div>',
|
||||
'</div>',
|
||||
].join(''));
|
||||
|
||||
const modal = document.getElementById('error-log-modal');
|
||||
const content = document.getElementById('error-log-content');
|
||||
const meta = document.getElementById('error-log-meta');
|
||||
const viewBtn = document.getElementById('view-error-logs');
|
||||
const refreshBtn = document.getElementById('error-log-refresh');
|
||||
const clearBtn = document.getElementById('error-log-clear');
|
||||
const closeBtn = document.getElementById('error-log-close');
|
||||
const levelSel = document.getElementById('error-log-level');
|
||||
const contextSel = document.getElementById('error-log-context');
|
||||
const searchInput = document.getElementById('error-log-search');
|
||||
const sinceInput = document.getElementById('error-log-since');
|
||||
const untilInput = document.getElementById('error-log-until');
|
||||
const container = document.getElementById('error-log-container');
|
||||
const loadMoreBtn = document.getElementById('error-log-load-more');
|
||||
const totalSpan = document.getElementById('error-log-total');
|
||||
const levelSelect = /** @type {HTMLSelectElement|null} */ (document.getElementById('error-log-level'));
|
||||
const tailSelect = /** @type {HTMLSelectElement|null} */ (document.getElementById('error-log-tail'));
|
||||
|
||||
const PAGE_SIZE = 50;
|
||||
let currentOffset = 0;
|
||||
let inflight = null;
|
||||
let filterNonce = 0;
|
||||
// Cached distinct contexts so the dropdown is populated once per open and
|
||||
// re-populated after a clear (which removes all contexts) or a refresh
|
||||
// that surfaces a new subsystem for the first time.
|
||||
let knownContexts = [];
|
||||
|
||||
// datetime-local fields are naive local time — convert to UTC ISO so the
|
||||
// server compares correctly. Same shape as audit-log.js so the operator
|
||||
// sees consistent behaviour between the two modals.
|
||||
function toIso(localDtValue) {
|
||||
if (!localDtValue) return null;
|
||||
const d = new Date(localDtValue);
|
||||
if (isNaN(d.getTime())) return null;
|
||||
return d.toISOString();
|
||||
function levelClass(level) {
|
||||
const L = (level || '').toUpperCase();
|
||||
if (L === 'ERR') return 'log-entry error';
|
||||
if (L === 'WRN') return 'log-entry warn';
|
||||
if (L === 'INF') return 'log-entry info';
|
||||
if (L === 'DBG') return 'log-entry debug';
|
||||
return 'log-entry';
|
||||
}
|
||||
|
||||
// Pull the distinct contexts list once per open. Failures are silent
|
||||
// (the dropdown will just show "All" only) so a transient backend hiccup
|
||||
// doesn't block the operator from seeing the actual error rows.
|
||||
async function refreshContexts() {
|
||||
function formatBytes(n) {
|
||||
if (!Number.isFinite(n) || n <= 0) return '0 B';
|
||||
if (n < 1024) return n + ' B';
|
||||
if (n < 1024 * 1024) return (n / 1024).toFixed(1) + ' KiB';
|
||||
return (n / 1024 / 1024).toFixed(2) + ' MiB';
|
||||
}
|
||||
|
||||
async function loadErrorLogs() {
|
||||
content.innerHTML = '<div class="logs-loading">Loading error logs...</div>';
|
||||
meta.textContent = '';
|
||||
|
||||
const tail = encodeURIComponent(tailSelect.value || '100');
|
||||
const level = levelSelect.value || '';
|
||||
const qs = `tail=${tail}` + (level ? `&level=${encodeURIComponent(level)}` : '');
|
||||
|
||||
try {
|
||||
const res = await fetch('/api/v1/error-logs/contexts');
|
||||
if (!res.ok) return;
|
||||
const data = await res.json();
|
||||
if (!data.success || !Array.isArray(data.contexts)) return;
|
||||
knownContexts = data.contexts;
|
||||
const currentValue = contextSel.value;
|
||||
contextSel.innerHTML = '<option value="">All</option>';
|
||||
for (const c of data.contexts) {
|
||||
const opt = document.createElement('option');
|
||||
opt.value = c.name;
|
||||
opt.textContent = `${c.name} (${c.count})`;
|
||||
contextSel.appendChild(opt);
|
||||
}
|
||||
// Restore previous selection if still present.
|
||||
if (currentValue && data.contexts.some((c) => c.name === currentValue)) {
|
||||
contextSel.value = currentValue;
|
||||
}
|
||||
} catch { /* ignore */ }
|
||||
}
|
||||
const response = await fetch('/api/v1/error-logs?' + qs);
|
||||
const data = await response.json();
|
||||
|
||||
function buildQuery() {
|
||||
const params = new URLSearchParams();
|
||||
params.set('limit', String(PAGE_SIZE));
|
||||
params.set('offset', String(currentOffset));
|
||||
if (levelSel.value) params.set('level', levelSel.value);
|
||||
if (contextSel.value) params.set('context', contextSel.value);
|
||||
const since = toIso(sinceInput.value);
|
||||
const until = toIso(untilInput.value);
|
||||
if (since) params.set('since', since);
|
||||
if (until) params.set('until', until);
|
||||
const search = (searchInput.value || '').trim();
|
||||
if (search) params.set('search', search);
|
||||
return params;
|
||||
}
|
||||
|
||||
async function loadLogs(append) {
|
||||
try {
|
||||
if (!append) {
|
||||
if (inflight) inflight.abort();
|
||||
inflight = new AbortController();
|
||||
currentOffset = 0;
|
||||
filterNonce++;
|
||||
container.innerHTML = '<div class="panel-empty"><span class="brand-spinner"></span> Loading...</div>';
|
||||
} else {
|
||||
if (inflight) inflight.abort();
|
||||
inflight = new AbortController();
|
||||
}
|
||||
const myNonce = filterNonce;
|
||||
const params = buildQuery();
|
||||
|
||||
const res = await fetch('/api/v1/error-logs?' + params.toString(), {
|
||||
signal: inflight.signal,
|
||||
});
|
||||
// Mirror audit-log: surface 4xx/5xx explicitly instead of falling
|
||||
// through to a misleading "no entries yet" empty state.
|
||||
if (!res.ok) {
|
||||
container.innerHTML = `<div class="panel-empty" style="color: var(--bad-fg);">Failed: HTTP ${res.status}</div>`;
|
||||
loadMoreBtn.style.display = 'none';
|
||||
totalSpan.textContent = '';
|
||||
return;
|
||||
}
|
||||
const data = await res.json();
|
||||
if (!data.success) {
|
||||
container.innerHTML = `<div class="panel-empty" style="color: var(--bad-fg);">Failed: ${escapeHtml(data.error || 'unknown')}</div>`;
|
||||
loadMoreBtn.style.display = 'none';
|
||||
totalSpan.textContent = '';
|
||||
return;
|
||||
}
|
||||
// Stale-response guard: a non-append load happened after this fetch,
|
||||
// discard so we don't splice into the wrong DOM.
|
||||
if (!append && myNonce !== filterNonce) return;
|
||||
|
||||
const logs = Array.isArray(data.logs) ? data.logs : [];
|
||||
if (logs.length === 0 && !append) {
|
||||
const reason = (data.filters && (data.filters.level || data.filters.context || data.filters.search || data.filters.since || data.filters.until))
|
||||
? 'No error log entries match your filters.'
|
||||
: '✅ No errors logged! Everything is working smoothly.';
|
||||
container.innerHTML = `<div class="panel-empty"><span class="empty-icon">📋</span>${escapeHtml(reason)}</div>`;
|
||||
loadMoreBtn.style.display = 'none';
|
||||
totalSpan.textContent = data.total ? `${data.total} total` : '';
|
||||
return;
|
||||
}
|
||||
|
||||
let html = '';
|
||||
if (!append) {
|
||||
html = '<table style="width: 100%; border-collapse: collapse; font-size: 0.82rem;">';
|
||||
html += '<tr style="border-bottom: 1px solid var(--border); color: var(--muted);">';
|
||||
html += '<th style="padding: 6px; text-align: left; width: 160px;">When</th>';
|
||||
html += '<th style="padding: 6px; text-align: left; width: 80px;">Level</th>';
|
||||
html += '<th style="padding: 6px; text-align: left; width: 140px;">Context</th>';
|
||||
html += '<th style="padding: 6px; text-align: left;">Message</th>';
|
||||
html += '<th style="padding: 6px; text-align: left; width: 110px;">IP</th>';
|
||||
html += '</tr>';
|
||||
}
|
||||
|
||||
for (const log of logs) {
|
||||
const level = (log.level || '?').toUpperCase();
|
||||
const levelColor = level === 'ERR' ? 'var(--bad-fg)' : (level === 'WARN' ? 'var(--warn-fg, #f0c674)' : 'var(--muted)');
|
||||
const ts = log.timestamp ? new Date(log.timestamp).toLocaleString() : '—';
|
||||
const ctx = log.context || '—';
|
||||
const msg = (log.error || '').split('\n')[0];
|
||||
const ip = (log.request && log.request.ip) || '';
|
||||
html += `<tr style="border-bottom: 1px solid var(--border); cursor: pointer;" class="error-log-row">`;
|
||||
html += `<td style="padding: 6px; color: var(--muted);" title="${escapeHtml(log.timestamp || '')}">${escapeHtml(ts)}</td>`;
|
||||
html += `<td style="padding: 6px;"><span style="color: ${levelColor}; font-weight: 600;">${escapeHtml(level)}</span></td>`;
|
||||
html += `<td style="padding: 6px; font-family: monospace; font-size: 0.78rem;">${escapeHtml(ctx)}</td>`;
|
||||
html += `<td style="padding: 6px;">${escapeHtml(msg)}</td>`;
|
||||
html += `<td style="padding: 6px; font-family: monospace; font-size: 0.78rem;">${escapeHtml(ip)}</td>`;
|
||||
html += '</tr>';
|
||||
if (log.detail) {
|
||||
html += `<tr class="error-log-detail" style="display: none;"><td colspan="5" style="padding: 6px 6px 10px; font-size: 0.78rem; color: var(--muted);"><pre style="margin: 0; white-space: pre-wrap; font-family: monospace; max-height: 320px; overflow: auto;">${escapeHtml(log.detail)}</pre></td></tr>`;
|
||||
if (data.success && data.logs) {
|
||||
if (data.logs.length === 0) {
|
||||
content.innerHTML = '<div style="padding: 20px; text-align: center; color: var(--muted);">✅ No errors logged! Everything is working smoothly.</div>';
|
||||
} else {
|
||||
content.innerHTML = data.logs.map((log, idx) => {
|
||||
const date = new Date(log.timestamp).toLocaleString();
|
||||
const lvl = (log.level || 'ERR').toUpperCase();
|
||||
const detailsId = `error-log-details-${idx}`;
|
||||
const details = log.details ? escapeHtml(log.details) : null;
|
||||
const ctx = log.context ? `<strong>${escapeHtml(log.context)}</strong>: ` : '';
|
||||
const msg = escapeHtml(log.message || '');
|
||||
return `
|
||||
<div class="${levelClass(log.level)}">
|
||||
<span class="log-timestamp">${escapeHtml(date)}</span>
|
||||
<span class="log-level">${escapeHtml(lvl)}</span>
|
||||
<div class="log-message">
|
||||
${ctx}${msg}
|
||||
${details ? `<br><details id="${detailsId}"><summary style="cursor:pointer;opacity:.7">stack + request context</summary><pre style="margin:6px 0 0;font-size:.75rem;background:var(--card-bg);padding:8px;border-radius:4px;overflow-x:auto">${details}</pre></details>` : ''}
|
||||
</div>
|
||||
</div>
|
||||
`;
|
||||
}).join('');
|
||||
}
|
||||
}
|
||||
|
||||
if (!append) {
|
||||
html += '</table>';
|
||||
container.innerHTML = html;
|
||||
const sizeStr = formatBytes(data.totalSize);
|
||||
const truncStr = data.truncated ? ' (showing last 2 MiB)' : '';
|
||||
const returnedStr = `${data.returned ?? data.logs.length}`;
|
||||
meta.textContent = `${returnedStr} entries · ${sizeStr}${truncStr}`;
|
||||
} else {
|
||||
const table = container.querySelector('table');
|
||||
if (table) table.insertAdjacentHTML('beforeend', html);
|
||||
content.innerHTML = '<div style="padding: 20px; color: var(--bad-fg);">❌ Failed to load error logs</div>';
|
||||
}
|
||||
|
||||
currentOffset += logs.length;
|
||||
loadMoreBtn.style.display = data.hasMore ? '' : 'none';
|
||||
totalSpan.textContent = `${data.total} total${data.hasMore ? ' (showing ' + currentOffset + ')' : ''}`;
|
||||
|
||||
// Toggle detail rows on click — same pattern as audit-log.js
|
||||
container.querySelectorAll('.error-log-row').forEach((row) => {
|
||||
if (row.dataset.wired) return;
|
||||
row.dataset.wired = 'true';
|
||||
row.addEventListener('click', () => {
|
||||
const detail = row.nextElementSibling;
|
||||
if (detail && detail.classList.contains('error-log-detail')) {
|
||||
detail.style.display = detail.style.display === 'none' ? '' : 'none';
|
||||
}
|
||||
});
|
||||
});
|
||||
} catch (e) {
|
||||
if (e && e.name === 'AbortError') return;
|
||||
container.innerHTML = `<div class="panel-empty" style="color: var(--bad-fg);">Failed: ${escapeHtml(e.message)}</div>`;
|
||||
totalSpan.textContent = '';
|
||||
} catch (error) {
|
||||
content.innerHTML = `<div style="padding: 20px; color: var(--bad-fg);">❌ Error loading logs: ${escapeHtml(error.message)}</div>`;
|
||||
}
|
||||
}
|
||||
|
||||
async function clearLogs() {
|
||||
if (!confirm('Clear the entire error log? This cannot be undone.')) return;
|
||||
async function clearErrorLogs() {
|
||||
if (!confirm('Clear all error logs?')) return;
|
||||
|
||||
try {
|
||||
const res = await secureFetch('/api/v1/error-logs', {
|
||||
method: 'DELETE',
|
||||
headers: { 'content-type': 'application/json' },
|
||||
body: JSON.stringify({ confirm: 'CLEAR' }),
|
||||
});
|
||||
const data = await res.json();
|
||||
const response = await secureFetch('/api/v1/error-logs', { method: 'DELETE' });
|
||||
const data = await response.json();
|
||||
|
||||
if (data.success) {
|
||||
// After a clear, the contexts list will be empty — re-fetch so the
|
||||
// dropdown reflects reality. Load the now-empty page in parallel.
|
||||
await refreshContexts();
|
||||
loadLogs(false);
|
||||
showNotification('✅ Error logs cleared', 'success', 3000);
|
||||
loadErrorLogs();
|
||||
} else {
|
||||
showNotification('❌ ' + (data.error || 'Clear failed'), 'error', 4000);
|
||||
showNotification('❌ Failed to clear logs', 'error', 3000);
|
||||
}
|
||||
} catch (e) {
|
||||
showNotification('❌ ' + e.message, 'error', 4000);
|
||||
} catch (error) {
|
||||
showNotification(`❌ Error: ${error.message}`, 'error', 3000);
|
||||
}
|
||||
}
|
||||
|
||||
// Debounce text-input changes so we don't refetch on every keystroke.
|
||||
let searchDebounce;
|
||||
function wireFilters() {
|
||||
levelSel?.addEventListener('change', () => loadLogs(false));
|
||||
contextSel?.addEventListener('change', () => loadLogs(false));
|
||||
searchInput?.addEventListener('input', () => {
|
||||
clearTimeout(searchDebounce);
|
||||
searchDebounce = setTimeout(() => loadLogs(false), 250);
|
||||
});
|
||||
let dateDebounce;
|
||||
[sinceInput, untilInput].forEach((el) => {
|
||||
el?.addEventListener('change', () => {
|
||||
clearTimeout(dateDebounce);
|
||||
dateDebounce = setTimeout(() => loadLogs(false), 250);
|
||||
});
|
||||
});
|
||||
refreshBtn?.addEventListener('click', () => loadLogs(false));
|
||||
loadMoreBtn?.addEventListener('click', () => loadLogs(true));
|
||||
clearBtn?.addEventListener('click', clearLogs);
|
||||
wireModal(modal, closeBtn);
|
||||
}
|
||||
|
||||
viewBtn?.addEventListener('click', async () => {
|
||||
modal?.classList.add('show');
|
||||
await refreshContexts();
|
||||
loadLogs(false);
|
||||
viewBtn?.addEventListener('click', () => {
|
||||
modal.classList.add('show');
|
||||
loadErrorLogs();
|
||||
});
|
||||
wireFilters();
|
||||
|
||||
refreshBtn?.addEventListener('click', loadErrorLogs);
|
||||
clearBtn?.addEventListener('click', clearErrorLogs);
|
||||
levelSelect?.addEventListener('change', loadErrorLogs);
|
||||
tailSelect?.addEventListener('change', loadErrorLogs);
|
||||
wireModal(modal, closeBtn);
|
||||
})();
|
||||
@@ -1,282 +0,0 @@
|
||||
// ========== DC-055: HOST JOURNALD LOG VIEWER ==========
|
||||
// Streams host service logs (caddy, dashcaddy-api, docker, ssh, …) via the
|
||||
// journalctl bind-mount added in start.sh. Server-Sent Events for live
|
||||
// tailing; bounded non-streaming read for historical views.
|
||||
(function() {
|
||||
'use strict';
|
||||
|
||||
// Allow-list mirrors the backend's ALLOWED_UNITS so the dropdown stays
|
||||
// honest when the bind-mount isn't available. The server is still the
|
||||
// source of truth — anything not in its allow-list returns 400.
|
||||
const UNIT_PRESETS = [
|
||||
{ unit: 'caddy', label: 'Caddy (reverse proxy)' },
|
||||
{ unit: 'dashcaddy-api', label: 'DashCaddy API (host systemd unit, not this container)' },
|
||||
{ unit: 'docker', label: 'Docker daemon' },
|
||||
{ unit: 'ssh', label: 'SSH server' },
|
||||
{ unit: 'systemd-journald', label: 'systemd-journald' },
|
||||
{ unit: 'tailscaled', label: 'Tailscale' },
|
||||
{ unit: 'networkd-dispatcher', label: 'Networkd dispatcher' },
|
||||
];
|
||||
|
||||
injectModal('journald-modal', `
|
||||
<div id="journald-modal" class="weather-modal" style="z-index: 1002;">
|
||||
<div class="weather-modal-content" style="min-width: 900px; max-width: 95vw; height: 80vh; display: flex; flex-direction: column;">
|
||||
<div class="logs-header" style="display: flex; justify-content: space-between; align-items: center; padding-bottom: 12px; border-bottom: 1px solid var(--border); margin-bottom: 12px;">
|
||||
<div>
|
||||
<h3 style="margin: 0;">🛰️ Host Logs (journald)</h3>
|
||||
<p class="modal-subtitle" style="margin: 4px 0 0 0; font-size: 0.85rem; opacity: 0.7;">
|
||||
Stream host service logs from <code>journalctl</code> (read-only mount). Docker container logs are still in the <em>Container Logs</em> modal.
|
||||
</p>
|
||||
</div>
|
||||
<div class="logs-controls" style="display: flex; gap: 8px; align-items: center; flex-wrap: wrap; justify-content: flex-end;">
|
||||
<select id="jd-unit-select" style="padding: 6px 10px; border: 1px solid var(--border); border-radius: 6px; background: var(--bg); color: var(--fg); min-width: 220px;"></select>
|
||||
<input type="text" id="jd-search" placeholder="Search logs..." style="padding: 6px 10px; border: 1px solid var(--border); border-radius: 6px; background: var(--bg); color: var(--fg); width: 160px;" />
|
||||
<input type="number" id="jd-tail" min="1" max="5000" value="200" title="Lines to load (historical view)" style="padding: 6px 10px; border: 1px solid var(--border); border-radius: 6px; background: var(--bg); color: var(--fg); width: 90px;" />
|
||||
<button id="jd-refresh" class="btn-accent-solid" style="padding: 6px 14px; font-size: 0.85rem;">🔄 Load tail</button>
|
||||
<button id="jd-stream" class="btn-accent-solid" style="padding: 6px 14px; font-size: 0.85rem;">▶ Stream</button>
|
||||
<button id="jd-clear-search" style="padding: 6px 10px; font-size: 0.85rem;" title="Clear search">✕</button>
|
||||
<button id="jd-close" class="close-btn" style="padding: 6px 10px;">✕</button>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div id="jd-meta" style="display: flex; gap: 16px; margin-bottom: 12px; padding: 8px 12px; background: var(--bg-secondary, var(--bg)); border-radius: 6px; font-size: 0.82rem; flex-wrap: wrap;">
|
||||
<span><strong>Source:</strong> <span id="jd-source">journald</span></span>
|
||||
<span><strong>Unit:</strong> <span id="jd-unit-display">-</span></span>
|
||||
<span><strong>Stream:</strong> <span id="jd-stream-state">disconnected</span></span>
|
||||
</div>
|
||||
|
||||
<div id="jd-content" class="logs-content scroll-container" style="flex: 1; min-height: 0; background: #1a1a1a; border-radius: 6px; padding: 12px; font-family: 'Monaco', 'Menlo', 'Ubuntu Mono', monospace; font-size: 0.78rem; overflow: auto;">
|
||||
<div class="logs-loading" style="color: var(--muted); text-align: center; padding: 40px;">Select a unit and click <em>Load tail</em> or <em>Stream</em>.</div>
|
||||
</div>
|
||||
|
||||
<div class="weather-modal-buttons modal-footer-bar" style="margin-top: 12px; padding-top: 12px; border-top: 1px solid var(--border);">
|
||||
<div style="display: flex; gap: 8px; font-size: 0.78rem; color: var(--muted);">
|
||||
<span id="jd-line-count">0 lines</span>
|
||||
<span>|</span>
|
||||
<span id="jd-filter-count">0 shown</span>
|
||||
<span>|</span>
|
||||
<span id="jd-overflow" style="display: none; color: var(--warn-fg, #fbbf24);">⚠ stream overflow — re-load with narrower window</span>
|
||||
</div>
|
||||
<button id="jd-close-btn" class="btn-secondary">Close</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
`);
|
||||
|
||||
const modal = document.getElementById('journald-modal');
|
||||
const unitSelect = document.getElementById('jd-unit-select');
|
||||
const searchInput = document.getElementById('jd-search');
|
||||
const tailInput = document.getElementById('jd-tail');
|
||||
const refreshBtn = document.getElementById('jd-refresh');
|
||||
const streamBtn = document.getElementById('jd-stream');
|
||||
const clearSearch = document.getElementById('jd-clear-search');
|
||||
const closeBtn = document.getElementById('jd-close');
|
||||
const closeBtn2 = document.getElementById('jd-close-btn');
|
||||
const content = document.getElementById('jd-content');
|
||||
const lineCount = document.getElementById('jd-line-count');
|
||||
const filterCount = document.getElementById('jd-filter-count');
|
||||
const overflowHint = document.getElementById('jd-overflow');
|
||||
const unitDisplay = document.getElementById('jd-unit-display');
|
||||
const streamState = document.getElementById('jd-stream-state');
|
||||
|
||||
let available = false; // /var/log/journal mounted?
|
||||
let lines = []; // current buffer (array of {timestamp, unit, text})
|
||||
let streaming = false;
|
||||
let eventSource = null;
|
||||
let searchTimer = null;
|
||||
|
||||
function escapeHtml(s) {
|
||||
// Local re-declaration so we don't depend on a global; same semantics
|
||||
// as the helper used by container-logs.js and error-logs.js.
|
||||
const div = document.createElement('div');
|
||||
div.textContent = String(s);
|
||||
return div.innerHTML;
|
||||
}
|
||||
|
||||
function setAvailable(isAvailable) {
|
||||
available = isAvailable;
|
||||
unitSelect.innerHTML = '';
|
||||
UNIT_PRESETS.forEach(p => {
|
||||
const opt = document.createElement('option');
|
||||
opt.value = p.unit;
|
||||
opt.textContent = p.label + ' (' + p.unit + ')';
|
||||
unitSelect.appendChild(opt);
|
||||
});
|
||||
unitSelect.disabled = !isAvailable;
|
||||
if (!isAvailable) {
|
||||
content.innerHTML = '<div class="logs-loading" style="color: var(--muted); text-align: center; padding: 40px;">journald bind-mount not available in this container.<br/><small>Requires <code>/var/log/journal</code> + <code>/usr/bin/journalctl</code> mounted (start.sh).</small></div>';
|
||||
refreshBtn.disabled = true;
|
||||
streamBtn.disabled = true;
|
||||
} else {
|
||||
refreshBtn.disabled = false;
|
||||
streamBtn.disabled = false;
|
||||
}
|
||||
}
|
||||
|
||||
async function probeAvailable() {
|
||||
try {
|
||||
const resp = await fetch('/api/v1/logs/journal/units');
|
||||
if (!resp.ok) { setAvailable(false); return; }
|
||||
const data = await resp.json();
|
||||
setAvailable(!!data.available);
|
||||
} catch (e) {
|
||||
setAvailable(false);
|
||||
}
|
||||
}
|
||||
|
||||
function renderLines() {
|
||||
const term = (searchInput.value || '').trim().toLowerCase();
|
||||
const filtered = term ? lines.filter(l => (l.textContent || '').toLowerCase().includes(term)) : lines;
|
||||
if (filtered.length === 0) {
|
||||
content.innerHTML = '<div class="logs-loading" style="color: var(--muted); text-align: center; padding: 40px;">No entries' + (term ? ` matching "${escapeHtml(term)}"` : '') + '</div>';
|
||||
} else {
|
||||
const html = filtered.map(line => {
|
||||
const ts = line.timestamp ? escapeHtml(line.timestamp) : '—';
|
||||
const t = escapeHtml(line.textContent);
|
||||
return `<div class="jd-line" style="padding: 1px 0; line-height: 1.4; color: #d4d4d4;"><span style="color: var(--muted); margin-right: 8px;">${ts}</span>${t}</div>`;
|
||||
}).join('');
|
||||
content.innerHTML = html;
|
||||
// Auto-scroll only if user is already at the bottom (don't fight them).
|
||||
const nearBottom = content.scrollHeight - content.scrollTop - content.clientHeight < 80;
|
||||
if (nearBottom) content.scrollTop = content.scrollHeight;
|
||||
}
|
||||
lineCount.textContent = `${lines.length} entries`;
|
||||
filterCount.textContent = term ? `${filtered.length} of ${lines.length} shown` : `${lines.length} shown`;
|
||||
}
|
||||
|
||||
async function loadTail() {
|
||||
if (!available) return;
|
||||
stopStream();
|
||||
const unit = unitSelect.value;
|
||||
if (!unit) return;
|
||||
const tail = Math.max(1, Math.min(5000, Number(tailInput.value) || 200));
|
||||
const term = (searchInput.value || '').trim();
|
||||
content.innerHTML = '<div class="logs-loading" style="color: var(--muted); text-align: center; padding: 40px;">Loading…</div>';
|
||||
try {
|
||||
const url = new URL('/api/v1/logs/journal', window.location.origin);
|
||||
url.searchParams.set('unit', unit);
|
||||
url.searchParams.set('tail', String(tail));
|
||||
if (term) url.searchParams.set('search', term);
|
||||
const resp = await fetch(url.toString());
|
||||
const data = await resp.json();
|
||||
if (!resp.ok || !data.success) {
|
||||
content.innerHTML = '<div class="logs-loading" style="color: var(--bad-fg, #ef4444); text-align: center; padding: 40px;">Failed: ' + escapeHtml((data && data.error) || ('HTTP ' + resp.status)) + '</div>';
|
||||
return;
|
||||
}
|
||||
unitDisplay.textContent = unit;
|
||||
lines = (data.entries || []).map(e => ({
|
||||
timestamp: e.timestamp,
|
||||
unit: e.unit,
|
||||
textContent: e.text || '',
|
||||
}));
|
||||
overflowHint.style.display = 'none';
|
||||
renderLines();
|
||||
} catch (e) {
|
||||
content.innerHTML = '<div class="logs-loading" style="color: var(--bad-fg, #ef4444); text-align: center; padding: 40px;">Error: ' + escapeHtml(e.message) + '</div>';
|
||||
}
|
||||
}
|
||||
|
||||
function startStream() {
|
||||
if (!available) return;
|
||||
stopStream();
|
||||
const unit = unitSelect.value;
|
||||
if (!unit) return;
|
||||
const term = (searchInput.value || '').trim();
|
||||
unitDisplay.textContent = unit;
|
||||
streamBtn.textContent = '⏸ Stop';
|
||||
streamBtn.classList.add('streaming');
|
||||
streamState.textContent = 'streaming';
|
||||
streamState.style.color = 'var(--ok-fg, #4ade80)';
|
||||
lines = [];
|
||||
renderLines();
|
||||
overflowHint.style.display = 'none';
|
||||
const url = new URL('/api/v1/logs/journal/stream', window.location.origin);
|
||||
url.searchParams.set('unit', unit);
|
||||
if (term) url.searchParams.set('search', term);
|
||||
eventSource = new EventSource(url.toString());
|
||||
eventSource.onmessage = (ev) => {
|
||||
try {
|
||||
const entry = JSON.parse(ev.data);
|
||||
if (entry.error) {
|
||||
// Overflow / validation / bind-mount errors
|
||||
if (/stream (exceeded|line cap)/.test(entry.error)) {
|
||||
overflowHint.style.display = '';
|
||||
stopStream();
|
||||
}
|
||||
content.innerHTML += '<div class="jd-line" style="color: var(--bad-fg, #ef4444); padding: 4px 0;">⚠ ' + escapeHtml(entry.error) + '</div>';
|
||||
content.scrollTop = content.scrollHeight;
|
||||
return;
|
||||
}
|
||||
lines.push({
|
||||
timestamp: entry.timestamp,
|
||||
unit: entry.unit || unit,
|
||||
textContent: entry.text || '',
|
||||
});
|
||||
// Hard cap to keep memory bounded if operator streams forever.
|
||||
if (lines.length > 5000) {
|
||||
lines = lines.slice(lines.length - 5000);
|
||||
overflowHint.style.display = '';
|
||||
}
|
||||
renderLines();
|
||||
} catch (_) {
|
||||
// Ignore malformed events; the server is authoritative.
|
||||
}
|
||||
};
|
||||
eventSource.onerror = () => {
|
||||
// EventSource auto-reconnects; mark transient if we were expecting
|
||||
// more, otherwise we closed it deliberately.
|
||||
if (!streaming) return;
|
||||
};
|
||||
streaming = true;
|
||||
}
|
||||
|
||||
function stopStream() {
|
||||
streaming = false;
|
||||
if (eventSource) {
|
||||
try { eventSource.close(); } catch (_) { /* ignore */ }
|
||||
eventSource = null;
|
||||
}
|
||||
streamBtn.textContent = '▶ Stream';
|
||||
streamBtn.classList.remove('streaming');
|
||||
streamState.textContent = 'disconnected';
|
||||
streamState.style.color = 'var(--muted)';
|
||||
}
|
||||
|
||||
function close() {
|
||||
stopStream();
|
||||
modal.classList.remove('show');
|
||||
}
|
||||
|
||||
// Wire events
|
||||
refreshBtn.addEventListener('click', loadTail);
|
||||
streamBtn.addEventListener('click', () => streaming ? stopStream() : startStream());
|
||||
clearSearch.addEventListener('click', () => { searchInput.value = ''; renderLines(); });
|
||||
searchInput.addEventListener('input', () => {
|
||||
clearTimeout(searchTimer);
|
||||
searchTimer = setTimeout(renderLines, 200);
|
||||
});
|
||||
searchInput.addEventListener('keydown', (e) => {
|
||||
if (e.key === 'Escape') { searchInput.value = ''; renderLines(); }
|
||||
});
|
||||
closeBtn.addEventListener('click', close);
|
||||
closeBtn2.addEventListener('click', close);
|
||||
modal.addEventListener('click', (e) => { if (e.target === modal) close(); });
|
||||
document.addEventListener('keydown', (e) => {
|
||||
if (e.key === 'Escape' && modal.classList.contains('show')) close();
|
||||
});
|
||||
// Reload tail automatically when the unit dropdown changes (if we have
|
||||
// data already — saves a click).
|
||||
unitSelect.addEventListener('change', () => {
|
||||
if (lines.length > 0) loadTail();
|
||||
});
|
||||
|
||||
// Hook into the existing "Container Logs" modal button so operators get a
|
||||
// separate entry point; mirror the openContainerLogsModal pattern.
|
||||
function openJournaldModal() {
|
||||
modal.classList.add('show');
|
||||
probeAvailable();
|
||||
}
|
||||
window.openJournaldModal = openJournaldModal;
|
||||
|
||||
document.getElementById('view-journald-logs')?.addEventListener('click', openJournaldModal);
|
||||
})();
|
||||
@@ -0,0 +1,172 @@
|
||||
// Logs page (status/logs.html) — dedicated admin log viewer.
|
||||
// Two tabs: Error log (calls /api/v1/error-logs) + Container (calls
|
||||
// /api/v1/logs/containers + /api/v1/logs/container/:id). Mirrors the
|
||||
// /api/v1/error-logs parser fix from DC-051 — U+2500 separator, capped
|
||||
// tail, level filter.
|
||||
(function() {
|
||||
'use strict';
|
||||
|
||||
function escapeHtml(s) {
|
||||
if (s === null || s === undefined) return '';
|
||||
return String(s).replace(/[&<>"']/g, c => ({'&':'&','<':'<','>':'>','"':'"',"'":'''}[c]));
|
||||
}
|
||||
|
||||
function formatBytes(n) {
|
||||
if (!Number.isFinite(n) || n <= 0) return '0 B';
|
||||
if (n < 1024) return n + ' B';
|
||||
if (n < 1024 * 1024) return (n / 1024).toFixed(1) + ' KiB';
|
||||
return (n / 1024 / 1024).toFixed(2) + ' MiB';
|
||||
}
|
||||
|
||||
const out = document.getElementById('output');
|
||||
const meta = document.getElementById('meta');
|
||||
const tabError = document.getElementById('tab-error');
|
||||
const tabContainer = document.getElementById('tab-container');
|
||||
const errorCtrls = document.getElementById('error-controls');
|
||||
const containerCtrls = document.getElementById('container-controls');
|
||||
|
||||
let activeTab = 'error';
|
||||
let containers = [];
|
||||
|
||||
function switchTab(tab) {
|
||||
activeTab = tab;
|
||||
tabError.classList.toggle('active', tab === 'error');
|
||||
tabContainer.classList.toggle('active', tab === 'container');
|
||||
errorCtrls.style.display = tab === 'error' ? 'flex' : 'none';
|
||||
containerCtrls.style.display = tab === 'container' ? 'flex' : 'none';
|
||||
if (tab === 'error') loadErrorLog();
|
||||
else loadContainerList();
|
||||
}
|
||||
|
||||
async function fetchJson(url, opts) {
|
||||
const r = await fetch(url, opts);
|
||||
const data = await r.json().catch(() => ({}));
|
||||
if (!r.ok || (data && data.success === false)) {
|
||||
throw new Error((data && (data.error || data.message)) || `HTTP ${r.status}`);
|
||||
}
|
||||
return data;
|
||||
}
|
||||
|
||||
async function loadErrorLog() {
|
||||
const tailEl = /** @type {HTMLSelectElement} */ (document.getElementById('tail'));
|
||||
const levelEl = /** @type {HTMLSelectElement} */ (document.getElementById('level'));
|
||||
const tail = tailEl.value;
|
||||
const level = levelEl.value;
|
||||
let qs = `tail=${encodeURIComponent(tail)}`;
|
||||
if (level) qs += '&level=' + encodeURIComponent(level);
|
||||
|
||||
out.innerHTML = '<div class="logs-loading">Loading error log…</div>';
|
||||
meta.textContent = '';
|
||||
try {
|
||||
const data = await fetchJson('/api/v1/error-logs?' + qs);
|
||||
const logs = data.logs || [];
|
||||
if (logs.length === 0) {
|
||||
out.innerHTML = '<div class="empty">✅ No errors logged</div>';
|
||||
} else {
|
||||
out.innerHTML = logs.map((log, idx) => {
|
||||
const date = new Date(log.timestamp).toLocaleString();
|
||||
const lvl = (log.level || 'ERR').toUpperCase();
|
||||
const cls = ['ERR','WRN','INF','DBG'].includes(lvl) ? lvl.toLowerCase() : 'error';
|
||||
const details = log.details ? escapeHtml(log.details) : null;
|
||||
return `
|
||||
<div class="log-entry ${cls}">
|
||||
<span class="log-timestamp">${escapeHtml(date)}</span>
|
||||
<span class="log-level">${escapeHtml(lvl)}</span>
|
||||
<div class="log-message">
|
||||
<strong>${escapeHtml(log.context || '')}</strong>: ${escapeHtml(log.message || '')}
|
||||
${details ? `<details><summary style="cursor:pointer;opacity:.7">stack + request context</summary><pre>${details}</pre></details>` : ''}
|
||||
</div>
|
||||
</div>
|
||||
`;
|
||||
}).join('');
|
||||
}
|
||||
const sizeStr = formatBytes(data.totalSize);
|
||||
const truncStr = data.truncated ? ' (last 2 MiB)' : '';
|
||||
const returnedStr = data.returned ?? logs.length;
|
||||
meta.textContent = `${returnedStr} entries · ${sizeStr}${truncStr}`;
|
||||
} catch (err) {
|
||||
out.innerHTML = `<div class="empty">❌ ${escapeHtml(err.message)}</div>`;
|
||||
}
|
||||
}
|
||||
|
||||
async function clearErrorLog() {
|
||||
if (!confirm('Clear all error logs?')) return;
|
||||
try {
|
||||
await fetchJson('/api/v1/error-logs', { method: 'DELETE' });
|
||||
meta.textContent = '✅ cleared';
|
||||
loadErrorLog();
|
||||
} catch (err) {
|
||||
meta.textContent = '❌ ' + err.message;
|
||||
}
|
||||
}
|
||||
|
||||
async function loadContainerList() {
|
||||
const sel = document.getElementById('container-select');
|
||||
out.innerHTML = '<div class="logs-loading">Loading containers…</div>';
|
||||
document.getElementById('container-meta').textContent = '';
|
||||
try {
|
||||
const data = await fetchJson('/api/v1/logs/containers');
|
||||
containers = data.containers || [];
|
||||
sel.innerHTML = containers.map(c => {
|
||||
const name = c.name || c.id;
|
||||
const state = (c.status || 'unknown');
|
||||
return `<option value="${escapeHtml(c.id)}">${escapeHtml(name)} (${escapeHtml(state)})</option>`;
|
||||
}).join('');
|
||||
if (containers.length === 0) {
|
||||
out.innerHTML = '<div class="empty">No containers running</div>';
|
||||
return;
|
||||
}
|
||||
loadContainerLog();
|
||||
} catch (err) {
|
||||
out.innerHTML = `<div class="empty">❌ ${escapeHtml(err.message)}</div>`;
|
||||
}
|
||||
}
|
||||
|
||||
async function loadContainerLog() {
|
||||
const sel = /** @type {HTMLSelectElement} */ (document.getElementById('container-select'));
|
||||
const tailEl = /** @type {HTMLSelectElement} */ (document.getElementById('container-tail'));
|
||||
const tail = tailEl.value;
|
||||
const id = sel.value;
|
||||
if (!id) {
|
||||
out.innerHTML = '<div class="empty">Select a container</div>';
|
||||
return;
|
||||
}
|
||||
out.innerHTML = '<div class="logs-loading">Loading container logs…</div>';
|
||||
document.getElementById('container-meta').textContent = '';
|
||||
try {
|
||||
const data = await fetchJson(`/api/v1/logs/container/${encodeURIComponent(id)}?tail=${encodeURIComponent(tail)}×tamps=true`);
|
||||
const logs = data.logs || [];
|
||||
if (logs.length === 0) {
|
||||
out.innerHTML = '<div class="empty">No log lines</div>';
|
||||
} else {
|
||||
out.innerHTML = logs.map(l => {
|
||||
const cls = l.stream === 'stderr' ? 'error' : 'info';
|
||||
const ts = l.timestamp || (data.logs.length ? '' : '');
|
||||
return `
|
||||
<div class="log-entry ${cls}">
|
||||
${ts ? `<span class="log-timestamp">${escapeHtml(new Date(ts).toLocaleString())}</span>` : ''}
|
||||
<span class="log-level">${l.stream === 'stderr' ? 'ERR' : 'OUT'}</span>
|
||||
<div class="log-message"><pre style="margin:0;white-space:pre-wrap">${escapeHtml(l.text)}</pre></div>
|
||||
</div>
|
||||
`;
|
||||
}).join('');
|
||||
}
|
||||
const containerName = data.containerName || '';
|
||||
document.getElementById('container-meta').textContent = `${escapeHtml(containerName)} · ${logs.length} lines`;
|
||||
} catch (err) {
|
||||
out.innerHTML = `<div class="empty">❌ ${escapeHtml(err.message)}</div>`;
|
||||
}
|
||||
}
|
||||
|
||||
tabError.addEventListener('click', () => switchTab('error'));
|
||||
tabContainer.addEventListener('click', () => switchTab('container'));
|
||||
document.getElementById('refresh').addEventListener('click', loadErrorLog);
|
||||
document.getElementById('clear').addEventListener('click', clearErrorLog);
|
||||
document.getElementById('level').addEventListener('change', loadErrorLog);
|
||||
document.getElementById('tail').addEventListener('change', loadErrorLog);
|
||||
document.getElementById('container-refresh').addEventListener('click', loadContainerLog);
|
||||
document.getElementById('container-select').addEventListener('change', loadContainerLog);
|
||||
document.getElementById('container-tail').addEventListener('change', loadContainerLog);
|
||||
|
||||
switchTab('error');
|
||||
})();
|
||||
@@ -0,0 +1,99 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<title>DashCaddy — Logs</title>
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<link rel="stylesheet" href="/css/style.css">
|
||||
<style>
|
||||
body.logs-page { padding: 0; margin: 0; background: var(--bg, #0e1116); color: var(--fg, #e6e6e6); font-family: ui-monospace, SFMono-Regular, Menlo, monospace; }
|
||||
.logs-wrap { max-width: 1200px; margin: 24px auto; padding: 0 16px; }
|
||||
.logs-top { display: flex; align-items: center; gap: 12px; padding: 12px 16px; background: var(--card-bg, #161a22); border-radius: 8px; margin-bottom: 16px; }
|
||||
.logs-top h1 { margin: 0; font-size: 1.1rem; }
|
||||
.logs-tabs { display: flex; gap: 6px; margin-left: auto; }
|
||||
.logs-tabs button { padding: 6px 12px; background: transparent; border: 1px solid var(--border, #2a2f3a); color: inherit; border-radius: 6px; cursor: pointer; font: inherit; font-size: .85rem; }
|
||||
.logs-tabs button.active { background: var(--accent, #4f8cff); color: white; border-color: transparent; }
|
||||
.logs-controls { display: flex; gap: 8px; align-items: center; padding: 10px 16px; background: var(--card-bg, #161a22); border-radius: 8px; margin-bottom: 12px; flex-wrap: wrap; }
|
||||
.logs-controls select, .logs-controls input { background: var(--bg, #0e1116); color: inherit; border: 1px solid var(--border, #2a2f3a); padding: 4px 8px; border-radius: 4px; font: inherit; font-size: .85rem; }
|
||||
.logs-controls button { padding: 6px 12px; background: var(--accent, #4f8cff); color: white; border: none; border-radius: 4px; cursor: pointer; font: inherit; font-size: .85rem; }
|
||||
.logs-controls button.danger { background: color-mix(in srgb, #ff5555 25%, transparent); border: 1px solid #ff5555; color: #ff5555; }
|
||||
.logs-meta { color: var(--muted, #8a93a6); font-size: .8rem; margin-left: auto; }
|
||||
.logs-output { background: var(--card-bg, #161a22); border-radius: 8px; padding: 12px; max-height: 70vh; overflow-y: auto; font-size: .85rem; line-height: 1.4; }
|
||||
.logs-output .log-entry { padding: 8px 10px; border-bottom: 1px solid var(--border, #2a2f3a); }
|
||||
.logs-output .log-entry:last-child { border-bottom: none; }
|
||||
.logs-output .log-entry.error { border-left: 3px solid #ff5555; }
|
||||
.logs-output .log-entry.warn { border-left: 3px solid #f0b400; }
|
||||
.logs-output .log-entry.info { border-left: 3px solid #4f8cff; }
|
||||
.logs-output .log-entry.debug { border-left: 3px solid #8a93a6; }
|
||||
.logs-output .log-timestamp { color: var(--muted, #8a93a6); margin-right: 8px; font-size: .75rem; }
|
||||
.logs-output .log-level { display: inline-block; padding: 0 6px; border-radius: 3px; font-size: .7rem; font-weight: 600; margin-right: 8px; min-width: 38px; text-align: center; }
|
||||
.log-entry.error .log-level { background: #ff5555; color: white; }
|
||||
.log-entry.warn .log-level { background: #f0b400; color: black; }
|
||||
.log-entry.info .log-level { background: #4f8cff; color: white; }
|
||||
.log-entry.debug .log-level { background: #555; color: white; }
|
||||
.logs-output .log-message pre { margin: 6px 0 0; font-size: .75rem; padding: 6px 8px; background: rgba(0,0,0,0.25); border-radius: 4px; overflow-x: auto; white-space: pre-wrap; word-break: break-word; }
|
||||
.logs-output .empty { color: var(--muted, #8a93a6); text-align: center; padding: 40px; }
|
||||
.logs-loading { color: var(--muted, #8a93a6); text-align: center; padding: 40px; }
|
||||
.logs-back { padding: 4px 10px; background: transparent; border: 1px solid var(--border, #2a2f3a); color: inherit; border-radius: 4px; cursor: pointer; font: inherit; font-size: .85rem; text-decoration: none; }
|
||||
.container-pick { display: flex; gap: 6px; align-items: center; }
|
||||
</style>
|
||||
</head>
|
||||
<body class="logs-page">
|
||||
<div class="logs-wrap">
|
||||
<div class="logs-top">
|
||||
<a href="/" class="logs-back">← Back</a>
|
||||
<h1>📋 Logs</h1>
|
||||
<div class="logs-tabs">
|
||||
<button id="tab-error" class="active">Error log</button>
|
||||
<button id="tab-container">Container</button>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- Error log controls -->
|
||||
<div id="error-controls" class="logs-controls">
|
||||
<label>Level:
|
||||
<select id="level">
|
||||
<option value="">All</option>
|
||||
<option value="ERR">Errors</option>
|
||||
<option value="WRN">Warnings</option>
|
||||
<option value="INF">Info</option>
|
||||
<option value="DBG">Debug</option>
|
||||
</select>
|
||||
</label>
|
||||
<label>Tail:
|
||||
<select id="tail">
|
||||
<option value="50">50</option>
|
||||
<option value="100" selected>100</option>
|
||||
<option value="200">200</option>
|
||||
<option value="500">500</option>
|
||||
</select>
|
||||
</label>
|
||||
<button id="refresh">🔄 Refresh</button>
|
||||
<button id="clear" class="danger">🗑️ Clear</button>
|
||||
<span class="logs-meta" id="meta"></span>
|
||||
</div>
|
||||
|
||||
<!-- Container log controls -->
|
||||
<div id="container-controls" class="logs-controls" style="display:none">
|
||||
<label>Container:
|
||||
<select id="container-select"></select>
|
||||
</label>
|
||||
<label>Tail:
|
||||
<select id="container-tail">
|
||||
<option value="50">50</option>
|
||||
<option value="200" selected>200</option>
|
||||
<option value="1000">1000</option>
|
||||
</select>
|
||||
</label>
|
||||
<button id="container-refresh">🔄 Refresh</button>
|
||||
<span class="logs-meta" id="container-meta"></span>
|
||||
</div>
|
||||
|
||||
<div class="logs-output" id="output">
|
||||
<div class="logs-loading">Loading…</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<script src="/js/logs-page.js" defer></script>
|
||||
</body>
|
||||
</html>
|
||||
+1
-1
@@ -1,4 +1,4 @@
|
||||
const CACHE = 'dashcaddy-shell-a24ef15882';
|
||||
const CACHE = 'dashcaddy-shell-78eab743c2';
|
||||
const PRECACHE = [
|
||||
'/',
|
||||
'/index.html',
|
||||
|
||||
Reference in New Issue
Block a user