Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Hermes
|
d362e79b1b |
No files matched your search
@@ -31,4 +31,3 @@ dashcaddy-api/*.js
|
||||
# checkout overwriting the live signing secret revokes activations (incident 2026-10-08).
|
||||
dashcaddy-api/.license-secret
|
||||
dashcaddy-api/.license-counter
|
||||
dashcaddy-api/data/services.json
|
||||
@@ -8,49 +8,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
||||
## [Unreleased]
|
||||
|
||||
### Added
|
||||
|
||||
- **DC-165 judge: grade B (round 5)** urn:ump:oqgczb6zv5bemekbxko7gi5rvfle6yoshwgfwsx4mbbj4xmg6paq
|
||||
- **DC-165: product/site uniformity + LLM-readable capabilities.** Site-vs-product
|
||||
audit reconciliation (owner: "advertise as Premium", "It should be LLM readable"):
|
||||
'fleet' added to PREMIUM_FEATURES and `requirePremium('fleet')` mounted at the
|
||||
/fleet ROUTER prefix (app.js) so every sub-route present and future inherits the
|
||||
gate — proven by 4 real-boot composition-root e2e tests (free 403 envelope
|
||||
contract, per-feature check, with-fleet gate cleared, hosts/status/deploy
|
||||
inheritance). 'workflows' + 'auto-backup' (gated in routes forever, missing from
|
||||
the constant so the offline path could never grant them) listed with
|
||||
source-quoted descriptions; marketing pages now advertise them (manual backup +
|
||||
Disaster Recovery stay free — copy matches code exactly). Offline activations
|
||||
forward-migrate on load (append-only union, online untouched — server stays
|
||||
authoritative). GET /api/v1/capabilities: public machine-readable manifest of the
|
||||
RUNNING build — six measured fields (version, template count/categories, MCP
|
||||
tools, transport identity triple, premium list, language count) derived at request
|
||||
time from the runtime modules (single source: MCP_RUNTIME exported from
|
||||
routes/mcp.js, read by /info and capabilities alike), static metadata fields
|
||||
honestly labeled; PUBLIC_ROUTES + drift test + OpenAPI 200-only contract;
|
||||
no-secrets negative test. License-server grant list extended to
|
||||
sso/recipes/swarm/fleet/workflows/auto-backup with existing records backfilled
|
||||
(ops). Marketing repo (dashcaddy.net, separate commits): counts 77→78 everywhere,
|
||||
internal-identifier sweep (~85 private-TLD/IP/user/path hits → .home/example
|
||||
style), radicale install guide (78th), calendar/Connect-AI advertised, MCP claim
|
||||
softened to real scope + capabilities pointer, llms.txt → runtime ground truth,
|
||||
robots LLMs-Txt line. 124 targeted tests (9 dc165 + 4 fleet-e2e + 76 license +
|
||||
21 tier + 14 drift); 73 MCP tests re-green after refactor.
|
||||
- **DC-164 judge: grade B (round 6)** urn:ump:5vuahbn4znf7hrrshjvu2pcbqln5m6qcrpkkn3mx6y2rvvmdtqoa
|
||||
- **DC-164: operator env overrides + license-material untracking.** start.sh
|
||||
forwards `-e` flags from /etc/dashcaddy/operator.env (root-owned KEY=VALUE,
|
||||
0600) into the container via scripts/operator-flags.js: one pinned fd
|
||||
(lstat pre-check → open O_RDONLY|O_NOFOLLOW|O_NONBLOCK → fstat+read on the
|
||||
same descriptor) so symlinks, FIFOs/devices, group/other-readable or
|
||||
special-bit modes, and foreign ownership are refused (exit 3, fail closed:
|
||||
warn + forward nothing; any other helper failure ABORTS startup, fail
|
||||
loud). Canonical flag ALLOW_LIFETIME_LICENSE=true — creator hosts only;
|
||||
it is a deployment rail, not the boundary: offline lifetime codes must
|
||||
HMAC-verify against the signing secret which is never shipped to customers
|
||||
(installs carry .license-secret-hash). 17 executed tests (FIFO non-block
|
||||
regression, O_NOFOLLOW symlink-to-valid-target, mode/owner matrix,
|
||||
injection-inert values). Root-cause fix for the 2026-10-08 incident:
|
||||
data/services.json, .license-secret, .license-counter UNTRACKED +
|
||||
.gitignore'd — deploy checkouts can no longer clobber live runtime state.
|
||||
- **DC-163 judge: grade B (round 2)** urn:ump:l2tg66wmchkmd6fde4k3ojwc56zpxqh657spe37bu6dpvduswalq
|
||||
- **DC-163: AI assistant that actually works — LLM intent engine + fixed
|
||||
chat panel.** The 🤖 floating assistant was broken end-to-end: the
|
||||
|
||||
@@ -1,201 +0,0 @@
|
||||
/**
|
||||
* DC-165: site/product uniformity bundle — tests.
|
||||
* 1. fleet is a gated premium feature (403 free / pass premium, and the
|
||||
* gate is mounted at ROUTER level so new sub-routes inherit it).
|
||||
* 2. offline activations minted before 'fleet' existed are forward-
|
||||
* migrated on load (creator lifetime key case).
|
||||
* 3. GET /api/v1/capabilities returns the running build's ground truth
|
||||
* derived from source modules (no drift by construction).
|
||||
*/
|
||||
|
||||
'use strict';
|
||||
|
||||
const express = require('express');
|
||||
|
||||
function buildGatedRouter(licenseLike) {
|
||||
const { LicenseManager } = require('../src/managers/license-manager');
|
||||
// Real requirePremium() against a duck-typed instance: own properties
|
||||
// (hasFeature/isExpired/log) win over prototype defaults.
|
||||
const lm = Object.assign(Object.create(LicenseManager.prototype), {
|
||||
log: { warn() {} },
|
||||
isExpired: () => false,
|
||||
}, licenseLike);
|
||||
const router = express.Router();
|
||||
router.use(lm.requirePremium('fleet'));
|
||||
router.get('/fleet/hosts', (_req, res) => res.json({ ok: true }));
|
||||
return router;
|
||||
}
|
||||
|
||||
describe('DC-165 fleet premium gate', () => {
|
||||
test('PREMIUM_FEATURES includes fleet (site entitlement contract)', () => {
|
||||
const { PREMIUM_FEATURES } = require('../src/managers/license-manager');
|
||||
expect(PREMIUM_FEATURES.fleet).toBeDefined();
|
||||
expect(PREMIUM_FEATURES.fleet.name).toMatch(/Fleet/i);
|
||||
});
|
||||
|
||||
test('free license: GET /fleet/hosts -> 403 premiumRequired fleet', async () => {
|
||||
const app = express();
|
||||
app.use('/api/v1', buildGatedRouter({
|
||||
hasFeature: () => false,
|
||||
isExpired: () => false,
|
||||
log: { warn() {} },
|
||||
}));
|
||||
const srv = await new Promise((r) => { const s = app.listen(0, () => r(s)); });
|
||||
try {
|
||||
const res = await fetch(`http://127.0.0.1:${srv.address().port}/api/v1/fleet/hosts`);
|
||||
expect(res.status).toBe(403);
|
||||
const body = await res.json();
|
||||
expect(body.premiumRequired).toBe(true);
|
||||
expect(body.feature).toBe('fleet');
|
||||
} finally { srv.close(); }
|
||||
});
|
||||
|
||||
test('premium license with fleet: request passes the gate', async () => {
|
||||
const app = express();
|
||||
app.use('/api/v1', buildGatedRouter({
|
||||
hasFeature: (f) => f === 'fleet',
|
||||
isExpired: () => false,
|
||||
log: { warn() {} },
|
||||
}));
|
||||
const srv = await new Promise((r) => { const s = app.listen(0, () => r(s)); });
|
||||
try {
|
||||
const res = await fetch(`http://127.0.0.1:${srv.address().port}/api/v1/fleet/hosts`);
|
||||
expect(res.status).toBe(200);
|
||||
} finally { srv.close(); }
|
||||
});
|
||||
|
||||
test('hasFeature fallback covers fleet for activations without explicit features list', () => {
|
||||
const { LicenseManager, PREMIUM_FEATURES } = require('../src/managers/license-manager');
|
||||
const lm = Object.create(LicenseManager.prototype);
|
||||
lm.activation = { code: 'DC-X', expiresAt: '2099-01-01T00:00:00Z', features: undefined };
|
||||
lm.isExpired = () => false;
|
||||
expect(lm.hasFeature('fleet')).toBe(true);
|
||||
expect(Object.keys(PREMIUM_FEATURES)).toContain('fleet');
|
||||
});
|
||||
});
|
||||
|
||||
describe('DC-165 offline activation forward-migration', () => {
|
||||
test('load() adds missing premium features to an offline activation and persists', async () => {
|
||||
const { LicenseManager, PREMIUM_FEATURES } = require('../src/managers/license-manager');
|
||||
const stored = {
|
||||
code: 'DC-OLD-OLD-OLD-OLD-OLD',
|
||||
codeId: 1,
|
||||
durationDays: 0,
|
||||
lifetime: true,
|
||||
activatedAt: '2026-01-01T00:00:00.000Z',
|
||||
expiresAt: '2099-12-31T23:59:59.999Z',
|
||||
machineId: 'deadbeefdeadbeef',
|
||||
validationMethod: 'offline',
|
||||
features: ['sso', 'recipes', 'swarm'], // pre-fleet snapshot
|
||||
};
|
||||
let persisted = null;
|
||||
const lm = new LicenseManager(
|
||||
{
|
||||
retrieve: async () => JSON.stringify(stored),
|
||||
store: async (key, value) => { persisted = { key, value }; },
|
||||
delete: async () => {},
|
||||
},
|
||||
'/tmp/dc165-nonexistent-config.json', // no config fallback path
|
||||
{ info() {}, warn() {}, error() {} }
|
||||
);
|
||||
await lm.load();
|
||||
expect(lm.activation.features).toEqual(Object.keys(PREMIUM_FEATURES));
|
||||
expect(persisted).not.toBeNull();
|
||||
expect(persisted.key).toBe('license.activation');
|
||||
expect(JSON.parse(persisted.value).features).toContain('fleet');
|
||||
});
|
||||
|
||||
test('migration is APPEND-ONLY: unknown legacy entries are preserved (judge P0)', async () => {
|
||||
const { LicenseManager, PREMIUM_FEATURES } = require('../src/managers/license-manager');
|
||||
const stored = {
|
||||
code: 'DC-LEG-LEG-LEG-LEG-LEG', codeId: 3, durationDays: 0, lifetime: true,
|
||||
activatedAt: '2026-01-01T00:00:00.000Z',
|
||||
expiresAt: '2099-12-31T23:59:59.999Z',
|
||||
machineId: 'cafe0000deadbeef',
|
||||
validationMethod: 'offline',
|
||||
features: ['sso', 'recipes', 'swarm', 'legacy-beta-widget'], // extra rides along
|
||||
};
|
||||
let persisted = null;
|
||||
const lm = new LicenseManager(
|
||||
{ retrieve: async () => JSON.stringify(stored), store: async (key, value) => { persisted = { key, value }; }, delete: async () => {} },
|
||||
'/tmp/dc165-nonexistent-config.json',
|
||||
{ info() {}, warn() {}, error() {} }
|
||||
);
|
||||
await lm.load();
|
||||
expect(lm.activation.features).toEqual(Object.keys(PREMIUM_FEATURES).concat(['legacy-beta-widget']));
|
||||
expect(JSON.parse(persisted.value).features).toContain('legacy-beta-widget');
|
||||
});
|
||||
|
||||
test('online activations are NOT migrated (server is authoritative)', async () => {
|
||||
const { LicenseManager } = require('../src/managers/license-manager');
|
||||
const activatedAt = new Date(Date.now() - 24 * 3600e3).toISOString(); // yesterday
|
||||
const stored = {
|
||||
code: 'DC-ONLINE', codeId: 2, durationDays: 365,
|
||||
activatedAt,
|
||||
expiresAt: new Date(Date.now() + 340 * 864e5).toISOString(), // within activatedAt+366d bound
|
||||
lastOnlineValidatedAt: activatedAt,
|
||||
machineId: 'aabbccddeeff0011',
|
||||
validationMethod: 'online',
|
||||
features: ['sso', 'recipes', 'swarm'],
|
||||
serverToken: 'tok',
|
||||
};
|
||||
let storedCount = 0;
|
||||
const lm = new LicenseManager(
|
||||
{
|
||||
retrieve: async () => JSON.stringify(stored),
|
||||
store: async () => { storedCount++; },
|
||||
delete: async () => {},
|
||||
},
|
||||
'/tmp/dc165-nonexistent-config.json',
|
||||
{ info() {}, warn() {}, error() {} }
|
||||
);
|
||||
// No LICENSE_SERVER_URL => _validateLoadedActivationForServerMode returns true immediately.
|
||||
await lm.load();
|
||||
expect(lm.activation.features).toEqual(['sso', 'recipes', 'swarm']); // untouched
|
||||
expect(storedCount).toBe(0); // nothing persisted
|
||||
});
|
||||
});
|
||||
|
||||
describe('DC-165 capabilities endpoint', () => {
|
||||
let srv;
|
||||
let base;
|
||||
beforeAll(async () => {
|
||||
const cap = require('../routes/capabilities');
|
||||
const app = express();
|
||||
app.use('/api/v1', cap.buildRouter());
|
||||
srv = await new Promise((r) => { const s = app.listen(0, () => r(s)); });
|
||||
base = `http://127.0.0.1:${srv.address().port}/api/v1`;
|
||||
});
|
||||
afterAll(() => srv && srv.close());
|
||||
|
||||
test('returns source-derived ground truth with zero drift from modules', async () => {
|
||||
const res = await fetch(`${base}/capabilities`);
|
||||
expect(res.status).toBe(200);
|
||||
const j = await res.json();
|
||||
const { APP_TEMPLATES } = require('../src/docker/app-templates');
|
||||
const { TOOLS } = require('../src/mcp/mcp-core');
|
||||
const { PREMIUM_FEATURES } = require('../src/managers/license-manager');
|
||||
expect(j.success).toBe(true);
|
||||
expect(j.product).toBe('dashcaddy');
|
||||
expect(j.templates.count).toBe(Object.keys(APP_TEMPLATES).length);
|
||||
expect(j.templates.count).toBeGreaterThanOrEqual(78);
|
||||
const { MCP_RUNTIME } = require('../routes/mcp');
|
||||
expect(j.mcp.transport).toBe(MCP_RUNTIME.transport);
|
||||
expect(j.mcp.protocolVersion).toBe(MCP_RUNTIME.protocolVersion);
|
||||
expect(j.mcp.protocolVersions).toEqual(MCP_RUNTIME.supportedProtocolVersions);
|
||||
expect(j.mcp.tools).toEqual(TOOLS.map((t) => t.name).sort());
|
||||
expect(j.premiumFeatures).toEqual(Object.keys(PREMIUM_FEATURES).sort());
|
||||
expect(j.premiumFeatures).toContain('fleet');
|
||||
expect(j.i18n.languageCount).toBe(31);
|
||||
expect(j.version).toMatch(/^\d+\.\d+\.\d+/);
|
||||
});
|
||||
|
||||
test('no secrets or host-specific data in the payload', async () => {
|
||||
const res = await fetch(`${base}/capabilities`);
|
||||
const text = await res.text();
|
||||
expect(text).not.toMatch(/license\/(activation|secret)/i);
|
||||
expect(text).not.toMatch(/sami/i);
|
||||
expect(text).not.toMatch(/100\.|192\.168|dashcaddy\.net|status\.sami/i);
|
||||
expect(text).not.toMatch(/"token"|"api_?key"|"password"|"secret"/i);
|
||||
});
|
||||
});
|
||||
@@ -1,179 +0,0 @@
|
||||
/**
|
||||
* DC-165 rev2 (judge r1 B2): composition-root integration proof for the
|
||||
* fleet premium gate. Boots the REAL createApp() (src/app.js) on an
|
||||
* ephemeral port — no synthetic router — and probes /api/v1/fleet/hosts:
|
||||
*
|
||||
* 1. no activation -> 403 premiumRequired, feature 'fleet'
|
||||
* 2. activation WITHOUT fleet -> still 403 (proves the check is per-feature)
|
||||
* 3. activation WITH fleet -> NOT the 403 premium envelope (200 ok or
|
||||
* a downstream error, e.g. 500 from a
|
||||
* missing hosts file in the temp data dir —
|
||||
* anything except the gate rejection)
|
||||
*
|
||||
* The gate middleware (requirePremium) closes over the same LicenseManager
|
||||
* instance that createApp returns (src/app.js line ~184/1399), so mutating
|
||||
* `.activation` on that instance after boot exercises exactly what a loaded
|
||||
* activation would do at request time. The 403 envelope shape is asserted
|
||||
* byte-identical to requirePremium's errorResponse contract
|
||||
* (premiumRequired/feature/featureName/currentTier/upgradeUrl).
|
||||
*/
|
||||
|
||||
'use strict';
|
||||
|
||||
const { spawn } = require('child_process');
|
||||
const path = require('path');
|
||||
const os = require('os');
|
||||
const fs = require('fs');
|
||||
|
||||
const ROOT = path.join(__dirname, '..', '..'); // dashcaddy-api/
|
||||
const DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), 'dc165-fleet-e2e-'));
|
||||
|
||||
const BOOT_CODE = `
|
||||
process.env.DATA_DIR = ${JSON.stringify(path.join(DATA_DIR, 'data'))};
|
||||
process.env.SERVICES_FILE = ${JSON.stringify(path.join(DATA_DIR, 'services.json'))};
|
||||
process.env.TOTP_CONFIG_FILE = ${JSON.stringify(path.join(DATA_DIR, 'totp-config.json'))};
|
||||
const { createApp } = require(${JSON.stringify(path.join(ROOT, 'src', 'app'))});
|
||||
createApp().then(async (created) => {
|
||||
const app = created.app || created;
|
||||
globalThis.__licenseManager = created.licenseManager;
|
||||
const authManager = require(${JSON.stringify(path.join(ROOT, 'src', 'managers', 'auth-manager'))});
|
||||
let jwt = '';
|
||||
try {
|
||||
jwt = await authManager.generateJWT({ sub: 'e2e-test', scope: ['admin'] }, '1h');
|
||||
} catch (e) {
|
||||
jwt = '';
|
||||
}
|
||||
const server = app.listen(0, '127.0.0.1', () => {
|
||||
console.log('JWT:' + jwt);
|
||||
console.log('PORT:' + server.address().port);
|
||||
console.log('READY');
|
||||
});
|
||||
// control channel on stdout: JSON lines the test writes to stdin
|
||||
require('readline').createInterface({ input: process.stdin }).on('line', (line) => {
|
||||
let msg; try { msg = JSON.parse(line); } catch (_) { return; }
|
||||
if (msg.op === 'setActivation') {
|
||||
if (msg.activation === null) { globalThis.__licenseManager.activation = null; }
|
||||
else { globalThis.__licenseManager.activation = msg.activation; }
|
||||
console.log('ACK:setActivation');
|
||||
}
|
||||
});
|
||||
process.on('SIGTERM', () => server.close(() => process.exit(0)));
|
||||
process.on('SIGINT', () => server.close(() => process.exit(0)));
|
||||
}).catch((e) => { console.error('BOOT-FAIL', e && e.message); process.exit(1); });
|
||||
`;
|
||||
|
||||
let child;
|
||||
let PORT;
|
||||
let JWT;
|
||||
|
||||
function boot() {
|
||||
return new Promise((resolve, reject) => {
|
||||
const c = spawn(process.execPath, ['-e', BOOT_CODE], { cwd: ROOT, stdio: ['pipe', 'pipe', 'pipe'] });
|
||||
let buf = '';
|
||||
const to = setTimeout(() => { try { c.kill('SIGKILL'); } catch (_) {} reject(new Error('boot timeout')); }, 30000);
|
||||
c.stdout.on('data', (d) => {
|
||||
buf += String(d);
|
||||
const mp = buf.match(/PORT:(\d+)/);
|
||||
const mj = buf.match(/JWT:(\S*)/);
|
||||
if (mp && buf.includes('READY')) {
|
||||
clearTimeout(to);
|
||||
c.port = Number(mp[1]);
|
||||
c.jwt = mj ? mj[1] : '';
|
||||
resolve(c);
|
||||
}
|
||||
});
|
||||
c.stderr.on('data', (d) => process.stderr.write('[boot] ' + d));
|
||||
c.on('exit', (code) => { if (!c.port) { clearTimeout(to); reject(new Error('boot exited ' + code)); } });
|
||||
});
|
||||
}
|
||||
|
||||
function probeFleet() {
|
||||
return fetch(`http://127.0.0.1:${PORT}/api/v1/fleet/hosts`, {
|
||||
redirect: 'manual',
|
||||
headers: JWT ? { authorization: `Bearer ${JWT}` } : {},
|
||||
}).then(async (r) => ({ status: r.status, body: await r.text() }));
|
||||
}
|
||||
|
||||
function send(msg) {
|
||||
return new Promise((resolve) => {
|
||||
const onData = (d) => {
|
||||
if (String(d).includes('ACK:')) { child.stdout.removeListener('data', onData); resolve(); }
|
||||
};
|
||||
child.stdout.on('data', onData);
|
||||
child.stdin.write(JSON.stringify(msg) + '\n');
|
||||
});
|
||||
}
|
||||
|
||||
const BASE_ACT = {
|
||||
code: 'DC-TEST-TEST-TEST-TEST-TEST',
|
||||
codeId: 99,
|
||||
durationDays: 365,
|
||||
activatedAt: new Date().toISOString(),
|
||||
expiresAt: new Date(Date.now() + 300 * 864e5).toISOString(),
|
||||
lastOnlineValidatedAt: new Date().toISOString(),
|
||||
machineId: 'e2e00000000000aa',
|
||||
validationMethod: 'online',
|
||||
features: [],
|
||||
serverToken: 'tok',
|
||||
};
|
||||
|
||||
describe('DC-165 fleet gate through the real composition root', () => {
|
||||
beforeAll(async () => {
|
||||
child = await boot();
|
||||
PORT = child.port;
|
||||
JWT = child.jwt || '';
|
||||
if (!Number.isInteger(PORT) || PORT <= 0) throw new Error('no bound port');
|
||||
}, 45000);
|
||||
|
||||
afterAll(() => {
|
||||
if (child) { try { child.kill('SIGTERM'); } catch (_) {} }
|
||||
fs.rmSync(DATA_DIR, { recursive: true, force: true });
|
||||
});
|
||||
|
||||
test('1) no activation -> 403 premiumRequired fleet', async () => {
|
||||
await send({ op: 'setActivation', activation: null });
|
||||
const r = await probeFleet();
|
||||
expect(r.status).toBe(403);
|
||||
const j = JSON.parse(r.body);
|
||||
expect(j.premiumRequired).toBe(true);
|
||||
expect(j.feature).toBe('fleet');
|
||||
expect(j.featureName).toMatch(/Fleet/);
|
||||
expect(j.currentTier).toBe('free');
|
||||
});
|
||||
|
||||
test('2) premium activation WITHOUT fleet -> still 403 fleet (per-feature)', async () => {
|
||||
await send({ op: 'setActivation', activation: { ...BASE_ACT, features: ['sso', 'recipes'] } });
|
||||
const r = await probeFleet();
|
||||
expect(r.status).toBe(403);
|
||||
expect(JSON.parse(r.body).feature).toBe('fleet');
|
||||
});
|
||||
|
||||
test('3) premium activation WITH fleet -> gate passes (not the 403 envelope)', async () => {
|
||||
await send({ op: 'setActivation', activation: { ...BASE_ACT, features: ['sso', 'recipes', 'fleet'] } });
|
||||
const r = await probeFleet();
|
||||
// gate cleared; downstream handler may 200 (empty hosts file gets created)
|
||||
// or surface an unrelated data-dir issue — it must NOT be the gate 403.
|
||||
const gateReject = r.status === 403 && /premiumRequired/.test(r.body);
|
||||
expect(gateReject).toBe(false);
|
||||
expect([200, 500]).toContain(r.status);
|
||||
if (r.status === 200) {
|
||||
const j = JSON.parse(r.body);
|
||||
expect(Array.isArray(j.hosts)).toBe(true);
|
||||
}
|
||||
});
|
||||
|
||||
test('4) gate is inherited by the whole /fleet prefix, not just /hosts', async () => {
|
||||
await send({ op: 'setActivation', activation: null });
|
||||
for (const p of ['/api/v1/fleet/status', '/api/v1/fleet/deploy']) {
|
||||
const r = await fetch(`http://127.0.0.1:${PORT}${p}`, {
|
||||
method: p.endsWith('/deploy') ? 'POST' : 'GET',
|
||||
headers: { 'Content-Type': 'application/json', ...(JWT ? { authorization: `Bearer ${JWT}` } : {}) },
|
||||
body: p.endsWith('/deploy') ? '{}' : undefined,
|
||||
redirect: 'manual',
|
||||
});
|
||||
const body = await r.text();
|
||||
expect(r.status).toBe(403);
|
||||
expect(JSON.parse(body).feature).toBe('fleet');
|
||||
}
|
||||
});
|
||||
});
|
||||
@@ -132,7 +132,6 @@ function readMountedRoutes() {
|
||||
'routes/share.js', // apiRouter.use(shareRoutes({...})) // bare mount (DC-053)
|
||||
'routes/services.js', // apiRouter.use(serviceRoutes({...})) // bare mount — needed for /api/v1/services + /api/v1/services/status PUBLIC_ROUTES
|
||||
'routes/version.js', // apiRouter.use(versionRoute.buildRouter()) // bare mount — needed for /api/v1/version PUBLIC_ROUTES
|
||||
'routes/capabilities.js', // apiRouter.use(capabilitiesRoute.buildRouter()) // bare mount — DC-165 /api/v1/capabilities PUBLIC_ROUTES
|
||||
];
|
||||
// Prefix map: explicit prefix from src/app.js's apiRouter.use() call
|
||||
const prefixMap = {
|
||||
|
||||
@@ -155,24 +155,6 @@ describe('DC-164 operator-flags.js security contract (fd-pinned)', () => {
|
||||
expect(out).toBe('ALLOW_LIFETIME_LICENSE=true\n');
|
||||
});
|
||||
|
||||
test('FIFO never blocks open: exits 3 within 2s (r5 DoS blocker)', (done) => {
|
||||
const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'opflags-sec-'));
|
||||
const fifo = path.join(dir, 'operator.env');
|
||||
try {
|
||||
spawnSync('mkfifo', [fifo], { encoding: 'utf8' });
|
||||
// No writer is ever attached — open would block forever without the
|
||||
// O_NONBLOCK + lstat pre-check. killSignal proves the timeout path.
|
||||
const r = spawnSync('node', [SCRIPT, fifo], { encoding: 'utf8', timeout: 2000, killSignal: 'SIGKILL' });
|
||||
expect(r.error).toBeUndefined(); // not killed => returned on its own
|
||||
expect(r.status).toBe(3);
|
||||
expect(r.stderr).toMatch(/not a regular file/);
|
||||
expect(r.stdout).toBe('');
|
||||
} finally {
|
||||
fs.rmSync(dir, { recursive: true, force: true });
|
||||
done();
|
||||
}
|
||||
});
|
||||
|
||||
test('usage error: no argument → exit 3 FATAL', () => {
|
||||
const r = spawnSync('node', [SCRIPT], { encoding: 'utf8' });
|
||||
expect(r.status).toBe(3);
|
||||
|
||||
@@ -218,30 +218,6 @@ paths:
|
||||
schema:
|
||||
$ref: '#/components/schemas/ErrorResponse'
|
||||
|
||||
/api/v1/capabilities:
|
||||
get:
|
||||
tags: [System]
|
||||
summary: Get capability manifest
|
||||
description: >-
|
||||
Public, machine-readable ground truth of the running build (DC-165):
|
||||
product version, app-template count and per-category breakdown, MCP
|
||||
tool names and protocol revisions, premium feature list, and
|
||||
supported-language count. The six measured fields (version, template
|
||||
count/categories, tools, transport identity, premium list, language
|
||||
count) are computed at request time from the same modules the product
|
||||
uses at runtime; the remaining fields (product name, one-line
|
||||
description, endpoint paths) are static registration/product
|
||||
metadata. Intended as the ground-truth surface for AI assistants and
|
||||
external docs so the MEASURED numbers cannot drift. Contains no
|
||||
secrets, credentials, or host-specific data.
|
||||
responses:
|
||||
'200':
|
||||
description: Successful operation (public route; no authentication — see PUBLIC_ROUTES)
|
||||
content:
|
||||
application/json:
|
||||
schema:
|
||||
$ref: '#/components/schemas/SuccessResponse'
|
||||
|
||||
/api/v1/csrf-token:
|
||||
get:
|
||||
tags: [Authentication]
|
||||
|
||||
@@ -1,81 +0,0 @@
|
||||
'use strict';
|
||||
|
||||
/**
|
||||
* DC-165: Public capability manifest — one machine-readable ground truth
|
||||
* about what THIS running DashCaddy build actually does.
|
||||
*
|
||||
* Purpose (Sami 2026-10-09: "It should be LLM readable"): the marketing
|
||||
* site, llms.txt, docs and the live product must never disagree. Static
|
||||
* prose drifts (77 vs 78 templates proved it). This endpoint lets any AI
|
||||
* assistant — or the site build itself — read the truth from the running
|
||||
* product. The six MEASURED fields (version, template count + categories,
|
||||
* MCP tool names, transport identity triple, premium list, language count)
|
||||
* derive from the runtime modules the product itself uses (APP_TEMPLATES,
|
||||
* mcp-core TOOLS, mcp.js MCP_RUNTIME, PREMIUM_FEATURES, i18n, version.js) —
|
||||
* nothing measured is hand-typed, so those cannot drift BY CONSTRUCTION.
|
||||
* `product`, `description`, `api.restMount` and `mcp.endpoint` are STATIC
|
||||
* registration/product metadata (visible in app.js) — labeled as such in
|
||||
* openapi.yaml. This is the
|
||||
*
|
||||
* Public by design (like /version and /health): no secrets, no usage data,
|
||||
* no hostnames — only static capability facts of the installed build.
|
||||
* Registered in PUBLIC_ROUTES (middleware.js, exact:true, GET) and guarded
|
||||
* by public-routes-drift.test.js like every other public route.
|
||||
*
|
||||
* buildRouter() is attached as a property so the drift test's router-walk
|
||||
* sees the route (routes/version.js convention).
|
||||
*/
|
||||
|
||||
const express = require('express');
|
||||
const { ok } = require('../src/utils/responses');
|
||||
const versionRoute = require('./version');
|
||||
|
||||
function buildRouter(deps = {}) {
|
||||
const router = express.Router();
|
||||
const asyncHandler = deps.asyncHandler
|
||||
|| ((fn) => (req, res, next) => Promise.resolve(fn(req, res, next)).catch(next));
|
||||
|
||||
router.get('/capabilities', asyncHandler(async (req, res) => {
|
||||
const { APP_TEMPLATES } = require('../src/docker/app-templates');
|
||||
const templates = APP_TEMPLATES || {};
|
||||
const templateIds = Object.keys(templates);
|
||||
const categories = {};
|
||||
for (const id of templateIds) {
|
||||
const c = (templates[id] && templates[id].category) || 'uncategorized';
|
||||
categories[c] = (categories[c] || 0) + 1;
|
||||
}
|
||||
|
||||
const { TOOLS } = require('../src/mcp/mcp-core');
|
||||
const { MCP_RUNTIME } = require('./mcp');
|
||||
const tools = (TOOLS || []).map((t) => t.name).sort();
|
||||
|
||||
const { PREMIUM_FEATURES } = require('../src/managers/license-manager');
|
||||
const premiumFeatures = Object.keys(PREMIUM_FEATURES || {}).sort();
|
||||
|
||||
const i18n = require('../src/utilities/i18n');
|
||||
let languageCount = null;
|
||||
try { languageCount = i18n.getSupportedLanguages().length; } catch (_) { /* optional surface */ }
|
||||
|
||||
ok(res, {
|
||||
product: 'dashcaddy',
|
||||
version: versionRoute.getVersion(),
|
||||
description: 'Self-hosting dashboard: one-click Docker app deployment with automatic SSL, DNS and reverse proxy; AI intent router; MCP control plane.',
|
||||
templates: { count: templateIds.length, categories },
|
||||
mcp: {
|
||||
transport: MCP_RUNTIME.transport,
|
||||
protocolVersion: MCP_RUNTIME.protocolVersion,
|
||||
protocolVersions: MCP_RUNTIME.supportedProtocolVersions,
|
||||
endpoint: '/api/v1/mcp',
|
||||
tools
|
||||
},
|
||||
premiumFeatures,
|
||||
api: { restMount: '/api/v1' },
|
||||
i18n: { languageCount }
|
||||
});
|
||||
}));
|
||||
|
||||
return router;
|
||||
}
|
||||
|
||||
module.exports = { buildRouter };
|
||||
module.exports.default = function factory(ctx) { return buildRouter(ctx); };
|
||||
@@ -63,18 +63,8 @@ const { ValidationError, ForbiddenError } = require('../src/utilities/errors');
|
||||
const { ok } = require('../src/utils/responses');
|
||||
const { createToolHandler, createMcpHandler, TOOLS } = require('../src/mcp/mcp-core');
|
||||
|
||||
// MCP_RUNTIME is the single source of truth for the transport identity.
|
||||
// DC-165 rev2 (judge B0): the /info route AND the /api/v1/capabilities
|
||||
// manifest both read these values instead of re-typing them, so a protocol
|
||||
// bump in one place cannot leave the other stale. The capability test asserts
|
||||
// the manifest equals these constants.
|
||||
const MCP_RUNTIME = {
|
||||
transport: 'streamable-http',
|
||||
protocolVersion: '2025-03-10',
|
||||
supportedProtocolVersions: ['2025-03-10', '2024-11-05'],
|
||||
};
|
||||
const PROTOCOL_VERSION = MCP_RUNTIME.protocolVersion;
|
||||
const SUPPORTED_PROTOCOL_VERSIONS = MCP_RUNTIME.supportedProtocolVersions;
|
||||
const PROTOCOL_VERSION = '2025-03-10';
|
||||
const SUPPORTED_PROTOCOL_VERSIONS = ['2025-03-10', '2024-11-05'];
|
||||
const SERVER_VERSION = (() => {
|
||||
try {
|
||||
return require(path.join(__dirname, '..', 'package.json')).version;
|
||||
@@ -285,7 +275,7 @@ module.exports = function createMcpRoutes({ asyncHandler, errorResponse, log, au
|
||||
router.get('/info', asyncHandler(async (req, res) => {
|
||||
ok(res, {
|
||||
endpoint: publicEndpoint(req),
|
||||
transport: MCP_RUNTIME.transport,
|
||||
transport: 'streamable-http',
|
||||
protocolVersion: PROTOCOL_VERSION,
|
||||
supportedProtocolVersions: SUPPORTED_PROTOCOL_VERSIONS,
|
||||
serverVersion: SERVER_VERSION,
|
||||
@@ -330,7 +320,7 @@ module.exports = function createMcpRoutes({ asyncHandler, errorResponse, log, au
|
||||
// shapes they don't (e.g. ChatGPT hosted connectors need public https).
|
||||
const httpConfig = {
|
||||
url: endpoint,
|
||||
transport: MCP_RUNTIME.transport,
|
||||
transport: 'streamable-http',
|
||||
headers: { 'x-api-key': keyData.key },
|
||||
mcpProtocolVersion: PROTOCOL_VERSION,
|
||||
};
|
||||
@@ -346,7 +336,7 @@ module.exports = function createMcpRoutes({ asyncHandler, errorResponse, log, au
|
||||
name: keyData.name,
|
||||
scopes: keyData.scopes,
|
||||
endpoint,
|
||||
transport: MCP_RUNTIME.transport,
|
||||
transport: 'streamable-http',
|
||||
httpConfig,
|
||||
note: clientNotes[client],
|
||||
warning: 'Save this key securely — it will not be shown again. Revoke any time from Settings → Connect your AI.',
|
||||
@@ -357,7 +347,3 @@ module.exports = function createMcpRoutes({ asyncHandler, errorResponse, log, au
|
||||
|
||||
return router;
|
||||
};
|
||||
|
||||
// DC-165 rev2: expose transport identity so the capabilities manifest reads
|
||||
// the SAME constants the live MCP route serves (single source of truth).
|
||||
module.exports.MCP_RUNTIME = MCP_RUNTIME;
|
||||
@@ -60,31 +60,8 @@ function main() {
|
||||
if (!file || typeof file !== 'string') fatal('operator-flags: missing <file> argument', 3);
|
||||
|
||||
let fd;
|
||||
// Advisory pre-check: reject anything that is not a plain regular file
|
||||
// BEFORE opening it, so no open() can block on a FIFO/device (a block
|
||||
// device may still block even with O_NONBLOCK — POSIX leaves its effect
|
||||
// undefined there). The AUTHORITATIVE checks run on the pinned fd below;
|
||||
// a swap between lstat and open is caught by O_NOFOLLOW + fstat on the
|
||||
// SAME descriptor (TOCTOU r3 blocker remains closed).
|
||||
try {
|
||||
const lst = fs.lstatSync(file);
|
||||
if (!lst.isFile()) {
|
||||
fatal(`operator-flags: FATAL — ${file} is not a regular file (pre-check: ${lst.isSymbolicLink() ? 'symlink' : lst.isFIFO() ? 'FIFO' : lst.isDirectory() ? 'directory' : lst.isCharacterDevice() || lst.isBlockDevice() ? 'device' : 'special'})`, 3);
|
||||
}
|
||||
} catch (e) {
|
||||
if (e.code === 'ENOENT') process.exit(0); // absent = zero overrides
|
||||
if (e.code === 'EACCES' || e.code === 'EPERM' || e.code === 'ENOTDIR') {
|
||||
fatal(`operator-flags: FATAL — cannot stat ${file}: ${e.code}`, 3);
|
||||
}
|
||||
throw e;
|
||||
}
|
||||
try {
|
||||
// O_NONBLOCK completes r5 blocker: opening a FIFO WITHOUT it blocks the
|
||||
// process indefinitely at open() (startup DoS). With O_RDONLY|O_NONBLOCK
|
||||
// a FIFO opens instantly and is rejected below by the isFile() check;
|
||||
// for regular files O_NONBLOCK is a no-op (POSIX: undefined effect,
|
||||
// universally ignored on Linux/macOS regular-file reads).
|
||||
fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK);
|
||||
fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
|
||||
} catch (e) {
|
||||
if (e.code === 'ENOENT') process.exit(0); // absent = zero overrides
|
||||
if (e.code === 'ELOOP') fatal(`operator-flags: FATAL — ${file} is a symlink; refusing (O_NOFOLLOW)`, 3);
|
||||
|
||||
@@ -542,13 +542,6 @@ async function createApp() {
|
||||
apiRouter.use(versionRouter);
|
||||
log.info('app', `Version endpoint available at /api/v1/version (v${appVersion})`);
|
||||
|
||||
// DC-165: capability manifest — public, machine-readable ground truth of
|
||||
// THIS build (template count, MCP tools, premium features). Same-shape
|
||||
// registration as /version so public-routes-drift.test.js walks it.
|
||||
const capabilitiesRoute = require('../routes/capabilities');
|
||||
apiRouter.use(capabilitiesRoute.buildRouter());
|
||||
log.info('app', 'Capability manifest available at /api/v1/capabilities');
|
||||
|
||||
// Wire up notification listeners for resourceMonitor and backupManager
|
||||
if (ctx.notification && ctx.resourceMonitor) {
|
||||
ctx.resourceMonitor.on('alert', (alertData) => {
|
||||
@@ -700,10 +693,6 @@ async function createApp() {
|
||||
}));
|
||||
|
||||
// DC-108: Multi-host fleet management
|
||||
// DC-165: gate behind premium entitlement ('fleet' in PREMIUM_FEATURES).
|
||||
// Mounted at the router level so EVERY future fleet sub-route inherits
|
||||
// the gate by default (fail-closed for new endpoints).
|
||||
apiRouter.use('/fleet', ctx.licenseManager.requirePremium('fleet'));
|
||||
apiRouter.use(fleetRoutes({
|
||||
log: ctx.log,
|
||||
asyncHandler: ctx.asyncHandler,
|
||||
|
||||
@@ -24,25 +24,7 @@ const LICENSE_SERVER_URL = process.env.LICENSE_SERVER_URL || null; // Set when l
|
||||
const PREMIUM_FEATURES = {
|
||||
sso: { name: 'Auto-Login SSO', description: 'Automatic single sign-on for deployed apps' },
|
||||
recipes: { name: 'Recipes', description: 'Multi-container stack deployment' },
|
||||
swarm: { name: 'Docker Swarm', description: 'Multi-node cluster orchestration' },
|
||||
// DC-165: site has always sold Fleet as Premium (pricing page + comparison
|
||||
// table); the gate was missing. hasFeature() falls back to
|
||||
// Object.keys(PREMIUM_FEATURES) for activations that stored no explicit
|
||||
// features list, so existing premium licenses (incl. offline activations
|
||||
// like the creator lifetime key) gain fleet automatically on next load.
|
||||
// 'fleet' is now part of the shipped entitlement contract — a new
|
||||
// PREMIUM_FEATURES key must ALWAYS be accompanied by the license-server
|
||||
// grant list (plans.js) or online activations will 403 it.
|
||||
fleet: { name: 'Multi-Host Fleet Management', description: 'Register remote DashCaddy instances, health probes, and multi-host deploys' },
|
||||
// DC-165: these two have ALWAYS been requirePremium-gated (routes/
|
||||
// workflows.js line 32, routes/backups.js schedule routes) but were
|
||||
// never listed here — offline activations could therefore never gain
|
||||
// them, and the marketing site didn't advertise them either. The site
|
||||
// now advertises both (Sami's decision 2026-10-09: "advertise as
|
||||
// Premium"); listing them here closes the offline path and makes
|
||||
// PREMIUM_FEATURES the single source of truth for gated features.
|
||||
workflows: { name: 'Workflow Automation', description: 'Bundled one-click maintenance workflows — update checks, disk cleanup, cert expiry checks — enable, run, and review history' },
|
||||
'auto-backup': { name: 'Scheduled Backups', description: 'Automated per-app backup schedules (manual one-click backup stays free)' }
|
||||
swarm: { name: 'Docker Swarm', description: 'Multi-node cluster orchestration' }
|
||||
};
|
||||
|
||||
class LicenseManager {
|
||||
@@ -94,9 +76,6 @@ class LicenseManager {
|
||||
expiredAt: this.activation.expiresAt
|
||||
});
|
||||
} else {
|
||||
// DC-165 rev2 (judge P0): offline feature-snapshot repair, in a
|
||||
// helper to keep load() complexity/nesting inside house lint.
|
||||
await this._migrateOfflineFeatureSnapshot();
|
||||
this.log.info?.('license', 'License loaded', {
|
||||
code: this._maskCode(this.activation.code),
|
||||
expiresAt: this.activation.expiresAt,
|
||||
@@ -530,41 +509,6 @@ class LicenseManager {
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* DC-165 rev2 (judge P0): repair an OFFLINE activation's feature snapshot
|
||||
* when it was stored by an older build whose PREMIUM_FEATURES lacked a
|
||||
* key this build gates (fleet, workflows, auto-backup). Without this the
|
||||
* offline snapshot would deny the feature forever despite an active
|
||||
* premium license. Refresh is an APPEND-ONLY union: current premium keys
|
||||
* first, then any unknown legacy entries preserved verbatim — a
|
||||
* missing-key repair never implies removal. Result is identical to what
|
||||
* re-activating the same code today would store (activate() writes
|
||||
* Object.keys(PREMIUM_FEATURES)). ONLINE activations are NOT touched:
|
||||
* their authoritative feature list comes from the license server on
|
||||
* validation; this only reconciles a local build's own derived snapshot
|
||||
* with its own constant. Store failure warns — in-memory state stays
|
||||
* correct for this process.
|
||||
*/
|
||||
async _migrateOfflineFeatureSnapshot() {
|
||||
if (!this.activation || this.activation.validationMethod !== 'offline') return;
|
||||
if (!Array.isArray(this.activation.features)) return;
|
||||
const current = Object.keys(PREMIUM_FEATURES);
|
||||
const stored = new Set(this.activation.features);
|
||||
const missing = current.filter((f) => !stored.has(f));
|
||||
if (!missing.length) return;
|
||||
const extras = this.activation.features.filter((f) => !current.includes(f));
|
||||
this.activation.features = current.concat(extras);
|
||||
try {
|
||||
await this.credentialManager.store(LICENSE_CRED_KEY, JSON.stringify(this.activation), {
|
||||
activatedAt: this.activation.activatedAt,
|
||||
expiresAt: this.activation.expiresAt
|
||||
});
|
||||
} catch (error) {
|
||||
this.log.warn?.('license', 'Could not persist premium-feature migration (in-memory state still correct)', { error: error.message });
|
||||
}
|
||||
this.log.info?.('license', 'Migrated offline activation to current premium feature set', { added: missing });
|
||||
}
|
||||
|
||||
async _validateLoadedActivationForServerMode() {
|
||||
if (!LICENSE_SERVER_URL || !this.activation) return true;
|
||||
const cachedWasOnline = this.activation.validationMethod === 'online';
|
||||
|
||||
@@ -498,7 +498,6 @@ module.exports = function configureMiddleware(app, {
|
||||
{ path: '/api/v1/monitoring/stats', exact: true, method: 'GET', monitoring: true },
|
||||
{ path: '/api/v1/health-checks/status', exact: true, method: 'GET', monitoring: true },
|
||||
{ path: '/api/v1/version', exact: true, method: 'GET' },
|
||||
{ path: '/api/v1/capabilities', exact: true, method: 'GET' },
|
||||
// Security ingest endpoints — auth via per-host Bearer token (handled in routes/security.js),
|
||||
// NOT via TOTP/JWT. This lets remote DashCaddy agents and log parsers push events
|
||||
// without needing a TOTP session.
|
||||
|
||||
Reference in new issue
Block a user