77 lines
3.6 KiB
JavaScript
77 lines
3.6 KiB
JavaScript
/**
|
|
* Live transcript generator for the P7 network routes (judge r7 blocker 2):
|
|
* boots the REAL app (createApp) on an ephemeral port and issues actual
|
|
* HTTP requests over a real socket. Fresh boot = no active provider, which
|
|
* demonstrates the inactive-provider outcome honestly. Run on dns2:
|
|
* timeout 90 node scripts/p7-live-curl.js 2>/dev/null
|
|
*/
|
|
'use strict';
|
|
|
|
const http = require('http');
|
|
const { createApp } = require('../src/app');
|
|
|
|
function req(port, method, path, headers = {}) {
|
|
return new Promise((resolve, reject) => {
|
|
const r = http.request(
|
|
{ host: '127.0.0.1', port, method, path, headers },
|
|
(res) => {
|
|
let body = '';
|
|
res.on('data', (c) => { body += c; });
|
|
res.on('end', () => resolve({ status: res.statusCode, headers: res.headers, body }));
|
|
}
|
|
);
|
|
r.on('error', reject);
|
|
r.end();
|
|
});
|
|
}
|
|
|
|
async function main() {
|
|
const { app } = await createApp();
|
|
const server = app.listen(0, '127.0.0.1');
|
|
await new Promise((r) => server.on('listening', r));
|
|
const port = server.address().port;
|
|
|
|
const { execSync } = require('child_process');
|
|
console.log(`# git HEAD: ${execSync('git -C .. rev-parse HEAD', { encoding: 'utf8' }).trim()}`);
|
|
const show = (label, method, path, headers, res) => {
|
|
console.log(`### ${label}`);
|
|
console.log(`> ${method} http://127.0.0.1:${port}${path}`);
|
|
for (const [k, v] of Object.entries(headers)) console.log(`> ${k}: ${v}`);
|
|
console.log(`< HTTP ${res.status}`);
|
|
if (res.headers['www-authenticate']) console.log(`< www-authenticate: ${res.headers['www-authenticate']}`);
|
|
if (res.headers['x-forwarded-user']) console.log(`< x-forwarded-user: ${res.headers['x-forwarded-user']}`);
|
|
console.log(`< body: ${res.body.slice(0, 260)}`);
|
|
console.log('');
|
|
};
|
|
|
|
const FA = '/api/v1/network/forward-auth/';
|
|
|
|
// 1. inactive provider (fresh boot) + supplied XFF
|
|
let res = await req(port, 'GET', FA, { 'X-Forwarded-For': '10.53.0.7' });
|
|
show('forward-auth, provider inactive (fresh boot) → 503 network provider not active', 'GET', FA, { 'X-Forwarded-For': '10.53.0.7' }, res);
|
|
|
|
// 2. direct request, no headers, provider inactive (socket identity path — still 503 pre-activation; the 401 unknown-device variant requires an active provider and is covered by the jest suite's adversarial tests)
|
|
res = await req(port, 'GET', FA);
|
|
show('forward-auth, direct request (no headers), provider inactive → 503', 'GET', FA, {}, res);
|
|
|
|
// 3. POST parity
|
|
res = await req(port, 'POST', FA, { 'X-Forwarded-For': '10.53.0.7', 'X-Forwarded-Host': 'plex.sami' });
|
|
show('forward-auth POST parity, provider inactive → 503', 'POST', FA, { 'X-Forwarded-For': '10.53.0.7', 'X-Forwarded-Host': 'plex.sami' }, res);
|
|
|
|
// 4. mounted-route proofs behind the auth gate (unauthenticated)
|
|
res = await req(port, 'GET', '/api/v1/network/people');
|
|
show('people list, unauthenticated → auth gate (route mounted, gated)', 'GET', '/api/v1/network/people', {}, res);
|
|
|
|
res = await req(port, 'GET', '/api/v1/network/wizard/state');
|
|
show('wizard state, unauthenticated → auth gate (route mounted, gated)', 'GET', '/api/v1/network/wizard/state', {}, res);
|
|
|
|
res = await req(port, 'GET', '/api/v1/network/wg/redeem/nonexistent-token');
|
|
show('wg redeem, bogus token (public route) → redeem outcome (route mounted)', 'GET', '/api/v1/network/wg/redeem/nonexistent-token', {}, res);
|
|
|
|
await new Promise((r) => server.close(r));
|
|
console.log('LIVE-PROBE-DONE');
|
|
process.exit(0); // background timers would hold the loop open
|
|
}
|
|
|
|
main().catch((e) => { console.error('FATAL', e && e.message); process.exit(1); });
|