449 lines
19 KiB
JavaScript
449 lines
19 KiB
JavaScript
/**
|
|
* Tests for src/network/providers/tailscale.js (DC-140).
|
|
*
|
|
* Hermetic: the coordination client is a jest.fn() stub object, the local
|
|
* manager is a jest.mock of ../managers/tailscale-manager (same rigor as
|
|
* __tests__/tailscale-manager.test.js), and the whois execFile call is a
|
|
* plain stub — no network, no child processes.
|
|
*/
|
|
|
|
'use strict';
|
|
|
|
jest.mock('../src/managers/tailscale-manager', () => ({
|
|
getSummary: jest.fn(),
|
|
getStatus: jest.fn(),
|
|
}));
|
|
|
|
const tailscaleManager = require('../src/managers/tailscale-manager');
|
|
const { createTailscaleProvider, toProviderError } = require('../src/network/providers/tailscale');
|
|
const { ProviderError } = require('../src/network/errors');
|
|
const { TailscaleCoordError } = require('../src/managers/tailscale-coord');
|
|
|
|
/** Coord client stub factory: every method is a jest.fn resolving []. */
|
|
function makeCoord(overrides = {}) {
|
|
return {
|
|
listDevices: jest.fn(async () => []),
|
|
listUsers: jest.fn(async () => []),
|
|
deleteDevice: jest.fn(async () => ({ success: true })),
|
|
request: jest.fn(),
|
|
...overrides,
|
|
};
|
|
}
|
|
|
|
function devicesFixture() {
|
|
return [
|
|
{ id: 'dev1', name: 'laptop.tail3e209.ts.net', addresses: ['100.91.55.51'], user: '1001', os: 'linux' },
|
|
{ id: 'dev2', name: 'phone.tail3e209.ts.net', addresses: ['100.92.60.10'], user: '1001', os: 'android' },
|
|
{ id: 'dev3', name: 'nas.tail3e209.ts.net', addresses: ['100.93.7.7'], user: '2002', os: 'linux' },
|
|
];
|
|
}
|
|
|
|
/** execFile stub (promise-style, matching promisify(execFile)) with canned stdout. */
|
|
function makeExec(stdoutByIp = {}, { failAll = false } = {}) {
|
|
const calls = [];
|
|
const fn = (bin, args) => {
|
|
calls.push({ bin, args });
|
|
const ip = args && args[1];
|
|
if (failAll) return Promise.reject(new Error('tailscale CLI not available'));
|
|
return Promise.resolve({ stdout: stdoutByIp[ip] || '' });
|
|
};
|
|
fn.calls = calls;
|
|
return fn;
|
|
}
|
|
|
|
beforeEach(() => {
|
|
jest.clearAllMocks();
|
|
tailscaleManager.getSummary.mockResolvedValue({ installed: true, connected: true, peerCount: 1 });
|
|
tailscaleManager.getStatus.mockResolvedValue(null);
|
|
});
|
|
|
|
describe('tailscale provider: id + capabilities', () => {
|
|
test('id() returns "tailscale"', () => {
|
|
expect(createTailscaleProvider().id()).toBe('tailscale');
|
|
});
|
|
|
|
test('capabilities() flags invites + splitDnsApi, no perPeerFirewall, not selfHosted', () => {
|
|
expect(createTailscaleProvider().capabilities()).toEqual({
|
|
invites: true,
|
|
splitDnsApi: true,
|
|
perPeerFirewall: false,
|
|
selfHosted: false,
|
|
});
|
|
});
|
|
});
|
|
|
|
describe('tailscale provider: getStatus()', () => {
|
|
test('wraps the local manager summary with provider framing', async () => {
|
|
tailscaleManager.getSummary.mockResolvedValue({ installed: true, connected: true, peerCount: 4 });
|
|
const p = createTailscaleProvider({ localManager: tailscaleManager });
|
|
const status = await p.getStatus();
|
|
expect(status).toMatchObject({ provider: 'tailscale', installed: true, connected: true });
|
|
expect(status.summary).toEqual({ installed: true, connected: true, peerCount: 4 });
|
|
});
|
|
|
|
test('degrades to installed:false when the CLI is missing', async () => {
|
|
tailscaleManager.getSummary.mockResolvedValue({ installed: false, connected: false });
|
|
const p = createTailscaleProvider({ localManager: tailscaleManager });
|
|
const status = await p.getStatus();
|
|
expect(status.installed).toBe(false);
|
|
expect(status.connected).toBe(false);
|
|
});
|
|
});
|
|
|
|
describe('tailscale provider: listDevices()', () => {
|
|
test('merges API devices with local online state by tailnet IP', async () => {
|
|
const coord = makeCoord({ listDevices: jest.fn(async () => devicesFixture()) });
|
|
tailscaleManager.getStatus.mockResolvedValue({
|
|
Peer: {
|
|
'nodekey:laptop': { TailscaleIPs: ['100.91.55.51'], Online: true },
|
|
},
|
|
});
|
|
const p = createTailscaleProvider({ coordClient: coord, localManager: tailscaleManager });
|
|
const devices = await p.listDevices();
|
|
expect(devices).toHaveLength(3);
|
|
expect(devices.find((d) => d.id === 'dev1')).toMatchObject({ ip: '100.91.55.51', online: true, userId: '1001' });
|
|
expect(devices.find((d) => d.id === 'dev3')).toMatchObject({ online: false });
|
|
});
|
|
|
|
test('works when local status is unavailable (all online false, no throw)', async () => {
|
|
const coord = makeCoord({ listDevices: jest.fn(async () => devicesFixture()) });
|
|
tailscaleManager.getStatus.mockResolvedValue(null);
|
|
const p = createTailscaleProvider({ coordClient: coord, localManager: tailscaleManager });
|
|
const devices = await p.listDevices();
|
|
expect(devices).toHaveLength(3);
|
|
expect(devices.every((d) => d.online === false)).toBe(true);
|
|
});
|
|
|
|
test('surfaces coord not-configured as ProviderError not_configured', async () => {
|
|
const p = createTailscaleProvider(); // no coord client attached
|
|
await expect(p.listDevices()).rejects.toMatchObject({
|
|
name: 'ProviderError',
|
|
code: 'not_configured',
|
|
retryable: false,
|
|
});
|
|
});
|
|
});
|
|
|
|
describe('tailscale provider: listPeople()', () => {
|
|
test('projects API users to { id, displayName, email, createdAt }', async () => {
|
|
const coord = makeCoord({
|
|
listUsers: jest.fn(async () => [
|
|
{ id: '1001', loginName: 'sami@example.com', displayName: 'Sami', created: '2026-01-01T00:00:00Z' },
|
|
{ id: '2002', loginName: 'guest-user', created: '2026-02-02T00:00:00Z' },
|
|
]),
|
|
});
|
|
const p = createTailscaleProvider({ coordClient: coord });
|
|
const people = await p.listPeople();
|
|
expect(people).toEqual([
|
|
{ id: '1001', displayName: 'Sami', email: 'sami@example.com', createdAt: '2026-01-01T00:00:00Z' },
|
|
{ id: '2002', displayName: 'guest-user', email: null, createdAt: '2026-02-02T00:00:00Z' },
|
|
]);
|
|
});
|
|
});
|
|
|
|
describe('tailscale provider: createInvite()', () => {
|
|
test('with email: POSTs user-invites including the email field', async () => {
|
|
const coord = makeCoord({
|
|
request: jest.fn(async () => ({ id: 'inv1', inviteUrl: 'https://login.tailscale.com/a/abc123' })),
|
|
});
|
|
const p = createTailscaleProvider({ coordClient: coord });
|
|
const invite = await p.createInvite({ role: 'member', email: 'friend@example.com' });
|
|
expect(invite).toEqual({ inviteUrl: 'https://login.tailscale.com/a/abc123', id: 'inv1' });
|
|
expect(coord.request).toHaveBeenCalledWith('POST', '/tailnet/-/user-invites', {
|
|
body: { inviteTailnet: true, email: 'friend@example.com' },
|
|
});
|
|
});
|
|
|
|
test('without email: body omits the email field entirely (link-first)', async () => {
|
|
const coord = makeCoord({
|
|
request: jest.fn(async () => ({ id: 'inv2', inviteUrl: 'https://login.tailscale.com/a/nomail' })),
|
|
});
|
|
const p = createTailscaleProvider({ coordClient: coord });
|
|
const invite = await p.createInvite({ role: 'member' });
|
|
expect(invite.inviteUrl).toBe('https://login.tailscale.com/a/nomail');
|
|
expect(coord.request).toHaveBeenCalledWith('POST', '/tailnet/-/user-invites', {
|
|
body: { inviteTailnet: true },
|
|
});
|
|
});
|
|
|
|
test('missing inviteUrl in the response maps to a ProviderError', async () => {
|
|
const coord = makeCoord({ request: jest.fn(async () => ({ id: 'inv3' })) });
|
|
const p = createTailscaleProvider({ coordClient: coord });
|
|
await expect(p.createInvite({ role: 'member' })).rejects.toMatchObject({
|
|
name: 'ProviderError',
|
|
code: 'provider_error',
|
|
});
|
|
});
|
|
|
|
test('invalid email input is rejected as bad_input before any API call', async () => {
|
|
const coord = makeCoord();
|
|
const p = createTailscaleProvider({ coordClient: coord });
|
|
await expect(p.createInvite({ role: 'member', email: 'not-an-email' })).rejects.toMatchObject({
|
|
code: 'bad_input',
|
|
});
|
|
expect(coord.request).not.toHaveBeenCalled();
|
|
});
|
|
|
|
test('missing role is rejected as bad_input', async () => {
|
|
const p = createTailscaleProvider({ coordClient: makeCoord() });
|
|
await expect(p.createInvite({})).rejects.toMatchObject({ code: 'bad_input' });
|
|
});
|
|
});
|
|
|
|
describe('tailscale provider: revokeInvite()', () => {
|
|
test('DELETEs the user-invite by id', async () => {
|
|
const coord = makeCoord({ request: jest.fn(async () => ({})) });
|
|
const p = createTailscaleProvider({ coordClient: coord });
|
|
const res = await p.revokeInvite('inv1');
|
|
expect(res).toEqual({ revoked: true });
|
|
expect(coord.request).toHaveBeenCalledWith('DELETE', '/tailnet/-/user-invites/inv1');
|
|
});
|
|
|
|
test('requires an id', async () => {
|
|
const p = createTailscaleProvider({ coordClient: makeCoord() });
|
|
await expect(p.revokeInvite()).rejects.toMatchObject({ code: 'bad_input' });
|
|
});
|
|
});
|
|
|
|
describe('tailscale provider: blockPerson()', () => {
|
|
test('expires the key of EVERY device owned by the user', async () => {
|
|
const coord = makeCoord({ listDevices: jest.fn(async () => devicesFixture()) });
|
|
const p = createTailscaleProvider({ coordClient: coord });
|
|
const res = await p.blockPerson('1001');
|
|
expect(res).toEqual({ expired: ['dev1', 'dev2'], count: 2 });
|
|
const expireCalls = coord.request.mock.calls.filter((c) => c[1].endsWith('/expire'));
|
|
expect(expireCalls.map((c) => c[1])).toEqual(['/device/dev1/expire', '/device/dev2/expire']);
|
|
expireCalls.forEach((c) => expect(c[0]).toBe('POST'));
|
|
// no expiry for other users' devices
|
|
expect(coord.request.mock.calls.some((c) => c[1] === '/device/dev3/expire')).toBe(false);
|
|
});
|
|
|
|
test('user with zero devices → empty result, no expire calls', async () => {
|
|
const coord = makeCoord({ listDevices: jest.fn(async () => devicesFixture()) });
|
|
const p = createTailscaleProvider({ coordClient: coord });
|
|
const res = await p.blockPerson('9999');
|
|
expect(res).toEqual({ expired: [], count: 0 });
|
|
expect(coord.request).not.toHaveBeenCalled();
|
|
});
|
|
|
|
test('matches userId numerically-or-stringly (API returns numbers)', async () => {
|
|
const coord = makeCoord({
|
|
listDevices: jest.fn(async () => devicesFixture().map((d) => ({ ...d, user: Number(d.user) }))),
|
|
});
|
|
const p = createTailscaleProvider({ coordClient: coord });
|
|
const res = await p.blockPerson('1001');
|
|
expect(res.count).toBe(2);
|
|
});
|
|
|
|
test('requires a userId', async () => {
|
|
const p = createTailscaleProvider({ coordClient: makeCoord() });
|
|
await expect(p.blockPerson()).rejects.toMatchObject({ code: 'bad_input' });
|
|
});
|
|
});
|
|
|
|
describe('tailscale provider: unblockPerson()', () => {
|
|
test('is honest (corrected spec): re-allow at ACL level only, devices need re-auth', async () => {
|
|
const coord = makeCoord();
|
|
const p = createTailscaleProvider({ coordClient: coord });
|
|
await expect(p.unblockPerson('1001')).resolves.toEqual({ restored: true, reauthRequired: true });
|
|
// No device-key restore call exists — nothing may touch the coord API here.
|
|
expect(coord.request).not.toHaveBeenCalled();
|
|
expect(coord.listDevices).not.toHaveBeenCalled();
|
|
});
|
|
});
|
|
|
|
describe('tailscale provider: removePerson()', () => {
|
|
test('DELETEs every device owned by the user', async () => {
|
|
const coord = makeCoord({ listDevices: jest.fn(async () => devicesFixture()) });
|
|
const p = createTailscaleProvider({ coordClient: coord });
|
|
const res = await p.removePerson('1001');
|
|
expect(res).toEqual({ deleted: ['dev1', 'dev2'], count: 2 });
|
|
expect(coord.deleteDevice).toHaveBeenCalledTimes(2);
|
|
expect(coord.deleteDevice).toHaveBeenCalledWith('dev1');
|
|
expect(coord.deleteDevice).toHaveBeenCalledWith('dev2');
|
|
expect(coord.deleteDevice).not.toHaveBeenCalledWith('dev3');
|
|
});
|
|
|
|
test('requires a userId', async () => {
|
|
const p = createTailscaleProvider({ coordClient: makeCoord() });
|
|
await expect(p.removePerson()).rejects.toMatchObject({ code: 'bad_input' });
|
|
});
|
|
});
|
|
|
|
describe('tailscale provider: revokeDevice()', () => {
|
|
test('expires the single device key via POST /device/{id}/expire', async () => {
|
|
const coord = makeCoord({ request: jest.fn(async () => ({})) });
|
|
const p = createTailscaleProvider({ coordClient: coord });
|
|
const res = await p.revokeDevice('dev2');
|
|
expect(res).toEqual({ expired: 'dev2' });
|
|
expect(coord.request).toHaveBeenCalledWith('POST', '/device/dev2/expire', { body: {} });
|
|
});
|
|
|
|
test('requires a deviceId', async () => {
|
|
const p = createTailscaleProvider({ coordClient: makeCoord() });
|
|
await expect(p.revokeDevice()).rejects.toMatchObject({ code: 'bad_input' });
|
|
});
|
|
});
|
|
|
|
describe('tailscale provider: syncAccess()', () => {
|
|
test('throws ProviderError code=not_implemented_in_provider (DC-148 lands later)', async () => {
|
|
const p = createTailscaleProvider({ coordClient: makeCoord() });
|
|
await expect(p.syncAccess({}, [])).rejects.toMatchObject({
|
|
name: 'ProviderError',
|
|
code: 'not_implemented_in_provider',
|
|
retryable: false,
|
|
});
|
|
});
|
|
});
|
|
|
|
describe('tailscale provider: whois()', () => {
|
|
test('resolves identity via the local tailscale CLI', async () => {
|
|
const exec = makeExec({
|
|
'100.91.55.51': 'user: sami@example.com\nnodeKey: nodekey:abc123\nnode: laptop.tail3e209.ts.net\n',
|
|
});
|
|
const p = createTailscaleProvider({ coordClient: makeCoord(), execFileImpl: exec });
|
|
const who = await p.whois('100.91.55.51');
|
|
expect(exec.calls).toEqual([{ bin: 'tailscale', args: ['whois', '100.91.55.51'] }]);
|
|
expect(who).toEqual({
|
|
nodeKey: 'nodekey:abc123',
|
|
userId: null,
|
|
loginName: 'sami@example.com',
|
|
hostname: 'laptop.tail3e209.ts.net',
|
|
});
|
|
});
|
|
|
|
test('captures userid when present', async () => {
|
|
const exec = makeExec({ '1.2.3.4': 'userid: 1001\nuser: sami@example.com\n' });
|
|
const p = createTailscaleProvider({ execFileImpl: exec });
|
|
await expect(p.whois('1.2.3.4')).resolves.toMatchObject({ userId: 1001 });
|
|
});
|
|
|
|
test('CLI failure resolves to null (unknown identity is not an error)', async () => {
|
|
const exec = makeExec({}, { failAll: true });
|
|
const p = createTailscaleProvider({ execFileImpl: exec });
|
|
await expect(p.whois('100.0.0.1')).resolves.toBeNull();
|
|
});
|
|
|
|
test('empty CLI output resolves to null', async () => {
|
|
const exec = makeExec({});
|
|
const p = createTailscaleProvider({ execFileImpl: exec });
|
|
await expect(p.whois('100.0.0.2')).resolves.toBeNull();
|
|
});
|
|
|
|
test('missing ip is bad_input', async () => {
|
|
const p = createTailscaleProvider();
|
|
await expect(p.whois()).rejects.toMatchObject({ code: 'bad_input' });
|
|
});
|
|
|
|
test('never touches the coordination client', async () => {
|
|
const coord = makeCoord();
|
|
const exec = makeExec({ '9.9.9.9': 'user: x@example.com\n' });
|
|
const p = createTailscaleProvider({ coordClient: coord, execFileImpl: exec });
|
|
await p.whois('9.9.9.9');
|
|
expect(coord.request).not.toHaveBeenCalled();
|
|
expect(coord.listDevices).not.toHaveBeenCalled();
|
|
});
|
|
});
|
|
|
|
describe('tailscale provider: configureDns()', () => {
|
|
test('POSTs split-DNS nameservers for the zone (capability-flagged)', async () => {
|
|
const coord = makeCoord({ request: jest.fn(async () => ({})) });
|
|
const p = createTailscaleProvider({ coordClient: coord });
|
|
const res = await p.configureDns({ zone: 'internal', server: '100.100.100.10' });
|
|
expect(res).toEqual({ configured: true, zone: 'internal', server: '100.100.100.10' });
|
|
expect(coord.request).toHaveBeenCalledWith('POST', '/tailnet/-/dns/nameservers', {
|
|
body: { dns: ['100.100.100.10'], domains: ['internal'] },
|
|
});
|
|
});
|
|
|
|
test('requires both zone and server', async () => {
|
|
const p = createTailscaleProvider({ coordClient: makeCoord() });
|
|
await expect(p.configureDns({ zone: 'internal' })).rejects.toMatchObject({ code: 'bad_input' });
|
|
await expect(p.configureDns({ server: '1.1.1.1' })).rejects.toMatchObject({ code: 'bad_input' });
|
|
});
|
|
});
|
|
|
|
describe('tailscale provider: error mapping', () => {
|
|
test('listPeople surfaces a coord error as ProviderError', async () => {
|
|
const coord = makeCoord({
|
|
listUsers: jest.fn(async () => {
|
|
throw new TailscaleCoordError('Tailscale API 404: no users', { status: 404 });
|
|
}),
|
|
});
|
|
const p = createTailscaleProvider({ coordClient: coord });
|
|
await expect(p.listPeople()).rejects.toBeInstanceOf(ProviderError);
|
|
await expect(p.listPeople()).rejects.toMatchObject({ code: 'not_found' });
|
|
});
|
|
|
|
test('unauthorized coord error → ProviderError code unauthorized, not retryable', async () => {
|
|
const coord = makeCoord({
|
|
listUsers: jest.fn(async () => {
|
|
throw new TailscaleCoordError('Tailscale API 401: bad token', { status: 401 });
|
|
}),
|
|
});
|
|
const p = createTailscaleProvider({ coordClient: coord });
|
|
await expect(p.listPeople()).rejects.toMatchObject({
|
|
name: 'ProviderError',
|
|
code: 'unauthorized',
|
|
retryable: false,
|
|
});
|
|
});
|
|
|
|
test('rate_limited coord error → ProviderError retryable, retryAfter preserved', async () => {
|
|
const coord = makeCoord({
|
|
listUsers: jest.fn(async () => {
|
|
throw new TailscaleCoordError('Tailscale API 429: slow down', {
|
|
status: 429,
|
|
retryAfter: '30',
|
|
});
|
|
}),
|
|
});
|
|
const p = createTailscaleProvider({ coordClient: coord });
|
|
await expect(p.listPeople()).rejects.toMatchObject({
|
|
code: 'rate_limited',
|
|
retryable: true,
|
|
retryAfter: '30',
|
|
});
|
|
});
|
|
|
|
test('server_error coord error → ProviderError retryable', async () => {
|
|
const coord = makeCoord({
|
|
listUsers: jest.fn(async () => {
|
|
throw new TailscaleCoordError('Tailscale API 502: bad gateway', { status: 502 });
|
|
}),
|
|
});
|
|
const p = createTailscaleProvider({ coordClient: coord });
|
|
await expect(p.listPeople()).rejects.toMatchObject({ code: 'server_error', retryable: true });
|
|
});
|
|
|
|
test('generic thrown errors become retryable provider_error', () => {
|
|
const mapped = toProviderError(new Error('boom'));
|
|
expect(mapped).toBeInstanceOf(ProviderError);
|
|
expect(mapped.code).toBe('provider_error');
|
|
expect(mapped.retryable).toBe(true);
|
|
});
|
|
|
|
test('ProviderError passes through toProviderError unchanged', () => {
|
|
const original = new ProviderError('keep me', { code: 'bad_input' });
|
|
expect(toProviderError(original)).toBe(original);
|
|
});
|
|
|
|
test('coord errors thrown mid-block propagate as ProviderError', async () => {
|
|
const coord = makeCoord({ listDevices: jest.fn(async () => devicesFixture()) });
|
|
coord.request = jest.fn(async () => {
|
|
throw new TailscaleCoordError('Tailscale API 403: forbidden', { status: 403 });
|
|
});
|
|
const p = createTailscaleProvider({ coordClient: coord });
|
|
await expect(p.blockPerson('1001')).rejects.toMatchObject({ code: 'unauthorized' });
|
|
});
|
|
});
|
|
|
|
describe('tailscale provider: attachCoordClient()', () => {
|
|
test('late-binding a client flips not_configured → working', async () => {
|
|
const p = createTailscaleProvider();
|
|
await expect(p.listPeople()).rejects.toMatchObject({ code: 'not_configured' });
|
|
p.attachCoordClient(makeCoord({ listUsers: jest.fn(async () => []) }));
|
|
await expect(p.listPeople()).resolves.toEqual([]);
|
|
});
|
|
});
|