648 lines
28 KiB
JavaScript
648 lines
28 KiB
JavaScript
/**
|
|
* Route tests for the Private Network setup wizard + status — DC-152
|
|
* (specs/PRIVATE-NETWORK-SPEC.md §9).
|
|
*
|
|
* Hermetic: supertest against an in-process express app with fully mocked
|
|
* deps (registry, providers, peopleStore, credentialStore, technitium,
|
|
* caSetup). No network, no real filesystem state (tmp state file per app).
|
|
*
|
|
* Coverage required by the ticket:
|
|
* - mode validation for BOTH providers, incl. credential failure →
|
|
* step does NOT advance
|
|
* - apiKey expiry warning present for apiKey, absent for oauth
|
|
* - domain default + custom-TLD warning (accepted, never blocked)
|
|
* - connect runs the first sync (people + devices)
|
|
* - dns capability gating in both modes
|
|
* - ca locked-in warning + skip-when-dep-absent
|
|
* - admin bootstrap (first person = admin)
|
|
* - complete gate refuses when checks are missing
|
|
* - status aggregation shape
|
|
*/
|
|
|
|
'use strict';
|
|
|
|
const express = require('express');
|
|
const request = require('supertest');
|
|
const fs = require('fs');
|
|
const path = require('path');
|
|
const os = require('os');
|
|
const wizardRoutes = require('../routes/network-wizard');
|
|
const { createPeopleStore, ADMIN_GROUP } = require('../src/security/network-people-store');
|
|
const { ProviderError } = require('../src/network/errors');
|
|
|
|
/* ── fixtures ─────────────────────────────────────────────────────── */
|
|
|
|
function makeCredentialStore() {
|
|
const map = new Map();
|
|
return {
|
|
map,
|
|
async store(key, value) { map.set(key, value); return true; },
|
|
async retrieve(key) { return map.get(key) || null; },
|
|
async delete(key) { map.delete(key); return true; },
|
|
};
|
|
}
|
|
|
|
function makeProvider(overrides = {}) {
|
|
const base = {
|
|
id: () => 'mock',
|
|
capabilities: () => ({ invites: true, splitDnsApi: true, perPeerFirewall: false, selfHosted: false }),
|
|
getStatus: async () => ({ connected: true, installed: true }),
|
|
listDevices: async () => [
|
|
{ keyId: 'dev-1', name: 'laptop', ip: '100.64.0.2', online: true },
|
|
{ keyId: 'dev-2', name: 'phone', ip: '100.64.0.3', online: false },
|
|
],
|
|
listPeople: async () => [
|
|
{ providerUserId: 'user-1', displayName: 'Sami' },
|
|
],
|
|
};
|
|
return Object.assign(base, overrides);
|
|
}
|
|
|
|
function makeRegistry({ activeId = null } = {}) {
|
|
const reg = {
|
|
_activeId: activeId,
|
|
setActiveProvider: jest.fn(function (id) { this._activeId = id; }),
|
|
getActiveProvider: jest.fn(function () { return this._activeId; }),
|
|
};
|
|
return reg;
|
|
}
|
|
|
|
let _seq = 0;
|
|
function createApp(overrides = {}) {
|
|
const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'dc152-wizard-'));
|
|
const stateFile = path.join(dir, 'network-wizard-state.json');
|
|
const credentialStore = overrides.credentialStore || makeCredentialStore();
|
|
const peopleStore = overrides.peopleStore
|
|
|| createPeopleStore({ dataDir: dir, log: { info() {}, warn() {}, error() {} } });
|
|
const tailscale = overrides.tailscale || makeProvider({ id: () => 'tailscale' });
|
|
const wireguard = overrides.wireguard || makeProvider({
|
|
id: () => 'wireguard',
|
|
capabilities: () => ({ invites: false, splitDnsApi: false, perPeerFirewall: true, selfHosted: true }),
|
|
});
|
|
const registry = overrides.registry || makeRegistry();
|
|
const router = wizardRoutes({
|
|
registry,
|
|
providers: { tailscale, wireguard },
|
|
peopleStore,
|
|
technitium: overrides.technitium !== undefined ? overrides.technitium : null,
|
|
caSetup: overrides.caSetup !== undefined ? overrides.caSetup : null,
|
|
credentialStore,
|
|
stateFile,
|
|
connectionLogReader: overrides.connectionLogReader || null,
|
|
aclStateReader: overrides.aclStateReader || null,
|
|
firewallStateReader: overrides.firewallStateReader || null,
|
|
asyncHandler: (fn) => (req, res, next) => Promise.resolve(fn(req, res, next)).catch(next),
|
|
log: { info() {}, warn() {}, error() {} },
|
|
});
|
|
const app = express();
|
|
app.use(express.json());
|
|
app.use('/network/wizard', router);
|
|
app.use((err, _req, res, _next) => {
|
|
const status = err.statusCode || 500;
|
|
res.status(status).json({ success: false, error: err.message, code: err.code || null });
|
|
});
|
|
_seq += 1;
|
|
return { app, dir, stateFile, credentialStore, peopleStore, registry, tailscale, wireguard, seq: _seq };
|
|
}
|
|
|
|
function cleanup(dir) {
|
|
try { fs.rmSync(dir, { recursive: true, force: true }); } catch { /* ok */ }
|
|
}
|
|
|
|
/* ── state ────────────────────────────────────────────────────────── */
|
|
|
|
describe('GET /network/wizard/state', () => {
|
|
let ctx;
|
|
afterEach(() => cleanup(ctx.dir));
|
|
|
|
test('initial state: step mode, no checks passing', async () => {
|
|
ctx = createApp();
|
|
const res = await request(ctx.app).get('/network/wizard/state');
|
|
expect(res.status).toBe(200);
|
|
expect(res.body.success).toBe(true);
|
|
expect(res.body.step).toBe('mode');
|
|
expect(res.body.mode).toBeNull();
|
|
expect(res.body.startedAt).toBeTruthy();
|
|
expect(res.body.completedAt).toBeNull();
|
|
expect(res.body.checks).toMatchObject({
|
|
modeSelected: false,
|
|
domainConfigured: false,
|
|
providerConnected: false,
|
|
dnsConfigured: false,
|
|
caConfigured: false,
|
|
adminCreated: false,
|
|
});
|
|
});
|
|
|
|
test('state persists to network-wizard-state.json', async () => {
|
|
ctx = createApp();
|
|
await request(ctx.app).post('/network/wizard/mode').send({
|
|
mode: 'tailscale', credentials: { oauthClientSecret: 'tskey-client-xyz' },
|
|
});
|
|
const raw = JSON.parse(fs.readFileSync(ctx.stateFile, 'utf8'));
|
|
expect(raw.mode).toBe('tailscale');
|
|
expect(raw.step).toBe('domain');
|
|
});
|
|
});
|
|
|
|
/* ── step 1: mode ─────────────────────────────────────────────────── */
|
|
|
|
describe('POST /network/wizard/mode', () => {
|
|
let ctx;
|
|
afterEach(() => cleanup(ctx.dir));
|
|
|
|
test('tailscale with oauthClientSecret: accepted, no expiry warning', async () => {
|
|
ctx = createApp();
|
|
const res = await request(ctx.app).post('/network/wizard/mode').send({
|
|
mode: 'tailscale', credentials: { oauthClientSecret: 'tskey-client-abc123' },
|
|
});
|
|
expect(res.status).toBe(200);
|
|
expect(res.body.mode).toBe('tailscale');
|
|
expect(res.body.apiKeyExpiryWarning).toBeUndefined();
|
|
expect(res.body.step).toBe('domain');
|
|
expect(ctx.registry.setActiveProvider).toHaveBeenCalledWith('tailscale');
|
|
});
|
|
|
|
test('tailscale with apiKey: accepted WITH expiry warning + oauth recommendation', async () => {
|
|
ctx = createApp();
|
|
const res = await request(ctx.app).post('/network/wizard/mode').send({
|
|
mode: 'tailscale', credentials: { apiKey: 'tskey-api-k1234567890abcdef' },
|
|
});
|
|
expect(res.status).toBe(200);
|
|
expect(res.body.apiKeyExpiryWarning).toBe(true);
|
|
expect(res.body.warning).toMatch(/90 days/);
|
|
expect(res.body.warning).toMatch(/tskey-client-/);
|
|
expect(res.body.step).toBe('domain');
|
|
});
|
|
|
|
test('tailscale: credential stored under REUSED keys (tailscale.coord.apiToken / oauth)', async () => {
|
|
ctx = createApp();
|
|
await request(ctx.app).post('/network/wizard/mode').send({
|
|
mode: 'tailscale', credentials: { apiKey: 'tskey-api-k1234567890abcdef' },
|
|
});
|
|
expect(ctx.credentialStore.map.get('tailscale.coord.apiToken')).toBe('tskey-api-k1234567890abcdef');
|
|
await request(ctx.app).post('/network/wizard/mode').send({
|
|
mode: 'tailscale', credentials: { oauthClientSecret: 'tskey-client-aaa' },
|
|
});
|
|
expect(ctx.credentialStore.map.get('tailscale.oauth.client_secret')).toBe('tskey-client-aaa');
|
|
});
|
|
|
|
test('tailscale credential failure (unauthorized): 4xx, step does NOT advance, credential rolled back', async () => {
|
|
const tailscale = makeProvider({
|
|
id: () => 'tailscale',
|
|
listDevices: async () => { throw new ProviderError('token rejected', { code: 'unauthorized' }); },
|
|
});
|
|
ctx = createApp({ tailscale });
|
|
const res = await request(ctx.app).post('/network/wizard/mode').send({
|
|
mode: 'tailscale', credentials: { apiKey: 'tskey-api-k1234567890abcdef' },
|
|
});
|
|
expect(res.status).toBeGreaterThanOrEqual(400);
|
|
expect(res.status).toBeLessThan(500);
|
|
expect(res.body.success).toBe(false);
|
|
const state = await request(ctx.app).get('/network/wizard/state');
|
|
expect(state.body.step).toBe('mode'); // NOT advanced
|
|
expect(state.body.checks.modeSelected).toBe(false);
|
|
expect(ctx.credentialStore.map.get('tailscale.coord.apiToken')).toBeUndefined();
|
|
});
|
|
|
|
test('tailscale without any credentials: 400', async () => {
|
|
ctx = createApp();
|
|
const res = await request(ctx.app).post('/network/wizard/mode').send({ mode: 'tailscale' });
|
|
expect(res.status).toBe(400);
|
|
expect(res.body.success).toBe(false);
|
|
});
|
|
|
|
test('wireguard happy path: endpoint validated via getStatus, step advances', async () => {
|
|
ctx = createApp();
|
|
const res = await request(ctx.app).post('/network/wizard/mode').send({
|
|
mode: 'wireguard',
|
|
credentials: { endpoint: 'vpn.example.com', listenPort: 51820, externalInterface: 'eth0' },
|
|
});
|
|
expect(res.status).toBe(200);
|
|
expect(res.body.mode).toBe('wireguard');
|
|
expect(res.body.step).toBe('domain');
|
|
expect(ctx.registry.setActiveProvider).toHaveBeenCalledWith('wireguard');
|
|
});
|
|
|
|
test('wireguard dependency_missing: 400 with the missing binary list, step does NOT advance', async () => {
|
|
const wireguard = makeProvider({
|
|
id: () => 'wireguard',
|
|
getStatus: async () => {
|
|
throw new ProviderError('wireguard: `wg` binary not installed; wireguard: `wg-quick` binary not installed', {
|
|
code: 'dependency_missing',
|
|
});
|
|
},
|
|
});
|
|
ctx = createApp({ wireguard });
|
|
const res = await request(ctx.app).post('/network/wizard/mode').send({
|
|
mode: 'wireguard', credentials: { endpoint: 'vpn.example.com' },
|
|
});
|
|
expect(res.status).toBe(400);
|
|
expect(res.body.success).toBe(false);
|
|
expect(res.body.details.missingBinaries).toEqual(expect.arrayContaining(['wg', 'wg-quick']));
|
|
const state = await request(ctx.app).get('/network/wizard/state');
|
|
expect(state.body.step).toBe('mode');
|
|
});
|
|
|
|
test('wireguard without endpoint: 400', async () => {
|
|
ctx = createApp();
|
|
const res = await request(ctx.app).post('/network/wizard/mode').send({ mode: 'wireguard' });
|
|
expect(res.status).toBe(400);
|
|
});
|
|
|
|
test('unknown mode: 400', async () => {
|
|
ctx = createApp();
|
|
const res = await request(ctx.app).post('/network/wizard/mode').send({ mode: 'openvpn' });
|
|
expect(res.status).toBe(400);
|
|
expect(res.body.code).toBe('bad_mode');
|
|
});
|
|
});
|
|
|
|
/* ── step 2: domain ───────────────────────────────────────────────── */
|
|
|
|
describe('POST /network/wizard/domain', () => {
|
|
let ctx;
|
|
afterEach(() => cleanup(ctx.dir));
|
|
|
|
beforeEach(async () => {
|
|
ctx = createApp();
|
|
await request(ctx.app).post('/network/wizard/mode').send({
|
|
mode: 'tailscale', credentials: { oauthClientSecret: 'tskey-client-x' },
|
|
});
|
|
});
|
|
|
|
test('default .internal: accepted silently, no warning', async () => {
|
|
const res = await request(ctx.app).post('/network/wizard/domain').send({ tld: '.internal' });
|
|
expect(res.status).toBe(200);
|
|
expect(res.body.tld).toBe('.internal');
|
|
expect(res.body.customTldWarning).toBeUndefined();
|
|
expect(res.body.step).toBe('connect');
|
|
});
|
|
|
|
test('home.arpa: accepted silently', async () => {
|
|
const res = await request(ctx.app).post('/network/wizard/domain').send({ tld: 'home.arpa' });
|
|
expect(res.status).toBe(200);
|
|
expect(res.body.tld).toBe('.home.arpa');
|
|
expect(res.body.customTldWarning).toBeUndefined();
|
|
});
|
|
|
|
test('empty body → default .internal', async () => {
|
|
const res = await request(ctx.app).post('/network/wizard/domain').send({});
|
|
expect(res.status).toBe(200);
|
|
expect(res.body.tld).toBe('.internal');
|
|
expect(res.body.customTldWarning).toBeUndefined();
|
|
});
|
|
|
|
test('custom TLD: accepted WITH "could become real later" warning (never blocked)', async () => {
|
|
const res = await request(ctx.app).post('/network/wizard/domain').send({ tld: '.mynet' });
|
|
expect(res.status).toBe(200); // accepted, not blocked
|
|
expect(res.body.tld).toBe('.mynet');
|
|
expect(res.body.customTldWarning).toBe(true);
|
|
expect(res.body.warning).toMatch(/could become real later/);
|
|
});
|
|
|
|
test('garbage tld: 400', async () => {
|
|
const res = await request(ctx.app).post('/network/wizard/domain').send({ tld: '.not valid!' });
|
|
expect(res.status).toBe(400);
|
|
});
|
|
|
|
test('domain before mode: 409, step does not advance', async () => {
|
|
const fresh = createApp();
|
|
const res = await request(fresh.app).post('/network/wizard/domain').send({ tld: '.internal' });
|
|
expect(res.status).toBe(409);
|
|
cleanup(fresh.dir);
|
|
});
|
|
});
|
|
|
|
/* ── step 3: connect ─────────────────────────────────────────────── */
|
|
|
|
describe('POST /network/wizard/connect', () => {
|
|
let ctx;
|
|
afterEach(() => cleanup(ctx.dir));
|
|
|
|
async function ready(mode = 'tailscale') {
|
|
ctx = createApp();
|
|
const creds = mode === 'tailscale'
|
|
? { mode, credentials: { oauthClientSecret: 'tskey-client-x' } }
|
|
: { mode, credentials: { endpoint: 'vpn.example.com' } };
|
|
await request(ctx.app).post('/network/wizard/mode').send(creds);
|
|
await request(ctx.app).post('/network/wizard/domain').send({ tld: '.internal' });
|
|
}
|
|
|
|
test('runs health check + first sync (people into store, devices listed)', async () => {
|
|
await ready('tailscale');
|
|
const res = await request(ctx.app).post('/network/wizard/connect');
|
|
expect(res.status).toBe(200);
|
|
expect(res.body.connected).toBe(true);
|
|
expect(res.body.peopleSynced).toBe(1);
|
|
expect(Array.isArray(res.body.devices)).toBe(true);
|
|
expect(res.body.devices).toHaveLength(2);
|
|
expect(res.body.step).toBe('dns');
|
|
const people = await ctx.peopleStore.listPeople();
|
|
expect(people).toHaveLength(1);
|
|
expect(people[0].displayName).toBe('Sami');
|
|
});
|
|
|
|
test('connect is idempotent: re-running does not duplicate people', async () => {
|
|
await ready('tailscale');
|
|
await request(ctx.app).post('/network/wizard/connect');
|
|
const res = await request(ctx.app).post('/network/wizard/connect');
|
|
expect(res.status).toBe(200);
|
|
const people = await ctx.peopleStore.listPeople();
|
|
expect(people).toHaveLength(1);
|
|
});
|
|
|
|
test('health check failure → 502, providerConnected stays false', async () => {
|
|
await ready('wireguard');
|
|
ctx.wireguard.getStatus = async () => ({ connected: false, installed: true });
|
|
const res = await request(ctx.app).post('/network/wizard/connect');
|
|
expect(res.status).toBe(502);
|
|
const state = await request(ctx.app).get('/network/wizard/state');
|
|
expect(state.body.checks.providerConnected).toBe(false);
|
|
});
|
|
|
|
test('connect before mode: 409', async () => {
|
|
ctx = createApp();
|
|
const res = await request(ctx.app).post('/network/wizard/connect');
|
|
expect(res.status).toBe(409);
|
|
});
|
|
});
|
|
|
|
/* ── step 4: dns ─────────────────────────────────────────────────── */
|
|
|
|
describe('POST /network/wizard/dns (capability gating)', () => {
|
|
let ctx;
|
|
afterEach(() => cleanup(ctx.dir));
|
|
|
|
function makeTechnitium() {
|
|
return {
|
|
checkSetup: jest.fn(async () => ({ ok: true, installed: true, configured: true, server: '127.0.0.1:5353' })),
|
|
configureSplitDns: jest.fn(async ({ zone, server }) => ({ ok: true, zone, server })),
|
|
};
|
|
}
|
|
|
|
async function readyToDns(mode, technitium) {
|
|
ctx = createApp({ technitium });
|
|
const creds = mode === 'tailscale'
|
|
? { mode, credentials: { oauthClientSecret: 'tskey-client-x' } }
|
|
: { mode, credentials: { endpoint: 'vpn.example.com' } };
|
|
await request(ctx.app).post('/network/wizard/mode').send(creds);
|
|
await request(ctx.app).post('/network/wizard/domain').send({ tld: '.internal' });
|
|
await request(ctx.app).post('/network/wizard/connect');
|
|
}
|
|
|
|
test('tailscale mode: split-DNS delegated via provider-capable path, per-check results', async () => {
|
|
const technitium = makeTechnitium();
|
|
await readyToDns('tailscale', technitium);
|
|
const res = await request(ctx.app).post('/network/wizard/dns');
|
|
expect(res.status).toBe(200);
|
|
expect(res.body.configured).toBe(true);
|
|
expect(res.body.checks).toHaveLength(2);
|
|
expect(technitium.checkSetup).toHaveBeenCalledTimes(1);
|
|
expect(technitium.configureSplitDns).toHaveBeenCalledTimes(1);
|
|
expect(technitium.configureSplitDns.mock.calls[0][0].zone).toBe('internal');
|
|
expect(technitium.configureSplitDns.mock.calls[0][0].viaProviderApi).toBe(true); // splitDnsApi capability
|
|
expect(res.body.step).toBe('ca');
|
|
});
|
|
|
|
test('wireguard mode: splitDnsApi capability false → direct Technitium write path', async () => {
|
|
const technitium = makeTechnitium();
|
|
await readyToDns('wireguard', technitium);
|
|
const res = await request(ctx.app).post('/network/wizard/dns');
|
|
expect(res.status).toBe(200);
|
|
expect(res.body.configured).toBe(true);
|
|
expect(technitium.configureSplitDns.mock.calls[0][0].viaProviderApi).toBe(false);
|
|
});
|
|
|
|
test('technitium dep absent: skipped honestly, dns check counts as done', async () => {
|
|
await readyToDns('tailscale', null);
|
|
const res = await request(ctx.app).post('/network/wizard/dns');
|
|
expect(res.status).toBe(200);
|
|
expect(res.body.skipped).toBe(true);
|
|
expect(res.body.reason).toBeTruthy();
|
|
const state = await request(ctx.app).get('/network/wizard/state');
|
|
expect(state.body.checks.dnsConfigured).toBe(true); // skipped counts
|
|
expect(state.body.step).toBe('ca');
|
|
});
|
|
|
|
test('technitium setup not ok: configured=false, per-check fail surfaced', async () => {
|
|
const technitium = {
|
|
checkSetup: async () => ({ ok: false, installed: false }),
|
|
configureSplitDns: jest.fn(async () => ({ ok: true })),
|
|
};
|
|
await readyToDns('tailscale', technitium);
|
|
const res = await request(ctx.app).post('/network/wizard/dns');
|
|
expect(res.status).toBe(200);
|
|
expect(res.body.configured).toBe(false);
|
|
expect(res.body.checks[0].status).toBe('fail');
|
|
expect(technitium.configureSplitDns).not.toHaveBeenCalled();
|
|
const state = await request(ctx.app).get('/network/wizard/state');
|
|
expect(state.body.checks.dnsConfigured).toBe(false);
|
|
});
|
|
});
|
|
|
|
/* ── step 5: ca ──────────────────────────────────────────────────── */
|
|
|
|
describe('POST /network/wizard/ca', () => {
|
|
let ctx;
|
|
afterEach(() => cleanup(ctx.dir));
|
|
|
|
async function readyToCa(caSetup) {
|
|
ctx = createApp({ caSetup });
|
|
await request(ctx.app).post('/network/wizard/mode').send({
|
|
mode: 'tailscale', credentials: { oauthClientSecret: 'tskey-client-x' },
|
|
});
|
|
await request(ctx.app).post('/network/wizard/domain').send({ tld: '.internal' });
|
|
await request(ctx.app).post('/network/wizard/connect');
|
|
await request(ctx.app).post('/network/wizard/dns');
|
|
}
|
|
|
|
test('dep present: setupNamedRootCA called with commonName + privateTld, locked-in warning returned', async () => {
|
|
const caSetup = { setupNamedRootCA: jest.fn(async ({ commonName, privateTld }) => ({
|
|
ok: true, commonName, privateTld, fingerprint: 'AA:BB',
|
|
})) };
|
|
await readyToCa(caSetup);
|
|
const res = await request(ctx.app).post('/network/wizard/ca').send({ commonName: 'DashCaddy Home CA' });
|
|
expect(res.status).toBe(200);
|
|
expect(res.body.configured).toBe(true);
|
|
expect(res.body.lockedInWarning).toMatch(/new root/i);
|
|
expect(res.body.lockedInWarning).toMatch(/re-trust/i);
|
|
expect(caSetup.setupNamedRootCA).toHaveBeenCalledWith({
|
|
commonName: 'DashCaddy Home CA',
|
|
privateTld: '.internal',
|
|
});
|
|
expect(res.body.step).toBe('admin');
|
|
});
|
|
|
|
test('dep absent: skipped with reason (wizard not wedged), still carries warning', async () => {
|
|
await readyToCa(null);
|
|
const res = await request(ctx.app).post('/network/wizard/ca').send({ commonName: 'X' });
|
|
expect(res.status).toBe(200);
|
|
expect(res.body.skipped).toBe(true);
|
|
expect(res.body.reason).toBeTruthy();
|
|
expect(res.body.lockedInWarning).toBeTruthy();
|
|
expect(res.body.step).toBe('admin');
|
|
});
|
|
|
|
test('missing commonName with dep present: 400', async () => {
|
|
await readyToCa({ setupNamedRootCA: async () => ({ ok: true }) });
|
|
const res = await request(ctx.app).post('/network/wizard/ca').send({});
|
|
expect(res.status).toBe(400);
|
|
expect(res.body.code).toBe('bad_common_name');
|
|
});
|
|
});
|
|
|
|
/* ── step 6: admin ───────────────────────────────────────────────── */
|
|
|
|
describe('POST /network/wizard/admin (bootstrap admin)', () => {
|
|
let ctx;
|
|
afterEach(() => cleanup(ctx.dir));
|
|
|
|
async function readyToAdmin() {
|
|
// No provider people: the store must still be EMPTY at /admin time so
|
|
// the bootstrap-admin rule (first person ⇒ Admin group) applies to the
|
|
// wizard-created person, not to a connect-synced one.
|
|
const tailscale = makeProvider({ id: () => 'tailscale', listPeople: async () => [] });
|
|
ctx = createApp({ tailscale });
|
|
await request(ctx.app).post('/network/wizard/mode').send({
|
|
mode: 'tailscale', credentials: { oauthClientSecret: 'tskey-client-x' },
|
|
});
|
|
await request(ctx.app).post('/network/wizard/domain').send({ tld: '.internal' });
|
|
await request(ctx.app).post('/network/wizard/connect');
|
|
await request(ctx.app).post('/network/wizard/dns');
|
|
await request(ctx.app).post('/network/wizard/ca').send({ commonName: 'CA' });
|
|
}
|
|
|
|
test('creates first person via peopleStore with bootstrap admin rule', async () => {
|
|
await readyToAdmin();
|
|
const res = await request(ctx.app).post('/network/wizard/admin').send({
|
|
displayName: 'Sami', providerUserId: 'ts-user-1',
|
|
});
|
|
expect(res.status).toBe(201);
|
|
expect(res.body.adminCreated).toBe(true);
|
|
expect(res.body.person.displayName).toBe('Sami');
|
|
expect(res.body.person.groups).toContain(ADMIN_GROUP); // bootstrap rule
|
|
expect(res.body.person.protectedAt).toBeTruthy();
|
|
expect(res.body.step).toBe('complete');
|
|
});
|
|
|
|
test('invalid displayName: 400', async () => {
|
|
await readyToAdmin();
|
|
const res = await request(ctx.app).post('/network/wizard/admin').send({ displayName: '' });
|
|
expect(res.status).toBe(400);
|
|
});
|
|
});
|
|
|
|
/* ── completion gate ─────────────────────────────────────────────── */
|
|
|
|
describe('POST /network/wizard/complete', () => {
|
|
let ctx;
|
|
afterEach(() => cleanup(ctx.dir));
|
|
|
|
test('refuses (409) when checks missing — names them', async () => {
|
|
ctx = createApp();
|
|
await request(ctx.app).post('/network/wizard/mode').send({
|
|
mode: 'tailscale', credentials: { oauthClientSecret: 'tskey-client-x' },
|
|
});
|
|
const res = await request(ctx.app).post('/network/wizard/complete');
|
|
expect(res.status).toBe(409);
|
|
expect(res.body.code).toBe('incomplete');
|
|
expect(res.body.details.missing).toEqual(expect.arrayContaining([
|
|
'providerConnected', 'dnsConfigured', 'caConfigured', 'adminCreated',
|
|
]));
|
|
const state = await request(ctx.app).get('/network/wizard/state');
|
|
expect(state.body.completedAt).toBeNull();
|
|
});
|
|
|
|
test('all green → completedAt set', async () => {
|
|
ctx = createApp();
|
|
await request(ctx.app).post('/network/wizard/mode').send({
|
|
mode: 'tailscale', credentials: { oauthClientSecret: 'tskey-client-x' },
|
|
});
|
|
await request(ctx.app).post('/network/wizard/domain').send({ tld: '.internal' });
|
|
await request(ctx.app).post('/network/wizard/connect');
|
|
await request(ctx.app).post('/network/wizard/dns'); // skipped path (no technitium)
|
|
await request(ctx.app).post('/network/wizard/ca').send({ commonName: 'CA' }); // skipped path
|
|
await request(ctx.app).post('/network/wizard/admin').send({ displayName: 'Sami' });
|
|
const res = await request(ctx.app).post('/network/wizard/complete');
|
|
expect(res.status).toBe(200);
|
|
expect(res.body.completed).toBe(true);
|
|
expect(res.body.completedAt).toBeTruthy();
|
|
const state = await request(ctx.app).get('/network/wizard/state');
|
|
expect(state.body.completedAt).toBeTruthy();
|
|
});
|
|
});
|
|
|
|
/* ── status aggregation ──────────────────────────────────────────── */
|
|
|
|
describe('GET /network/wizard/status', () => {
|
|
let ctx;
|
|
afterEach(() => cleanup(ctx.dir));
|
|
|
|
test('aggregation shape: wizard, online, recentConnections, sync, driftBanner', async () => {
|
|
ctx = createApp({
|
|
connectionLogReader: async () => ({ events: [{ at: 't', ip: '100.64.0.2' }], note: 'event-store' }),
|
|
aclStateReader: async () => ({ hash: 'abc123', lastPushAt: 't', drifted: false }),
|
|
firewallStateReader: async () => ({ applied: true, lastApplyAt: 't', drifted: false }),
|
|
});
|
|
await request(ctx.app).post('/network/wizard/mode').send({
|
|
mode: 'tailscale', credentials: { oauthClientSecret: 'tskey-client-x' },
|
|
});
|
|
const res = await request(ctx.app).get('/network/wizard/status');
|
|
expect(res.status).toBe(200);
|
|
expect(res.body.wizard).toMatchObject({ mode: 'tailscale', privateTld: null });
|
|
expect(res.body.online).toMatchObject({ provider: 'tailscale', devicesTotal: 2, devicesOnline: 1 });
|
|
expect(Array.isArray(res.body.online.devices)).toBe(true);
|
|
expect(res.body.recentConnections.events).toHaveLength(1);
|
|
expect(res.body.sync.acl.hash).toBe('abc123');
|
|
expect(res.body.sync.firewall.applied).toBe(true);
|
|
expect(res.body.driftBanner).toBe(false);
|
|
});
|
|
|
|
test('no connectionLogReader → empty list with a note (not an error)', async () => {
|
|
ctx = createApp();
|
|
const res = await request(ctx.app).get('/network/wizard/status');
|
|
expect(res.status).toBe(200);
|
|
expect(res.body.recentConnections.events).toEqual([]);
|
|
expect(res.body.recentConnections.note).toBeTruthy();
|
|
expect(res.body.sync).toEqual({ acl: null, firewall: null });
|
|
});
|
|
|
|
test('drift in either reader flips driftBanner', async () => {
|
|
ctx = createApp({
|
|
aclStateReader: async () => ({ hash: 'x', drifted: true }),
|
|
});
|
|
await request(ctx.app).post('/network/wizard/mode').send({
|
|
mode: 'tailscale', credentials: { oauthClientSecret: 'tskey-client-x' },
|
|
});
|
|
const res = await request(ctx.app).get('/network/wizard/status');
|
|
expect(res.status).toBe(200);
|
|
expect(res.body.driftBanner).toBe(true);
|
|
});
|
|
|
|
test('provider status failure surfaces as online.error, still 200', async () => {
|
|
// listDevices works (mode validation passes); getStatus fails → the
|
|
// status aggregation surfaces the error instead of 500ing.
|
|
const tailscale = makeProvider({
|
|
id: () => 'tailscale',
|
|
getStatus: async () => { throw new Error('daemon down'); },
|
|
});
|
|
ctx = createApp({ tailscale });
|
|
await request(ctx.app).post('/network/wizard/mode').send({
|
|
mode: 'tailscale', credentials: { oauthClientSecret: 'tskey-client-x' },
|
|
});
|
|
const res = await request(ctx.app).get('/network/wizard/status');
|
|
expect(res.status).toBe(200);
|
|
expect(res.body.online.error).toBe('daemon down');
|
|
});
|
|
|
|
test('before any mode: honest empty shape', async () => {
|
|
ctx = createApp();
|
|
const res = await request(ctx.app).get('/network/wizard/status');
|
|
expect(res.status).toBe(200);
|
|
expect(res.body.wizard.mode).toBeNull();
|
|
expect(res.body.online.devices).toEqual([]);
|
|
expect(res.body.driftBanner).toBe(false);
|
|
});
|
|
});
|