File size: 2,494 Bytes
87dab07 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 | import { beforeEach, describe, expect, it, vi } from "vitest";
import {
FULL_ACCESS_PAIRING_SETUP_BOOTSTRAP_PROFILE,
PAIRING_SETUP_BOOTSTRAP_PROFILE,
} from "../shared/device-bootstrap-profile.js";
vi.mock("../infra/device-bootstrap.js", () => ({
issueDevicePairSetupBootstrapToken: vi.fn(async () => ({
token: "bootstrap-123",
expiresAtMs: 123,
setupId: "setup-123",
})),
}));
const { resolvePairingSetupFromConfig } = await import("./setup-code.js");
const { issueDevicePairSetupBootstrapToken } = await import("../infra/device-bootstrap.js");
const config = {
gateway: {
bind: "custom",
customBindHost: "127.0.0.1",
auth: { mode: "trusted-proxy" },
},
} as const;
describe("trusted-proxy pairing setup", () => {
beforeEach(() => {
vi.mocked(issueDevicePairSetupBootstrapToken).mockClear();
});
it.each([
{
name: "issues full setup codes without a shared secret over TLS",
url: "wss://gateway.example.test",
profile: FULL_ACCESS_PAIRING_SETUP_BOOTSTRAP_PROFILE,
access: "full",
accessDowngraded: false,
},
{
name: "keeps plaintext LAN handoff limited",
url: "ws://192.168.1.20:18789",
profile: PAIRING_SETUP_BOOTSTRAP_PROFILE,
access: "limited",
accessDowngraded: true,
},
])("$name", async ({ url, profile, access, accessDowngraded }) => {
const result = await resolvePairingSetupFromConfig(config, { env: {}, publicUrl: url });
expect(result).toMatchObject({
ok: true,
authLabel: "trusted-proxy",
payload: { url, bootstrapToken: "bootstrap-123", expiresAtMs: 123 },
setupId: "setup-123",
expiresAtMs: 123,
urlSource: "plugins.entries.device-pair.config.publicUrl",
access,
accessDowngraded,
});
expect(issueDevicePairSetupBootstrapToken).toHaveBeenCalledExactlyOnceWith({
baseDir: undefined,
profile,
});
if (result.ok) {
expect(result.payload).not.toHaveProperty("setupId");
}
});
it("keeps public transport restrictions before issuing credentials", async () => {
const result = await resolvePairingSetupFromConfig(config, {
env: {},
publicUrl: "ws://gateway.example.test",
});
expect(result).toMatchObject({
ok: false,
error: expect.stringContaining(
"Tailscale and public mobile pairing require a secure gateway URL",
),
});
expect(issueDevicePairSetupBootstrapToken).not.toHaveBeenCalled();
});
});
|