src/pairing/setup-code.trusted-proxy.test.ts

import { beforeEach, describe, expect, it, vi } from "vitest";
import {
  FULL_ACCESS_PAIRING_SETUP_BOOTSTRAP_PROFILE,
  PAIRING_SETUP_BOOTSTRAP_PROFILE,
} from "../shared/device-bootstrap-profile.js";

vi.mock("../infra/device-bootstrap.js", () => ({
  issueDevicePairSetupBootstrapToken: vi.fn(async () => ({
    token: "bootstrap-123",
    expiresAtMs: 123,
    setupId: "setup-123",
  })),
}));

const { resolvePairingSetupFromConfig } = await import("./setup-code.js");
const { issueDevicePairSetupBootstrapToken } = await import("../infra/device-bootstrap.js");
const config = {
  gateway: {
    bind: "custom",
    customBindHost: "127.0.0.1",
    auth: { mode: "trusted-proxy" },
  },
} as const;

describe("trusted-proxy pairing setup", () => {
  beforeEach(() => {
    vi.mocked(issueDevicePairSetupBootstrapToken).mockClear();
  });

  it.each([
    {
      name: "issues full setup codes without a shared secret over TLS",
      url: "wss://gateway.example.test",
      profile: FULL_ACCESS_PAIRING_SETUP_BOOTSTRAP_PROFILE,
      access: "full",
      accessDowngraded: false,
    },
    {
      name: "keeps plaintext LAN handoff limited",
      url: "ws://192.168.1.20:18789",
      profile: PAIRING_SETUP_BOOTSTRAP_PROFILE,
      access: "limited",
      accessDowngraded: true,
    },
  ])("$name", async ({ url, profile, access, accessDowngraded }) => {
    const result = await resolvePairingSetupFromConfig(config, { env: {}, publicUrl: url });
    expect(result).toMatchObject({
      ok: true,
      authLabel: "trusted-proxy",
      payload: { url, bootstrapToken: "bootstrap-123", expiresAtMs: 123 },
      setupId: "setup-123",
      expiresAtMs: 123,
      urlSource: "plugins.entries.device-pair.config.publicUrl",
      access,
      accessDowngraded,
    });
    expect(issueDevicePairSetupBootstrapToken).toHaveBeenCalledExactlyOnceWith({
      baseDir: undefined,
      profile,
    });
    if (result.ok) {
      expect(result.payload).not.toHaveProperty("setupId");
    }
  });

  it("keeps public transport restrictions before issuing credentials", async () => {
    const result = await resolvePairingSetupFromConfig(config, {
      env: {},
      publicUrl: "ws://gateway.example.test",
    });
    expect(result).toMatchObject({
      ok: false,
      error: expect.stringContaining(
        "Tailscale and public mobile pairing require a secure gateway URL",
      ),
    });
    expect(issueDevicePairSetupBootstrapToken).not.toHaveBeenCalled();
  });
});