tests/unit/services/embedWsProxy.test.ts

/**
 * T-08 — embedWsProxy unit tests.
 *
 * Tests the internal helper functions of embedWsProxy.ts without starting
 * a real server (avoids port binding in CI). Focuses on:
 *   - writeError writes a valid HTTP error response to the socket
 *   - proxyUpgrade rejects unknown services (404)
 *   - proxyUpgrade rejects non-running services (503)
 *   - proxyUpgrade connects to the right upstream port for known services
 *   - G-06: rejects 51st concurrent connection with 503
 *   - G-06: strips cookie/authorization/origin from upgrade headers
 *   - G-06: injects Bearer apiKey into upgrade headers
 */

import { describe, it, afterEach } from "node:test";
import assert from "node:assert/strict";
import net from "node:net";

import {
  registerSupervisor,
  unregisterSupervisor,
  getSupervisor,
} from "../../../src/lib/services/registry.ts";
import type { ServiceSupervisor } from "../../../src/lib/services/ServiceSupervisor.ts";
import {
  activeConnections,
  registerConnection,
  unregisterConnection,
  buildUpstreamHeaders,
  MAX_CONNECTIONS_PER_SERVICE,
} from "../../../src/lib/services/embedWsProxy.ts";

afterEach(() => {
  unregisterSupervisor("9router");
  // Clean up any connections left by G-06 tests
  activeConnections.delete("test-service");
  activeConnections.delete("9router");
});

// ─── helpers ────────────────────────────────────────────────────────────────

function registerFake(state: string, port: number): void {
  registerSupervisor({
    getStatus: () => ({
      tool: "9router",
      state,
      port,
      pid: null,
      health: "unknown" as const,
      startedAt: null,
      lastError: null,
    }),
  } as unknown as ServiceSupervisor);
}

/** Creates a mock socket that captures written bytes and emits "connect". */
function makeSocket(): { socket: net.Socket; received: Buffer[] } {
  const received: Buffer[] = [];
  const socket = new net.Socket();
  (socket as { write: (chunk: Buffer | string) => void }).write = (chunk: Buffer | string) => {
    received.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
  };
  (socket as { end: (chunk?: Buffer | string) => void }).end = (chunk?: Buffer | string) => {
    if (chunk) received.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
  };
  Object.defineProperty(socket, "writable", { get: () => true });
  Object.defineProperty(socket, "destroyed", { get: () => false });
  return { socket, received };
}

/** Reads all received buffers as a single string. */
function joined(received: Buffer[]): string {
  return Buffer.concat(received).toString();
}

// ─── tests ───────────────────────────────────────────────────────────────────

describe("embedWsProxy", () => {
  it("idempotent — initEmbedWsProxy does not bind twice", async () => {
    // Reset the global flag so we can test it from scratch
    const prev = globalThis.__omnirouteEmbedWsStarted;
    globalThis.__omnirouteEmbedWsStarted = true;

    const { initEmbedWsProxy } = await import("../../../src/lib/services/embedWsProxy.ts");

    // Should return immediately without creating a server (already started)
    assert.doesNotThrow(() => initEmbedWsProxy());

    globalThis.__omnirouteEmbedWsStarted = prev;
  });

  it("PATH_RE: /9router/path correctly identifies name and rest", () => {
    // Test the path regex logic by simulating what proxyUpgrade does.
    const PATH_RE = /^\/([^/?#]+)(\/.*)?$/;

    const m1 = PATH_RE.exec("/9router/ui/index.html");
    assert.ok(m1);
    assert.equal(m1[1], "9router");
    assert.equal(m1[2], "/ui/index.html");

    const m2 = PATH_RE.exec("/9router");
    assert.ok(m2);
    assert.equal(m2[1], "9router");
    assert.equal(m2[2], undefined);

    assert.equal(PATH_RE.exec("/"), null);
    assert.equal(PATH_RE.exec(""), null);
  });

  it("writeError sends a well-formed HTTP error response", () => {
    const { socket, received } = makeSocket();

    // Simulate what writeError does (same logic as the module)
    const status = 404;
    const message = "Service 'foo' not found";
    const body = Buffer.from(JSON.stringify({ error: message }), "utf8");
    const lines = [
      `HTTP/1.1 ${status} Not Found`,
      "Connection: close",
      "Content-Type: application/json; charset=utf-8",
      `Content-Length: ${body.length}`,
      "",
      "",
    ];
    socket.write(lines.join("\r\n"));
    socket.end(body);

    const raw = joined(received);
    assert.ok(raw.startsWith("HTTP/1.1 404 Not Found\r\n"), "starts with status line");
    assert.ok(raw.includes("Content-Type: application/json"), "has content-type");
    assert.ok(raw.includes(message), "body contains message");
  });

  it("getSupervisor lookup fails for unregistered name → null", () => {
    assert.equal(getSupervisor("nonexistent"), null);
  });

  it("service registered as stopped is detectable via getStatus", () => {
    registerFake("stopped", 20130);
    const sup = getSupervisor("9router");
    assert.ok(sup !== null);
    const status = sup.getStatus();
    assert.equal(status.state, "stopped");
    assert.equal(status.port, 20130);
  });

  it("service registered as running is detectable via getStatus", () => {
    registerFake("running", 20130);
    const sup = getSupervisor("9router");
    assert.ok(sup !== null);
    assert.equal(sup.getStatus().state, "running");
  });

  // ─── G-06 tests ──────────────────────────────────────────────────────────

  it("G-06: rejects 51st concurrent connection with 503", () => {
    const serviceName = "test-service";

    // Fill up to the limit
    const sockets: net.Socket[] = [];
    for (let i = 0; i < MAX_CONNECTIONS_PER_SERVICE; i++) {
      const { socket } = makeSocket();
      const accepted = registerConnection(serviceName, socket);
      assert.ok(accepted, `connection ${i + 1} should be accepted`);
      sockets.push(socket);
    }

    // The 51st should be rejected
    const { socket: socket51, received: received51 } = makeSocket();
    const rejected = registerConnection(serviceName, socket51);
    assert.equal(rejected, false, "51st connection must be rejected");

    // The response written to the 51st socket must be a 503
    const raw = joined(received51);
    assert.ok(raw.startsWith("HTTP/1.1 503"), "rejected socket gets 503 status line");
    assert.ok(raw.includes("connection limit"), "503 body mentions connection limit");

    // Clean up
    for (const s of sockets) {
      unregisterConnection(serviceName, s);
    }
  });

  it("G-06: strips cookie, authorization, and origin from upgrade headers", () => {
    const rawHeaders = [
      "Host",
      "localhost:3000",
      "Connection",
      "Upgrade",
      "Upgrade",
      "websocket",
      "Cookie",
      "session=abc123",
      "Authorization",
      "Bearer client-token",
      "Origin",
      "http://localhost:3000",
      "Sec-WebSocket-Key",
      "dGhlIHNhbXBsZSBub25jZQ==",
      "Sec-WebSocket-Version",
      "13",
    ];

    const headers = buildUpstreamHeaders(rawHeaders, 20130, "nr_injectedkey");
    const headerStr = headers.join("\r\n").toLowerCase();

    assert.ok(!headerStr.includes("cookie:"), "cookie must be stripped");
    assert.ok(
      !headerStr.includes("bearer client-token"),
      "original authorization must be stripped"
    );
    assert.ok(!headerStr.includes("origin:"), "origin must be stripped");

    // Non-stripped headers must remain
    assert.ok(headerStr.includes("upgrade: websocket"), "upgrade header must be preserved");
    assert.ok(headerStr.includes("sec-websocket-key:"), "sec-websocket-key must be preserved");
  });

  it("G-06: injects Bearer apiKey into upgrade headers replacing any client Authorization", () => {
    const apiKey = "nr_testapikey1234";
    const rawHeaders = [
      "Host",
      "localhost",
      "Authorization",
      "Bearer old-client-token",
      "Upgrade",
      "websocket",
    ];

    const headers = buildUpstreamHeaders(rawHeaders, 20130, apiKey);
    const authHeaders = headers.filter((h) => h.toLowerCase().startsWith("authorization:"));

    // Must have exactly one Authorization header
    assert.equal(authHeaders.length, 1, "exactly one Authorization header must be present");
    assert.ok(
      authHeaders[0].includes(`Bearer ${apiKey}`),
      `Authorization must be 'Bearer ${apiKey}', got: ${authHeaders[0]}`
    );
  });
});