@hyzyn/dsh-docker 0.9.5 → 0.10.0

package/scripts/route-smoke.mjs

@@ -181,6 +181,8 @@ function makeCtx(config, options = {}) {
     settingsStored: {},
     ttyConfig: options.ttyConfig,
     disposers: [],
+    // 宿主日志捕获：info / warn 都进这里（其余宿主侧断言用）
+    logs: [],
     /**
      * 本插件 entry 的安装级配置（= apply 拿到的 config）。DSH ≥0.1.7 的
      * `settings.describe()` 返回的是「默认值 ← 组合 base ← 用户层」的 resolved 值，
@@ -202,7 +204,10 @@ function makeCtx(config, options = {}) {
       return () => {}
     }
     const child = {
-      logger: { info: () => {}, warn: () => {} },
+      logger: {
+        info: (msg) => { state.logs.push(msg) },
+        warn: (msg) => { state.logs.push(msg) },
+      },
       effect: (callback, _name) => {
         const dispose = callback()
         state.disposers.push(typeof dispose === 'function' ? dispose : () => {})
@@ -389,9 +394,9 @@ function toolNames() {
  * 1. 挂载面
  * ------------------------------------------------------------------ */
 
-await test('挂载：注册 11 个只读 agent 工具', () => {
+await test('挂载：注册 12 个只读 agent 工具', () => {
   const names = toolNames().sort()
-  assert.deepEqual(names, ['docker_attention', 'docker_events', 'docker_image_inspect', 'docker_images', 'docker_inspect', 'docker_logs', 'docker_networks', 'docker_ps', 'docker_stats', 'docker_targets', 'docker_volumes'])
+  assert.deepEqual(names, ['docker_attention', 'docker_connect_local', 'docker_events', 'docker_image_inspect', 'docker_images', 'docker_inspect', 'docker_logs', 'docker_networks', 'docker_ps', 'docker_stats', 'docker_targets', 'docker_volumes'])
 })
 
 await test('挂载：注册能力公告 section', () => {
@@ -426,7 +431,7 @@ await test('GET /config：凭证脱敏 + 只读默认 + 复用 tty 连接簿名'
   const direct = config.targets.find((item) => item.name === '直连')
   assert.equal(direct.passwordSet, true)
   assert.equal(direct.passphraseSet, false)
-  assert.deepEqual(config.toolsRegistered.sort(), ['docker_attention', 'docker_events', 'docker_image_inspect', 'docker_images', 'docker_inspect', 'docker_logs', 'docker_networks', 'docker_ps', 'docker_stats', 'docker_targets', 'docker_volumes'])
+  assert.deepEqual(config.toolsRegistered.sort(), ['docker_attention', 'docker_connect_local', 'docker_events', 'docker_image_inspect', 'docker_images', 'docker_inspect', 'docker_logs', 'docker_networks', 'docker_ps', 'docker_stats', 'docker_targets', 'docker_volumes'])
 })
 
 await test('POST /config：未知键被拒绝', async () => {
@@ -1042,7 +1047,76 @@ await test('GET /config 以 settings 解析值为准（挂载竞态不再返回
 })
 
 /* ------------------------------------------------------------------ *
- * 7. 禁用与恢复：enabled 热生效（设置卡片路径 + 重启路径）
+ * 7. 一键连接本机：显式、保守、幂等（空 targets 的既有语义不变）
+ * ------------------------------------------------------------------ */
+
+/*
+ * 单独搭一个「一个目标都没有」的宿主：主 ctx 已经历过 clearTargets / 重写目标，
+ * 借用它会分不清「本来就空」还是「被上一节清掉了」。这条路径要的正是**从来没配过**
+ * 的那份初始状态。
+ */
+const localOnly = makeCtx({ dockerBin: fakeBin, targets: [] }, { ttyConfig: TTY_CONFIG })
+host.apply({ ...localOnly.ctx }, { dockerBin: fakeBin, targets: [] })
+const localRoute = localOnly.state.routes.find((item) => item.path === '/api/dsh-docker')
+assert.ok(localRoute !== undefined, '未注册 /api/dsh-docker 路由（空目标宿主）')
+
+async function callOn(route_, method, sub, body) {
+  const res = makeRes()
+  await route_.handler(makeReq(method, '/api/dsh-docker' + sub, body), res)
+  return res
+}
+
+await test('POST /connect-local：空目标宿主上一步加好本机目标并选中', async () => {
+  const before = await callOn(localRoute, 'GET', '/targets')
+  assert.deepEqual(before.body.targets, [], '前置条件：这个宿主一个目标都没有')
+  const res = await callOn(localRoute, 'POST', '/connect-local', {})
+  assert.equal(res.status, 200, JSON.stringify(res.body))
+  assert.equal(res.body.result.name, 'local')
+  assert.equal(res.body.result.created, true)
+  assert.equal(res.body.result.saved, true)
+  // 假 CLI 的 version 返回 27.3.1 → daemon 可达，probe 结果随响应一起回来
+  assert.equal(res.body.result.reachable, true)
+  assert.equal(res.body.result.serverVersion, '27.3.1')
+  assert.match(res.body.result.message, /已添加并选中本机目标「local」/)
+  assert.deepEqual(res.body.config.targets.map((item) => item.name), ['local'])
+  assert.deepEqual(localOnly.state.settingsStored.targets, [{ name: 'local', kind: 'local' }])
+})
+
+await test('POST /connect-local：再点一次复用（不重复创建、不再写盘）', async () => {
+  const writes = localOnly.state.settingsStored.targets.length
+  const res = await callOn(localRoute, 'POST', '/connect-local', {})
+  assert.equal(res.status, 200)
+  assert.equal(res.body.result.name, 'local')
+  assert.equal(res.body.result.created, false)
+  assert.match(res.body.result.message, /已选中本机目标/)
+  assert.equal(res.body.config.targets.length, writes, '目标数不应增加')
+})
+
+await test('POST /connect-local：已有 SSH 目标原样保留，本机目标追加在末尾', async () => {
+  const sshHost = makeCtx({ dockerBin: fakeBin, targets: [{ name: '远程', kind: 'ssh', book: 'prod-a' }] }, { ttyConfig: TTY_CONFIG })
+  host.apply({ ...sshHost.ctx }, { dockerBin: fakeBin, targets: [{ name: '远程', kind: 'ssh', book: 'prod-a' }] })
+  const sshRoute = sshHost.state.routes.find((item) => item.path === '/api/dsh-docker')
+  const res = await callOn(sshRoute, 'POST', '/connect-local', {})
+  assert.equal(res.status, 200)
+  assert.deepEqual(res.body.config.targets.map((item) => item.name), ['远程', 'local'])
+  assert.equal(res.body.config.targets[0].book, 'prod-a', 'SSH 目标的连接簿引用必须一字不动')
+  // 这条路径不需要任何能力授权，也不该顺手打开开关
+  assert.equal(res.body.config.allowMutations, false)
+  assert.equal(res.body.config.allowExec, false)
+})
+
+await test('POST /connect-local：GET 405；空数组防丢保护不受影响（clearTargets 语义不变）', async () => {
+  const wrongMethod = await callOn(localRoute, 'GET', '/connect-local')
+  assert.equal(wrongMethod.status, 405)
+  const cleared = await callOn(localRoute, 'POST', '/config', { targets: [] })
+  assert.equal(cleared.status, 200)
+  assert.match(cleared.body.warning, /已忽略空的目标列表/, '未带 clearTargets 的空数组仍被忽略')
+  const after = await callOn(localRoute, 'GET', '/targets')
+  assert.equal(after.body.targets.length, 1)
+})
+
+/* ------------------------------------------------------------------ *
+ * 8. 禁用与恢复：enabled 热生效（设置卡片路径 + 重启路径）
  * ------------------------------------------------------------------ */
 
 await test('禁用：POST /config enabled=false → 工具清空、公告撤下、数据路由 403', async () => {
@@ -1116,6 +1190,143 @@ await test('重启路径：settings 命名空间已禁用时挂载 → 挂载即
   assert.equal(config.body.config.enabled, false)
 })
 
+/* ------------------------------------------------------------------ *
+ * 7.5 能力使用审计（capability-use）：过闸的变更 / exec 每次一行
+ * ------------------------------------------------------------------ */
+
+const USE_PREFIX = '[dsh-docker] capability-use: '
+/*
+ * 审计行的出口是宿主 stdout（console.log，docker D162）——断言面因此是 console 捕获，
+ * 不是假 ctx 的 logger（那是其余宿主侧断言用的）。捕获行原样放行，不影响人工排障。
+ */
+const consoleLogs = []
+const origConsoleLog = console.log.bind(console)
+console.log = (...args) => {
+  consoleLogs.push(args.map((arg) => String(arg)).join(' '))
+  origConsoleLog(...args)
+}
+const useLines = () => consoleLogs.filter((line) => line.startsWith(USE_PREFIX))
+/** 前段字段无空格；detail 恒在行尾且值可含空格、可含像 key=value 的文本（exec 命令）——从最后一个 ` detail=` 处整段吃下。 */
+function parseUseLine(line) {
+  const fields = {}
+  const body = line.slice(USE_PREFIX.length)
+  const detailAt = body.lastIndexOf(' detail=')
+  const head = detailAt === -1 ? body : body.slice(0, detailAt)
+  for (const pair of head.split(' ')) {
+    const eq = pair.indexOf('=')
+    if (eq > 0) fields[pair.slice(0, eq)] = pair.slice(eq + 1)
+  }
+  if (detailAt !== -1) fields.detail = body.slice(detailAt + ' detail='.length)
+  return fields
+}
+/** 跑一条变更路由，断言它**恰好**产生一行 use 行且指定字段逐一对上。 */
+async function auditCase(sub, body, expected) {
+  const before = useLines().length
+  const res = await call('POST', sub, body)
+  assert.equal(res.status, 200, `${sub} 前置：路由本身要成功`)
+  const lines = useLines().slice(before)
+  assert.equal(lines.length, 1, `${sub} 应恰好产生一行 use 行，实际 ${String(lines.length)} 行`)
+  const fields = parseUseLine(lines[0])
+  for (const [key, value] of Object.entries(expected)) {
+    assert.equal(fields[key], value, `${sub}: 字段 ${key}`)
+  }
+  assert.equal(fields.target, '本机', `${sub}: target`)
+  assert.equal(fields.ok, 'true', `${sub}: ok`)
+  assert.notEqual(Number(fields.durationMs), NaN, `${sub}: durationMs 应是数字`)
+  return fields
+}
+
+await test('审计：八条变更 / exec 路由各恰好一行，字段与操作一一对应', async () => {
+  await auditCase('/images/remove', { target: '本机', ref: 'nginx:1.27' }, { capability: 'allowMutations', source: 'http', action: 'image.remove', ref: 'nginx:1.27' })
+  const prune = await auditCase('/images/prune', { target: '本机' }, { capability: 'allowMutations', source: 'http', action: 'image.prune' })
+  assert.equal('ref' in prune, false, 'prune 无目标：ref 字段应省略')
+  await auditCase('/networks/remove', { target: '本机', name: 'shop_default' }, { capability: 'allowMutations', source: 'http', action: 'network.remove', ref: 'shop_default' })
+  await auditCase('/networks/prune', { target: '本机' }, { capability: 'allowMutations', source: 'http', action: 'network.prune' })
+  await auditCase('/volumes/remove', { target: '本机', name: 'pgdata' }, { capability: 'allowMutations', source: 'http', action: 'volume.remove', ref: 'pgdata' })
+  await auditCase('/volumes/prune', { target: '本机' }, { capability: 'allowMutations', source: 'http', action: 'volume.prune' })
+  await auditCase('/action', { target: '本机', action: 'start', id: 'shop-web-1' }, { capability: 'allowMutations', source: 'http', action: 'container.start', ref: 'shop-web-1' })
+  await auditCase('/exec', { target: '本机', id: 'shop-web-1', command: 'echo hi' }, { capability: 'allowExec', source: 'http', action: 'exec', ref: 'shop-web-1', detail: 'code=0 cmd=echo hi' })
+})
+
+await test('审计：pull 流开记 start、收尾记 end（reason / code / durationMs）', async () => {
+  const before = useLines().length
+  const res = await call('GET', '/images/pull/stream?target=本机&ref=nginx:1.27')
+  assert.equal(res.status, 200)
+  const lines = useLines().slice(before)
+  assert.equal(lines.length, 2, 'pull 流应恰好产生 start + end 两行')
+  const start = parseUseLine(lines[0])
+  assert.equal(start.event, 'start')
+  assert.equal(start.action, 'image.pull')
+  assert.equal(start.ref, 'nginx:1.27')
+  assert.equal('ok' in start, false, 'start 行还没有结果：不带 ok')
+  const end = parseUseLine(lines[1])
+  assert.equal(end.event, 'end')
+  assert.equal(end.ok, 'true')
+  assert.equal(end.reason, 'pull-exit')
+  assert.equal(end.code, '0')
+  assert.notEqual(Number(end.durationMs), NaN)
+})
+
+await test('审计：只读路由与 /connect-local 产生零 use 行', async () => {
+  const before = useLines().length
+  for (const [method, sub, body] of [
+    ['POST', '/probe', { target: '本机' }],
+    ['POST', '/containers', { target: '本机' }],
+    ['POST', '/inspect', { target: '本机', id: 'shop-web-1' }],
+    ['POST', '/logs', { target: '本机', id: 'shop-web-1' }],
+    ['POST', '/stats', { target: '本机', ids: ['shop-web-1'] }],
+    ['POST', '/images', { target: '本机' }],
+    ['POST', '/networks', { target: '本机' }],
+    ['POST', '/volumes', { target: '本机' }],
+    ['POST', '/connect-local', {}],
+  ]) {
+    const res = await call(method, sub, body)
+    assert.equal(res.status, 200, `${sub} 前置`)
+  }
+  assert.equal(useLines().length - before, 0, '只读操作与 /connect-local 不该产生 use 行')
+})
+
+await test('审计：agent 工具 source=tool（不经 HTTP 路由，不与路由重复计数）', async () => {
+  const before = useLines().length
+  const action = state.tools.find((item) => item.name === 'docker_action')
+  assert.ok(action !== undefined)
+  await action.execute({ target: '本机', action: 'stop', id: 'shop-web-1' })
+  const exec = state.tools.find((item) => item.name === 'docker_exec')
+  assert.ok(exec !== undefined)
+  await exec.execute({ target: '本机', id: 'shop-web-1', command: 'ls -la' })
+  const lines = useLines().slice(before)
+  assert.equal(lines.length, 2, '两个工具各恰好一行')
+  const stop = parseUseLine(lines[0])
+  assert.equal(stop.source, 'tool')
+  assert.equal(stop.capability, 'allowMutations')
+  assert.equal(stop.action, 'container.stop')
+  assert.equal(stop.ref, 'shop-web-1')
+  const execLine = parseUseLine(lines[1])
+  assert.equal(execLine.source, 'tool')
+  assert.equal(execLine.capability, 'allowExec')
+  assert.equal(execLine.action, 'exec')
+  assert.equal(execLine.detail, 'code=0 cmd=ls -la')
+})
+
+await test('审计：403 不记（使用 = 过了闸）；开关恢复后一切照旧', async () => {
+  const before = useLines().length
+  const off = await call('POST', '/config', { allowMutations: false, allowExec: false })
+  assert.equal(off.status, 200)
+  const action = await call('POST', '/action', { target: '本机', action: 'stop', id: 'shop-web-1' })
+  assert.equal(action.status, 403)
+  const exec = await call('POST', '/exec', { target: '本机', id: 'shop-web-1', command: 'ls' })
+  assert.equal(exec.status, 403)
+  const pull = await call('GET', '/images/pull/stream?target=本机&ref=nginx:1.27')
+  assert.equal(pull.status, 403)
+  assert.equal(useLines().length - before, 0, '被闸挡回的请求不算使用')
+
+  // 恢复开关：后续用例（若有）不受影响，工具重新注册
+  const on = await call('POST', '/config', { allowMutations: true, allowExec: true })
+  assert.equal(on.status, 200)
+  assert.equal(toolNames().includes('docker_action'), true)
+  await auditCase('/action', { target: '本机', action: 'start', id: 'shop-web-1' }, { capability: 'allowMutations', source: 'http', action: 'container.start', ref: 'shop-web-1' })
+})
+
 /* ------------------------------------------------------------------ *
  * 8. 结果
  * ------------------------------------------------------------------ */