@mzzsfy/dsh-turn-notify 0.10.0 → 0.11.1

package/test/host-notify.test.mjs

@@ -1,4 +1,4 @@
-// 宿主桌面通知 BDD:core 纯函数(回环判定 / 派发决策 / 平台命令 / spawn 执行 / 配置键)
+// 宿主桌面通知 BDD:core 纯函数(派发决策 / 平台命令 / spawn 执行 / 配置键)
 // 与 host 接线集成(stub ctx 装载真实 src/index.js,stub spawn 观测派发)。
 import test from 'node:test'
 import assert from 'node:assert/strict'
@@ -10,53 +10,32 @@ import {
   HOST_NOTIFY_TIMEOUT_MS,
   hostNotifyCommand,
   hostNotifyWanted,
-  isLocalBrowserPoll,
-  isLocalBrowserPresent,
-  isLoopbackAddress,
+  isBrowserPoll,
+  isBrowserPresent,
   publicConfig,
   resolvedConfig,
   sendHostNotify,
   validateConfigPatch,
 } from '../src/core.mjs'
 
-// ---- isLoopbackAddress:同机判定,回环地址即本机浏览器 ----
+// ---- isBrowserPoll:在场记账形态收紧,防伪造在场压制宿主通知 ----
 
-test('Given 回环形态地址 When 判定 Then 为真', () => {
-  assert.equal(isLoopbackAddress('::1'), true)
-  assert.equal(isLoopbackAddress('127.0.0.1'), true)
-  assert.equal(isLoopbackAddress('127.8.8.8'), true)
-  assert.equal(isLoopbackAddress('::ffff:127.0.0.1'), true)
+test('Given 合格轮询形态(任意来源加 cursor 加 fetch 形态或无 Sec-Fetch 头)When 判定 Then 为真', () => {
+  assert.equal(isBrowserPoll({ hasCursor: true, secFetchMode: 'cors' }), true)
+  assert.equal(isBrowserPoll({ hasCursor: true, secFetchMode: undefined }), true)
 })
 
-test('Given 非回环或非法地址 When 判定 Then 为假', () => {
-  assert.equal(isLoopbackAddress('192.168.1.5'), false)
-  assert.equal(isLoopbackAddress('::ffff:192.168.1.5'), false)
-  assert.equal(isLoopbackAddress('::2'), false)
-  assert.equal(isLoopbackAddress(''), false)
-  assert.equal(isLoopbackAddress(undefined), false)
-  assert.equal(isLoopbackAddress(null), false)
-})
-
-// ---- isLocalBrowserPoll:在场记账形态收紧,防伪造在场压制宿主通知 ----
-
-test('Given 回环加 cursor 加 fetch 形态或无 Sec-Fetch 头 When 判定 Then 为真', () => {
-  assert.equal(isLocalBrowserPoll({ remoteAddress: '127.0.0.1', hasCursor: true, secFetchMode: 'cors' }), true)
-  assert.equal(isLocalBrowserPoll({ remoteAddress: '::1', hasCursor: true, secFetchMode: undefined }), true)
-})
-
-test('Given 非回环或无 cursor 或 no-cors 形态 When 判定 Then 为假', () => {
-  assert.equal(isLocalBrowserPoll({ remoteAddress: '192.168.1.5', hasCursor: true, secFetchMode: 'cors' }), false)
-  assert.equal(isLocalBrowserPoll({ remoteAddress: '127.0.0.1', hasCursor: false, secFetchMode: 'cors' }), false)
-  assert.equal(isLocalBrowserPoll({ remoteAddress: '127.0.0.1', hasCursor: true, secFetchMode: 'no-cors' }), false)
-  assert.equal(isLocalBrowserPoll({ remoteAddress: undefined, hasCursor: true, secFetchMode: 'cors' }), false)
+test('Given 无 cursor 或 no-cors 形态 When 判定 Then 为假', () => {
+  assert.equal(isBrowserPoll({ hasCursor: false, secFetchMode: 'cors' }), false)
+  assert.equal(isBrowserPoll({ hasCursor: true, secFetchMode: 'no-cors' }), false)
 })
 
 test('Given Origin 缺席或与 Host 一致 When 判定 Then 为真;跨源或畸形 Origin Then 为假', () => {
-  const base = { remoteAddress: '127.0.0.1', hasCursor: true, secFetchMode: 'cors' }
-  assert.equal(isLocalBrowserPoll({ ...base, origin: undefined, host: '127.0.0.1:3080' }), true, '同源 GET fetch 不带 Origin')
-  assert.equal(isLocalBrowserPoll({ ...base, origin: 'http://127.0.0.1:3080', host: '127.0.0.1:3080' }), true)
-  assert.equal(isLocalBrowserPoll({ ...base, origin: 'https://evil.example', host: '127.0.0.1:3080' }), false, '跨源 fetch 必带且与 Host 不符')
-  assert.equal(isLocalBrowserPoll({ ...base, origin: 'not a url', host: '127.0.0.1:3080' }), false, '畸形 Origin 不放行')
+  const base = { hasCursor: true, secFetchMode: 'cors' }
+  assert.equal(isBrowserPoll({ ...base, origin: undefined, host: '127.0.0.1:3080' }), true, '同源 GET fetch 不带 Origin')
+  assert.equal(isBrowserPoll({ ...base, origin: 'http://127.0.0.1:3080', host: '127.0.0.1:3080' }), true)
+  assert.equal(isBrowserPoll({ ...base, origin: 'https://evil.example', host: '127.0.0.1:3080' }), false, '跨源 fetch 必带且与 Host 不符')
+  assert.equal(isBrowserPoll({ ...base, origin: 'not a url', host: '127.0.0.1:3080' }), false, '畸形 Origin 不放行')
 })
 
 // ---- hostNotifyWanted:浏览器优先,在场让位、离场补位;重复只发生在边界情况 ----
@@ -64,36 +43,36 @@ test('Given Origin 缺席或与 Host 一致 When 判定 Then 为真;跨源或畸
 const NOW = 1000 * 1000
 const WINDOW_MS = 2 * 1000
 
-test('Given 任一开关开且本机浏览器不在场 When 决策 Then 弹', () => {
-  assert.equal(hostNotifyWanted({ hostNotify: true, localBrowserPresent: false }), true)
-  assert.equal(hostNotifyWanted({ hostNotifyFallback: true, localBrowserPresent: false }), true)
-  assert.equal(hostNotifyWanted({ hostNotify: true, hostNotifyFallback: true, localBrowserPresent: false }), true)
+test('Given 任一开关开且浏览器不在场 When 决策 Then 弹', () => {
+  assert.equal(hostNotifyWanted({ hostNotify: true, browserPresent: false }), true)
+  assert.equal(hostNotifyWanted({ hostNotifyFallback: true, browserPresent: false }), true)
+  assert.equal(hostNotifyWanted({ hostNotify: true, hostNotifyFallback: true, browserPresent: false }), true)
 })
 
-test('Given 任一开关开且本机浏览器在场 When 决策 Then 让位不弹(浏览器优先,正常路径零重复)', () => {
-  assert.equal(hostNotifyWanted({ hostNotify: true, localBrowserPresent: true }), false)
-  assert.equal(hostNotifyWanted({ hostNotifyFallback: true, localBrowserPresent: true }), false)
-  assert.equal(hostNotifyWanted({ hostNotify: true, hostNotifyFallback: true, localBrowserPresent: true }), false)
+test('Given 任一开关开且浏览器在场 When 决策 Then 让位不弹(浏览器优先,正常路径零重复)', () => {
+  assert.equal(hostNotifyWanted({ hostNotify: true, browserPresent: true }), false)
+  assert.equal(hostNotifyWanted({ hostNotifyFallback: true, browserPresent: true }), false)
+  assert.equal(hostNotifyWanted({ hostNotify: true, hostNotifyFallback: true, browserPresent: true }), false)
 })
 
 test('Given 两开关均关 When 决策 Then 恒不弹', () => {
-  assert.equal(hostNotifyWanted({ localBrowserPresent: false }), false)
-  assert.equal(hostNotifyWanted({ hostNotify: false, hostNotifyFallback: false, localBrowserPresent: false }), false)
+  assert.equal(hostNotifyWanted({ browserPresent: false }), false)
+  assert.equal(hostNotifyWanted({ hostNotify: false, hostNotifyFallback: false, browserPresent: false }), false)
 })
 
-// ---- isLocalBrowserPresent:在场 = 有在途长轮询,或宽限窗口内有活动 ----
+// ---- isBrowserPresent:在场 = 有在途长轮询,或宽限窗口内有活动 ----
 
 test('Given 在途长轮询存在 When 判定在场 Then 为真(时间戳过期不影响)', () => {
-  assert.equal(isLocalBrowserPresent({ inFlightPolls: 1, lastSeenAt: NOW - WINDOW_MS - 1, now: NOW, windowMs: WINDOW_MS }), true)
-  assert.equal(isLocalBrowserPresent({ inFlightPolls: 3, lastSeenAt: 0, now: NOW, windowMs: WINDOW_MS }), true)
+  assert.equal(isBrowserPresent({ inFlightPolls: 1, lastSeenAt: NOW - WINDOW_MS - 1, now: NOW, windowMs: WINDOW_MS }), true)
+  assert.equal(isBrowserPresent({ inFlightPolls: 3, lastSeenAt: 0, now: NOW, windowMs: WINDOW_MS }), true)
 })
 
 test('Given 无在途 When 判定在场 Then 最近活动在窗口内为真,超窗或从未为假', () => {
-  assert.equal(isLocalBrowserPresent({ inFlightPolls: 0, lastSeenAt: NOW - 1, now: NOW, windowMs: WINDOW_MS }), true)
-  assert.equal(isLocalBrowserPresent({ inFlightPolls: 0, lastSeenAt: NOW - WINDOW_MS, now: NOW, windowMs: WINDOW_MS }), true)
-  assert.equal(isLocalBrowserPresent({ inFlightPolls: 0, lastSeenAt: NOW - WINDOW_MS - 1, now: NOW, windowMs: WINDOW_MS }), false)
-  assert.equal(isLocalBrowserPresent({ inFlightPolls: 0, lastSeenAt: 0, now: NOW, windowMs: WINDOW_MS }), false)
-  assert.equal(isLocalBrowserPresent({ inFlightPolls: 0, lastSeenAt: undefined, now: NOW, windowMs: WINDOW_MS }), false)
+  assert.equal(isBrowserPresent({ inFlightPolls: 0, lastSeenAt: NOW - 1, now: NOW, windowMs: WINDOW_MS }), true)
+  assert.equal(isBrowserPresent({ inFlightPolls: 0, lastSeenAt: NOW - WINDOW_MS, now: NOW, windowMs: WINDOW_MS }), true)
+  assert.equal(isBrowserPresent({ inFlightPolls: 0, lastSeenAt: NOW - WINDOW_MS - 1, now: NOW, windowMs: WINDOW_MS }), false)
+  assert.equal(isBrowserPresent({ inFlightPolls: 0, lastSeenAt: 0, now: NOW, windowMs: WINDOW_MS }), false)
+  assert.equal(isBrowserPresent({ inFlightPolls: 0, lastSeenAt: undefined, now: NOW, windowMs: WINDOW_MS }), false)
 })
 
 // ---- hostNotifyCommand:平台命令构造与文本转义 ----
@@ -209,7 +188,7 @@ test('Given 缺省配置 When 解析 Then 两键回 false;CHANNELS 含 host', ()
   assert.ok(CHANNELS.indexOf('host') >= 0, 'host 应为可路由通道')
 })
 
-// ---- host 接线集成:stub spawn 观测派发,presence 经投影路由的来源地址注入 ----
+// ---- host 接线集成:stub spawn 观测派发,presence 经投影路由的请求形态注入 ----
 
 // res 桩带事件能力:投影处理器挂 close 事件感知断连,桩须支持 once/emit;
 // end 不自动触发 close,断连时机由测试显式 emit 模拟
@@ -272,30 +251,31 @@ async function postConfig(routes, patch) {
   return res
 }
 
-async function pollProjection(routes, remoteAddress) {
+async function pollProjection(routes) {
   const req = makeReq('GET')
   req.url = '/api/turn-notify/projection'
-  if (remoteAddress !== undefined) req.socket = { remoteAddress }
   const res = makeRes()
   await routes.get('/api/turn-notify/projection')(req, res)
   assert.equal(res.status, 200)
   return res
 }
 
-// 本机浏览器长轮询记账形态:回环 + 带续传 cursor + fetch 形态头;
-// cursor 取超前值立即返回,不挂起
+// 浏览器长轮询记账形态:任意来源 + 带续传 cursor + fetch 形态头;
+// cursor 取超前值立即返回,不挂起。跨机地址为主场景(真实部署拓扑:
+// 浏览器在局域网另一台机器访问 dsh),回环为同机特例
 const FUTURE_CURSOR = 2 ** 40
-async function browserPoll(routes, remoteAddress) {
+const REMOTE_BROWSER = '10.123.90.14'
+async function browserPoll(routes) {
   const req = makeReq('GET', undefined, { 'sec-fetch-mode': 'cors' })
   req.url = '/api/turn-notify/projection?cursor=' + FUTURE_CURSOR
-  req.socket = { remoteAddress }
+  req.socket = { remoteAddress: REMOTE_BROWSER }
   const res = makeRes()
   await routes.get('/api/turn-notify/projection')(req, res)
   assert.equal(res.status, 200)
   return res
 }
 
-// 伪形态轮询:回环来源但缺 cursor / no-cors / 跨源 Origin,记账须拒绝
+// 伪形态轮询:缺 cursor / no-cors / 跨源 Origin,记账须拒绝(与来源地址无关)
 async function rawShapePoll(routes, remoteAddress, secFetchMode, withCursor, origin) {
   const headers = secFetchMode === undefined ? {} : { 'sec-fetch-mode': secFetchMode }
   if (origin !== undefined) headers.origin = origin
@@ -330,9 +310,11 @@ async function emitCompletedTurn(handlers) {
 }
 
 // 挂起中的长轮询:cursor 等于当前版本(配置 POST 后为 1),服务端挂起等待,
-// 模拟真实客户端的在途请求;返回 pending 承诺与 res 桩(供断连模拟与唤醒等待)
-function hangingPoll(routes, remoteAddress) {
-  const req = makeReq('GET', undefined, { 'sec-fetch-mode': 'cors' })
+// 模拟真实客户端的在途请求;返回 pending 承诺与 res 桩(供断连模拟与唤醒等待);
+// secFetchMode 缺省 cors,传 undefined 模拟不发 Sec-Fetch 头的旧浏览器
+function hangingPoll(routes, remoteAddress, secFetchMode) {
+  const headers = secFetchMode === undefined ? {} : { 'sec-fetch-mode': secFetchMode }
+  const req = makeReq('GET', undefined, headers)
   req.url = '/api/turn-notify/projection?cursor=1'
   req.socket = { remoteAddress }
   const res = makeRes()
@@ -340,39 +322,53 @@ function hangingPoll(routes, remoteAddress) {
   return { pending, res }
 }
 
-test('Given 总开关开且本机长轮询在途 When 回合完成 Then 宿主让位;离场超窗后接管', async () => {
+test('Given 旧浏览器形态(无 Sec-Fetch 头)跨机长轮询在途 When 回合完成 Then 宿主让位', async () => {
+  await withStubSpawn(async (spawns) => {
+    const { ctx, routes, handlers } = makeCtx()
+    apply(ctx)
+    await postConfig(routes, { hostNotify: true, minTurnDurationMs: 0 })
+    const { pending } = hangingPoll(routes, REMOTE_BROWSER, undefined)
+    await flushMicrotasks()
+    await emitCompletedTurn(handlers)
+    assert.equal(spawns.length, 0, '无 Sec-Fetch 头的同源续传轮询同样入账,宿主让位')
+    await pending
+  })
+})
+
+test('Given 总开关开且跨机长轮询在途 When 回合完成 Then 宿主让位;离场超窗后接管', async () => {
   await withStubSpawn(async (spawns) => {
     const { ctx, routes, handlers } = makeCtx()
     apply(ctx)
     const saved = await postConfig(routes, { hostNotify: true, minTurnDurationMs: 0 })
     assert.equal(saved.body.hostNotify, true)
-    const { pending, res } = hangingPoll(routes, '127.0.0.1')
+    const { pending, res } = hangingPoll(routes, REMOTE_BROWSER)
     await flushMicrotasks()
-    // 在途请求即在场信号:浏览器优先,宿主让位,正常路径零重复
+    // 在途请求即在场信号:浏览器优先,宿主让位,正常路径零重复;
+    // 浏览器在局域网另一台机器访问时同样让位
     await emitCompletedTurn(handlers)
-    assert.equal(spawns.length, 0, '本机长轮询在途,宿主让位')
+    assert.equal(spawns.length, 0, '跨机浏览器长轮询在途,宿主让位')
     // 在途请求被回合事件唤醒完成,宽限窗口内仍算在场
     await pending
     await emitCompletedTurn(handlers)
     assert.equal(spawns.length, 0, '长轮询刚完成,宽限窗口内仍由浏览器呈现')
-    // 推进时钟越过宽限窗口:本机视为离场,宿主接管(宁可重复不可漏)
+    // 推进时钟越过宽限窗口:浏览器视为离场,宿主接管(宁可重复不可漏)
     const realNow = Date.now
     Date.now = () => realNow() + CLIENT_PRESENCE_WINDOW_MS + 1
     try {
       await emitCompletedTurn(handlers)
     } finally { Date.now = realNow }
     assert.equal(spawns.length, 1, '离场超窗,宿主接管')
-    const projection = await pollProjection(routes, undefined)
+    const projection = await pollProjection(routes)
     assert.equal(projection.body.units.length, 3, '浏览器呈现通道不受让位影响')
   })
 })
 
-test('Given 总开关开且本机长轮询断连 When 回合完成 Then 认可窗口内让位,超窗接管', async () => {
+test('Given 总开关开且长轮询断连 When 回合完成 Then 认可窗口内让位,超窗接管', async () => {
   await withStubSpawn(async (spawns) => {
     const { ctx, routes, handlers } = makeCtx()
     apply(ctx)
     await postConfig(routes, { hostNotify: true, minTurnDurationMs: 0 })
-    const { pending, res } = hangingPoll(routes, '127.0.0.1')
+    const { pending, res } = hangingPoll(routes, REMOTE_BROWSER)
     await flushMicrotasks()
     // 浏览器关闭中止请求:close 事件即时出账,最近活动定格于断连时刻
     res.emit('close')
@@ -401,7 +397,7 @@ test('Given 记账轮询正常完成后再触发 close When 时钟推进越过
     let fake = 1000 * 1000
     Date.now = () => fake
     try {
-      const first = await browserPoll(routes, '127.0.0.1')
+      const first = await browserPoll(routes)
       // 生产正常完成路径:finally 已出账,响应完成后的 close 再触发须被幂等消化;
       // 若双出账致计数走负,时钟推进后本应让位的在途轮询将误弹
       first.emit('close')
@@ -427,8 +423,8 @@ test('Given 双 tab 并发挂起其一断连 When 时钟推进越过认可窗 Th
     let fake = 1000 * 1000
     Date.now = () => fake
     try {
-      const tabA = hangingPoll(routes, '127.0.0.1')
-      const tabB = hangingPoll(routes, '::1')
+      const tabA = hangingPoll(routes, REMOTE_BROWSER)
+      const tabB = hangingPoll(routes, '127.0.0.1')
       await flushMicrotasks()
       // tabA 断连即时出账,tabB 独力承载在途信号
       tabA.res.emit('close')
@@ -445,15 +441,23 @@ test('Given 双 tab 并发挂起其一断连 When 时钟推进越过认可窗 Th
   })
 })
 
-test('Given 总开关开且仅远程浏览器在线 When 回合完成 Then 宿主弹', async () => {
+test('Given 回退开关开 When 跨机长轮询在途 Then 不弹;无浏览器在场 Then 弹', async () => {
   await withStubSpawn(async (spawns) => {
-    const { ctx, routes, handlers } = makeCtx()
-    apply(ctx)
-    await postConfig(routes, { hostNotify: true, minTurnDurationMs: 0 })
-    await browserPoll(routes, '192.168.1.5')
-    await emitCompletedTurn(handlers)
-    assert.equal(spawns.length, 1, '远程浏览器不与宿主同机,照常弹')
-    assert.ok(spawns[0].args.flat().join(' ').includes('任务完成'), '通知文本应随 spawn 传出')
+    const local = makeCtx()
+    apply(local.ctx)
+    await postConfig(local.routes, { hostNotifyFallback: true, minTurnDurationMs: 0 })
+    const localPoll = hangingPoll(local.routes, REMOTE_BROWSER)
+    await flushMicrotasks()
+    await emitCompletedTurn(local.handlers)
+    assert.equal(spawns.length, 0, '跨机浏览器在途,回退不触发')
+    await postConfig(local.routes, { hostNotifyFallback: true, minTurnDurationMs: 0 })
+    await localPoll.pending
+    // 独立实例:从未有浏览器轮询
+    const remote = makeCtx()
+    apply(remote.ctx)
+    await postConfig(remote.routes, { hostNotifyFallback: true, minTurnDurationMs: 0 })
+    await emitCompletedTurn(remote.handlers)
+    assert.equal(spawns.length, 1, '无浏览器在场,回退触发')
   })
 })
 
@@ -477,40 +481,19 @@ test('Given kindRoutes 名单不含 host When 总开关开 Then 不弹', async (
   })
 })
 
-test('Given 回退开关开 When 本机长轮询在途 Then 不弹;仅远程在线 Then 弹', async () => {
-  await withStubSpawn(async (spawns) => {
-    const local = makeCtx()
-    apply(local.ctx)
-    await postConfig(local.routes, { hostNotifyFallback: true, minTurnDurationMs: 0 })
-    const localPoll = hangingPoll(local.routes, '::1')
-    await flushMicrotasks()
-    await emitCompletedTurn(local.handlers)
-    assert.equal(spawns.length, 0, '本机浏览器在途,回退不触发')
-    await postConfig(local.routes, { hostNotifyFallback: true, minTurnDurationMs: 0 })
-    await localPoll.pending
-    // 独立实例:本机从未有浏览器,仅远程浏览器轮询过
-    const remote = makeCtx()
-    apply(remote.ctx)
-    await postConfig(remote.routes, { hostNotifyFallback: true, minTurnDurationMs: 0 })
-    await browserPoll(remote.routes, '10.0.0.8')
-    await emitCompletedTurn(remote.handlers)
-    assert.equal(spawns.length, 1, '本机无浏览器,回退触发')
-  })
-})
-
 test('Given 裸 GET 形态(无 cursor 或 no-cors 或跨源)When 回合完成 Then 回退不触发(伪造在场不入账)', async () => {
   await withStubSpawn(async (spawns) => {
     const { ctx, routes, handlers } = makeCtx()
     apply(ctx)
     await postConfig(routes, { hostNotifyFallback: true, minTurnDurationMs: 0 })
-    // 回环来源但缺 cursor:手工探测形态
-    await rawShapePoll(routes, '127.0.0.1', 'cors', false)
-    // 回环来源带 cursor 但 no-cors:同机网页 img 探活形态
-    await rawShapePoll(routes, '127.0.0.1', 'no-cors', true)
-    // 回环来源带 cursor 且 cors 但跨源 Origin:同机恶意网页标准 fetch 形态
-    await rawShapePoll(routes, '127.0.0.1', 'cors', true, 'https://evil.example')
+    // 浏览器来源但缺 cursor:手工探测形态
+    await rawShapePoll(routes, REMOTE_BROWSER, 'cors', false)
+    // 浏览器来源带 cursor 但 no-cors:dsh 同源网页的 img 探活形态
+    await rawShapePoll(routes, REMOTE_BROWSER, 'no-cors', true)
+    // 浏览器来源带 cursor 且 cors 但跨源 Origin:任意机器上恶意网页的标准 fetch 形态
+    await rawShapePoll(routes, REMOTE_BROWSER, 'cors', true, 'https://evil.example')
     await emitCompletedTurn(handlers)
-    assert.equal(spawns.length, 1, '伪造在场不入账,本机无真实浏览器时回退照常触发')
+    assert.equal(spawns.length, 1, '伪造在场不入账,无真实浏览器时回退照常触发')
   })
 })
 
@@ -529,7 +512,7 @@ test('Given spawn 失败 When 回合完成 Then 无未处理拒绝且投影照
     await flushMicrotasks()
     await flushMicrotasks()
     assert.equal(rejections.length, 0)
-    const projection = await pollProjection(routes, undefined)
+    const projection = await pollProjection(routes)
     assert.equal(projection.body.units.length, 1)
   } finally {
     process.off('unhandledRejection', onUnhandled)