@serfab/cadre-host 0.10.0 → 0.12.0

package/src/server/__tests__/static.test.ts

@@ -1,145 +1,145 @@
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join, normalize, relative, sep } from 'node:path';
-
-import Fastify from 'fastify';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-
-import { registerStaticMount, resolveSafe } from '../static.js';
-
-describe('resolveSafe', () => {
-  // POSIX-style fixtures; node:path normalizes separators per-platform, so the
-  // containment logic is exercised identically on Windows and POSIX.
-  const root = '/srv/app/dist/ui';
-
-  it('resolves a normal in-root asset', () => {
-    expect(resolveSafe(root, '/assets/app.js')).toBe(normalize(join(root, 'assets/app.js')));
-  });
-
-  it('resolves a bare / to the root directory itself', () => {
-    expect(resolveSafe(root, '/')).toBe(normalize(root));
-  });
-
-  it('resolves /index.html to the root index', () => {
-    expect(resolveSafe(root, '/index.html')).toBe(normalize(join(root, 'index.html')));
-  });
-
-  it('rejects the sibling-directory prefix bypass', () => {
-    // `ui-private` shares `ui`'s basename as a prefix — the bare startsWith
-    // guard accepted this; the relative-based guard must reject it.
-    expect(resolveSafe(root, '/../ui-private/secret')).toBeNull();
-  });
-
-  it('accepts an in-root asset whose name merely begins with ".."', () => {
-    // `..foo` is a legitimate descendant — the containment guard must not reject
-    // it via a loose '..' prefix match (the precise check keys on '..' + sep).
-    expect(resolveSafe(root, '/..foo.js')).toBe(normalize(join(root, '..foo.js')));
-  });
-
-  it('rejects ordinary out-of-tree traversal', () => {
-    expect(resolveSafe(root, '/../../etc/passwd')).toBeNull();
-  });
-
-  it('rejects an encoded out-of-tree traversal', () => {
-    expect(resolveSafe(root, '/%2e%2e/%2e%2e/etc/passwd')).toBeNull();
-  });
-
-  it('rejects a NUL-byte path', () => {
-    expect(resolveSafe(root, '/app%00.js')).toBeNull();
-  });
-
-  it('rejects malformed percent-encoding', () => {
-    expect(resolveSafe(root, '/%')).toBeNull();
-  });
-
-  it('never returns a path that escapes the root', () => {
-    const escapes = [
-      '/../ui-private/secret',
-      '/../../etc/passwd',
-      '/../ui/../ui-private/x',
-      '/..',
-    ];
-    for (const p of escapes) {
-      const resolved = resolveSafe(root, p);
-      if (resolved !== null) {
-        const rel = relative(normalize(root), resolved);
-        expect(rel === '..' || rel.startsWith('..' + sep)).toBe(false);
-      }
-    }
-  });
-});
-
-describe('serveStatic (via registerStaticMount)', () => {
-  let app: ReturnType<typeof Fastify>;
-  let tmpRoot: string;
-  let rootDir: string;
-
-  beforeEach(() => {
-    tmpRoot = mkdtempSync(join(tmpdir(), 'cadre-host-static-'));
-    rootDir = join(tmpRoot, 'ui');
-    mkdirSync(join(rootDir, 'assets'), { recursive: true });
-    writeFileSync(join(rootDir, 'index.html'), '<!doctype html><title>spa</title>');
-    writeFileSync(join(rootDir, 'assets', 'app.js'), 'console.log("hi");');
-
-    // Sibling directory whose name is a prefix superset of the root basename.
-    const sibling = join(tmpRoot, 'ui-private');
-    mkdirSync(sibling, { recursive: true });
-    writeFileSync(join(sibling, 'secret.txt'), 'top secret');
-
-    app = Fastify();
-    registerStaticMount(app, { rootDir });
-  });
-
-  afterEach(async () => {
-    await app.close();
-    try { rmSync(tmpRoot, { recursive: true, force: true }); } catch { /* ignore */ }
-  });
-
-  it('serves an in-root asset', async () => {
-    const res = await app.inject({ method: 'GET', url: '/assets/app.js' });
-    expect(res.statusCode).toBe(200);
-    expect(res.headers['content-type']).toContain('application/javascript');
-    expect(res.body).toBe('console.log("hi");');
-  });
-
-  it('serves index.html for the bare root', async () => {
-    const res = await app.inject({ method: 'GET', url: '/' });
-    expect(res.statusCode).toBe(200);
-    expect(res.headers['content-type']).toContain('text/html');
-    expect(res.body).toContain('<title>spa</title>');
-  });
-
-  it('serves index.html as SPA fallback for unknown HTML routes', async () => {
-    const res = await app.inject({
-      method: 'GET',
-      url: '/some/client/route',
-      headers: { accept: 'text/html' },
-    });
-    expect(res.statusCode).toBe(200);
-    expect(res.body).toContain('<title>spa</title>');
-  });
-
-  // HTTP-level regression for the sibling-prefix bypass. Two vector classes:
-  //   - literal / `%2e%2e`-with-literal-slash: Fastify's router collapses the
-  //     `../` to a within-root path before the handler, so these never reach
-  //     `resolveSafe` in escaping form — they pass regardless of the fix.
-  //   - encoded-SEPARATOR (`%2f`/`%5c`): Fastify does NOT collapse these; the
-  //     handler sees the still-encoded url, `decodeSafe` then reconstitutes
-  //     `../`, and the escaping path DOES reach `resolveSafe`. Under the old
-  //     `startsWith` guard this served the sibling secret over HTTP — a genuine
-  //     exploit. These cases fail without the `relative`-based guard.
-  // Either way the asserted invariant is the same: sibling content never leaks.
-  it('never serves sibling-prefix directory content over HTTP', async () => {
-    const vectors = [
-      '/../ui-private/secret.txt',
-      '/%2e%2e/ui-private/secret.txt',
-      '/..%2fui-private%2fsecret.txt',
-      '/%2e%2e%2fui-private%2fsecret.txt',
-      '/..%5cui-private%5csecret.txt',
-    ];
-    for (const url of vectors) {
-      const res = await app.inject({ method: 'GET', url });
-      expect(res.body).not.toContain('top secret');
-    }
-  });
-});
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, normalize, relative, sep } from 'node:path';
+
+import Fastify from 'fastify';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+
+import { registerStaticMount, resolveSafe } from '../static.js';
+
+describe('resolveSafe', () => {
+  // POSIX-style fixtures; node:path normalizes separators per-platform, so the
+  // containment logic is exercised identically on Windows and POSIX.
+  const root = '/srv/app/dist/ui';
+
+  it('resolves a normal in-root asset', () => {
+    expect(resolveSafe(root, '/assets/app.js')).toBe(normalize(join(root, 'assets/app.js')));
+  });
+
+  it('resolves a bare / to the root directory itself', () => {
+    expect(resolveSafe(root, '/')).toBe(normalize(root));
+  });
+
+  it('resolves /index.html to the root index', () => {
+    expect(resolveSafe(root, '/index.html')).toBe(normalize(join(root, 'index.html')));
+  });
+
+  it('rejects the sibling-directory prefix bypass', () => {
+    // `ui-private` shares `ui`'s basename as a prefix — the bare startsWith
+    // guard accepted this; the relative-based guard must reject it.
+    expect(resolveSafe(root, '/../ui-private/secret')).toBeNull();
+  });
+
+  it('accepts an in-root asset whose name merely begins with ".."', () => {
+    // `..foo` is a legitimate descendant — the containment guard must not reject
+    // it via a loose '..' prefix match (the precise check keys on '..' + sep).
+    expect(resolveSafe(root, '/..foo.js')).toBe(normalize(join(root, '..foo.js')));
+  });
+
+  it('rejects ordinary out-of-tree traversal', () => {
+    expect(resolveSafe(root, '/../../etc/passwd')).toBeNull();
+  });
+
+  it('rejects an encoded out-of-tree traversal', () => {
+    expect(resolveSafe(root, '/%2e%2e/%2e%2e/etc/passwd')).toBeNull();
+  });
+
+  it('rejects a NUL-byte path', () => {
+    expect(resolveSafe(root, '/app%00.js')).toBeNull();
+  });
+
+  it('rejects malformed percent-encoding', () => {
+    expect(resolveSafe(root, '/%')).toBeNull();
+  });
+
+  it('never returns a path that escapes the root', () => {
+    const escapes = [
+      '/../ui-private/secret',
+      '/../../etc/passwd',
+      '/../ui/../ui-private/x',
+      '/..',
+    ];
+    for (const p of escapes) {
+      const resolved = resolveSafe(root, p);
+      if (resolved !== null) {
+        const rel = relative(normalize(root), resolved);
+        expect(rel === '..' || rel.startsWith('..' + sep)).toBe(false);
+      }
+    }
+  });
+});
+
+describe('serveStatic (via registerStaticMount)', () => {
+  let app: ReturnType<typeof Fastify>;
+  let tmpRoot: string;
+  let rootDir: string;
+
+  beforeEach(() => {
+    tmpRoot = mkdtempSync(join(tmpdir(), 'cadre-host-static-'));
+    rootDir = join(tmpRoot, 'ui');
+    mkdirSync(join(rootDir, 'assets'), { recursive: true });
+    writeFileSync(join(rootDir, 'index.html'), '<!doctype html><title>spa</title>');
+    writeFileSync(join(rootDir, 'assets', 'app.js'), 'console.log("hi");');
+
+    // Sibling directory whose name is a prefix superset of the root basename.
+    const sibling = join(tmpRoot, 'ui-private');
+    mkdirSync(sibling, { recursive: true });
+    writeFileSync(join(sibling, 'secret.txt'), 'top secret');
+
+    app = Fastify();
+    registerStaticMount(app, { rootDir });
+  });
+
+  afterEach(async () => {
+    await app.close();
+    try { rmSync(tmpRoot, { recursive: true, force: true }); } catch { /* ignore */ }
+  });
+
+  it('serves an in-root asset', async () => {
+    const res = await app.inject({ method: 'GET', url: '/assets/app.js' });
+    expect(res.statusCode).toBe(200);
+    expect(res.headers['content-type']).toContain('application/javascript');
+    expect(res.body).toBe('console.log("hi");');
+  });
+
+  it('serves index.html for the bare root', async () => {
+    const res = await app.inject({ method: 'GET', url: '/' });
+    expect(res.statusCode).toBe(200);
+    expect(res.headers['content-type']).toContain('text/html');
+    expect(res.body).toContain('<title>spa</title>');
+  });
+
+  it('serves index.html as SPA fallback for unknown HTML routes', async () => {
+    const res = await app.inject({
+      method: 'GET',
+      url: '/some/client/route',
+      headers: { accept: 'text/html' },
+    });
+    expect(res.statusCode).toBe(200);
+    expect(res.body).toContain('<title>spa</title>');
+  });
+
+  // HTTP-level regression for the sibling-prefix bypass. Two vector classes:
+  //   - literal / `%2e%2e`-with-literal-slash: Fastify's router collapses the
+  //     `../` to a within-root path before the handler, so these never reach
+  //     `resolveSafe` in escaping form — they pass regardless of the fix.
+  //   - encoded-SEPARATOR (`%2f`/`%5c`): Fastify does NOT collapse these; the
+  //     handler sees the still-encoded url, `decodeSafe` then reconstitutes
+  //     `../`, and the escaping path DOES reach `resolveSafe`. Under the old
+  //     `startsWith` guard this served the sibling secret over HTTP — a genuine
+  //     exploit. These cases fail without the `relative`-based guard.
+  // Either way the asserted invariant is the same: sibling content never leaks.
+  it('never serves sibling-prefix directory content over HTTP', async () => {
+    const vectors = [
+      '/../ui-private/secret.txt',
+      '/%2e%2e/ui-private/secret.txt',
+      '/..%2fui-private%2fsecret.txt',
+      '/%2e%2e%2fui-private%2fsecret.txt',
+      '/..%5cui-private%5csecret.txt',
+    ];
+    for (const url of vectors) {
+      const res = await app.inject({ method: 'GET', url });
+      expect(res.body).not.toContain('top secret');
+    }
+  });
+});

package/src/server/__tests__/status-route.test.ts

@@ -1,134 +1,134 @@
-import Fastify from 'fastify';
-import { describe, it, expect, afterEach } from 'vitest';
-
-import { registerErrorHandler } from '../error-handler.js';
-import { registerStatusRoute } from '../routes/status.js';
-import type { HostProcessOrchestrator } from '../../orchestrator/index.js';
-import type { ManagedNodeInfo } from '../../orchestrator/types.js';
-import type { TrustCircleService } from '../../auth/index.js';
-import type { TrustCircleSnapshot } from '../../auth/types.js';
-import type { NatService } from '../../nat/index.js';
-import type { NatStatusSnapshot } from '../../nat/types.js';
-import type { UpdateService } from '../../update/index.js';
-import type { UpdateState } from '../../update/types.js';
-
-function fakeOrchestrator(nodes: ManagedNodeInfo[]): HostProcessOrchestrator {
-  return { listNodes: () => nodes } as unknown as HostProcessOrchestrator;
-}
-function fakeTrustCircle(snap: TrustCircleSnapshot): TrustCircleService {
-  return { list: async () => snap } as unknown as TrustCircleService;
-}
-function fakeNat(snap: NatStatusSnapshot): NatService {
-  return { getStatus: () => snap } as unknown as NatService;
-}
-function fakeUpdate(state: UpdateState): UpdateService {
-  return { getState: async () => state } as unknown as UpdateService;
-}
-
-const SAMPLE_CONNECTIVITY: NatStatusSnapshot = {
-  portMode: 'auto-upnp',
-  externalPort: 4001,
-  internalPort: 4001,
-  routerExternalIp: '203.0.113.5',
-  mappingLeaseExpiresAt: null,
-  externalIp: '203.0.113.5',
-  externalIpDetectedAt: null,
-  cgnatDetected: false,
-  directReachability: 'reachable',
-  lastTestedAt: null,
-  ddns: {
-    providerId: null,
-    hostname: null,
-    externallyManaged: false,
-    lastUpdateAt: null,
-    lastUpdateOk: null,
-    lastError: null,
-  },
-};
-
-describe('GET /api/status', () => {
-  let app: ReturnType<typeof Fastify>;
-
-  afterEach(async () => { await app.close(); });
-
-  it('returns aggregated status without update service', async () => {
-    app = Fastify();
-    registerErrorHandler(app);
-    registerStatusRoute(app, {
-      orchestrator: fakeOrchestrator([
-        {
-          id: 'alice',
-          dockerId: '1234:abc',
-          partyId: 'party-alice',
-          profile: 'storage',
-          status: 'running',
-          spawnedAt: '2025-01-01T00:00:00Z',
-          workdir: '/tmp/alice',
-          ports: { health: 1, metrics: 2, p2p: 3, admin: 4 },
-        },
-      ]),
-      trustCircle: fakeTrustCircle({
-        members: [{ peerId: 'p1', label: 'Self', addedAt: '2025-01-01T00:00:00Z', self: true }],
-        pending: [],
-      }),
-      nat: fakeNat(SAMPLE_CONNECTIVITY),
-    });
-
-    const res = await app.inject({ method: 'GET', url: '/api/status' });
-    expect(res.statusCode).toBe(200);
-    const body = res.json() as {
-      service: { name: string; version: string; uptimeSeconds: number };
-      nodes: Array<{ id: string; status: string }>;
-      trustCircle: { members: number; pending: number };
-      connectivity: { portMode: string };
-      update?: { available?: string };
-    };
-    expect(body.service.name).toBe('cadre-host');
-    expect(body.nodes).toHaveLength(1);
-    expect(body.nodes[0]).toMatchObject({ id: 'alice', status: 'running' });
-    expect(body.trustCircle).toEqual({ members: 1, pending: 0 });
-    expect(body.connectivity.portMode).toBe('auto-upnp');
-    expect(body.update).toBeUndefined();
-  });
-
-  it('omits trustCircle + connectivity in donor-only mode (no trust circle / NAT wired)', async () => {
-    app = Fastify();
-    registerErrorHandler(app);
-    registerStatusRoute(app, {
-      orchestrator: fakeOrchestrator([]),
-    });
-
-    const res = await app.inject({ method: 'GET', url: '/api/status' });
-    expect(res.statusCode).toBe(200);
-    const body = res.json() as {
-      service: { name: string };
-      nodes: unknown[];
-      trustCircle?: unknown;
-      connectivity?: unknown;
-    };
-    expect(body.service.name).toBe('cadre-host');
-    expect(body.nodes).toEqual([]);
-    expect(body.trustCircle).toBeUndefined();
-    expect(body.connectivity).toBeUndefined();
-  });
-
-  it('includes update info when service is present', async () => {
-    app = Fastify();
-    registerErrorHandler(app);
-    registerStatusRoute(app, {
-      orchestrator: fakeOrchestrator([]),
-      trustCircle: fakeTrustCircle({ members: [], pending: [] }),
-      nat: fakeNat(SAMPLE_CONNECTIVITY),
-      update: fakeUpdate({
-        version: 1,
-        lastChecked: '2025-06-01T00:00:00Z',
-        available: { version: '0.7.0', publishedAt: '2025-06-01T00:00:00Z' },
-      }),
-    });
-
-    const res = await app.inject({ method: 'GET', url: '/api/status' });
-    expect(res.statusCode).toBe(200);
-    const body = res.json() as { update?: { available?: string; lastChecked?: string } };
-    expect(body.update).toEqual({ available: '0.7.0', lastChecked: '2025-06-01T00:00:00Z' });
-  });
-});
+import Fastify from 'fastify';
+import { describe, it, expect, afterEach } from 'vitest';
+
+import { registerErrorHandler } from '../error-handler.js';
+import { registerStatusRoute } from '../routes/status.js';
+import type { HostProcessOrchestrator } from '../../orchestrator/index.js';
+import type { ManagedNodeInfo } from '../../orchestrator/types.js';
+import type { TrustCircleService } from '../../auth/index.js';
+import type { TrustCircleSnapshot } from '../../auth/types.js';
+import type { NatService } from '../../nat/index.js';
+import type { NatStatusSnapshot } from '../../nat/types.js';
+import type { UpdateService } from '../../update/index.js';
+import type { UpdateState } from '../../update/types.js';
+
+function fakeOrchestrator(nodes: ManagedNodeInfo[]): HostProcessOrchestrator {
+  return { listNodes: () => nodes } as unknown as HostProcessOrchestrator;
+}
+function fakeTrustCircle(snap: TrustCircleSnapshot): TrustCircleService {
+  return { list: async () => snap } as unknown as TrustCircleService;
+}
+function fakeNat(snap: NatStatusSnapshot): NatService {
+  return { getStatus: () => snap } as unknown as NatService;
+}
+function fakeUpdate(state: UpdateState): UpdateService {
+  return { getState: async () => state } as unknown as UpdateService;
+}
+
+const SAMPLE_CONNECTIVITY: NatStatusSnapshot = {
+  portMode: 'auto-upnp',
+  externalPort: 4001,
+  internalPort: 4001,
+  routerExternalIp: '203.0.113.5',
+  mappingLeaseExpiresAt: null,
+  externalIp: '203.0.113.5',
+  externalIpDetectedAt: null,
+  cgnatDetected: false,
+  directReachability: 'reachable',
+  lastTestedAt: null,
+  ddns: {
+    providerId: null,
+    hostname: null,
+    externallyManaged: false,
+    lastUpdateAt: null,
+    lastUpdateOk: null,
+    lastError: null,
+  },
+};
+
+describe('GET /api/status', () => {
+  let app: ReturnType<typeof Fastify>;
+
+  afterEach(async () => { await app.close(); });
+
+  it('returns aggregated status without update service', async () => {
+    app = Fastify();
+    registerErrorHandler(app);
+    registerStatusRoute(app, {
+      orchestrator: fakeOrchestrator([
+        {
+          id: 'alice',
+          dockerId: '1234:abc',
+          partyId: 'party-alice',
+          profile: 'storage',
+          status: 'running',
+          spawnedAt: '2025-01-01T00:00:00Z',
+          workdir: '/tmp/alice',
+          ports: { health: 1, metrics: 2, p2p: 3, admin: 4 },
+        },
+      ]),
+      trustCircle: fakeTrustCircle({
+        members: [{ peerId: 'p1', label: 'Self', addedAt: '2025-01-01T00:00:00Z', self: true }],
+        pending: [],
+      }),
+      nat: fakeNat(SAMPLE_CONNECTIVITY),
+    });
+
+    const res = await app.inject({ method: 'GET', url: '/api/status' });
+    expect(res.statusCode).toBe(200);
+    const body = res.json() as {
+      service: { name: string; version: string; uptimeSeconds: number };
+      nodes: Array<{ id: string; status: string }>;
+      trustCircle: { members: number; pending: number };
+      connectivity: { portMode: string };
+      update?: { available?: string };
+    };
+    expect(body.service.name).toBe('cadre-host');
+    expect(body.nodes).toHaveLength(1);
+    expect(body.nodes[0]).toMatchObject({ id: 'alice', status: 'running' });
+    expect(body.trustCircle).toEqual({ members: 1, pending: 0 });
+    expect(body.connectivity.portMode).toBe('auto-upnp');
+    expect(body.update).toBeUndefined();
+  });
+
+  it('omits trustCircle + connectivity in donor-only mode (no trust circle / NAT wired)', async () => {
+    app = Fastify();
+    registerErrorHandler(app);
+    registerStatusRoute(app, {
+      orchestrator: fakeOrchestrator([]),
+    });
+
+    const res = await app.inject({ method: 'GET', url: '/api/status' });
+    expect(res.statusCode).toBe(200);
+    const body = res.json() as {
+      service: { name: string };
+      nodes: unknown[];
+      trustCircle?: unknown;
+      connectivity?: unknown;
+    };
+    expect(body.service.name).toBe('cadre-host');
+    expect(body.nodes).toEqual([]);
+    expect(body.trustCircle).toBeUndefined();
+    expect(body.connectivity).toBeUndefined();
+  });
+
+  it('includes update info when service is present', async () => {
+    app = Fastify();
+    registerErrorHandler(app);
+    registerStatusRoute(app, {
+      orchestrator: fakeOrchestrator([]),
+      trustCircle: fakeTrustCircle({ members: [], pending: [] }),
+      nat: fakeNat(SAMPLE_CONNECTIVITY),
+      update: fakeUpdate({
+        version: 1,
+        lastChecked: '2025-06-01T00:00:00Z',
+        available: { version: '0.7.0', publishedAt: '2025-06-01T00:00:00Z' },
+      }),
+    });
+
+    const res = await app.inject({ method: 'GET', url: '/api/status' });
+    expect(res.statusCode).toBe(200);
+    const body = res.json() as { update?: { available?: string; lastChecked?: string } };
+    expect(body.update).toEqual({ available: '0.7.0', lastChecked: '2025-06-01T00:00:00Z' });
+  });
+});