@serfab/cadre-host 0.7.1 → 0.8.1

package/src/push/__tests__/push.test.ts

@@ -0,0 +1,90 @@
+import { describe, it, expect } from 'vitest';
+
+import type { SecretsStore } from '../../nat/secrets/index.js';
+import type { PushSettings } from '../../installer/config.js';
+import {
+  resolvePushCredentials,
+  setFcmSecret,
+  setApnsSecret,
+  clearPushSecret,
+  pushAccount,
+  pushStatus,
+} from '../index.js';
+
+/** In-memory SecretsStore for tests. */
+function fakeStore(): SecretsStore {
+  const map = new Map<string, string>();
+  return {
+    async set(account, value) { map.set(account, value); },
+    async get(account) { return map.get(account) ?? null; },
+    async delete(account) { return map.delete(account); },
+    async list() { return [...map.keys()]; },
+  };
+}
+
+const FCM = { projectId: 'proj', clientEmail: 'svc@proj.iam', privateKey: 'FCM-PEM' };
+const APNS = { keyId: 'KID', teamId: 'TEAM', privateKey: 'P8-PEM' };
+
+describe('resolvePushCredentials', () => {
+  it('returns undefined when no platform is configured (opt-in default)', async () => {
+    const store = fakeStore();
+    expect(await resolvePushCredentials(store, undefined)).toBeUndefined();
+  });
+
+  it('resolves an FCM-only bundle from the secret store', async () => {
+    const store = fakeStore();
+    await setFcmSecret(store, FCM);
+    const push = await resolvePushCredentials(store, undefined);
+    expect(push).toEqual({ fcm: FCM });
+  });
+
+  it('merges the APNs secret with non-secret bundleId/production from settings', async () => {
+    const store = fakeStore();
+    await setApnsSecret(store, APNS);
+    const settings: PushSettings = { apns: { bundleId: 'com.example.app', production: true }, cooldownMs: 1000, debounceMs: 50 };
+    const push = await resolvePushCredentials(store, settings);
+    expect(push).toEqual({
+      apns: { keyId: 'KID', teamId: 'TEAM', bundleId: 'com.example.app', privateKey: 'P8-PEM', production: true },
+      cooldownMs: 1000,
+      debounceMs: 50,
+    });
+  });
+
+  it('combines both platforms when both secrets are present', async () => {
+    const store = fakeStore();
+    await setFcmSecret(store, FCM);
+    await setApnsSecret(store, APNS);
+    const push = await resolvePushCredentials(store, { apns: { bundleId: 'com.example.app' } });
+    expect(push?.fcm).toEqual(FCM);
+    expect(push?.apns?.bundleId).toBe('com.example.app');
+  });
+
+  it('throws on a partial APNs config (secret present but bundleId unset)', async () => {
+    const store = fakeStore();
+    await setApnsSecret(store, APNS);
+    // No settings.apns.bundleId → bundleId resolves to '' → validation rejects.
+    await expect(resolvePushCredentials(store, undefined)).rejects.toThrow(/push\.apns\.bundleId/);
+  });
+
+  it('keeps the FCM private key out of the secret-store account name', async () => {
+    const store = fakeStore();
+    await setFcmSecret(store, FCM);
+    const accounts = await store.list();
+    expect(accounts).toContain(pushAccount('fcm'));
+    expect(accounts.join()).not.toContain('FCM-PEM');
+  });
+});
+
+describe('clearPushSecret / pushStatus', () => {
+  it('reports configured platforms and clears them', async () => {
+    const store = fakeStore();
+    await setFcmSecret(store, FCM);
+    await setApnsSecret(store, APNS);
+    expect(await pushStatus(store)).toEqual({ fcm: true, apns: true });
+
+    expect(await clearPushSecret(store, 'fcm')).toBe(true);
+    expect(await pushStatus(store)).toEqual({ fcm: false, apns: true });
+
+    expect(await clearPushSecret(store, 'fcm')).toBe(false);
+  });
+});

package/src/push/index.ts

@@ -0,0 +1,146 @@
+/**
+ * Push (FCM/APNs) credential storage + resolution for cadre-host.
+ *
+ * The platform-push secrets a self-hosted deployment provisions live in the host
+ * secret store (keytar with file-store fallback — the same store DDNS tokens use);
+ * the non-secret app-config bits (APNs bundle id / sandbox toggle, cooldown /
+ * debounce) live in `host.config.json` (`PushSettings`). At node-spawn time the
+ * orchestrator's `pushResolver` calls {@link resolvePushCredentials}, which reads
+ * BOTH and merges them into the `PushCredentials` block written into the spawned
+ * node's `cadre.json`.
+ *
+ * Secret hygiene: the FCM service-account fields and the APNs `.p8` key are stored
+ * ONLY in the secret store, never in `host.config.json` and never in `state.json`.
+ * They are re-read on every spawn so a restart picks up rotated keys, and the
+ * resolver redacts on any log line. A partial credential set (a present platform
+ * missing required fields) is rejected — fail fast, not at first push.
+ */
+
+import debug from 'debug';
+
+import type { PushCredentials, FcmCredentials, ApnsCredentials } from '@serfab/cadre-core';
+import { validatePushCredentials } from '@serfab/cadre-core';
+
+import type { SecretsStore } from '../nat/secrets/index.js';
+import type { PushSettings } from '../installer/config.js';
+
+const log = debug('cadre:host:push');
+
+/** Push platform whose secret bundle lives in the secret store. */
+export type PushSecretPlatform = 'fcm' | 'apns';
+
+/** Build the secret-store account key for a platform's credential bundle. */
+export function pushAccount(platform: PushSecretPlatform): string {
+  return `push:${platform}`;
+}
+
+/** FCM secret bundle persisted in the secret store (the whole set is sensitive). */
+export interface FcmSecret {
+  projectId: string;
+  clientEmail: string;
+  /** Service-account RSA private key, PEM. */
+  privateKey: string;
+}
+
+/**
+ * APNs secret bundle persisted in the secret store. `bundleId` / `production` are
+ * NOT here — they are non-secret app-config in {@link PushSettings}.
+ */
+export interface ApnsSecret {
+  keyId: string;
+  teamId: string;
+  /** `.p8` ES256 private key, PEM. */
+  privateKey: string;
+}
+
+/** Store (or replace) the FCM service-account secret bundle. */
+export async function setFcmSecret(secrets: SecretsStore, secret: FcmSecret): Promise<void> {
+  await secrets.set(pushAccount('fcm'), JSON.stringify(secret));
+}
+
+/** Store (or replace) the APNs auth-key secret bundle. */
+export async function setApnsSecret(secrets: SecretsStore, secret: ApnsSecret): Promise<void> {
+  await secrets.set(pushAccount('apns'), JSON.stringify(secret));
+}
+
+/** Remove a platform's secret bundle. Returns true if one was present. */
+export async function clearPushSecret(secrets: SecretsStore, platform: PushSecretPlatform): Promise<boolean> {
+  return secrets.delete(pushAccount(platform));
+}
+
+/** Read a platform's stored secret bundle, or null when unset. */
+async function readSecret<T>(secrets: SecretsStore, platform: PushSecretPlatform): Promise<T | null> {
+  const raw = await secrets.get(pushAccount(platform));
+  if (raw === null) return null;
+  try {
+    return JSON.parse(raw) as T;
+  } catch (err) {
+    throw new Error(`Stored ${platform} push secret is not valid JSON: ${(err as Error).message}`, { cause: err });
+  }
+}
+
+/**
+ * Resolve the full {@link PushCredentials} block to inject into a spawned node,
+ * merging the secret-store bundles with the non-secret {@link PushSettings}.
+ *
+ * Returns `undefined` when NO platform is configured (push is opt-in — the node
+ * then constructs no fan-out). Throws when a configured platform is incomplete
+ * (e.g. APNs secret present but `bundleId` unset), so a misconfig surfaces at the
+ * spawn boundary rather than silently at first push.
+ */
+export async function resolvePushCredentials(
+  secrets: SecretsStore,
+  settings: PushSettings | undefined,
+): Promise<PushCredentials | undefined> {
+  const fcmSecret = await readSecret<FcmSecret>(secrets, 'fcm');
+  const apnsSecret = await readSecret<ApnsSecret>(secrets, 'apns');
+
+  if (!fcmSecret && !apnsSecret) return undefined;
+
+  const push: PushCredentials = {};
+  if (fcmSecret) {
+    const fcm: FcmCredentials = {
+      projectId: fcmSecret.projectId,
+      clientEmail: fcmSecret.clientEmail,
+      privateKey: fcmSecret.privateKey,
+    };
+    push.fcm = fcm;
+  }
+  if (apnsSecret) {
+    const apns: ApnsCredentials = {
+      keyId: apnsSecret.keyId,
+      teamId: apnsSecret.teamId,
+      bundleId: settings?.apns?.bundleId ?? '',
+      privateKey: apnsSecret.privateKey,
+      ...(settings?.apns?.production !== undefined ? { production: settings.apns.production } : {}),
+    };
+    push.apns = apns;
+  }
+  if (settings?.cooldownMs !== undefined) push.cooldownMs = settings.cooldownMs;
+  if (settings?.debounceMs !== undefined) push.debounceMs = settings.debounceMs;
+
+  const errors = validatePushCredentials(push);
+  if (errors.length > 0) {
+    throw new Error(`Invalid push credentials: ${errors.join('; ')}`);
+  }
+  log('resolved push credentials (fcm=%s apns=%s)', !!push.fcm, !!push.apns);
+  return push;
+}
+
+/**
+ * A description of which push platforms are configured, for the `push status` CLI
+ * and any UI — derived without exposing any secret material.
+ */
+export interface PushStatus {
+  fcm: boolean;
+  apns: boolean;
+}
+
+/** Report which platforms have a stored secret bundle (no secret material). */
+export async function pushStatus(secrets: SecretsStore): Promise<PushStatus> {
+  const accounts = await secrets.list();
+  return {
+    fcm: accounts.includes(pushAccount('fcm')),
+    apns: accounts.includes(pushAccount('apns')),
+  };
+}

package/src/server/__tests__/error-handler.test.ts

@@ -1,4 +1,4 @@
-import Fastify from 'fastify';
+import Fastify, { type FastifyRequest } from 'fastify';
 import { describe, it, expect, beforeEach, afterEach } from 'vitest';
 
 import { TrustCircleError } from '../../auth/types.js';
@@ -12,15 +12,15 @@ describe('error handler', () => {
   beforeEach(async () => {
     app = Fastify();
     registerErrorHandler(app);
-    app.get('/trust/:code', async (req) => {
+    app.get('/trust/:code', async (req: FastifyRequest) => {
       const { code } = req.params as { code: string };
       throw new TrustCircleError(code as never, `trust err: ${code}`);
     });
-    app.get('/nat/:code', async (req) => {
+    app.get('/nat/:code', async (req: FastifyRequest) => {
       const { code } = req.params as { code: string };
       throw new NatError(code as never, `nat err: ${code}`);
     });
-    app.get('/update/:code', async (req) => {
+    app.get('/update/:code', async (req: FastifyRequest) => {
       const { code } = req.params as { code: string };
       throw new UpdateErrorException(code as never, `update err: ${code}`);
     });

package/src/server/__tests__/nodes-route.test.ts

@@ -15,25 +15,48 @@ interface FakeOrchestrator extends HostProcessOrchestrator {
   __nodes: Map<string, ManagedNodeInfo>;
   __listeners: Set<NodeStateListener>;
   __stoppedDockerIds: string[];
+  __ensured: number;
+  __restarted: number;
 }
 
-function fakeOrchestrator(initial: ManagedNodeInfo[] = []): FakeOrchestrator {
+function fakeOrchestrator(
+  initial: ManagedNodeInfo[] = [],
+  opts: { authorityId?: string; hasAuthorityConfig?: boolean } = {},
+): FakeOrchestrator {
   const nodes = new Map(initial.map((n) => [n.dockerId, n]));
   const listeners = new Set<NodeStateListener>();
   const stopped: string[] = [];
+  const counters = { ensured: 0, restarted: 0 };
+  const findById = (id: string): ManagedNodeInfo | undefined => {
+    const direct = nodes.get(id);
+    if (direct) return direct;
+    for (const n of nodes.values()) if (n.id === id) return n;
+    return undefined;
+  };
   const inst = {
     listNodes: () => [...nodes.values()],
-    getNode: (id: string) => {
-      const direct = nodes.get(id);
-      if (direct) return direct;
-      for (const n of nodes.values()) if (n.id === id) return n;
-      return undefined;
-    },
+    getNode: (id: string) => findById(id),
     resolveDockerId: (id: string) => {
       if (nodes.has(id)) return id;
       for (const n of nodes.values()) if (n.id === id) return n.dockerId;
       return undefined;
     },
+    isAuthorityNode: (id: string) => {
+      if (!opts.authorityId) return false;
+      const node = findById(id);
+      return id === opts.authorityId || node?.id === opts.authorityId;
+    },
+    hasAuthorityConfig: () => opts.hasAuthorityConfig ?? false,
+    ensureAuthorityNode: async () => {
+      counters.ensured++;
+      const node = opts.authorityId ? findById(opts.authorityId) : undefined;
+      return node ?? { id: opts.authorityId, status: 'running' } as unknown as ManagedNodeInfo;
+    },
+    restartAuthorityNode: async () => {
+      counters.restarted++;
+      const node = opts.authorityId ? findById(opts.authorityId) : undefined;
+      return node ?? { id: opts.authorityId, status: 'running' } as unknown as ManagedNodeInfo;
+    },
     onStateChange: (l: NodeStateListener) => { listeners.add(l); return () => { listeners.delete(l); }; },
     stopContainer: async (dockerId: string) => {
       stopped.push(dockerId);
@@ -48,6 +71,8 @@ function fakeOrchestrator(initial: ManagedNodeInfo[] = []): FakeOrchestrator {
     __nodes: nodes,
     __listeners: listeners,
     __stoppedDockerIds: stopped,
+    get __ensured() { return counters.ensured; },
+    get __restarted() { return counters.restarted; },
   } as unknown as FakeOrchestrator;
   return inst;
 }
@@ -60,7 +85,7 @@ const SAMPLE_NODE: ManagedNodeInfo = {
   status: 'running',
   spawnedAt: '2025-01-01T00:00:00Z',
   workdir: '',
-  ports: { health: 11, metrics: 12, p2p: 13 },
+  ports: { health: 11, metrics: 12, p2p: 13, admin: 14 },
 };
 
 describe('/api/nodes routes', () => {
@@ -146,17 +171,72 @@ describe('/api/nodes routes', () => {
     ]);
   });
 
-  it('POST /api/nodes/:id/start returns 501 not_implemented', async () => {
+  it('POST /api/nodes/:id/start on a non-authority node returns 501 not_implemented', async () => {
     const res = await app.inject({ method: 'POST', url: '/api/nodes/alice/start' });
     expect(res.statusCode).toBe(501);
     const body = res.json() as { error: { code: string } };
     expect(body.error.code).toBe('not_implemented');
   });
 
-  it('POST /api/nodes/:id/restart returns 501 not_implemented', async () => {
+  it('POST /api/nodes/:id/restart on a non-authority node returns 501 not_implemented', async () => {
     const res = await app.inject({ method: 'POST', url: '/api/nodes/alice/restart' });
     expect(res.statusCode).toBe(501);
   });
+
+  it('POST /api/nodes/:id/start on an unknown node returns 404', async () => {
+    const res = await app.inject({ method: 'POST', url: '/api/nodes/nobody/start' });
+    expect(res.statusCode).toBe(404);
+    const body = res.json() as { error: { code: string } };
+    expect(body.error.code).toBe('not_found');
+  });
+});
+
+describe('/api/nodes — authority node start/restart', () => {
+  const AUTHORITY_NODE: ManagedNodeInfo = {
+    id: 'authority',
+    dockerId: '999:tok',
+    partyId: 'install-id',
+    profile: 'storage',
+    status: 'running',
+    spawnedAt: '2025-01-01T00:00:00Z',
+    workdir: '',
+    ports: { health: 1, metrics: 2, p2p: 4555, admin: 3 },
+    authority: true,
+  };
+
+  let app: ReturnType<typeof Fastify>;
+  let orchestrator: FakeOrchestrator;
+
+  beforeEach(() => {
+    app = Fastify();
+    registerErrorHandler(app);
+    orchestrator = fakeOrchestrator([AUTHORITY_NODE], { authorityId: 'authority', hasAuthorityConfig: true });
+    registerNodesRoutes(app, { orchestrator });
+  });
+
+  afterEach(async () => { await app.close(); });
+
+  it('start ensures the authority node', async () => {
+    const res = await app.inject({ method: 'POST', url: '/api/nodes/authority/start' });
+    expect(res.statusCode).toBe(200);
+    expect(orchestrator.__ensured).toBe(1);
+  });
+
+  it('restart re-spawns the authority node', async () => {
+    const res = await app.inject({ method: 'POST', url: '/api/nodes/authority/restart' });
+    expect(res.statusCode).toBe(200);
+    expect(orchestrator.__restarted).toBe(1);
+  });
+
+  it('start returns 501 when there is no saved authority config', async () => {
+    const app2 = Fastify();
+    registerErrorHandler(app2);
+    const orch2 = fakeOrchestrator([AUTHORITY_NODE], { authorityId: 'authority', hasAuthorityConfig: false });
+    registerNodesRoutes(app2, { orchestrator: orch2 });
+    const res = await app2.inject({ method: 'POST', url: '/api/nodes/authority/start' });
+    expect(res.statusCode).toBe(501);
+    await app2.close();
+  });
 });
 
 describe('tailLogFile', () => {

package/src/server/__tests__/publishers.test.ts

@@ -131,7 +131,7 @@ describe('publisher wiring', () => {
       status: 'stopped',
       spawnedAt: 'x',
       workdir: '/tmp',
-      ports: { health: 1, metrics: 2, p2p: 3 },
+      ports: { health: 1, metrics: 2, p2p: 3, admin: 4 },
     });
     expect(received).toContainEqual({
       type: 'node-state-changed',

package/src/server/__tests__/static.test.ts

@@ -0,0 +1,145 @@
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, normalize, relative, sep } from 'node:path';
+
+import Fastify from 'fastify';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+
+import { registerStaticMount, resolveSafe } from '../static.js';
+
+describe('resolveSafe', () => {
+  // POSIX-style fixtures; node:path normalizes separators per-platform, so the
+  // containment logic is exercised identically on Windows and POSIX.
+  const root = '/srv/app/dist/ui';
+
+  it('resolves a normal in-root asset', () => {
+    expect(resolveSafe(root, '/assets/app.js')).toBe(normalize(join(root, 'assets/app.js')));
+  });
+
+  it('resolves a bare / to the root directory itself', () => {
+    expect(resolveSafe(root, '/')).toBe(normalize(root));
+  });
+
+  it('resolves /index.html to the root index', () => {
+    expect(resolveSafe(root, '/index.html')).toBe(normalize(join(root, 'index.html')));
+  });
+
+  it('rejects the sibling-directory prefix bypass', () => {
+    // `ui-private` shares `ui`'s basename as a prefix — the bare startsWith
+    // guard accepted this; the relative-based guard must reject it.
+    expect(resolveSafe(root, '/../ui-private/secret')).toBeNull();
+  });
+
+  it('accepts an in-root asset whose name merely begins with ".."', () => {
+    // `..foo` is a legitimate descendant — the containment guard must not reject
+    // it via a loose '..' prefix match (the precise check keys on '..' + sep).
+    expect(resolveSafe(root, '/..foo.js')).toBe(normalize(join(root, '..foo.js')));
+  });
+
+  it('rejects ordinary out-of-tree traversal', () => {
+    expect(resolveSafe(root, '/../../etc/passwd')).toBeNull();
+  });
+
+  it('rejects an encoded out-of-tree traversal', () => {
+    expect(resolveSafe(root, '/%2e%2e/%2e%2e/etc/passwd')).toBeNull();
+  });
+
+  it('rejects a NUL-byte path', () => {
+    expect(resolveSafe(root, '/app%00.js')).toBeNull();
+  });
+
+  it('rejects malformed percent-encoding', () => {
+    expect(resolveSafe(root, '/%')).toBeNull();
+  });
+
+  it('never returns a path that escapes the root', () => {
+    const escapes = [
+      '/../ui-private/secret',
+      '/../../etc/passwd',
+      '/../ui/../ui-private/x',
+      '/..',
+    ];
+    for (const p of escapes) {
+      const resolved = resolveSafe(root, p);
+      if (resolved !== null) {
+        const rel = relative(normalize(root), resolved);
+        expect(rel === '..' || rel.startsWith('..' + sep)).toBe(false);
+      }
+    }
+  });
+});
+
+describe('serveStatic (via registerStaticMount)', () => {
+  let app: ReturnType<typeof Fastify>;
+  let tmpRoot: string;
+  let rootDir: string;
+
+  beforeEach(() => {
+    tmpRoot = mkdtempSync(join(tmpdir(), 'cadre-host-static-'));
+    rootDir = join(tmpRoot, 'ui');
+    mkdirSync(join(rootDir, 'assets'), { recursive: true });
+    writeFileSync(join(rootDir, 'index.html'), '<!doctype html><title>spa</title>');
+    writeFileSync(join(rootDir, 'assets', 'app.js'), 'console.log("hi");');
+
+    // Sibling directory whose name is a prefix superset of the root basename.
+    const sibling = join(tmpRoot, 'ui-private');
+    mkdirSync(sibling, { recursive: true });
+    writeFileSync(join(sibling, 'secret.txt'), 'top secret');
+
+    app = Fastify();
+    registerStaticMount(app, { rootDir });
+  });
+
+  afterEach(async () => {
+    await app.close();
+    try { rmSync(tmpRoot, { recursive: true, force: true }); } catch { /* ignore */ }
+  });
+
+  it('serves an in-root asset', async () => {
+    const res = await app.inject({ method: 'GET', url: '/assets/app.js' });
+    expect(res.statusCode).toBe(200);
+    expect(res.headers['content-type']).toContain('application/javascript');
+    expect(res.body).toBe('console.log("hi");');
+  });
+
+  it('serves index.html for the bare root', async () => {
+    const res = await app.inject({ method: 'GET', url: '/' });
+    expect(res.statusCode).toBe(200);
+    expect(res.headers['content-type']).toContain('text/html');
+    expect(res.body).toContain('<title>spa</title>');
+  });
+
+  it('serves index.html as SPA fallback for unknown HTML routes', async () => {
+    const res = await app.inject({
+      method: 'GET',
+      url: '/some/client/route',
+      headers: { accept: 'text/html' },
+    });
+    expect(res.statusCode).toBe(200);
+    expect(res.body).toContain('<title>spa</title>');
+  });
+
+  // HTTP-level regression for the sibling-prefix bypass. Two vector classes:
+  //   - literal / `%2e%2e`-with-literal-slash: Fastify's router collapses the
+  //     `../` to a within-root path before the handler, so these never reach
+  //     `resolveSafe` in escaping form — they pass regardless of the fix.
+  //   - encoded-SEPARATOR (`%2f`/`%5c`): Fastify does NOT collapse these; the
+  //     handler sees the still-encoded url, `decodeSafe` then reconstitutes
+  //     `../`, and the escaping path DOES reach `resolveSafe`. Under the old
+  //     `startsWith` guard this served the sibling secret over HTTP — a genuine
+  //     exploit. These cases fail without the `relative`-based guard.
+  // Either way the asserted invariant is the same: sibling content never leaks.
+  it('never serves sibling-prefix directory content over HTTP', async () => {
+    const vectors = [
+      '/../ui-private/secret.txt',
+      '/%2e%2e/ui-private/secret.txt',
+      '/..%2fui-private%2fsecret.txt',
+      '/%2e%2e%2fui-private%2fsecret.txt',
+      '/..%5cui-private%5csecret.txt',
+    ];
+    for (const url of vectors) {
+      const res = await app.inject({ method: 'GET', url });
+      expect(res.body).not.toContain('top secret');
+    }
+  });
+});

package/src/server/__tests__/status-route.test.ts

@@ -1,5 +1,5 @@
 import Fastify from 'fastify';
-import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { describe, it, expect, afterEach } from 'vitest';
 
 import { registerErrorHandler } from '../error-handler.js';
 import { registerStatusRoute } from '../routes/status.js';
@@ -64,7 +64,7 @@ describe('GET /api/status', () => {
           status: 'running',
           spawnedAt: '2025-01-01T00:00:00Z',
           workdir: '/tmp/alice',
-          ports: { health: 1, metrics: 2, p2p: 3 },
+          ports: { health: 1, metrics: 2, p2p: 3, admin: 4 },
         },
       ]),
       trustCircle: fakeTrustCircle({

package/src/server/error-handler.ts

@@ -7,6 +7,7 @@
  *       invalid_label, invalid_token             → 400
  *       not_found, already_redeemed              → 404
  *       expired                                  → 410
+ *       node_unavailable                         → 503
  *       storage_error                            → 500
  *   - NatError
  *       invalid_config, ddns_provider_unknown,
@@ -14,6 +15,7 @@
  *       secrets_unavailable, storage_error,
  *       mapping_failed, router_unreachable,
  *       ip_detection_failed, ddns_update_failed  → 500
+ *       node_unavailable                         → 503
  *   - UpdateErrorException
  *       manifest_invalid, no_update_available,
  *       min_previous_version                     → 400
@@ -39,6 +41,7 @@ const TRUST_STATUS: Record<TrustCircleErrorCode, number> = {
   already_redeemed: 404,
   expired: 410,
   storage_error: 500,
+  node_unavailable: 503,
 };
 
 const NAT_STATUS: Record<NatErrorCode, number> = {
@@ -51,6 +54,7 @@ const NAT_STATUS: Record<NatErrorCode, number> = {
   router_unreachable: 500,
   ip_detection_failed: 500,
   ddns_update_failed: 500,
+  node_unavailable: 503,
 };
 
 const UPDATE_STATUS: Record<UpdateErrorCode, number> = {