@wingman-ai/gateway 0.3.2 → 0.4.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +29 -111
- package/dist/agent/config/agentConfig.cjs +2 -0
- package/dist/agent/config/agentConfig.d.ts +6 -0
- package/dist/agent/config/agentConfig.js +2 -0
- package/dist/agent/config/agentLoader.cjs +21 -18
- package/dist/agent/config/agentLoader.js +22 -19
- package/dist/agent/config/mcpClientManager.cjs +48 -9
- package/dist/agent/config/mcpClientManager.d.ts +12 -0
- package/dist/agent/config/mcpClientManager.js +48 -9
- package/dist/agent/config/toolRegistry.cjs +19 -0
- package/dist/agent/config/toolRegistry.d.ts +4 -0
- package/dist/agent/config/toolRegistry.js +17 -1
- package/dist/agent/middleware/additional-messages.cjs +115 -11
- package/dist/agent/middleware/additional-messages.d.ts +9 -0
- package/dist/agent/middleware/additional-messages.js +115 -11
- package/dist/agent/tests/agentLoader.test.cjs +45 -0
- package/dist/agent/tests/agentLoader.test.js +45 -0
- package/dist/agent/tests/mcpClientManager.test.cjs +50 -0
- package/dist/agent/tests/mcpClientManager.test.js +50 -0
- package/dist/agent/tests/toolRegistry.test.cjs +2 -0
- package/dist/agent/tests/toolRegistry.test.js +2 -0
- package/dist/agent/tools/node_invoke.cjs +146 -0
- package/dist/agent/tools/node_invoke.d.ts +86 -0
- package/dist/agent/tools/node_invoke.js +109 -0
- package/dist/cli/commands/gateway.cjs +1 -1
- package/dist/cli/commands/gateway.js +1 -1
- package/dist/cli/commands/skill.cjs +12 -4
- package/dist/cli/commands/skill.js +12 -4
- package/dist/cli/config/jsonSchema.cjs +55 -0
- package/dist/cli/config/jsonSchema.d.ts +2 -0
- package/dist/cli/config/jsonSchema.js +18 -0
- package/dist/cli/config/loader.cjs +33 -1
- package/dist/cli/config/loader.js +33 -1
- package/dist/cli/config/schema.cjs +119 -2
- package/dist/cli/config/schema.d.ts +40 -0
- package/dist/cli/config/schema.js +119 -2
- package/dist/cli/core/agentInvoker.cjs +25 -4
- package/dist/cli/core/agentInvoker.d.ts +13 -0
- package/dist/cli/core/agentInvoker.js +25 -4
- package/dist/cli/services/skillRepository.cjs +138 -20
- package/dist/cli/services/skillRepository.d.ts +10 -2
- package/dist/cli/services/skillRepository.js +138 -20
- package/dist/cli/services/skillSecurityScanner.cjs +158 -0
- package/dist/cli/services/skillSecurityScanner.d.ts +28 -0
- package/dist/cli/services/skillSecurityScanner.js +121 -0
- package/dist/cli/services/skillService.cjs +44 -12
- package/dist/cli/services/skillService.d.ts +2 -0
- package/dist/cli/services/skillService.js +46 -14
- package/dist/cli/types/skill.d.ts +9 -0
- package/dist/gateway/http/nodes.cjs +247 -0
- package/dist/gateway/http/nodes.d.ts +20 -0
- package/dist/gateway/http/nodes.js +210 -0
- package/dist/gateway/node.cjs +10 -1
- package/dist/gateway/node.d.ts +10 -1
- package/dist/gateway/node.js +10 -1
- package/dist/gateway/server.cjs +418 -27
- package/dist/gateway/server.d.ts +34 -0
- package/dist/gateway/server.js +412 -27
- package/dist/gateway/types.d.ts +15 -1
- package/dist/gateway/validation.cjs +2 -0
- package/dist/gateway/validation.d.ts +4 -0
- package/dist/gateway/validation.js +2 -0
- package/dist/tests/additionalMessageMiddleware.test.cjs +92 -0
- package/dist/tests/additionalMessageMiddleware.test.js +92 -0
- package/dist/tests/cli-config-loader.test.cjs +33 -1
- package/dist/tests/cli-config-loader.test.js +33 -1
- package/dist/tests/config-json-schema.test.cjs +25 -0
- package/dist/tests/config-json-schema.test.d.ts +1 -0
- package/dist/tests/config-json-schema.test.js +19 -0
- package/dist/tests/gateway-http-security.test.cjs +277 -0
- package/dist/tests/gateway-http-security.test.d.ts +1 -0
- package/dist/tests/gateway-http-security.test.js +271 -0
- package/dist/tests/gateway-node-mode.test.cjs +174 -0
- package/dist/tests/gateway-node-mode.test.d.ts +1 -0
- package/dist/tests/gateway-node-mode.test.js +168 -0
- package/dist/tests/gateway-origin-policy.test.cjs +60 -0
- package/dist/tests/gateway-origin-policy.test.d.ts +1 -0
- package/dist/tests/gateway-origin-policy.test.js +54 -0
- package/dist/tests/gateway.test.cjs +1 -0
- package/dist/tests/gateway.test.js +1 -0
- package/dist/tests/node-tools.test.cjs +77 -0
- package/dist/tests/node-tools.test.d.ts +1 -0
- package/dist/tests/node-tools.test.js +71 -0
- package/dist/tests/nodes-api.test.cjs +86 -0
- package/dist/tests/nodes-api.test.d.ts +1 -0
- package/dist/tests/nodes-api.test.js +80 -0
- package/dist/tests/skill-repository.test.cjs +106 -0
- package/dist/tests/skill-repository.test.d.ts +1 -0
- package/dist/tests/skill-repository.test.js +100 -0
- package/dist/tests/skill-security-scanner.test.cjs +126 -0
- package/dist/tests/skill-security-scanner.test.d.ts +1 -0
- package/dist/tests/skill-security-scanner.test.js +120 -0
- package/dist/tests/uv.test.cjs +47 -0
- package/dist/tests/uv.test.d.ts +1 -0
- package/dist/tests/uv.test.js +41 -0
- package/dist/utils/uv.cjs +64 -0
- package/dist/utils/uv.d.ts +3 -0
- package/dist/utils/uv.js +24 -0
- package/dist/webui/assets/{index-DHbfLOUR.js → index-BMekSELC.js} +106 -106
- package/dist/webui/index.html +1 -1
- package/package.json +2 -1
- package/skills/gog/SKILL.md +36 -0
- package/skills/weather/SKILL.md +49 -0
|
@@ -0,0 +1,271 @@
|
|
|
1
|
+
import { mkdtempSync, rmSync } from "node:fs";
|
|
2
|
+
import { tmpdir } from "node:os";
|
|
3
|
+
import { join } from "node:path";
|
|
4
|
+
import { afterAll, describe, expect, it } from "vitest";
|
|
5
|
+
import { GatewayServer } from "../gateway/server.js";
|
|
6
|
+
const tempWorkspaces = [];
|
|
7
|
+
function createGateway(config) {
|
|
8
|
+
const workspace = mkdtempSync(join(tmpdir(), "wingman-gateway-http-security-"));
|
|
9
|
+
tempWorkspaces.push(workspace);
|
|
10
|
+
return new GatewayServer({
|
|
11
|
+
logLevel: "silent",
|
|
12
|
+
workspace,
|
|
13
|
+
configDir: ".wingman-http-security-config",
|
|
14
|
+
stateDir: ".wingman-http-security-state",
|
|
15
|
+
...config
|
|
16
|
+
});
|
|
17
|
+
}
|
|
18
|
+
function getGatewayInternals(server) {
|
|
19
|
+
return server;
|
|
20
|
+
}
|
|
21
|
+
function createTestSocket(initialData) {
|
|
22
|
+
const messages = [];
|
|
23
|
+
const ws = {
|
|
24
|
+
data: {
|
|
25
|
+
...initialData || {}
|
|
26
|
+
},
|
|
27
|
+
send: (serialized)=>{
|
|
28
|
+
messages.push(JSON.parse(serialized));
|
|
29
|
+
return 1;
|
|
30
|
+
},
|
|
31
|
+
close: ()=>{}
|
|
32
|
+
};
|
|
33
|
+
return {
|
|
34
|
+
ws,
|
|
35
|
+
messages
|
|
36
|
+
};
|
|
37
|
+
}
|
|
38
|
+
afterAll(()=>{
|
|
39
|
+
for (const workspace of tempWorkspaces)rmSync(workspace, {
|
|
40
|
+
recursive: true,
|
|
41
|
+
force: true
|
|
42
|
+
});
|
|
43
|
+
});
|
|
44
|
+
describe("gateway HTTP security", ()=>{
|
|
45
|
+
it("requires auth for /api routes when token auth is enabled", async ()=>{
|
|
46
|
+
const server = createGateway({
|
|
47
|
+
host: "127.0.0.1",
|
|
48
|
+
port: 18789,
|
|
49
|
+
auth: {
|
|
50
|
+
mode: "token",
|
|
51
|
+
token: "test-token"
|
|
52
|
+
},
|
|
53
|
+
requireAuth: true
|
|
54
|
+
});
|
|
55
|
+
const internals = getGatewayInternals(server);
|
|
56
|
+
const unauthenticated = await internals.handleUiRequest(new Request("http://127.0.0.1:18789/api/providers"));
|
|
57
|
+
expect(unauthenticated.status).toBe(401);
|
|
58
|
+
const authenticated = await internals.handleUiRequest(new Request("http://127.0.0.1:18789/api/providers", {
|
|
59
|
+
headers: {
|
|
60
|
+
Authorization: "Bearer test-token"
|
|
61
|
+
}
|
|
62
|
+
}));
|
|
63
|
+
expect(authenticated.status).toBe(200);
|
|
64
|
+
});
|
|
65
|
+
it("rejects disallowed origins and allows loopback development preflight", async ()=>{
|
|
66
|
+
const server = createGateway({
|
|
67
|
+
host: "127.0.0.1",
|
|
68
|
+
port: 18789,
|
|
69
|
+
auth: {
|
|
70
|
+
mode: "token",
|
|
71
|
+
token: "test-token"
|
|
72
|
+
},
|
|
73
|
+
requireAuth: true
|
|
74
|
+
});
|
|
75
|
+
const internals = getGatewayInternals(server);
|
|
76
|
+
const denied = await internals.handleUiRequest(new Request("http://127.0.0.1:18789/api/providers", {
|
|
77
|
+
method: "OPTIONS",
|
|
78
|
+
headers: {
|
|
79
|
+
Origin: "https://evil.example",
|
|
80
|
+
"Access-Control-Request-Method": "GET"
|
|
81
|
+
}
|
|
82
|
+
}));
|
|
83
|
+
expect(denied.status).toBe(403);
|
|
84
|
+
const allowed = await internals.handleUiRequest(new Request("http://127.0.0.1:18789/api/providers", {
|
|
85
|
+
method: "OPTIONS",
|
|
86
|
+
headers: {
|
|
87
|
+
Origin: "http://localhost:5173",
|
|
88
|
+
"Access-Control-Request-Method": "GET"
|
|
89
|
+
}
|
|
90
|
+
}));
|
|
91
|
+
expect(allowed.status).toBe(204);
|
|
92
|
+
expect(allowed.headers.get("access-control-allow-origin")).toBe("http://localhost:5173");
|
|
93
|
+
});
|
|
94
|
+
it("does not trust tailscale identity headers on non-loopback hosts", ()=>{
|
|
95
|
+
const server = createGateway({
|
|
96
|
+
host: "0.0.0.0",
|
|
97
|
+
port: 18789,
|
|
98
|
+
auth: {
|
|
99
|
+
mode: "token",
|
|
100
|
+
token: "tailscale-token",
|
|
101
|
+
allowTailscale: true
|
|
102
|
+
},
|
|
103
|
+
requireAuth: true
|
|
104
|
+
});
|
|
105
|
+
const internals = getGatewayInternals(server);
|
|
106
|
+
const bypassAttempt = internals.requireHttpAuth(new Request("http://127.0.0.1:18789/api/providers", {
|
|
107
|
+
headers: {
|
|
108
|
+
"tailscale-user-login": "attacker@example.com"
|
|
109
|
+
}
|
|
110
|
+
}));
|
|
111
|
+
expect(bypassAttempt?.status).toBe(401);
|
|
112
|
+
const authenticated = internals.requireHttpAuth(new Request("http://127.0.0.1:18789/api/providers", {
|
|
113
|
+
headers: {
|
|
114
|
+
Authorization: "Bearer tailscale-token",
|
|
115
|
+
"tailscale-user-login": "attacker@example.com"
|
|
116
|
+
}
|
|
117
|
+
}));
|
|
118
|
+
expect(authenticated).toBeNull();
|
|
119
|
+
});
|
|
120
|
+
it("enforces bridge node capacity limits", async ()=>{
|
|
121
|
+
const server = createGateway({
|
|
122
|
+
host: "127.0.0.1",
|
|
123
|
+
port: 18789,
|
|
124
|
+
auth: {
|
|
125
|
+
mode: "none"
|
|
126
|
+
},
|
|
127
|
+
requireAuth: false,
|
|
128
|
+
maxNodes: 1
|
|
129
|
+
});
|
|
130
|
+
const internals = getGatewayInternals(server);
|
|
131
|
+
const registerBody = JSON.stringify({
|
|
132
|
+
type: "register",
|
|
133
|
+
payload: {
|
|
134
|
+
name: "bridge-node"
|
|
135
|
+
},
|
|
136
|
+
timestamp: Date.now()
|
|
137
|
+
});
|
|
138
|
+
const first = await internals.handleBridgeSend(new Request("http://127.0.0.1:18789/bridge/send", {
|
|
139
|
+
method: "POST",
|
|
140
|
+
headers: {
|
|
141
|
+
"Content-Type": "application/json"
|
|
142
|
+
},
|
|
143
|
+
body: registerBody
|
|
144
|
+
}));
|
|
145
|
+
expect(first.status).toBe(200);
|
|
146
|
+
const second = await internals.handleBridgeSend(new Request("http://127.0.0.1:18789/bridge/send", {
|
|
147
|
+
method: "POST",
|
|
148
|
+
headers: {
|
|
149
|
+
"Content-Type": "application/json"
|
|
150
|
+
},
|
|
151
|
+
body: registerBody
|
|
152
|
+
}));
|
|
153
|
+
expect(second.status).toBe(429);
|
|
154
|
+
});
|
|
155
|
+
it("rejects malformed /api/nodes client IDs with 400", async ()=>{
|
|
156
|
+
const server = createGateway({
|
|
157
|
+
host: "127.0.0.1",
|
|
158
|
+
port: 18789,
|
|
159
|
+
auth: {
|
|
160
|
+
mode: "none"
|
|
161
|
+
},
|
|
162
|
+
requireAuth: false
|
|
163
|
+
});
|
|
164
|
+
const internals = getGatewayInternals(server);
|
|
165
|
+
const res = await internals.handleUiRequest(new Request("http://127.0.0.1:18789/api/nodes/%E0%A4%A", {
|
|
166
|
+
method: "PUT",
|
|
167
|
+
headers: {
|
|
168
|
+
"Content-Type": "application/json"
|
|
169
|
+
},
|
|
170
|
+
body: JSON.stringify({
|
|
171
|
+
enabled: true
|
|
172
|
+
})
|
|
173
|
+
}));
|
|
174
|
+
expect(res.status).toBe(400);
|
|
175
|
+
});
|
|
176
|
+
it("requires approved client identity for node execution capabilities", ()=>{
|
|
177
|
+
const server = createGateway({
|
|
178
|
+
host: "127.0.0.1",
|
|
179
|
+
port: 18789,
|
|
180
|
+
auth: {
|
|
181
|
+
mode: "none"
|
|
182
|
+
},
|
|
183
|
+
requireAuth: false
|
|
184
|
+
});
|
|
185
|
+
const internals = getGatewayInternals(server);
|
|
186
|
+
const blocked = createTestSocket({
|
|
187
|
+
authenticated: true
|
|
188
|
+
});
|
|
189
|
+
internals.handleRegister(blocked.ws, {
|
|
190
|
+
type: "register",
|
|
191
|
+
payload: {
|
|
192
|
+
name: "unpaired-node",
|
|
193
|
+
capabilities: [
|
|
194
|
+
"system.run"
|
|
195
|
+
]
|
|
196
|
+
},
|
|
197
|
+
timestamp: Date.now()
|
|
198
|
+
});
|
|
199
|
+
expect(blocked.messages.some((message)=>"error" === message.type && message.payload?.code === "NODE_NOT_ENABLED")).toBe(true);
|
|
200
|
+
});
|
|
201
|
+
it("rejects duplicate pending node request IDs", async ()=>{
|
|
202
|
+
const server = createGateway({
|
|
203
|
+
host: "127.0.0.1",
|
|
204
|
+
port: 18789,
|
|
205
|
+
auth: {
|
|
206
|
+
mode: "none"
|
|
207
|
+
},
|
|
208
|
+
requireAuth: false
|
|
209
|
+
});
|
|
210
|
+
const internals = getGatewayInternals(server);
|
|
211
|
+
const enableTarget = await internals.handleUiRequest(new Request("http://127.0.0.1:18789/api/nodes/desktop-target", {
|
|
212
|
+
method: "PUT",
|
|
213
|
+
headers: {
|
|
214
|
+
"Content-Type": "application/json"
|
|
215
|
+
},
|
|
216
|
+
body: JSON.stringify({
|
|
217
|
+
enabled: true,
|
|
218
|
+
name: "Desktop Target"
|
|
219
|
+
})
|
|
220
|
+
}));
|
|
221
|
+
expect(enableTarget.status).toBe(200);
|
|
222
|
+
const target = createTestSocket({
|
|
223
|
+
authenticated: true,
|
|
224
|
+
clientId: "desktop-target",
|
|
225
|
+
clientType: "desktop"
|
|
226
|
+
});
|
|
227
|
+
internals.handleRegister(target.ws, {
|
|
228
|
+
type: "register",
|
|
229
|
+
payload: {
|
|
230
|
+
name: "target-node",
|
|
231
|
+
capabilities: [
|
|
232
|
+
"system.notify"
|
|
233
|
+
]
|
|
234
|
+
},
|
|
235
|
+
timestamp: Date.now()
|
|
236
|
+
});
|
|
237
|
+
const nodeId = target.messages.find((message)=>"ack" === message.type && "string" == typeof message.payload?.nodeId)?.payload?.nodeId;
|
|
238
|
+
expect(nodeId).toBeTruthy();
|
|
239
|
+
const requester = createTestSocket({
|
|
240
|
+
authenticated: true,
|
|
241
|
+
clientId: "desktop-requester",
|
|
242
|
+
clientType: "desktop"
|
|
243
|
+
});
|
|
244
|
+
const duplicateRequestId = "dup-node-request-id";
|
|
245
|
+
internals.handleNodeRequest(requester.ws, {
|
|
246
|
+
type: "req:node",
|
|
247
|
+
id: duplicateRequestId,
|
|
248
|
+
targetNodeId: nodeId,
|
|
249
|
+
payload: {
|
|
250
|
+
tool: "system.notify",
|
|
251
|
+
args: {
|
|
252
|
+
title: "test"
|
|
253
|
+
}
|
|
254
|
+
},
|
|
255
|
+
timestamp: Date.now()
|
|
256
|
+
});
|
|
257
|
+
internals.handleNodeRequest(requester.ws, {
|
|
258
|
+
type: "req:node",
|
|
259
|
+
id: duplicateRequestId,
|
|
260
|
+
targetNodeId: nodeId,
|
|
261
|
+
payload: {
|
|
262
|
+
tool: "system.notify",
|
|
263
|
+
args: {
|
|
264
|
+
title: "test"
|
|
265
|
+
}
|
|
266
|
+
},
|
|
267
|
+
timestamp: Date.now()
|
|
268
|
+
});
|
|
269
|
+
expect(requester.messages.some((message)=>"error" === message.type && message.payload?.code === "DUPLICATE_REQUEST_ID")).toBe(true);
|
|
270
|
+
});
|
|
271
|
+
});
|
|
@@ -0,0 +1,174 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
var __webpack_exports__ = {};
|
|
3
|
+
const external_node_fs_namespaceObject = require("node:fs");
|
|
4
|
+
const external_node_os_namespaceObject = require("node:os");
|
|
5
|
+
const external_node_path_namespaceObject = require("node:path");
|
|
6
|
+
const external_vitest_namespaceObject = require("vitest");
|
|
7
|
+
const server_cjs_namespaceObject = require("../gateway/server.cjs");
|
|
8
|
+
const isBun = void 0 !== globalThis.Bun;
|
|
9
|
+
const describeIfBun = isBun ? external_vitest_namespaceObject.describe : external_vitest_namespaceObject.describe.skip;
|
|
10
|
+
describeIfBun("Gateway node enablement", ()=>{
|
|
11
|
+
let server;
|
|
12
|
+
let port = 0;
|
|
13
|
+
let workspace;
|
|
14
|
+
(0, external_vitest_namespaceObject.beforeAll)(async ()=>{
|
|
15
|
+
workspace = (0, external_node_fs_namespaceObject.mkdtempSync)((0, external_node_path_namespaceObject.join)((0, external_node_os_namespaceObject.tmpdir)(), "wingman-gateway-node-mode-"));
|
|
16
|
+
server = new server_cjs_namespaceObject.GatewayServer({
|
|
17
|
+
port: 0,
|
|
18
|
+
host: "localhost",
|
|
19
|
+
requireAuth: false,
|
|
20
|
+
auth: {
|
|
21
|
+
mode: "none"
|
|
22
|
+
},
|
|
23
|
+
logLevel: "silent",
|
|
24
|
+
workspace,
|
|
25
|
+
configDir: ".wingman-node-test-config",
|
|
26
|
+
stateDir: ".wingman-node-test-state"
|
|
27
|
+
});
|
|
28
|
+
await server.start();
|
|
29
|
+
port = server.getPort();
|
|
30
|
+
if (!port) throw new Error("Unable to determine gateway port");
|
|
31
|
+
});
|
|
32
|
+
(0, external_vitest_namespaceObject.afterAll)(async ()=>{
|
|
33
|
+
await server.stop();
|
|
34
|
+
(0, external_node_fs_namespaceObject.rmSync)(workspace, {
|
|
35
|
+
recursive: true,
|
|
36
|
+
force: true
|
|
37
|
+
});
|
|
38
|
+
});
|
|
39
|
+
const connectClient = (instanceId, clientType = "desktop")=>new Promise((resolve, reject)=>{
|
|
40
|
+
const ws = new WebSocket(`ws://localhost:${port}/ws`);
|
|
41
|
+
const connectId = `connect-${instanceId}-${Date.now()}`;
|
|
42
|
+
const timeout = setTimeout(()=>reject(new Error("Connect timeout")), 5000);
|
|
43
|
+
ws.addEventListener("open", ()=>{
|
|
44
|
+
ws.send(JSON.stringify({
|
|
45
|
+
type: "connect",
|
|
46
|
+
id: connectId,
|
|
47
|
+
client: {
|
|
48
|
+
instanceId,
|
|
49
|
+
clientType,
|
|
50
|
+
version: "test"
|
|
51
|
+
},
|
|
52
|
+
timestamp: Date.now()
|
|
53
|
+
}));
|
|
54
|
+
});
|
|
55
|
+
ws.addEventListener("message", (event)=>{
|
|
56
|
+
const msg = JSON.parse(event.data);
|
|
57
|
+
if ("res" === msg.type && msg.id === connectId && msg.ok) {
|
|
58
|
+
clearTimeout(timeout);
|
|
59
|
+
resolve(ws);
|
|
60
|
+
}
|
|
61
|
+
});
|
|
62
|
+
ws.addEventListener("error", ()=>{
|
|
63
|
+
clearTimeout(timeout);
|
|
64
|
+
reject(new Error("WebSocket error"));
|
|
65
|
+
});
|
|
66
|
+
});
|
|
67
|
+
const waitForMessage = (ws, predicate, timeoutMs = 5000)=>new Promise((resolve, reject)=>{
|
|
68
|
+
const timeout = setTimeout(()=>reject(new Error("Message timeout")), timeoutMs);
|
|
69
|
+
const handler = (event)=>{
|
|
70
|
+
const data = event.data;
|
|
71
|
+
if ("string" != typeof data) return;
|
|
72
|
+
let msg;
|
|
73
|
+
try {
|
|
74
|
+
msg = JSON.parse(data);
|
|
75
|
+
} catch {
|
|
76
|
+
return;
|
|
77
|
+
}
|
|
78
|
+
if (!predicate(msg)) return;
|
|
79
|
+
clearTimeout(timeout);
|
|
80
|
+
ws.removeEventListener("message", handler);
|
|
81
|
+
resolve(msg);
|
|
82
|
+
};
|
|
83
|
+
ws.addEventListener("message", handler);
|
|
84
|
+
});
|
|
85
|
+
(0, external_vitest_namespaceObject.it)("blocks node registration before device enablement", async ()=>{
|
|
86
|
+
const ws = await connectClient("desktop-node-blocked");
|
|
87
|
+
ws.send(JSON.stringify({
|
|
88
|
+
type: "register",
|
|
89
|
+
payload: {
|
|
90
|
+
name: "Blocked Node",
|
|
91
|
+
capabilities: [
|
|
92
|
+
"system.notify"
|
|
93
|
+
]
|
|
94
|
+
},
|
|
95
|
+
timestamp: Date.now()
|
|
96
|
+
}));
|
|
97
|
+
const errorMessage = await waitForMessage(ws, (msg)=>"error" === msg.type && msg.payload?.code === "NODE_NOT_ENABLED");
|
|
98
|
+
(0, external_vitest_namespaceObject.expect)(errorMessage.payload?.message).toContain("not approved");
|
|
99
|
+
ws.close();
|
|
100
|
+
});
|
|
101
|
+
(0, external_vitest_namespaceObject.it)("allows enabled devices to register, execute, and revoke", async ()=>{
|
|
102
|
+
const enableResponse = await fetch(`http://localhost:${port}/api/nodes/${encodeURIComponent("desktop-node-enabled")}`, {
|
|
103
|
+
method: "PUT",
|
|
104
|
+
headers: {
|
|
105
|
+
"Content-Type": "application/json"
|
|
106
|
+
},
|
|
107
|
+
body: JSON.stringify({
|
|
108
|
+
enabled: true,
|
|
109
|
+
name: "Enabled Desktop"
|
|
110
|
+
})
|
|
111
|
+
});
|
|
112
|
+
(0, external_vitest_namespaceObject.expect)(enableResponse.ok).toBe(true);
|
|
113
|
+
const nodeWs = await connectClient("desktop-node-enabled");
|
|
114
|
+
nodeWs.send(JSON.stringify({
|
|
115
|
+
type: "register",
|
|
116
|
+
payload: {
|
|
117
|
+
name: "Enabled Desktop",
|
|
118
|
+
capabilities: [
|
|
119
|
+
"system.notify"
|
|
120
|
+
]
|
|
121
|
+
},
|
|
122
|
+
timestamp: Date.now()
|
|
123
|
+
}));
|
|
124
|
+
const registrationAck = await waitForMessage(nodeWs, (msg)=>"ack" === msg.type && "string" == typeof msg.payload?.nodeId);
|
|
125
|
+
const nodeId = registrationAck.payload.nodeId;
|
|
126
|
+
(0, external_vitest_namespaceObject.expect)(nodeId).toBeTruthy();
|
|
127
|
+
const requesterWs = await connectClient("desktop-requester");
|
|
128
|
+
requesterWs.send(JSON.stringify({
|
|
129
|
+
type: "req:node",
|
|
130
|
+
id: "node-req-1",
|
|
131
|
+
targetNodeId: nodeId,
|
|
132
|
+
payload: {
|
|
133
|
+
tool: "system.notify",
|
|
134
|
+
args: {
|
|
135
|
+
title: "Hello",
|
|
136
|
+
body: "Node test"
|
|
137
|
+
}
|
|
138
|
+
},
|
|
139
|
+
timestamp: Date.now()
|
|
140
|
+
}));
|
|
141
|
+
const forwardedToNode = await waitForMessage(nodeWs, (msg)=>"req:node" === msg.type && "node-req-1" === msg.id);
|
|
142
|
+
(0, external_vitest_namespaceObject.expect)(forwardedToNode.targetNodeId).toBe(nodeId);
|
|
143
|
+
nodeWs.send(JSON.stringify({
|
|
144
|
+
type: "res",
|
|
145
|
+
id: "node-req-1",
|
|
146
|
+
ok: true,
|
|
147
|
+
payload: {
|
|
148
|
+
delivered: true
|
|
149
|
+
},
|
|
150
|
+
timestamp: Date.now()
|
|
151
|
+
}));
|
|
152
|
+
const returnedToRequester = await waitForMessage(requesterWs, (msg)=>"res" === msg.type && "node-req-1" === msg.id);
|
|
153
|
+
(0, external_vitest_namespaceObject.expect)(returnedToRequester.ok).toBe(true);
|
|
154
|
+
(0, external_vitest_namespaceObject.expect)(returnedToRequester.nodeId).toBe(nodeId);
|
|
155
|
+
const closePromise = new Promise((resolve)=>{
|
|
156
|
+
nodeWs.addEventListener("close", ()=>{
|
|
157
|
+
resolve();
|
|
158
|
+
}, {
|
|
159
|
+
once: true
|
|
160
|
+
});
|
|
161
|
+
});
|
|
162
|
+
const revokeResponse = await fetch(`http://localhost:${port}/api/nodes/${encodeURIComponent("desktop-node-enabled")}`, {
|
|
163
|
+
method: "DELETE"
|
|
164
|
+
});
|
|
165
|
+
(0, external_vitest_namespaceObject.expect)(revokeResponse.ok).toBe(true);
|
|
166
|
+
await closePromise;
|
|
167
|
+
requesterWs.close();
|
|
168
|
+
nodeWs.close();
|
|
169
|
+
});
|
|
170
|
+
});
|
|
171
|
+
for(var __rspack_i in __webpack_exports__)exports[__rspack_i] = __webpack_exports__[__rspack_i];
|
|
172
|
+
Object.defineProperty(exports, '__esModule', {
|
|
173
|
+
value: true
|
|
174
|
+
});
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
export {};
|
|
@@ -0,0 +1,168 @@
|
|
|
1
|
+
import { mkdtempSync, rmSync } from "node:fs";
|
|
2
|
+
import { tmpdir } from "node:os";
|
|
3
|
+
import { join } from "node:path";
|
|
4
|
+
import { afterAll, beforeAll, describe, expect, it } from "vitest";
|
|
5
|
+
import { GatewayServer } from "../gateway/server.js";
|
|
6
|
+
const isBun = void 0 !== globalThis.Bun;
|
|
7
|
+
const describeIfBun = isBun ? describe : describe.skip;
|
|
8
|
+
describeIfBun("Gateway node enablement", ()=>{
|
|
9
|
+
let server;
|
|
10
|
+
let port = 0;
|
|
11
|
+
let workspace;
|
|
12
|
+
beforeAll(async ()=>{
|
|
13
|
+
workspace = mkdtempSync(join(tmpdir(), "wingman-gateway-node-mode-"));
|
|
14
|
+
server = new GatewayServer({
|
|
15
|
+
port: 0,
|
|
16
|
+
host: "localhost",
|
|
17
|
+
requireAuth: false,
|
|
18
|
+
auth: {
|
|
19
|
+
mode: "none"
|
|
20
|
+
},
|
|
21
|
+
logLevel: "silent",
|
|
22
|
+
workspace,
|
|
23
|
+
configDir: ".wingman-node-test-config",
|
|
24
|
+
stateDir: ".wingman-node-test-state"
|
|
25
|
+
});
|
|
26
|
+
await server.start();
|
|
27
|
+
port = server.getPort();
|
|
28
|
+
if (!port) throw new Error("Unable to determine gateway port");
|
|
29
|
+
});
|
|
30
|
+
afterAll(async ()=>{
|
|
31
|
+
await server.stop();
|
|
32
|
+
rmSync(workspace, {
|
|
33
|
+
recursive: true,
|
|
34
|
+
force: true
|
|
35
|
+
});
|
|
36
|
+
});
|
|
37
|
+
const connectClient = (instanceId, clientType = "desktop")=>new Promise((resolve, reject)=>{
|
|
38
|
+
const ws = new WebSocket(`ws://localhost:${port}/ws`);
|
|
39
|
+
const connectId = `connect-${instanceId}-${Date.now()}`;
|
|
40
|
+
const timeout = setTimeout(()=>reject(new Error("Connect timeout")), 5000);
|
|
41
|
+
ws.addEventListener("open", ()=>{
|
|
42
|
+
ws.send(JSON.stringify({
|
|
43
|
+
type: "connect",
|
|
44
|
+
id: connectId,
|
|
45
|
+
client: {
|
|
46
|
+
instanceId,
|
|
47
|
+
clientType,
|
|
48
|
+
version: "test"
|
|
49
|
+
},
|
|
50
|
+
timestamp: Date.now()
|
|
51
|
+
}));
|
|
52
|
+
});
|
|
53
|
+
ws.addEventListener("message", (event)=>{
|
|
54
|
+
const msg = JSON.parse(event.data);
|
|
55
|
+
if ("res" === msg.type && msg.id === connectId && msg.ok) {
|
|
56
|
+
clearTimeout(timeout);
|
|
57
|
+
resolve(ws);
|
|
58
|
+
}
|
|
59
|
+
});
|
|
60
|
+
ws.addEventListener("error", ()=>{
|
|
61
|
+
clearTimeout(timeout);
|
|
62
|
+
reject(new Error("WebSocket error"));
|
|
63
|
+
});
|
|
64
|
+
});
|
|
65
|
+
const waitForMessage = (ws, predicate, timeoutMs = 5000)=>new Promise((resolve, reject)=>{
|
|
66
|
+
const timeout = setTimeout(()=>reject(new Error("Message timeout")), timeoutMs);
|
|
67
|
+
const handler = (event)=>{
|
|
68
|
+
const data = event.data;
|
|
69
|
+
if ("string" != typeof data) return;
|
|
70
|
+
let msg;
|
|
71
|
+
try {
|
|
72
|
+
msg = JSON.parse(data);
|
|
73
|
+
} catch {
|
|
74
|
+
return;
|
|
75
|
+
}
|
|
76
|
+
if (!predicate(msg)) return;
|
|
77
|
+
clearTimeout(timeout);
|
|
78
|
+
ws.removeEventListener("message", handler);
|
|
79
|
+
resolve(msg);
|
|
80
|
+
};
|
|
81
|
+
ws.addEventListener("message", handler);
|
|
82
|
+
});
|
|
83
|
+
it("blocks node registration before device enablement", async ()=>{
|
|
84
|
+
const ws = await connectClient("desktop-node-blocked");
|
|
85
|
+
ws.send(JSON.stringify({
|
|
86
|
+
type: "register",
|
|
87
|
+
payload: {
|
|
88
|
+
name: "Blocked Node",
|
|
89
|
+
capabilities: [
|
|
90
|
+
"system.notify"
|
|
91
|
+
]
|
|
92
|
+
},
|
|
93
|
+
timestamp: Date.now()
|
|
94
|
+
}));
|
|
95
|
+
const errorMessage = await waitForMessage(ws, (msg)=>"error" === msg.type && msg.payload?.code === "NODE_NOT_ENABLED");
|
|
96
|
+
expect(errorMessage.payload?.message).toContain("not approved");
|
|
97
|
+
ws.close();
|
|
98
|
+
});
|
|
99
|
+
it("allows enabled devices to register, execute, and revoke", async ()=>{
|
|
100
|
+
const enableResponse = await fetch(`http://localhost:${port}/api/nodes/${encodeURIComponent("desktop-node-enabled")}`, {
|
|
101
|
+
method: "PUT",
|
|
102
|
+
headers: {
|
|
103
|
+
"Content-Type": "application/json"
|
|
104
|
+
},
|
|
105
|
+
body: JSON.stringify({
|
|
106
|
+
enabled: true,
|
|
107
|
+
name: "Enabled Desktop"
|
|
108
|
+
})
|
|
109
|
+
});
|
|
110
|
+
expect(enableResponse.ok).toBe(true);
|
|
111
|
+
const nodeWs = await connectClient("desktop-node-enabled");
|
|
112
|
+
nodeWs.send(JSON.stringify({
|
|
113
|
+
type: "register",
|
|
114
|
+
payload: {
|
|
115
|
+
name: "Enabled Desktop",
|
|
116
|
+
capabilities: [
|
|
117
|
+
"system.notify"
|
|
118
|
+
]
|
|
119
|
+
},
|
|
120
|
+
timestamp: Date.now()
|
|
121
|
+
}));
|
|
122
|
+
const registrationAck = await waitForMessage(nodeWs, (msg)=>"ack" === msg.type && "string" == typeof msg.payload?.nodeId);
|
|
123
|
+
const nodeId = registrationAck.payload.nodeId;
|
|
124
|
+
expect(nodeId).toBeTruthy();
|
|
125
|
+
const requesterWs = await connectClient("desktop-requester");
|
|
126
|
+
requesterWs.send(JSON.stringify({
|
|
127
|
+
type: "req:node",
|
|
128
|
+
id: "node-req-1",
|
|
129
|
+
targetNodeId: nodeId,
|
|
130
|
+
payload: {
|
|
131
|
+
tool: "system.notify",
|
|
132
|
+
args: {
|
|
133
|
+
title: "Hello",
|
|
134
|
+
body: "Node test"
|
|
135
|
+
}
|
|
136
|
+
},
|
|
137
|
+
timestamp: Date.now()
|
|
138
|
+
}));
|
|
139
|
+
const forwardedToNode = await waitForMessage(nodeWs, (msg)=>"req:node" === msg.type && "node-req-1" === msg.id);
|
|
140
|
+
expect(forwardedToNode.targetNodeId).toBe(nodeId);
|
|
141
|
+
nodeWs.send(JSON.stringify({
|
|
142
|
+
type: "res",
|
|
143
|
+
id: "node-req-1",
|
|
144
|
+
ok: true,
|
|
145
|
+
payload: {
|
|
146
|
+
delivered: true
|
|
147
|
+
},
|
|
148
|
+
timestamp: Date.now()
|
|
149
|
+
}));
|
|
150
|
+
const returnedToRequester = await waitForMessage(requesterWs, (msg)=>"res" === msg.type && "node-req-1" === msg.id);
|
|
151
|
+
expect(returnedToRequester.ok).toBe(true);
|
|
152
|
+
expect(returnedToRequester.nodeId).toBe(nodeId);
|
|
153
|
+
const closePromise = new Promise((resolve)=>{
|
|
154
|
+
nodeWs.addEventListener("close", ()=>{
|
|
155
|
+
resolve();
|
|
156
|
+
}, {
|
|
157
|
+
once: true
|
|
158
|
+
});
|
|
159
|
+
});
|
|
160
|
+
const revokeResponse = await fetch(`http://localhost:${port}/api/nodes/${encodeURIComponent("desktop-node-enabled")}`, {
|
|
161
|
+
method: "DELETE"
|
|
162
|
+
});
|
|
163
|
+
expect(revokeResponse.ok).toBe(true);
|
|
164
|
+
await closePromise;
|
|
165
|
+
requesterWs.close();
|
|
166
|
+
nodeWs.close();
|
|
167
|
+
});
|
|
168
|
+
});
|
|
@@ -0,0 +1,60 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
var __webpack_exports__ = {};
|
|
3
|
+
const external_vitest_namespaceObject = require("vitest");
|
|
4
|
+
const server_cjs_namespaceObject = require("../gateway/server.cjs");
|
|
5
|
+
(0, external_vitest_namespaceObject.describe)("gateway origin policy", ()=>{
|
|
6
|
+
(0, external_vitest_namespaceObject.it)("identifies loopback hostnames", ()=>{
|
|
7
|
+
(0, external_vitest_namespaceObject.expect)((0, server_cjs_namespaceObject.isLoopbackHostname)("127.0.0.1")).toBe(true);
|
|
8
|
+
(0, external_vitest_namespaceObject.expect)((0, server_cjs_namespaceObject.isLoopbackHostname)("localhost")).toBe(true);
|
|
9
|
+
(0, external_vitest_namespaceObject.expect)((0, server_cjs_namespaceObject.isLoopbackHostname)("[::1]")).toBe(true);
|
|
10
|
+
(0, external_vitest_namespaceObject.expect)((0, server_cjs_namespaceObject.isLoopbackHostname)("example.com")).toBe(false);
|
|
11
|
+
});
|
|
12
|
+
(0, external_vitest_namespaceObject.it)("allows loopback development origins", ()=>{
|
|
13
|
+
const allowed = (0, server_cjs_namespaceObject.isGatewayOriginAllowed)({
|
|
14
|
+
origin: "http://localhost:5173",
|
|
15
|
+
requestUrl: "http://127.0.0.1:18789/api/sessions",
|
|
16
|
+
gatewayHost: "127.0.0.1",
|
|
17
|
+
gatewayPort: 18789,
|
|
18
|
+
controlUiEnabled: true,
|
|
19
|
+
controlUiPort: 18790
|
|
20
|
+
});
|
|
21
|
+
(0, external_vitest_namespaceObject.expect)(allowed).toBe(true);
|
|
22
|
+
});
|
|
23
|
+
(0, external_vitest_namespaceObject.it)("rejects unrelated internet origins", ()=>{
|
|
24
|
+
const allowed = (0, server_cjs_namespaceObject.isGatewayOriginAllowed)({
|
|
25
|
+
origin: "https://evil.example",
|
|
26
|
+
requestUrl: "http://127.0.0.1:18789/api/sessions",
|
|
27
|
+
gatewayHost: "127.0.0.1",
|
|
28
|
+
gatewayPort: 18789,
|
|
29
|
+
controlUiEnabled: true,
|
|
30
|
+
controlUiPort: 18790
|
|
31
|
+
});
|
|
32
|
+
(0, external_vitest_namespaceObject.expect)(allowed).toBe(false);
|
|
33
|
+
});
|
|
34
|
+
(0, external_vitest_namespaceObject.it)("allows same-host control UI origin on configured port", ()=>{
|
|
35
|
+
const allowed = (0, server_cjs_namespaceObject.isGatewayOriginAllowed)({
|
|
36
|
+
origin: "http://192.168.1.50:18790",
|
|
37
|
+
requestUrl: "http://192.168.1.50:18789/api/sessions",
|
|
38
|
+
gatewayHost: "0.0.0.0",
|
|
39
|
+
gatewayPort: 18789,
|
|
40
|
+
controlUiEnabled: true,
|
|
41
|
+
controlUiPort: 18790
|
|
42
|
+
});
|
|
43
|
+
(0, external_vitest_namespaceObject.expect)(allowed).toBe(true);
|
|
44
|
+
});
|
|
45
|
+
(0, external_vitest_namespaceObject.it)("rejects same-host origins on unapproved ports", ()=>{
|
|
46
|
+
const allowed = (0, server_cjs_namespaceObject.isGatewayOriginAllowed)({
|
|
47
|
+
origin: "http://192.168.1.50:9999",
|
|
48
|
+
requestUrl: "http://192.168.1.50:18789/api/sessions",
|
|
49
|
+
gatewayHost: "0.0.0.0",
|
|
50
|
+
gatewayPort: 18789,
|
|
51
|
+
controlUiEnabled: true,
|
|
52
|
+
controlUiPort: 18790
|
|
53
|
+
});
|
|
54
|
+
(0, external_vitest_namespaceObject.expect)(allowed).toBe(false);
|
|
55
|
+
});
|
|
56
|
+
});
|
|
57
|
+
for(var __rspack_i in __webpack_exports__)exports[__rspack_i] = __webpack_exports__[__rspack_i];
|
|
58
|
+
Object.defineProperty(exports, '__esModule', {
|
|
59
|
+
value: true
|
|
60
|
+
});
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
export {};
|