pairling 0.2.4 → 0.2.6

package/payload/mac/connectd/internal/status/status_test.go

@@ -8,6 +8,61 @@ import (
 	"testing"
 )
 
+func hasRouteKind(routes []AdvertisedRoute, kind string) bool {
+	for _, r := range routes {
+		if r.Kind == kind {
+			return true
+		}
+	}
+	return false
+}
+
+func TestFunnelRouteIsAdditiveAndGated(t *testing.T) {
+	s := NewStore("pairling-test")
+	s.SetListenerRunning(true)
+	s.SetUpstreamReachable(true)
+	s.SetTailnetIP("100.64.0.1")
+	s.SetAuthenticated()
+
+	// Funnel disabled: only the tailnet route, and no funnel_hostname in the JSON.
+	snap := s.Snapshot()
+	if hasRouteKind(snap.AdvertisedRoutes, RouteKindFunnel) {
+		t.Error("funnel route present while funnel disabled")
+	}
+	js, _ := json.Marshal(snap)
+	if strings.Contains(string(js), "funnel_hostname") {
+		t.Error("funnel_hostname must be omitted when empty")
+	}
+
+	// Enable funnel: the route appears with an https base URL and a lower priority.
+	s.SetFunnelHostname("pairling-abc.tail1234.ts.net")
+	snap = s.Snapshot()
+	var funnel, tailnet *AdvertisedRoute
+	for i := range snap.AdvertisedRoutes {
+		switch snap.AdvertisedRoutes[i].Kind {
+		case RouteKindFunnel:
+			funnel = &snap.AdvertisedRoutes[i]
+		case RouteKindTailnet:
+			tailnet = &snap.AdvertisedRoutes[i]
+		}
+	}
+	if funnel == nil || tailnet == nil {
+		t.Fatalf("expected tailnet and funnel routes, got %+v", snap.AdvertisedRoutes)
+	}
+	if funnel.BaseURL != "https://pairling-abc.tail1234.ts.net" {
+		t.Errorf("funnel base_url = %q", funnel.BaseURL)
+	}
+	if funnel.Priority >= tailnet.Priority {
+		t.Errorf("funnel priority %d must be below tailnet priority %d", funnel.Priority, tailnet.Priority)
+	}
+
+	// Unhealthy node: no routes advertise, even with a funnel hostname set.
+	s.SetUpstreamReachable(false)
+	if len(s.Snapshot().AdvertisedRoutes) != 0 {
+		t.Error("no routes should advertise when the node is unhealthy")
+	}
+}
+
 func TestStoreServesHelperReadableSnapshotWithoutSecrets(t *testing.T) {
 	store := NewStore("pairling-inst-abcdef")
 	store.SetAuthPending("https://login.tailscale.com/a/secret-auth-token")
@@ -46,6 +101,89 @@ func TestStoreServesHelperReadableSnapshotWithoutSecrets(t *testing.T) {
 	}
 }
 
+func TestSnapshotSerializesTailnetIdentityFields(t *testing.T) {
+	store := NewStore("pairling-inst-abcdef")
+	store.SetTailnetIdentity("nXb6CNTRL", []string{"tag:pairling-connect"}, []string{"100.79.217.7"})
+
+	raw, err := json.Marshal(store.Snapshot())
+	if err != nil {
+		t.Fatal(err)
+	}
+	body := string(raw)
+	for _, want := range []string{
+		`"tailnet_node_id":"nXb6CNTRL"`,
+		`"tags":["tag:pairling-connect"]`,
+		`"tailnet_ips":["100.79.217.7"]`,
+	} {
+		if !strings.Contains(body, want) {
+			t.Fatalf("snapshot missing %s: %s", want, body)
+		}
+	}
+}
+
+func TestSnapshotSerializesKnownTailnetLockStatus(t *testing.T) {
+	store := NewStore("pairling-inst-abcdef")
+	store.SetTailnetLockEnabled(false)
+
+	raw, err := json.Marshal(store.Snapshot())
+	if err != nil {
+		t.Fatal(err)
+	}
+	body := string(raw)
+	if !strings.Contains(body, `"tailnet_lock_enabled":false`) {
+		t.Fatalf("snapshot missing known lock status: %s", body)
+	}
+}
+
+func TestSnapshotOmitsTailnetIdentityWhenUnknown(t *testing.T) {
+	raw, err := json.Marshal(NewStore("pairling-inst-abcdef").Snapshot())
+	if err != nil {
+		t.Fatal(err)
+	}
+	body := string(raw)
+	for _, forbidden := range []string{"tailnet_node_id", "tags", "tailnet_ips"} {
+		if strings.Contains(body, forbidden) {
+			t.Fatalf("fresh snapshot should omit %q: %s", forbidden, body)
+		}
+	}
+	if !strings.Contains(body, `"auth_state":"starting"`) {
+		t.Fatalf("fresh snapshot lost coherent auth state: %s", body)
+	}
+}
+
+func TestSetTailnetIdentityIsIdempotentAndReplaces(t *testing.T) {
+	store := NewStore("pairling-inst-abcdef")
+	store.SetTailnetIdentity("old-node", []string{"tag:old"}, []string{"100.64.0.1"})
+	store.SetTailnetIdentity("new-node", []string{"tag:pairling-connect"}, []string{"100.79.217.7", "fd7a:115c:a1e0::1"})
+
+	snapshot := store.Snapshot()
+	if snapshot.TailnetNodeID != "new-node" {
+		t.Fatalf("node ID = %q, want new-node", snapshot.TailnetNodeID)
+	}
+	if got, want := strings.Join(snapshot.Tags, ","), "tag:pairling-connect"; got != want {
+		t.Fatalf("tags = %q, want %q", got, want)
+	}
+	if got, want := strings.Join(snapshot.TailnetIPs, ","), "100.79.217.7,fd7a:115c:a1e0::1"; got != want {
+		t.Fatalf("tailnet IPs = %q, want %q", got, want)
+	}
+}
+
+func TestTailnetIdentityCarriesNoSecrets(t *testing.T) {
+	store := NewStore("pairling-inst-abcdef")
+	store.SetTailnetIdentity("tskey-auth-example", []string{"AuthKey=bad"}, []string{"NLPrivate=bad"})
+
+	raw, err := json.Marshal(store.Snapshot())
+	if err != nil {
+		t.Fatal(err)
+	}
+	body := string(raw)
+	for _, forbidden := range []string{"tskey", "authkey", "AuthKey", "NLPrivate"} {
+		if strings.Contains(body, forbidden) {
+			t.Fatalf("tailnet identity leaked %q: %s", forbidden, body)
+		}
+	}
+}
+
 func TestStoreAdvertisesRouteOnlyWhenReady(t *testing.T) {
 	store := NewStore("pairling-inst-abcdef")
 	store.SetAuthPending("open https://login.tailscale.com/a/example-token")