pinokiod 8.2.33 → 8.2.35

package/test/anywhere-peers.test.js

@@ -1,223 +0,0 @@
-const assert = require('node:assert/strict')
-const test = require('node:test')
-const Server = require('../server/index.js')
-const Anywhere = require('../kernel/anywhere')
-const { buildServeConfig } = require('../kernel/anywhere/serve')
-
-// The peer routes (spec/requirements/pinokio-anywhere-api.md, Peers) and the
-// forwarded link rewrite, with the proxy request and the forwarders stubbed.
-
-const status = {
-  Self: { DNSName: 'pinokio.tail1.ts.net.' },
-  Peer: {
-    a: { HostName: 'STUDIO', DNSName: 'pinokio-1.tail1.ts.net.', OS: 'windows', Online: true, TailscaleIPs: ['100.1.1.1'] },
-    b: { HostName: 'iphone', DNSName: 'iphone-14-pro.tail1.ts.net.', OS: 'iOS', Online: true },
-    c: { HostName: 'asleep', DNSName: 'asleep.tail1.ts.net.', OS: 'macOS', Online: false },
-    d: { HostName: 'other', DNSName: 'other.tail1.ts.net.', OS: 'linux', Online: true },
-  },
-}
-
-function anywhereWith(requests = {}, { proxy = true } = {}) {
-  const anywhere = new Anywhere({})
-  anywhere.config = { enabled: true }
-  anywhere.lastStatus = status
-  anywhere.proxyPort = proxy ? 1055 : null
-  anywhere.forwarders.request = async (url, options) => {
-    const handler = requests[url]
-    if (!handler) throw new Error(`no route to ${url}`)
-    return handler(options)
-  }
-  anywhere.forwarders.open = async (dnsName, port) => 51000 + (port % 1000)
-  return anywhere
-}
-const json = (body, code = 200) => async () => ({ status: code, headers: {}, body: JSON.stringify(body) })
-const fake = (anywhere) => ({ kernel: { anywhere }, anywherePeerOpenPath: Server.prototype.anywherePeerOpenPath, anywherePeerUnavailable: Server.prototype.anywherePeerUnavailable })
-
-test('peers lists the online computers that answered a status, with apps linked through the open route', async () => {
-  const anywhere = anywhereWith({
-    'https://pinokio-1.tail1.ts.net/anywhere/status': json({ phase: 'ready', apps: [
-      { id: 'comfy', name: 'ComfyUI', state: 'ready', exposed: true, remote: 'https://pinokio-1.tail1.ts.net:43000/ui/?a=1#v' },
-      { id: 'forge', name: 'Forge', state: 'starting', exposed: false, remote: null },
-    ] }),
-    'https://other.tail1.ts.net/anywhere/status': async () => ({ status: 404, headers: {}, body: 'not pinokio' }),
-  })
-  const out = await Server.prototype.composeAnywherePeers.call(fake(anywhere))
-  assert.equal(out.status, 200)
-  assert.deepEqual(out.body, { peers: [{ name: 'pinokio-1', address: 'https://pinokio-1.tail1.ts.net', apps: [
-    { id: 'comfy', name: 'ComfyUI', state: 'ready', exposed: true, open: '/anywhere/peers/pinokio-1/open?port=43000&to=%2Fui%2F%3Fa%3D1%23v' },
-    { id: 'forge', name: 'Forge', state: 'starting', exposed: false, open: null },
-  ] }] })
-})
-
-test('peers skips phones and offline peers, tolerates a peer that fails, and says why while the proxy is missing', async () => {
-  const asked = []
-  const anywhere = anywhereWith({
-    'https://pinokio-1.tail1.ts.net/anywhere/status': async () => { asked.push('pinokio-1'); throw new Error('no answer in 4 s') },
-    'https://other.tail1.ts.net/anywhere/status': async () => { asked.push('other'); return { status: 200, headers: {}, body: 'not json' } },
-  })
-  assert.deepEqual((await Server.prototype.composeAnywherePeers.call(fake(anywhere))).body, { peers: [] })
-  assert.deepEqual(asked.sort(), ['other', 'pinokio-1'], 'the phone and the offline computer are never asked')
-  const adopted = anywhereWith({}, { proxy: false })
-  assert.deepEqual(await Server.prototype.composeAnywherePeers.call(fake(adopted)), { status: 502, body: { error: 'Turn Remote off and on to reach your other Pinokios' } }, 'a daemon from before the proxy existed')
-  adopted.error = 'tailscaled exited (code=1 signal=null)'
-  assert.deepEqual((await Server.prototype.composeAnywherePeers.call(fake(adopted))).body, { error: 'Remote is not running on this computer' }, 'a daemon that died')
-})
-
-test('open validates the peer, the port and the path, then redirects to the forwarder', async () => {
-  const server = fake(anywhereWith())
-  assert.equal((await Server.prototype.anywherePeerOpen.call(server, 'nobody', { port: '443' })).status, 400)
-  assert.equal((await Server.prototype.anywherePeerOpen.call(server, 'pinokio-1', { port: '8080' })).status, 400)
-  assert.equal((await Server.prototype.anywherePeerOpen.call(server, 'pinokio-1', { port: '443.5' })).status, 400)
-  const root = await Server.prototype.anywherePeerOpen.call(server, 'pinokio-1', { port: '443' })
-  assert.equal(root.status, 302)
-  assert.equal(root.headers.Location, 'http://127.0.0.1:51443/')
-  const deep = await Server.prototype.anywherePeerOpen.call(server, 'PINOKIO-1', { port: '43000', to: '/ui/?a=1#v' })
-  assert.equal(deep.headers.Location, 'http://127.0.0.1:51000/ui/?a=1#v', 'the path, query and fragment survive; the name is case-insensitive')
-  for (const bad of ['//evil.example', 'https://evil.example/', '\\\\evil.example', 'http://127.0.0.1:51443@evil.example/']) {
-    const answer = await Server.prototype.anywherePeerOpen.call(server, 'pinokio-1', { port: '443', to: bad })
-    assert.equal(new URL(answer.headers.Location).origin, 'http://127.0.0.1:51443', `a path that could leave the forwarder (${bad}) stays on it`)
-  }
-  const odd = await Server.prototype.anywherePeerOpen.call(server, 'pinokio-1', { port: '443', to: '/ui/?q=caf\u00e9 x#\u00fc' })
-  assert.equal(odd.headers.Location, 'http://127.0.0.1:51443/ui/?q=caf%C3%A9%20x#%C3%BC', 'a path with characters a header cannot carry is encoded, fragment kept')
-  const unavailable = await Server.prototype.anywherePeerOpen.call(fake(anywhereWith({}, { proxy: false })), 'pinokio-1', { port: '443' })
-  assert.deepEqual(unavailable, { status: 502, body: { error: 'Turn Remote off and on to reach your other Pinokios' } }, 'a daemon from before the proxy existed')
-})
-
-test('the relays carry the peer\'s API under its prefix, with its own addresses made absolute open routes', async () => {
-  const anywhere = anywhereWith({
-    'https://pinokio-1.tail1.ts.net/anywhere/status': json({ phase: 'ready', apps: [
-      { id: 'comfy', name: 'ComfyUI', remote: 'https://pinokio-1.tail1.ts.net:43000/ui/?a=1#v' },
-      { id: 'ext', name: 'Ext', remote: 'https://example.com/' },
-      { id: 'forge', name: 'Forge', remote: null },
-    ] }),
-    'https://pinokio-1.tail1.ts.net/anywhere/apps': json({ apps: [{ id: 'comfy', name: 'ComfyUI', icon: '/asset/api/comfy/icon.png' }] }),
-    'https://pinokio-1.tail1.ts.net/asset/api/comfy/icon.png': async () => ({ status: 200, headers: { 'content-type': 'image/png' }, raw: Buffer.from([0x89, 0x50]), body: '' }),
-  })
-  const server = fake(anywhere)
-  const status = await Server.prototype.relayAnywherePeer.call(server, 'pinokio-1', 'GET', 'anywhere/status')
-  assert.equal(status.status, 200)
-  assert.deepEqual(status.body.apps.map((app) => app.remote), [
-    'http://127.0.0.1:42000/anywhere/peers/pinokio-1/open?port=43000&to=%2Fui%2F%3Fa%3D1%23v', 'https://example.com/', null,
-  ], 'the peer\'s own address becomes an absolute open route; anything else passes through')
-  const catalog = await Server.prototype.relayAnywherePeer.call(server, 'pinokio-1', 'GET', 'anywhere/apps')
-  assert.deepEqual(catalog.body, { apps: [{ id: 'comfy', name: 'ComfyUI', icon: '/asset/api/comfy/icon.png' }] })
-  const icon = await Server.prototype.relayAnywherePeer.call(server, 'pinokio-1', 'GET', 'asset/api/comfy/icon.png')
-  assert.deepEqual([icon.status, icon.contentType, [...icon.raw]], [200, 'image/png', [0x89, 0x50]], 'an asset is passed through as bytes')
-})
-
-test('launch and stop relay the peer\'s status and body, turning an open URL into the open route', async () => {
-  const sent = []
-  const anywhere = anywhereWith({
-    'https://pinokio-1.tail1.ts.net/anywhere/apps/launch': async (options) => { sent.push(options); return { status: 200, headers: {}, body: JSON.stringify({ action: 'open', url: 'https://pinokio-1.tail1.ts.net:43000/' }) } },
-    'https://pinokio-1.tail1.ts.net/anywhere/apps/stop': json({ error: 'Unknown app: x' }, 400),
-  })
-  const server = fake(anywhere)
-  const launch = await Server.prototype.relayAnywherePeer.call(server, 'pinokio-1', 'POST', 'anywhere/apps/launch', { id: 'comfy' })
-  assert.deepEqual(launch, { status: 200, body: { action: 'open', url: 'http://127.0.0.1:42000/anywhere/peers/pinokio-1/open?port=43000&to=%2F' } })
-  assert.equal(sent[0].method, 'POST')
-  assert.equal(sent[0].body, '{"id":"comfy"}')
-  assert.equal(sent[0].headers['Content-Type'], 'application/json')
-  assert.deepEqual(await Server.prototype.relayAnywherePeer.call(server, 'pinokio-1', 'POST', 'anywhere/apps/stop', { id: 'x' }), { status: 400, body: { error: 'Unknown app: x' } })
-  assert.equal((await Server.prototype.relayAnywherePeer.call(server, 'nobody', 'POST', 'anywhere/apps/stop', {})).status, 400)
-})
-
-test('a launch whose default is an outside address passes through unchanged', async () => {
-  const anywhere = anywhereWith({
-    'https://pinokio-1.tail1.ts.net/anywhere/apps/launch': json({ action: 'open', url: 'https://github.com/x/y' }),
-  })
-  const launch = await Server.prototype.relayAnywherePeer.call(fake(anywhere), 'pinokio-1', 'POST', 'anywhere/apps/launch', { id: 'docs' })
-  assert.deepEqual(launch.body, { action: 'open', url: 'https://github.com/x/y' })
-})
-
-test('a peer that cannot be reached or answers without JSON relays as 502', async () => {
-  const anywhere = anywhereWith({
-    'https://pinokio-1.tail1.ts.net/anywhere/apps/stop': async () => { throw new Error('no answer in 30 s') },
-    'https://other.tail1.ts.net/anywhere/apps/stop': async () => ({ status: 404, headers: {}, body: '<html>' }),
-  })
-  const server = fake(anywhere)
-  const down = await Server.prototype.relayAnywherePeer.call(server, 'pinokio-1', 'POST', 'anywhere/apps/stop', { id: 'x' })
-  assert.equal(down.status, 502)
-  assert.match(down.body.error, /Could not reach STUDIO: no answer/)
-  const old = await Server.prototype.relayAnywherePeer.call(server, 'other', 'POST', 'anywhere/apps/stop', { id: 'x' })
-  assert.deepEqual(old, { status: 502, body: { error: 'other did not answer with JSON (HTTP 404)' } })
-  const stopped = await Server.prototype.relayAnywherePeer.call(fake(anywhereWith({}, { proxy: false })), 'other', 'POST', 'anywhere/apps/stop', {})
-  assert.equal(stopped.status, 502)
-})
-
-test('the peer routes answer a browser on this computer only, never a tailnet client through Serve, whatever Host it sends', () => {
-  const server = { kernel: { anywhere: anywhereWith() }, isLoopbackHost: Server.prototype.isLoopbackHost, isLocalRequest: Server.prototype.isLocalRequest }
-  const request = ({ remote = '127.0.0.1', host = 'localhost:42000', origin, headers = {} } = {}) => ({
-    socket: { remoteAddress: remote },
-    get: (name) => ({ host, origin, ...Object.fromEntries(Object.entries(headers).map(([k, v]) => [k.toLowerCase(), v])) })[name.toLowerCase()],
-  })
-  const allowed = (req) => Server.prototype.anywherePeerAllowed.call(server, req)
-  assert.equal(allowed(request()), true, 'a top-level navigation on this computer')
-  assert.equal(allowed(request({ remote: '::1', host: '[::1]:42000', origin: 'http://[::1]:42000' })), true)
-  assert.equal(allowed(request({ remote: '::ffff:127.0.0.1', host: '127.0.0.1:42000', origin: 'http://127.0.0.1:42000' })), true)
-  assert.equal(allowed(request({ origin: 'http://localhost:3000' })), false, 'another local site is not this page')
-  assert.equal(allowed(request({ origin: 'https://pinokio.co' })), true, 'the Remote tab in a browser on this computer')
-  assert.equal(allowed(request({ origin: 'https://pinokio.co', headers: { 'X-Forwarded-For': '100.1.1.1' } })), false, 'but not through Serve')
-  assert.equal(allowed(request({ origin: 'https://pinokio.co.evil' })), false)
-  assert.equal(allowed(request({ origin: 'not a url' })), false)
-  assert.equal(allowed(request({ host: 'pinokio.tail1.ts.net' })), false, 'the node\'s own name')
-  assert.equal(allowed(request({ headers: { 'X-Forwarded-For': '100.1.1.1' } })), false, 'through Serve with a forged loopback Host')
-  assert.equal(allowed(request({ headers: { 'X-Pinokio-Peer': '1', 'X-Pinokio-Source-Host': 'localhost' } })), false, 'through another Pinokio')
-  assert.equal(allowed(request({ remote: '192.168.1.5' })), false, 'Home Server on the LAN')
-  assert.equal(allowed(request({ remote: null })), false, 'no socket address at all')
-  assert.equal(Server.prototype.isLoopbackHost('LOCALHOST'), true)
-  assert.equal(Server.prototype.isLoopbackHost('localhost.evil'), false)
-})
-
-test('a live daemon is still ours across a pinokiod restart, its proxy port read from its command line', () => {
-  const anywhere = new Anywhere({ platform: 'linux', path: (...parts) => ['/home/x', ...parts].join('/'), bin: { mod: { tailscaled: { binPath: () => '/opt/tailscaled' } } } })
-  const line = (port) => ['/opt/tailscaled', ...anywhere.daemonArgs(port)].join(' ')
-  assert.equal(anywhere.proxyPort, null, 'a fresh pinokiod process knows no port yet')
-  assert.equal(anywhere.ownedPid({ pid: 7 }, line(1055)), 7)
-  assert.equal(anywhere.ownedProxyPort, 1055, 'the port the daemon was given, for adoption')
-  assert.equal(anywhere.ownedPid({ pid: 7 }, line(null)), 7, 'a daemon started before the proxy existed')
-  assert.equal(anywhere.ownedProxyPort, null, 'and it has no proxy to use')
-  assert.equal(anywhere.ownedPid({ pid: 7 }, line(1055) + ' --extra'), null, 'anything else is not ours')
-  assert.equal(anywhere.ownedPid({ pid: 7 }, '/usr/bin/tailscaled --tun=userspace-networking'), null)
-  anywhere.platform = 'win32'
-  assert.equal(anywhere.ownedPid({ pid: 9 }, `"${line(1055).toUpperCase()}"`), 9, 'Windows compares without quotes, case-insensitively')
-})
-
-test('peerFor finds a peer by the first label of its DNS name, which may differ from its displayed name', () => {
-  const anywhere = anywhereWith()
-  assert.equal(anywhere.peerFor('pinokio-1').name, 'STUDIO')
-  assert.equal(anywhere.peerFor('iphone-14-pro').mobile, true)
-  assert.equal(anywhere.peerFor('STUDIO'), null, 'the hostname is not the key')
-  assert.equal(anywhere.peerFor(''), null)
-  assert.equal(anywhere.peerFor(null), null)
-})
-
-test('a forwarded visitor gets menu links on the forwarder\'s open path; every other visitor gets today\'s links', async () => {
-  const anywhere = new Anywhere({})
-  anywhere.config = { enabled: true }
-  anywhere.lastStatus = status
-  anywhere.lastServe = buildServeConfig({ dnsName: 'pinokio.tail1.ts.net', targets: [{ listen: 43000, target: 7860 }] })
-  const href = 'http://127.0.0.1:7860/ui/?a=1#v'
-  assert.equal(anywhere.rewriteHref('pinokio.tail1.ts.net', href, true), '/.pinokio/open?port=43000&to=%2Fui%2F%3Fa%3D1%23v')
-  assert.equal(anywhere.rewriteHref('pinokio.tail1.ts.net', href), 'https://pinokio.tail1.ts.net:43000/ui/?a=1#v')
-  assert.equal(anywhere.rewriteHref('pinokio.tail1.ts.net', href, false), 'https://pinokio.tail1.ts.net:43000/ui/?a=1#v')
-  assert.equal(anywhere.rewriteHref('localhost:42000', href, true), href, 'the Host gate still applies with the header')
-  assert.equal(anywhere.rewriteHref('pinokio.tail1.ts.net', 'http://127.0.0.1:9999/', true), 'http://127.0.0.1:9999/', 'a port without a route is left alone, as today')
-  const menu = [{ href, src: href, menu: [{ href: 'https://example.com/' }] }]
-  await anywhere.rewriteMenu('pinokio.tail1.ts.net', menu, true)
-  assert.equal(menu[0].href, '/.pinokio/open?port=43000&to=%2Fui%2F%3Fa%3D1%23v')
-  assert.equal(menu[0].src, menu[0].href)
-  assert.equal(menu[0].menu[0].href, 'https://example.com/')
-})
-
-test('the daemon is started with the proxy on the port pinokiod picked, and peers carry their DNS name', () => {
-  const anywhere = new Anywhere({ platform: 'linux', path: (...parts) => ['/home/x', ...parts].join('/') })
-  anywhere.proxyPort = 1055
-  assert.ok(anywhere.daemonArgs().includes('--outbound-http-proxy-listen=127.0.0.1:1055'))
-  assert.equal(anywhere.proxyUrl(), 'http://127.0.0.1:1055')
-  anywhere.proxyPort = null
-  assert.equal(anywhere.proxyUrl(), null)
-  assert.ok(!anywhere.daemonArgs().some((arg) => arg.includes('proxy')), 'no port, no flag')
-  assert.deepEqual(anywhere.peersFrom(status).map((p) => [p.name, p.dnsName]), [
-    ['iphone-14-pro', 'iphone-14-pro.tail1.ts.net'], ['other', 'other.tail1.ts.net'], ['STUDIO', 'pinokio-1.tail1.ts.net'], ['asleep', 'asleep.tail1.ts.net'],
-  ])
-})