socketduct 0.1.15

package/test/unit/server/control-handler.test.js

@@ -0,0 +1,291 @@
+import assert from "node:assert/strict"
+import test from "node:test"
+
+import {InMemoryUserStore, login, TokenStore} from "../../../src/auth/user-store.js"
+import {handleControlMessage as rawHandleControlMessage} from "../../../src/server/control-handler.js"
+import {SessionStore} from "../../../src/sessions/session.js"
+
+/**
+ * @returns {Promise<{token: import('../../../src/auth/user-store.js').AuthToken, tokens: TokenStore, sessions: SessionStore}>} - Authenticated test stores.
+ */
+async function createAuthenticatedStores() {
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+  return {token, tokens, sessions: new SessionStore({now: () => 1000})}
+}
+
+/**
+ * Calls the handler with the required v2 capabilities used by normal peers.
+ * @param {Parameters<typeof rawHandleControlMessage>[0]} options - Handler options.
+ * @param {Parameters<typeof rawHandleControlMessage>[1]} message - Control message.
+ * @returns {ReturnType<typeof rawHandleControlMessage>} Control response.
+ */
+function handleControlMessage(options, message) {
+  return rawHandleControlMessage({...options, supportedFraming: [2]}, {...message, framing: [2]})
+}
+
+test("handleControlMessage requires auth before creating sessions", () => {
+  const response = handleControlMessage({tokens: new TokenStore(), sessions: new SessionStore()}, {
+    type: "session.create",
+    name: "laptop shell"
+  })
+
+  assert.deepEqual(response, {
+    type: "error",
+    code: "AUTH_REQUIRED",
+    message: "Authentication is required.",
+    retryable: false
+  })
+})
+
+test("handleControlMessage creates a named session for authenticated users", async () => {
+  const {token, tokens, sessions} = await createAuthenticatedStores()
+
+  const response = handleControlMessage({tokens, sessions, authorizeTarget: () => true}, {
+    type: "session.create",
+    token: token.value,
+    name: "laptop shell",
+    identifier: "session-123",
+    target: {host: "127.0.0.1", port: 5432}
+  })
+
+  assert.deepEqual(response, {
+    type: "session.created",
+    identifier: "session-123",
+    name: "laptop shell",
+    state: "creating",
+    target: {host: "127.0.0.1", port: 5432},
+    framing: 2
+  })
+})
+
+test("handleControlMessage returns a protocol error for duplicate session identifiers", async () => {
+  const {token, tokens, sessions} = await createAuthenticatedStores()
+  const message = {
+    type: "session.create",
+    token: token.value,
+    name: "laptop shell",
+    identifier: "session-123",
+    target: {host: "127.0.0.1", port: 5432}
+  }
+
+  assert.equal(handleControlMessage({tokens, sessions, authorizeTarget: () => true}, message).type, "session.created")
+  assert.deepEqual(handleControlMessage({tokens, sessions, authorizeTarget: () => true}, message), {
+    type: "error",
+    code: "SESSION_EXISTS",
+    message: "Session identifier already exists.",
+    retryable: false
+  })
+})
+
+test("handleControlMessage resumes only sessions owned by the authenticated user", async () => {
+  const {token, tokens, sessions} = await createAuthenticatedStores()
+  const created = handleControlMessage({tokens, sessions, authorizeTarget: () => true}, {
+    type: "session.create",
+    token: token.value,
+    name: "laptop shell",
+    identifier: "session-123",
+    target: {host: "127.0.0.1", port: 5432}
+  })
+  assert.equal(created.type, "session.created")
+  sessions.transition("session-123", "active")
+  sessions.updateSequences("session-123", {clientSequence: 42, relaySequence: 7})
+  sessions.transition("session-123", "interrupted")
+
+  const resumed = handleControlMessage({tokens, sessions, authorizeTarget: () => true}, {
+    type: "session.resume",
+    token: token.value,
+    identifier: "session-123"
+  })
+
+  assert.deepEqual(resumed, {
+    type: "session.resumed",
+    identifier: "session-123",
+    name: "laptop shell",
+    state: "resuming",
+    serverLastSequence: 7,
+    serverLastAck: 42,
+    replayFromSequence: 43,
+    target: {host: "127.0.0.1", port: 5432},
+    framing: 2
+  })
+})
+
+test("handleControlMessage rejects missing or malformed session targets", async () => {
+  const {token, tokens, sessions} = await createAuthenticatedStores()
+
+  assert.deepEqual(handleControlMessage({tokens, sessions, authorizeTarget: () => true}, {
+    type: "session.create",
+    token: token.value,
+    name: "missing target"
+  }), {
+    type: "error",
+    code: "PROTOCOL_VIOLATION",
+    message: "Target host and port are required.",
+    retryable: false
+  })
+
+  assert.deepEqual(handleControlMessage({tokens, sessions, authorizeTarget: () => true}, {
+    type: "session.create",
+    token: token.value,
+    name: "bad target",
+    target: {host: "", port: 0}
+  }), {
+    type: "error",
+    code: "PROTOCOL_VIOLATION",
+    message: "Target host and port are required.",
+    retryable: false
+  })
+})
+
+test("handleControlMessage rejects unauthorized targets", async () => {
+  const {token, tokens, sessions} = await createAuthenticatedStores()
+
+  const response = handleControlMessage({
+    tokens,
+    sessions,
+    authorizeTarget: () => false
+  }, {
+    type: "session.create",
+    token: token.value,
+    name: "blocked target",
+    target: {host: "10.0.0.1", port: 22}
+  })
+
+  assert.deepEqual(response, {
+    type: "error",
+    code: "TARGET_UNAUTHORIZED",
+    message: "Target is not authorized for this principal.",
+    retryable: false
+  })
+})
+
+test("handleControlMessage selects a mutually supported stream.data codec on create", async () => {
+  const {token, tokens, sessions} = await createAuthenticatedStores()
+
+  const response = handleControlMessage({tokens, sessions, authorizeTarget: () => true, supportedCodecs: ["zstd"]}, {
+    type: "session.create",
+    token: token.value,
+    name: "compressed",
+    target: {host: "127.0.0.1", port: 5432},
+    compression: ["zstd"]
+  })
+
+  assert.equal(response.type, "session.created")
+  assert.equal(response.compression, "zstd")
+})
+
+test("handleControlMessage omits compression for a legacy client that offers none", async () => {
+  const {token, tokens, sessions} = await createAuthenticatedStores()
+
+  const response = handleControlMessage({tokens, sessions, authorizeTarget: () => true, supportedCodecs: ["zstd"]}, {
+    type: "session.create",
+    token: token.value,
+    name: "legacy",
+    target: {host: "127.0.0.1", port: 5432}
+  })
+
+  assert.equal(response.type, "session.created")
+  assert.equal("compression" in response, false)
+})
+
+test("handleControlMessage omits compression when the relay supports no codec", async () => {
+  const {token, tokens, sessions} = await createAuthenticatedStores()
+
+  const response = handleControlMessage({tokens, sessions, authorizeTarget: () => true, supportedCodecs: []}, {
+    type: "session.create",
+    token: token.value,
+    name: "disabled",
+    target: {host: "127.0.0.1", port: 5432},
+    compression: ["zstd"]
+  })
+
+  assert.equal(response.type, "session.created")
+  assert.equal("compression" in response, false)
+})
+
+test("handleControlMessage omits compression when no offered codec is supported", async () => {
+  const {token, tokens, sessions} = await createAuthenticatedStores()
+
+  const response = handleControlMessage({tokens, sessions, authorizeTarget: () => true, supportedCodecs: ["zstd"]}, {
+    type: "session.create",
+    token: token.value,
+    name: "unknown codec",
+    target: {host: "127.0.0.1", port: 5432},
+    compression: ["brotli"]
+  })
+
+  assert.equal(response.type, "session.created")
+  assert.equal("compression" in response, false)
+})
+
+test("handleControlMessage renegotiates the stream.data codec on resume", async () => {
+  const {token, tokens, sessions} = await createAuthenticatedStores()
+
+  const created = handleControlMessage({tokens, sessions, authorizeTarget: () => true, supportedCodecs: ["zstd"]}, {
+    type: "session.create",
+    token: token.value,
+    name: "resumable",
+    target: {host: "127.0.0.1", port: 5432},
+    compression: ["zstd"]
+  })
+  assert.equal(created.type, "session.created")
+  const identifier = /** @type {string} */ (created.identifier)
+  sessions.transition(identifier, "active")
+
+  const resumed = handleControlMessage({tokens, sessions, authorizeTarget: () => true, supportedCodecs: ["zstd"]}, {
+    type: "session.resume",
+    token: token.value,
+    identifier,
+    compression: ["zstd"]
+  })
+
+  assert.equal(resumed.type, "session.resumed")
+  assert.equal(resumed.compression, "zstd")
+})
+
+test("handleControlMessage negotiates compact framing v2 only when offered and supported", async () => {
+  const first = await createAuthenticatedStores()
+  const base = {type: "session.create", token: first.token.value, name: "compact", target: {host: "127.0.0.1", port: 80}}
+  const selected = rawHandleControlMessage({tokens: first.tokens, sessions: first.sessions, authorizeTarget: () => true, supportedFraming: [2]}, {...base, framing: [2]})
+  assert.equal(selected.framing, 2)
+
+  const second = await createAuthenticatedStores()
+  const missing = rawHandleControlMessage({tokens: second.tokens, sessions: second.sessions, authorizeTarget: () => true, supportedFraming: [2]}, {...base, token: second.token.value, identifier: "missing-framing"})
+  assert.equal(missing.type, "error")
+  assert.equal(missing.code, "PROTOCOL_VIOLATION")
+  assert.equal(second.sessions.get("missing-framing"), undefined)
+
+  const third = await createAuthenticatedStores()
+  const legacy = rawHandleControlMessage({tokens: third.tokens, sessions: third.sessions, authorizeTarget: () => true, supportedFraming: [2]}, {...base, token: third.token.value, identifier: "legacy-framing", framing: [1]})
+  assert.equal(legacy.type, "error")
+  assert.equal(legacy.code, "PROTOCOL_VIOLATION")
+  assert.equal(third.sessions.get("legacy-framing"), undefined)
+})
+
+test("handleControlMessage rejects legacy resume before authentication or session mutation", async () => {
+  const {token, tokens, sessions} = await createAuthenticatedStores()
+  handleControlMessage({tokens, sessions, authorizeTarget: () => true}, {
+    type: "session.create",
+    token: token.value,
+    name: "resumable",
+    identifier: "resume-framing",
+    target: {host: "127.0.0.1", port: 80}
+  })
+  sessions.transition("resume-framing", "active")
+  sessions.transition("resume-framing", "interrupted")
+
+  let authenticationCalls = 0
+  const response = rawHandleControlMessage({
+    tokens: {authenticate: () => { authenticationCalls += 1; return {userId: "ignored", username: "ignored"} }},
+    sessions,
+    supportedFraming: [2]
+  }, {type: "session.resume", token: "ignored", identifier: "resume-framing", framing: [1]})
+
+  assert.equal(response.type, "error")
+  assert.equal(response.code, "PROTOCOL_VIOLATION")
+  assert.equal(authenticationCalls, 0)
+  assert.equal(sessions.get("resume-framing")?.state, "interrupted")
+})

package/test/unit/server/primary.test.js

@@ -0,0 +1,59 @@
+import assert from "node:assert/strict"
+import test from "node:test"
+
+import {resolveWorkerCount, startPrimary} from "../../../src/server/primary.js"
+
+test("resolveWorkerCount uses configured workers or available CPUs", () => {
+  assert.equal(resolveWorkerCount(3, () => 99), 3)
+  assert.equal(resolveWorkerCount(undefined, () => 4), 4)
+  assert.equal(resolveWorkerCount(undefined, () => 0), 1)
+  assert.throws(() => resolveWorkerCount(0), /Invalid worker count/)
+})
+
+test("startPrimary forks configured workers and restarts exits", () => {
+  /** @type {Array<Record<string, string> | undefined>} */
+  const forks = []
+  /** @type {undefined | ((worker: {id: number}, code: number | null, signal: string | null) => void)} */
+  let exitListener
+  /** @type {string[]} */
+  const warnings = []
+
+  const result = startPrimary({
+    workers: 2,
+    clusterApi: {
+      isPrimary: true,
+      fork: (env) => {
+        forks.push(env)
+        return {id: forks.length}
+      },
+      on: (_event, listener) => {
+        exitListener = listener
+      }
+    },
+    logger: {warn: (message) => warnings.push(message)}
+  })
+
+  assert.deepEqual(result, {role: "primary", workers: 2})
+  assert.deepEqual(forks, [{SOCKETDUCT_WORKER_INDEX: "0"}, {SOCKETDUCT_WORKER_INDEX: "1"}])
+
+  assert.ok(exitListener)
+  exitListener({id: 7}, 1, null)
+  assert.equal(forks.length, 3)
+  assert.equal(warnings.length, 1)
+  assert.match(String(warnings[0]), /worker 7 exited/)
+})
+
+test("startPrimary reports worker role without forking", () => {
+  const result = startPrimary({
+    workers: 2,
+    clusterApi: {
+      isPrimary: false,
+      fork: () => {
+        throw new Error("should not fork from worker")
+      },
+      on: () => {}
+    }
+  })
+
+  assert.deepEqual(result, {role: "worker", workers: 0})
+})