troxy-cli 1.29.2 → 1.29.4

package/src/tests/interception-config.test.js

@@ -0,0 +1,203 @@
+// patchClaudeCodeInterception / unpatchClaudeCodeInterception /
+// interceptionIsConfigured - Layer 3 of the Live Model Policy Enforcement
+// plan. Writes HTTPS_PROXY + NODE_EXTRA_CA_CERTS into Claude Code's global
+// settings.json so BOTH terminal `claude` and the Desktop app's Code tab
+// (which hard-overrides ANTHROPIC_BASE_URL, unlike these two) route through
+// the local interceptor. Modeled directly on claude-code-proxy.test.js's
+// coverage of patchClaudeCodeProxy - same idempotency/preservation/corrupt-
+// JSON guarantees are required here too, since both patch the same file.
+
+import { describe, it, beforeEach, afterEach } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+import {
+  patchClaudeCodeInterception, unpatchClaudeCodeInterception, interceptionIsConfigured,
+  troxyInterceptorProxyUrl, troxyLocalCaCertPath,
+} from '../init.js';
+
+let dir;
+beforeEach(() => { dir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-interception-cfg-')); });
+afterEach(() => { fs.rmSync(dir, { recursive: true, force: true }); });
+
+describe('troxyInterceptorProxyUrl / troxyLocalCaCertPath', () => {
+  it('builds a loopback URL from the given port', () => {
+    assert.equal(troxyInterceptorProxyUrl(12345), 'http://127.0.0.1:12345');
+  });
+
+  it('defaults to the daemon\'s real INTERCEPTOR_PORT when no port is given', () => {
+    assert.match(troxyInterceptorProxyUrl(), /^http:\/\/127\.0\.0\.1:\d+$/);
+  });
+
+  it('builds the CA cert path under <troxyDir>/tls/', () => {
+    assert.equal(
+      troxyLocalCaCertPath('/tmp/fake-troxy-dir'),
+      path.join('/tmp/fake-troxy-dir', 'tls', 'troxy-local-ca.crt'),
+    );
+  });
+});
+
+describe('patchClaudeCodeInterception', () => {
+  const configPath = () => path.join(dir, 'settings.json');
+  const read = () => JSON.parse(fs.readFileSync(configPath(), 'utf8'));
+  const OPTS = { proxyUrl: 'http://127.0.0.1:48173', caCertPath: '/home/x/.troxy/tls/troxy-local-ca.crt' };
+
+  it('creates the env block with HTTPS_PROXY + NODE_EXTRA_CA_CERTS when the file does not exist', () => {
+    patchClaudeCodeInterception(configPath(), OPTS);
+    const cfg = read();
+    assert.equal(cfg.env.HTTPS_PROXY, OPTS.proxyUrl);
+    assert.equal(cfg.env.NODE_EXTRA_CA_CERTS, OPTS.caCertPath);
+  });
+
+  it('uses real default values (troxyInterceptorProxyUrl/troxyLocalCaCertPath) when no options are given', () => {
+    patchClaudeCodeInterception(configPath());
+    const cfg = read();
+    assert.equal(cfg.env.HTTPS_PROXY, troxyInterceptorProxyUrl());
+    assert.equal(cfg.env.NODE_EXTRA_CA_CERTS, troxyLocalCaCertPath());
+  });
+
+  it('preserves unrelated existing env keys instead of replacing the whole block', () => {
+    fs.writeFileSync(configPath(), JSON.stringify({ env: { SOME_OTHER_VAR: 'keep-me' } }));
+    patchClaudeCodeInterception(configPath(), OPTS);
+    const cfg = read();
+    assert.equal(cfg.env.SOME_OTHER_VAR, 'keep-me');
+    assert.equal(cfg.env.HTTPS_PROXY, OPTS.proxyUrl);
+  });
+
+  it('preserves the base-URL proxy env keys (ANTHROPIC_BASE_URL etc.) set by patchClaudeCodeProxy - both can coexist', () => {
+    fs.writeFileSync(configPath(), JSON.stringify({
+      env: { ANTHROPIC_BASE_URL: 'https://proxy.troxy.io', ANTHROPIC_AUTH_TOKEN: 'txy-abc', ENABLE_TOOL_SEARCH: 'true' },
+    }));
+    patchClaudeCodeInterception(configPath(), OPTS);
+    const cfg = read();
+    assert.equal(cfg.env.ANTHROPIC_BASE_URL, 'https://proxy.troxy.io');
+    assert.equal(cfg.env.ANTHROPIC_AUTH_TOKEN, 'txy-abc');
+    assert.equal(cfg.env.HTTPS_PROXY, OPTS.proxyUrl);
+  });
+
+  it('preserves unrelated top-level keys (e.g. hooks already written by patchClaudeCodeHooks)', () => {
+    fs.writeFileSync(configPath(), JSON.stringify({ hooks: { Stop: [{ hooks: [{ command: 'x' }] }] } }));
+    patchClaudeCodeInterception(configPath(), OPTS);
+    const cfg = read();
+    assert.equal(cfg.hooks.Stop.length, 1, 'existing hooks block was dropped');
+    assert.equal(cfg.env.HTTPS_PROXY, OPTS.proxyUrl);
+  });
+
+  it('re-running is idempotent - overwrites rather than duplicating or erroring', () => {
+    patchClaudeCodeInterception(configPath(), OPTS);
+    patchClaudeCodeInterception(configPath(), OPTS);
+    const cfg = read();
+    assert.equal(cfg.env.HTTPS_PROXY, OPTS.proxyUrl);
+    assert.equal(cfg.env.NODE_EXTRA_CA_CERTS, OPTS.caCertPath);
+  });
+
+  it('does not throw when the existing file is corrupted JSON', () => {
+    fs.writeFileSync(configPath(), '{ not json');
+    assert.doesNotThrow(() => patchClaudeCodeInterception(configPath(), OPTS));
+  });
+
+  it('creates the parent directory when the settings file does not exist yet', () => {
+    const nested = path.join(dir, 'nested', 'dir', 'settings.json');
+    assert.doesNotThrow(() => patchClaudeCodeInterception(nested, OPTS));
+    assert.ok(fs.existsSync(nested));
+  });
+});
+
+describe('unpatchClaudeCodeInterception', () => {
+  const configPath = () => path.join(dir, 'settings.json');
+  const read = () => JSON.parse(fs.readFileSync(configPath(), 'utf8'));
+  const OPTS = { proxyUrl: 'http://127.0.0.1:48173', caCertPath: '/home/x/.troxy/tls/troxy-local-ca.crt' };
+
+  it('removes exactly HTTPS_PROXY and NODE_EXTRA_CA_CERTS - the documented `troxy proxy disable` recovery', () => {
+    patchClaudeCodeInterception(configPath(), OPTS);
+    unpatchClaudeCodeInterception(configPath());
+    const cfg = read();
+    assert.equal(cfg.env.HTTPS_PROXY, undefined);
+    assert.equal(cfg.env.NODE_EXTRA_CA_CERTS, undefined);
+  });
+
+  it('leaves the base-URL proxy env keys untouched - the two mechanisms are independent', () => {
+    fs.writeFileSync(configPath(), JSON.stringify({
+      env: { ANTHROPIC_BASE_URL: 'https://proxy.troxy.io', ANTHROPIC_AUTH_TOKEN: 'txy-abc' },
+    }));
+    patchClaudeCodeInterception(configPath(), OPTS);
+    unpatchClaudeCodeInterception(configPath());
+    const cfg = read();
+    assert.equal(cfg.env.ANTHROPIC_BASE_URL, 'https://proxy.troxy.io');
+    assert.equal(cfg.env.ANTHROPIC_AUTH_TOKEN, 'txy-abc');
+  });
+
+  it('leaves unrelated env keys and top-level keys (e.g. hooks) untouched', () => {
+    fs.writeFileSync(configPath(), JSON.stringify({
+      env: { SOME_OTHER_VAR: 'keep-me' },
+      hooks: { Stop: [{ hooks: [{ command: 'x' }] }] },
+    }));
+    patchClaudeCodeInterception(configPath(), OPTS);
+    unpatchClaudeCodeInterception(configPath());
+    const cfg = read();
+    assert.equal(cfg.env.SOME_OTHER_VAR, 'keep-me');
+    assert.equal(cfg.hooks.Stop.length, 1);
+  });
+
+  it('does not throw and does not create a file when called against a non-existent settings file', () => {
+    assert.doesNotThrow(() => unpatchClaudeCodeInterception(configPath()));
+    assert.equal(fs.existsSync(configPath()), false);
+  });
+
+  it('does not throw when the existing file is corrupted JSON', () => {
+    fs.writeFileSync(configPath(), '{ not json');
+    assert.doesNotThrow(() => unpatchClaudeCodeInterception(configPath()));
+  });
+
+  it('is idempotent - calling twice is safe', () => {
+    patchClaudeCodeInterception(configPath(), OPTS);
+    unpatchClaudeCodeInterception(configPath());
+    assert.doesNotThrow(() => unpatchClaudeCodeInterception(configPath()));
+  });
+});
+
+describe('interceptionIsConfigured', () => {
+  const configPath = () => path.join(dir, 'settings.json');
+  const OPTS = { proxyUrl: 'http://127.0.0.1:48173', caCertPath: '/home/x/.troxy/tls/troxy-local-ca.crt' };
+
+  it('is false against a non-existent settings file', () => {
+    assert.equal(interceptionIsConfigured(configPath(), OPTS), false);
+  });
+
+  it('is false when the file exists but has no env block at all', () => {
+    fs.writeFileSync(configPath(), JSON.stringify({ hooks: {} }));
+    assert.equal(interceptionIsConfigured(configPath(), OPTS), false);
+  });
+
+  it('is true once patched with the exact same proxyUrl/caCertPath', () => {
+    patchClaudeCodeInterception(configPath(), OPTS);
+    assert.equal(interceptionIsConfigured(configPath(), OPTS), true);
+  });
+
+  it('is false when the configured port has moved - only an exact match counts', () => {
+    patchClaudeCodeInterception(configPath(), OPTS);
+    assert.equal(
+      interceptionIsConfigured(configPath(), { ...OPTS, proxyUrl: 'http://127.0.0.1:9999' }),
+      false,
+    );
+  });
+
+  it('is false when only one of the two keys is set (partial/corrupted state)', () => {
+    fs.writeFileSync(configPath(), JSON.stringify({ env: { HTTPS_PROXY: OPTS.proxyUrl } }));
+    assert.equal(interceptionIsConfigured(configPath(), OPTS), false);
+  });
+
+  it('is false again after unpatch - this is the check `troxy proxy enable` uses to avoid a no-op re-prompt, and the inverse also holds', () => {
+    patchClaudeCodeInterception(configPath(), OPTS);
+    unpatchClaudeCodeInterception(configPath());
+    assert.equal(interceptionIsConfigured(configPath(), OPTS), false);
+  });
+
+  it('does not throw when the existing file is corrupted JSON', () => {
+    fs.writeFileSync(configPath(), '{ not json');
+    assert.doesNotThrow(() => interceptionIsConfigured(configPath(), OPTS));
+    assert.equal(interceptionIsConfigured(configPath(), OPTS), false);
+  });
+});