49 lines
3.4 KiB
TypeScript
Executable File
49 lines
3.4 KiB
TypeScript
Executable File
import test from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { trustedProxies, operationsPort, startOperations } from '../server/operations.ts';
|
|
import express from 'express';
|
|
import { once } from 'node:events';
|
|
import { createServer } from 'node:net';
|
|
import { checkOperations } from '../server/operations-check.ts';
|
|
|
|
test('proxy trust is explicit literal IP/CIDR only; defaults disabled',()=>{
|
|
assert.deepEqual(trustedProxies({}),[]);
|
|
assert.deepEqual(trustedProxies({WIKIDECK_TRUSTED_PROXIES:'127.0.0.1,::1,172.20.1.0/24'}),['127.0.0.1','::1','172.20.1.0/24']);
|
|
for(const value of ['true','1','loopback','localhost','0.0.0.0/0','::/0','127.0.0.1/33','127.0.0.1,','http://proxy'])assert.throws(()=>trustedProxies({WIKIDECK_TRUSTED_PROXIES:value}));
|
|
assert.equal(operationsPort({}),undefined);
|
|
for(const value of ['0','-1','65536','x'])assert.throws(()=>operationsPort({WIKIDECK_OPS_PORT:value}));
|
|
});
|
|
test('untrusted forwarded headers do not alter client IP; explicit loopback proxy is recognized',async t=>{
|
|
const app=express();app.get('/ip',(req,res)=>{res.json({ip:req.ip});});
|
|
const server=app.listen(0,'127.0.0.1');await once(server,'listening');
|
|
t.after(()=>{server.closeAllConnections();server.close();});
|
|
const a=server.address();assert.ok(a&&typeof a==='object');const url=`http://127.0.0.1:${a.port}/ip`;
|
|
const request=()=>fetch(url,{headers:{'X-Forwarded-For':'203.0.113.12'}}).then(r=>r.json());
|
|
assert.equal((await request()).ip,'127.0.0.1');
|
|
app.set('trust proxy',trustedProxies({WIKIDECK_TRUSTED_PROXIES:'127.0.0.1'}));
|
|
assert.equal((await request()).ip,'203.0.113.12');
|
|
});
|
|
test('private operations listener exposes bounded aggregates only on separate loopback port',async t=>{
|
|
const reserve=createServer();reserve.listen(0,'127.0.0.1');await once(reserve,'listening');
|
|
const a=reserve.address();assert.ok(a&&typeof a==='object');await new Promise<void>(resolve=>reserve.close(()=>resolve()));
|
|
const ops=startOperations(a.port,()=>({network:'test',native:{available:true}}));t.after(()=>ops.close());
|
|
const r=await fetch(`http://127.0.0.1:${a.port}/status`,{signal:AbortSignal.timeout(5000)});
|
|
assert.equal(r.status,200);assert.equal(r.headers.get('cache-control'),'no-store');
|
|
const data=await r.json();assert.equal(data.network,'test');assert.equal(data.native.available,true);
|
|
assert.ok(data.nodeRssBytes>0);assert.equal('privateKey' in data,false);
|
|
assert.equal((await fetch(`http://127.0.0.1:${a.port}/metrics`)).status,404);
|
|
assert.equal(ops.address?.()?.address,'127.0.0.1');
|
|
});
|
|
test('operations checks identify node, peer, native-engine, and disk pressure',()=>{
|
|
const now=Date.now();
|
|
const status={schema:'wikideck-operations-v1',observedAt:new Date(now).toISOString(),
|
|
native:{available:true,queued:0},ledger:{height:10,mutationQueue:0,tipAgeSeconds:60},
|
|
peers:{configured:2,connected:2},eventLoop:{meanMs:20},disk:{availableBytes:1024**3},diskSampledAt:now};
|
|
assert.equal(checkOperations(status,now).healthy,true);
|
|
const bad={...status,native:{available:false,queued:50},peers:{configured:2,connected:0},disk:null,
|
|
ledger:{...status.ledger,mutationQueue:192}};
|
|
const report=checkOperations(bad,now);
|
|
for(const warning of ['native-engine-unavailable','queue-pressure','peer-isolation','disk-sample-unavailable-or-stale'])assert.ok(report.warnings.includes(warning));
|
|
assert.throws(()=>checkOperations({}));
|
|
});
|