69 lines
3.5 KiB
JavaScript
69 lines
3.5 KiB
JavaScript
import assert from "node:assert/strict";
|
|
import { readFile } from "node:fs/promises";
|
|
import test from "node:test";
|
|
import {
|
|
buildDaemonRegistrationCommand,
|
|
daemonStartCommand,
|
|
quoteBash,
|
|
quotePowerShell,
|
|
resolveConnectOrigin,
|
|
} from "../app/dashboard/hosts/new/onboarding.ts";
|
|
|
|
test("builds a PowerShell registration command without embedding the bootstrap token", () => {
|
|
const command = buildDaemonRegistrationCommand({
|
|
os: "windows",
|
|
connectOrigin: "https://connect.example.test",
|
|
hostName: "家里'; Remove-Item *; '电脑",
|
|
});
|
|
|
|
assert.match(command, /NEKONEST_SERVER = 'https:\/\/connect\.example\.test'/);
|
|
assert.match(command, /NEKONEST_TRANSPORT_MODE = 'sealed'/);
|
|
assert.match(command, /Read-Host '粘贴一次性配对码' -AsSecureString/);
|
|
assert.match(command, /SecureStringToBSTR/);
|
|
assert.match(command, /PtrToStringBSTR/);
|
|
assert.match(command, /IsNullOrWhiteSpace/);
|
|
assert.match(command, /-register -name '家里''; Remove-Item \*; ''电脑'/);
|
|
assert.match(command, /finally[\s\S]*Remove-Item Env:NEKONEST_BOOTSTRAP_TOKEN[\s\S]*ZeroFreeBSTR/);
|
|
assert.doesNotMatch(command, /bootstrap-token-value/);
|
|
assert.equal(quotePowerShell("a'b"), "'a''b'");
|
|
assert.equal(daemonStartCommand("windows"), ".\\nekonest-daemon.exe");
|
|
});
|
|
|
|
test("builds a Bash subshell that drops the secret environment after registration", () => {
|
|
const command = buildDaemonRegistrationCommand({
|
|
os: "linux",
|
|
connectOrigin: "https://connect.example.test",
|
|
hostName: "home'; rm -rf /; 'pc",
|
|
});
|
|
|
|
assert.match(command, /^\([\s\S]*\)$/);
|
|
assert.match(command, /read -rsp/);
|
|
assert.match(command, /\[ -z "\$NEKONEST_BOOTSTRAP_TOKEN" \][\s\S]*exit 1/);
|
|
assert.match(command, /export NEKONEST_BOOTSTRAP_TOKEN/);
|
|
assert.match(command, /\.\/nekonest-daemon -register -name 'home'"'"'; rm -rf \/; '"'"'pc'/);
|
|
assert.equal(quoteBash("a'b"), `'a'"'"'b'`);
|
|
assert.equal(daemonStartCommand("linux"), "./nekonest-daemon");
|
|
});
|
|
|
|
test("rejects non-origin and insecure public control-plane addresses", () => {
|
|
const base = { os: "linux", hostName: "home" };
|
|
assert.throws(() => buildDaemonRegistrationCommand({ ...base, connectOrigin: "http://cloud.example.test" }), /HTTPS origin/);
|
|
assert.throws(() => buildDaemonRegistrationCommand({ ...base, connectOrigin: "https://cloud.example.test/path" }), /HTTPS origin/);
|
|
assert.doesNotThrow(() => buildDaemonRegistrationCommand({ ...base, connectOrigin: "http://127.0.0.1:3000" }));
|
|
assert.equal(resolveConnectOrigin("https://connect.example.test", false), "https://connect.example.test");
|
|
assert.throws(() => resolveConnectOrigin(undefined, false), /CONNECT_ORIGIN is required/);
|
|
assert.equal(resolveConnectOrigin(undefined, true), "http://127.0.0.1:3000");
|
|
});
|
|
|
|
test("keeps the one-time token out of generated commands and browser persistence", async () => {
|
|
const form = await readFile(new URL("../app/dashboard/hosts/new/PairingForm.tsx", import.meta.url), "utf8");
|
|
const helper = await readFile(new URL("../app/dashboard/hosts/new/onboarding.ts", import.meta.url), "utf8");
|
|
assert.match(form, /navigator\.clipboard\?\.writeText/);
|
|
assert.match(form, /浏览器未允许自动复制/);
|
|
assert.match(form, /onFocus=\{\(event\) => event\.currentTarget\.select\(\)\}/);
|
|
assert.doesNotMatch(`${form}\n${helper}`, /localStorage|sessionStorage/);
|
|
assert.doesNotMatch(helper, /bootstrapToken/);
|
|
assert.doesNotMatch(form, /window\.location\.origin/);
|
|
assert.match(form, /一次性码不会拼进命令、URL 或浏览器存储/);
|
|
});
|