feat(proxy): idempotent interactive installer; retire credential-embedding legacy scripts
install.js (node, replaces install_proxy.sh + setup.js + update_*.sh + get_proxy.sh): - sections: preflight, deploy, config import/create, credentials, legacy migration, systemd unit, system-wide proxy (bashrc/apt/docker/snapd/ollama), verify - idempotent: re-run converges; tests prove a second non-interactive run shows zero CHANGED - imports existing /opt configs non-destructively; asks before changing - credentials: prompted when keyring entry missing; verified with ONE CONNECT round-trip before storing; 407 responses are never stored (anti-lockout); unreachable upstream stores nothing - legacy migration: removes bashrc #PROXY_A93JK2 line + plaintext-cred files, rewrites cred-embedding apt/snap/service drop-ins to the bridge URL - flags: --dry-run, --non-interactive (fails listing missing info), --no-systemd Tests cover dry-run-no-op, idempotency, verify-store-on-200, refuse-on-407.
This commit is contained in:
tke committed
1 parent
c514f32661
commit
3f9be30784
8 files changed
+711
-380
No files matched your search
@@ -0,0 +1,157 @@
|
||||
const assert = require('node:assert/strict');
|
||||
const { once } = require('node:events');
|
||||
const { spawnSync, spawn } = require('node:child_process');
|
||||
const fs = require('node:fs');
|
||||
const net = require('node:net');
|
||||
const os = require('node:os');
|
||||
const path = require('node:path');
|
||||
const { test } = require('node:test');
|
||||
|
||||
const INSTALLER = path.join(__dirname, 'install.js');
|
||||
const PROXY_DIR = __dirname;
|
||||
|
||||
function mkTmp(t) {
|
||||
const dirs = {
|
||||
bridge: fs.mkdtempSync(path.join(os.tmpdir(), 'pi-bridge-')),
|
||||
bin: fs.mkdtempSync(path.join(os.tmpdir(), 'pi-bin-')),
|
||||
systemd: fs.mkdtempSync(path.join(os.tmpdir(), 'pi-systemd-')),
|
||||
home: fs.mkdtempSync(path.join(os.tmpdir(), 'pi-home-')),
|
||||
apt: fs.mkdtempSync(path.join(os.tmpdir(), 'pi-apt-')),
|
||||
};
|
||||
t.after(() => Object.values(dirs).forEach(d => fs.rmSync(d, { recursive: true, force: true })));
|
||||
return dirs;
|
||||
}
|
||||
|
||||
function envFor(dirs) {
|
||||
return {
|
||||
...process.env,
|
||||
PROXY_BRIDGE_DIR: dirs.bridge,
|
||||
PROXY_BRIDGE_BIN_DIR: dirs.bin,
|
||||
PROXY_BRIDGE_SYSTEMD_USER_DIR: dirs.systemd,
|
||||
PROXY_BRIDGE_BASHRC: path.join(dirs.home, '.bashrc'),
|
||||
PROXY_BRIDGE_APT_CONF: path.join(dirs.apt, '80proxy-bridge'),
|
||||
};
|
||||
}
|
||||
|
||||
function runInstaller(t, dirs, extraArgs = []) {
|
||||
const r = spawnSync('node', [INSTALLER, '--no-systemd', ...extraArgs], {
|
||||
env: envFor(dirs),
|
||||
encoding: 'utf8',
|
||||
timeout: 60000,
|
||||
input: '', // no stdin: any interactive prompt must not be reached in these non-interactive paths
|
||||
});
|
||||
r.stdout = String(r.stdout).replace(/\x1b\[[0-9;]*m/g, '');
|
||||
r.stderr = String(r.stderr || '').replace(/\x1b\[[0-9;]*m/g, '');
|
||||
return r;
|
||||
}
|
||||
|
||||
// Async variant: use whenever the test process itself hosts a TCP stub server —
|
||||
// spawnSync would block the event loop and the stub would never answer.
|
||||
function runInstallerAsync(t, dirs, { args = [], stdinLines = [] } = {}) {
|
||||
return new Promise((resolve, reject) => {
|
||||
const child = spawn('node', [INSTALLER, '--no-systemd', ...args], { env: envFor(dirs) });
|
||||
let stdout = '';
|
||||
let stderr = '';
|
||||
child.stdout.on('data', d => { stdout += d; });
|
||||
child.stderr.on('data', d => { stderr += d; });
|
||||
const timer = setTimeout(() => { child.kill(); reject(new Error('installer hung')); }, 55000);
|
||||
child.on('exit', code => {
|
||||
clearTimeout(timer);
|
||||
resolve({
|
||||
status: code,
|
||||
stdout: stdout.replace(/\x1b\[[0-9;]*m/g, ''),
|
||||
stderr: stderr.replace(/\x1b\[[0-9;]*m/g, ''),
|
||||
});
|
||||
});
|
||||
// Feed stdin with a small delay so readline has attached before lines arrive.
|
||||
let i = 0;
|
||||
const feed = () => {
|
||||
if (i >= stdinLines.length) { try { child.stdin.end(); } catch {} return; }
|
||||
child.stdin.write(stdinLines[i++] + '\n');
|
||||
setTimeout(feed, 150);
|
||||
};
|
||||
setTimeout(feed, 300);
|
||||
});
|
||||
}
|
||||
|
||||
test('dry-run changes nothing on disk', { timeout: 30000 }, async t => {
|
||||
const dirs = mkTmp(t);
|
||||
const r = runInstaller(t, dirs, ['--dry-run', '--non-interactive']);
|
||||
// non-interactive with no imported config -> CONFIG section reports FAILED by design; fine for this test
|
||||
assert.equal(fs.readdirSync(dirs.bridge).length, 0, 'bridge dir must stay empty in dry-run');
|
||||
assert.equal(fs.readdirSync(dirs.bin).length, 0, 'bin dir must stay empty in dry-run');
|
||||
assert.equal(fs.readdirSync(dirs.systemd).length, 0, 'systemd dir must stay empty in dry-run');
|
||||
assert.ok(!fs.existsSync(path.join(dirs.home, '.bashrc')), 'bashrc must not be created in dry-run');
|
||||
assert.match(r.stdout, /Dry run: no changes were made\./);
|
||||
});
|
||||
|
||||
test('import-only run is idempotent: second run reports zero CHANGED', { timeout: 60000 }, async t => {
|
||||
const dirs = mkTmp(t);
|
||||
// Seed an 'imported' config the way the live /opt has it
|
||||
fs.writeFileSync(path.join(dirs.bridge, 'config.json'), JSON.stringify({ enabled: true, host: '127.0.0.1', port: '1' }));
|
||||
fs.writeFileSync(path.join(dirs.bridge, 'user.json'), JSON.stringify({ username: 'seeded-user' }));
|
||||
// Seed bashrc with the EXACT bridge block the installer would write (idempotency target)
|
||||
fs.writeFileSync(path.join(dirs.home, '.bashrc'),
|
||||
`\n# Local Proxy Bridge Configuration #PROXY_BRIDGE_CONFIG\nexport http_proxy="http://127.0.0.1:8888/"\nexport https_proxy="http://127.0.0.1:8888/"\nexport HTTP_PROXY="http://127.0.0.1:8888/"\nexport HTTPS_PROXY="http://127.0.0.1:8888/"\nexport NO_PROXY="localhost,127.0.0.1,::1"\nexport no_proxy="localhost,127.0.0.1,::1"\n`);
|
||||
// Seed the apt conf the installer would want (no sudo needed: our APT_CONF is a tmp path)
|
||||
fs.writeFileSync(path.join(dirs.apt, '80proxy-bridge'),
|
||||
`Acquire::http::Proxy "http://127.0.0.1:8888/";\nAcquire::https::Proxy "http://127.0.0.1:8888/";\n`);
|
||||
|
||||
const r1 = runInstaller(t, dirs, ['--non-interactive']);
|
||||
assert.equal(r1.status, 1, JSON.stringify(r1.stdout + r1.stderr)); // creds missing -> expected FAILED in this seed
|
||||
assert.match(r1.stdout, /\[OK\] Runtime config/);
|
||||
assert.match(r1.stdout, /\[FAILED\] Credentials/); // no keyring entry for seeded-user; correct
|
||||
|
||||
// Second run must show zero CHANGED in the sections that did run
|
||||
const r2 = runInstaller(t, dirs, ['--non-interactive']);
|
||||
const changedLines = r2.stdout.split('\n').filter(l => l.includes('[CHANGED]'));
|
||||
assert.deepEqual(changedLines, [], `second run must be a no-op, got CHANGED: ${changedLines.join(' | ')}`);
|
||||
});
|
||||
|
||||
test('credential verification: 200 from upstream stores the password (junk test account)', { timeout: 60000 }, async t => {
|
||||
const dirs = mkTmp(t);
|
||||
const account = `bridge-test-${process.pid}`;
|
||||
// Stub "upstream" that accepts any creds once
|
||||
const upstream = net.createServer(socket => {
|
||||
socket.once('data', () => {
|
||||
socket.end('HTTP/1.1 200 Connection Established\r\n\r\n');
|
||||
});
|
||||
});
|
||||
upstream.listen(0, '127.0.0.1');
|
||||
await once(upstream, 'listening');
|
||||
t.after(() => upstream.close());
|
||||
const port = upstream.address().port;
|
||||
|
||||
fs.writeFileSync(path.join(dirs.bridge, 'config.json'), JSON.stringify({ enabled: true, host: '127.0.0.1', port: String(port) }));
|
||||
fs.writeFileSync(path.join(dirs.bridge, 'user.json'), JSON.stringify({ username: account }));
|
||||
fs.writeFileSync(path.join(dirs.home, '.bashrc'), '');
|
||||
|
||||
const r = await runInstallerAsync(t, dirs, { stdinLines: ['junk-test-password-not-real', 'n'] });
|
||||
// creds stored via real secret-tool; clean up regardless of outcome
|
||||
spawnSync('secret-tool', ['clear', 'service', 'proxy-bridge', 'account', account], { encoding: 'utf8' });
|
||||
assert.match(r.stdout, /\[OK\] Credentials|\[CHANGED\] Credentials/);
|
||||
assert.match(r.stdout, /credentials verified against upstream and stored/);
|
||||
});
|
||||
|
||||
test('credential verification: 407 from upstream does NOT store and reports FAILED', { timeout: 60000 }, async t => {
|
||||
const dirs = mkTmp(t);
|
||||
const account = `bridge-test407-${process.pid}`;
|
||||
const upstream = net.createServer(socket => {
|
||||
socket.once('data', () => socket.end('HTTP/1.1 407 Proxy Authentication Required\r\n\r\n'));
|
||||
});
|
||||
upstream.listen(0, '127.0.0.1');
|
||||
await once(upstream, 'listening');
|
||||
t.after(() => upstream.close());
|
||||
const port = upstream.address().port;
|
||||
|
||||
fs.writeFileSync(path.join(dirs.bridge, 'config.json'), JSON.stringify({ enabled: true, host: '127.0.0.1', port: String(port) }));
|
||||
fs.writeFileSync(path.join(dirs.bridge, 'user.json'), JSON.stringify({ username: account }));
|
||||
fs.writeFileSync(path.join(dirs.home, '.bashrc'), '');
|
||||
|
||||
const r = await runInstallerAsync(t, dirs, { stdinLines: ['wrong1', 'wrong2', 'wrong3', 'n'] });
|
||||
// make sure nothing was stored for this account
|
||||
const check = spawnSync('secret-tool', ['lookup', 'service', 'proxy-bridge', 'account', account], { encoding: 'utf8' });
|
||||
assert.notEqual(check.status, 0, 'no keyring entry must exist for rejected creds');
|
||||
assert.match(r.stdout, /\[FAILED\] Credentials/);
|
||||
assert.match(r.stdout, /nothing stored/i);
|
||||
});
|
||||
Reference in new issue
Block a user