123import { Database } from "bun:sqlite";4import { afterAll, describe, expect, setSystemTime, test } from "bun:test";5import { mkdtemp } from "node:fs/promises";6import { tmpdir } from "node:os";7import { join } from "node:path";8import { createApp } from "../src/server/app.ts";9import { makeBackup } from "../src/server/backup.ts";10import { type Config, parseConfig } from "../src/server/config.ts";11import { openKeprDb } from "../src/server/db.ts";12import { Browser, PASSWORD } from "./browser.ts";1314const ORIGIN = "https://kepr.example";15const WRITE = { accessKeyId: "WRITE-ID", secretAccessKey: "WRITE-SECRET" };1617const HASH = await Bun.password.hash(PASSWORD, "argon2id");18let clock = Date.parse("2026-09-27T12:00:00Z");19setSystemTime(clock);20afterAll(() => setSystemTime());2122async function build(write = true, folder = false) {23 const dataDir = await mkdtemp(join(tmpdir(), "kepr-connect-"));24 const kepr = openKeprDb(dataDir);25 const bucket: Config["bucket"] = folder26 ? { kind: "folder", path: dataDir }27 : {28 kind: "s3",29 endpoint: "https://s3.fr-par.scw.cloud",30 name: "my-bucket",31 region: "fr-par",32 accessKeyId: "read-id",33 secretAccessKey: "read-secret",34 ...(write ? { write: WRITE } : {}),35 };36 const config: Config = {37 domain: "kepr.example",38 dataDir,39 adminPasswordHash: HASH,40 bucket,41 };42 return { app: createApp(config, kepr), kepr, config };43}4445async function connected(write = true) {46 const built = await build(write);47 const browser = new Browser(built.app, `198.51.100.${Math.floor(Math.random() * 200) + 1}`);48 await browser.signIn();49 return { ...built, browser };50}5152async function issue(browser: Browser, machine = "laptop") {53 await browser.get(`/connect?machine=${encodeURIComponent(machine)}`);54 const page = await browser.post("/connect", { machine });55 const body = await page.text();56 const match = /class="mono code">([^<]+)/.exec(body);57 const code = match?.[1]?.trim() ?? "";58 return { page, body, code };59}6061async function redeem(app: ReturnType<typeof createApp>, code: string, address = "203.0.113.77") {62 const browser = new Browser(app, address);63 return browser.post("/api/connect", { code });64}6566describe.serial("connect configuration and page", () => {67 test("parseConfig rejects write keys beside a folder bucket and empty write values", () => {68 const hash = "$argon2id$v=19$m=65536,t=2,p=1$abc$abc";69 expect(() =>70 parseConfig(71 `domain = "kepr.example"\nadmin_password_hash = "${hash}"\n[bucket]\nfolder = "/tmp/x"\n[bucket.write]\naccess_key_id = "x"\nsecret_access_key = "y"`,72 ),73 ).toThrow();74 expect(() =>75 parseConfig(76 `domain = "kepr.example"\nadmin_password_hash = "${hash}"\n[bucket]\nendpoint = "https://x"\nname = "n"\nregion = "r"\naccess_key_id = "a"\nsecret_access_key = "s"\n[bucket.write]\naccess_key_id = ""\nsecret_access_key = "y"`,77 ),78 ).toThrow();79 });8081 test("folder buckets and S3 buckets without write keys hide all connect routes", async () => {82 for (const built of [await build(false), await build(false, true)]) {83 const browser = new Browser(built.app);84 expect((await browser.get("/connect?machine=x")).status).toBe(404);85 expect((await browser.post("/connect", { machine: "x" })).status).toBe(404);86 expect((await browser.post("/api/connect", { code: "ABCDEFGH" })).status).toBe(404);87 }88 });8990 test("a disabled connect route is an unknown path, byte for byte", async () => {91 const { app } = await build(false);92 const browser = new Browser(app);93 for (const [method, path] of [94 ["GET", "/connect?machine=x"],95 ["POST", "/connect"],96 ["POST", "/api/connect"],97 ] as const) {98 const asked = method === "GET" ? browser.get(path) : browser.post(path, {});99 const unknown =100 method === "GET" ? browser.get("/nothing/here") : browser.post("/nothing/here", {});101 const [found, absent] = await Promise.all([asked, unknown]);102 expect(`${found.status} ${await found.text()}`).toBe(103 `${absent.status} ${await absent.text()}`,104 );105 expect(found.headers.get("cache-control")).toBe(absent.headers.get("cache-control"));106 }107 108 const big = { code: "x".repeat(70_000) };109 const oversized = await browser.post("/api/connect", big);110 const unrouted = await browser.post("/nothing/here", big);111 expect(`${oversized.status} ${await oversized.text()}`).toBe(112 `${unrouted.status} ${await unrouted.text()}`,113 );114 expect(oversized.headers.get("cache-control")).toBe(unrouted.headers.get("cache-control"));115 });116117 test("a signed-out request redirects before the machine name is judged", async () => {118 const { app } = await build();119 const browser = new Browser(app);120 const response = await browser.get(`/connect?machine=${encodeURIComponent("x".repeat(65))}`);121 expect(response.status).toBe(302);122 expect(response.headers.get("location")).toBe("/sign-in?next=%2Fconnect");123 });124125 test("connect redirects signed out, preserves next, and rejects unsafe next values", async () => {126 const built = await build();127 const browser = new Browser(built.app);128 const response = await browser.get("/connect?machine=desk%20%26%20rack");129 expect(response.status).toBe(302);130 for (const next of ["https://evil.example", "//evil.example", "/bad\n"]) {131 const sign = await browser.get(`/sign-in?next=${encodeURIComponent(next)}`);132 const html = await sign.text();133 expect(html).toContain('name="next" value="/admin"');134 }135 const sign = await browser.get("/sign-in?next=%2Fconnect%3Fmachine%3Ddesk");136 const form = /name="form" value="([^"]+)"/.exec(await sign.text())?.[1] ?? "";137 const wrong = await browser.request("/sign-in", {138 method: "POST",139 headers: { origin: ORIGIN },140 body: new URLSearchParams({ form, next: "/connect?machine=desk", password: "wrong" }),141 });142 expect(wrong.status).toBe(401);143 expect(await wrong.text()).toContain('name="next" value="/connect?machine=desk"');144 const good = await browser.request("/sign-in", {145 method: "POST",146 headers: { origin: ORIGIN },147 body: new URLSearchParams({ form, next: "/connect?machine=desk", password: PASSWORD }),148 });149 expect(good.status).toBe(303);150 expect(good.headers.get("location")).toBe("/connect?machine=desk");151 });152153 test("connect validates and escapes machine names, and never caches or exposes secrets", async () => {154 const { browser } = await connected();155 for (const machine of ["", "x".repeat(65), "bad\nname", "bad\u0085name", "bad\u202ename"])156 expect((await browser.get(`/connect?machine=${encodeURIComponent(machine)}`)).status).toBe(157 400,158 );159 const result = await issue(browser, "<img src=x onerror=alert(1)>");160 expect(result.page.status).toBe(200);161 expect(result.body).toContain("<img src=x onerror=alert(1)>");162 expect(result.body).not.toContain("WRITE-SECRET");163 expect(result.page.headers.get("cache-control")).toBe("no-store");164 });165});166167describe.serial("connect redemption", () => {168 test("stores only a hash, redeems once with exact credentials, normalizes code, and gives identical failures", async () => {169 const { app, browser, kepr, config } = await connected();170 const { code, body } = await issue(browser, "office");171 expect(code).toMatch(/^[A-Z2-9]{4}-[A-Z2-9]{4}$/);172 expect(body).not.toContain("WRITE-SECRET");173 const row = kepr.query("SELECT code_hash, machine FROM connect_codes").get() as {174 code_hash: string;175 machine: string;176 };177 expect(row.code_hash).toMatch(/^[0-9a-f]{64}$/);178 expect(row.code_hash).not.toContain(code.replace("-", ""));179 expect(row.machine).toBe("office");180 const success = await redeem(app, code.toLowerCase(), "203.0.113.88");181 expect(success.status).toBe(200);182 expect(await success.json()).toEqual({183 endpoint: config.bucket.kind === "s3" ? config.bucket.endpoint : "",184 bucket: "my-bucket",185 region: "fr-par",186 access_key_id: "WRITE-ID",187 secret_access_key: "WRITE-SECRET",188 });189 expect(success.headers.get("cache-control")).toBe("no-store");190 const used = await redeem(app, code, "203.0.113.89");191 const unknown = await redeem(app, "ZZZZ-ZZZZ", "203.0.113.90");192 expect(used.status).toBe(404);193 expect(await used.text()).toBe(await unknown.text());194 expect(used.headers.get("cache-control")).toBe("no-store");195 });196197 test("connect POST requires session, origin and fresh form token", async () => {198 const built = await build();199 const browser = new Browser(built.app);200 expect((await browser.post("/connect", { machine: "x" })).status).toBe(401);201 await browser.signIn();202 expect((await browser.post("/connect", { machine: "x" }, "https://evil.example")).status).toBe(203 403,204 );205 expect((await browser.post("/connect", { machine: "x", form: "stale" })).status).toBe(403);206 });207208 test("expired, malformed and missing codes all return the same no-code response", async () => {209 const { app, browser } = await connected();210 const { code } = await issue(browser);211 clock += 601_000;212 setSystemTime(clock);213 const expired = await redeem(app, code, "198.51.100.201");214 const malformed = await redeem(app, "bad", "198.51.100.202");215 const missing = await new Browser(app, "198.51.100.203").request("/api/connect", {216 method: "POST",217 body: "not-a-form",218 });219 expect(expired.status).toBe(404);220 const expected = await expired.text();221 expect(expected).toBe('{"error":"no_code","message":"no code"}');222 expect(await malformed.text()).toBe(expected);223 expect(await missing.text()).toBe(expected);224 });225226 test("rate limits ten attempts per peer while another peer succeeds", async () => {227 const { app, browser } = await connected();228 const { code } = await issue(browser);229 for (let i = 0; i < 10; i++) await redeem(app, "bad", "192.0.2.40");230 const limited = await redeem(app, code, "192.0.2.40");231 expect(limited.status).toBe(404);232 const other = await redeem(app, code, "192.0.2.41");233 expect(other.status).toBe(200);234 235 clock += 3_601_000;236 setSystemTime(clock);237 const { code: fresh } = await issue(browser, "later");238 expect((await redeem(app, fresh, "192.0.2.40")).status).toBe(200);239 });240241 test("a forged X-Forwarded-For does not buy another bucketful", async () => {242 const { app, browser } = await connected();243 const { code } = await issue(browser);244 for (let i = 0; i < 10; i++) await redeem(app, "bad", "192.0.2.50");245 const forged = await new Browser(app, "192.0.2.50").request("/api/connect", {246 method: "POST",247 headers: {248 "x-forwarded-for": "198.51.100.99",249 "content-type": "application/x-www-form-urlencoded",250 },251 body: new URLSearchParams({ code }),252 });253 expect(forged.status).toBe(404);254 });255256 test("two redemptions at once: exactly one wins", async () => {257 const { app, browser } = await connected();258 const { code } = await issue(browser, "race");259 const [first, second] = await Promise.all([260 redeem(app, code, "203.0.113.101"),261 redeem(app, code, "203.0.113.102"),262 ]);263 expect([first.status, second.status].sort()).toEqual([200, 404]);264 });265266 test("an oversized redemption is refused with the same no-code body", async () => {267 const { app } = await connected();268 const response = await new Browser(app, "192.0.2.60").post("/api/connect", {269 code: "x".repeat(70_000),270 });271 expect(response.status).toBe(404);272 expect(await response.text()).toBe('{"error":"no_code","message":"no code"}');273 expect(response.headers.get("cache-control")).toBe("no-store");274 });275276 test("a backup carries the hashed code and never the write key", async () => {277 const { browser, kepr, config } = await connected();278 const { code } = await issue(browser, "laptop");279 const name = makeBackup(kepr, config.dataDir);280 const file = join(config.dataDir, "backups", name, "kepr.db");281 const copy = new Database(file, { readonly: true });282 const rows = copy.query("SELECT machine, code_hash FROM connect_codes").all();283 copy.close();284 expect(rows.length).toBe(1);285 expect(JSON.stringify(rows)).not.toContain(code.replace("-", ""));286 287 const bytes = await Bun.file(file).bytes();288 expect(new TextDecoder().decode(bytes)).not.toContain("WRITE-SECRET");289 });290});291292describe.serial("connected machines in admin", () => {293 test("lists redeemed machines newest first, at most twenty, with revocation guidance", async () => {294 const { app, browser } = await connected();295 for (let i = 0; i < 22; i++) {296 const { code } = await issue(browser, `machine-${i}`);297 const response = await redeem(app, code, `10.0.0.${i + 1}`);298 expect(response.status).toBe(200);299 clock += 1000;300 setSystemTime(clock);301 }302 const admin = await browser.get("/admin");303 const html = await admin.text();304 expect(html).toContain("Machines connected");305 expect(html).toContain("rotate the write key in Scaleway");306 expect(html).not.toContain("machine-0 ");307 expect(html).toContain("machine-21");308 expect(html.indexOf("machine-21")).toBeLessThan(html.indexOf("machine-20"));309 });310});