209 lines
9.1 KiB
JavaScript
209 lines
9.1 KiB
JavaScript
'use strict';
|
|
|
|
const test = require('node:test');
|
|
const assert = require('node:assert/strict');
|
|
const fs = require('node:fs');
|
|
const os = require('node:os');
|
|
const path = require('node:path');
|
|
const { PassThrough } = require('node:stream');
|
|
|
|
const {
|
|
AppRuntime,
|
|
PairingController,
|
|
createBridgeHandler,
|
|
loadPairingEnvelope,
|
|
} = require('../src/electron-runtime');
|
|
const { APT_EXTENSION_ORIGIN, BridgeAuth } = require('../src/bridge-auth');
|
|
const { createSessionStore } = require('../src/session-store');
|
|
|
|
const ROOT = path.join(__dirname, '..');
|
|
const read = (name) => fs.readFileSync(path.join(ROOT, name), 'utf8');
|
|
|
|
function responseHarness() {
|
|
return {
|
|
statusCode: 0,
|
|
headers: {},
|
|
body: '',
|
|
setHeader(name, value) { this.headers[name.toLowerCase()] = value; },
|
|
writeHead(statusCode, headers = {}) {
|
|
this.statusCode = statusCode;
|
|
for (const [name, value] of Object.entries(headers)) this.setHeader(name, value);
|
|
},
|
|
end(chunk = '') { this.body += chunk; },
|
|
};
|
|
}
|
|
|
|
function requestHarness({ method = 'POST', origin = APT_EXTENSION_ORIGIN, secret, body = '{}' } = {}) {
|
|
const request = new PassThrough();
|
|
request.method = method;
|
|
request.url = '/cookie';
|
|
request.headers = { origin };
|
|
if (secret !== undefined) request.headers['x-apt-pairing'] = secret;
|
|
process.nextTick(() => request.end(body));
|
|
return request;
|
|
}
|
|
|
|
test('runtime keeps Alta credentials in main-owned modules and exposes only non-secret state', async () => {
|
|
const sessionStore = createSessionStore();
|
|
sessionStore.establish('https://customer.avasecurity.com', 'top-secret-cookie');
|
|
const calls = [];
|
|
const proxyManager = {
|
|
launchProxy(request) { calls.push(request); return { success: true, processId: 91, deviceId: request.deviceId, status: 'running' }; },
|
|
stopProxy(processId) { calls.push({ processId }); return { success: true, processId, status: 'stop-requested' }; },
|
|
listTrackedProxies() { return []; },
|
|
};
|
|
const runtime = new AppRuntime({
|
|
sessionStore,
|
|
altaClient: {
|
|
getDevices: async () => [{ guid: '550e8400-e29b-41d4-a716-446655440000' }],
|
|
getDeviceSites: async () => [],
|
|
getAuthInfo: async () => ({ user: 'safe' }),
|
|
},
|
|
proxyManager,
|
|
checkForUpdate: async ({ currentVersion }) => ({ status: 'up-to-date', currentVersion }),
|
|
currentVersion: '1.0.0',
|
|
openExternal: async () => {},
|
|
});
|
|
|
|
assert.deepEqual(await runtime.getDevices(), { success: true, devices: [{ guid: '550e8400-e29b-41d4-a716-446655440000' }] });
|
|
const launched = await runtime.launchProxy('550e8400-e29b-41d4-a716-446655440000');
|
|
assert.equal(launched.success, true);
|
|
assert.deepEqual(calls[0], {
|
|
deploymentHost: 'customer.avasecurity.com',
|
|
cookie: 'top-secret-cookie',
|
|
deviceId: '550e8400-e29b-41d4-a716-446655440000',
|
|
});
|
|
assert.deepEqual(runtime.getConnectionState(), {
|
|
connected: true,
|
|
origin: 'https://customer.avasecurity.com',
|
|
activeProxies: [{ deviceId: '550e8400-e29b-41d4-a716-446655440000', processId: 91 }],
|
|
});
|
|
assert.equal(JSON.stringify(launched).includes('top-secret-cookie'), false);
|
|
assert.equal(JSON.stringify(runtime.getConnectionState()).includes('top-secret-cookie'), false);
|
|
|
|
assert.equal((await runtime.stopProxy('550e8400-e29b-41d4-a716-446655440000')).success, true);
|
|
assert.deepEqual(calls[1], { processId: 91 });
|
|
assert.equal((await runtime.stopProxy(999)).success, false);
|
|
});
|
|
|
|
test('bridge rejects unknown preflight and unauthenticated requests before reading their body', async () => {
|
|
const auth = new BridgeAuth();
|
|
const secret = auth.rotate().secret;
|
|
const sessionStore = createSessionStore();
|
|
let stateNotifications = 0;
|
|
const handler = createBridgeHandler({
|
|
bridgeAuth: auth,
|
|
sessionStore,
|
|
onConnectionStateChanged: () => { stateNotifications += 1; },
|
|
});
|
|
|
|
const unknownPreflight = requestHarness({ method: 'OPTIONS', origin: 'chrome-extension://aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' });
|
|
const unknownResponse = responseHarness();
|
|
await handler(unknownPreflight, unknownResponse);
|
|
assert.equal(unknownResponse.statusCode, 403);
|
|
assert.equal(unknownResponse.headers['access-control-allow-origin'], undefined);
|
|
|
|
const unauthenticated = requestHarness({ body: '{'.repeat(1000) });
|
|
let dataRead = false;
|
|
unauthenticated.on('data', () => { dataRead = true; });
|
|
const unauthenticatedResponse = responseHarness();
|
|
await handler(unauthenticated, unauthenticatedResponse);
|
|
assert.equal(unauthenticatedResponse.statusCode, 403);
|
|
assert.equal(dataRead, false);
|
|
|
|
const allowedPreflight = requestHarness({ method: 'OPTIONS', secret });
|
|
const allowedResponse = responseHarness();
|
|
await handler(allowedPreflight, allowedResponse);
|
|
assert.equal(allowedResponse.statusCode, 204);
|
|
assert.equal(allowedResponse.headers['access-control-allow-origin'], APT_EXTENSION_ORIGIN);
|
|
assert.match(allowedResponse.headers['access-control-allow-headers'], /X-APT-Pairing/);
|
|
|
|
const accepted = requestHarness({
|
|
secret,
|
|
body: JSON.stringify({ deploymentUrl: 'https://customer.avasecurity.com', cookieValue: 'valid-cookie' }),
|
|
});
|
|
const acceptedResponse = responseHarness();
|
|
await handler(accepted, acceptedResponse);
|
|
assert.equal(acceptedResponse.statusCode, 200);
|
|
assert.deepEqual(sessionStore.describe(), { connected: true, origin: 'https://customer.avasecurity.com' });
|
|
assert.equal(stateNotifications, 1);
|
|
assert.equal(acceptedResponse.body.includes('valid-cookie'), false);
|
|
});
|
|
|
|
test('pairing envelope persists with restrictive permissions and secrets are returned once', () => {
|
|
const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'apt-pairing-'));
|
|
const envelopePath = path.join(directory, 'bridge-pairing.json');
|
|
const controller = new PairingController({ envelopePath });
|
|
|
|
const first = controller.initialize();
|
|
assert.equal(first.paired, true);
|
|
assert.match(first.secret, /^[A-Za-z0-9_-]{43}$/);
|
|
assert.deepEqual(controller.getStatus(), { paired: true });
|
|
const persisted = loadPairingEnvelope(envelopePath);
|
|
assert.equal(Object.values(persisted).includes(first.secret), false);
|
|
if (process.platform !== 'win32') assert.equal(fs.statSync(envelopePath).mode & 0o777, 0o600);
|
|
|
|
const rotated = controller.rotate();
|
|
assert.match(rotated.secret, /^[A-Za-z0-9_-]{43}$/);
|
|
assert.notEqual(rotated.secret, first.secret);
|
|
assert.deepEqual(controller.getStatus(), { paired: true });
|
|
controller.revoke();
|
|
assert.deepEqual(controller.getStatus(), { paired: false });
|
|
assert.equal(fs.existsSync(envelopePath), false);
|
|
});
|
|
|
|
test('update runtime is check-only and opens only the fixed GitPeji releases page', async () => {
|
|
const opened = [];
|
|
const runtime = new AppRuntime({
|
|
sessionStore: createSessionStore(),
|
|
altaClient: {},
|
|
proxyManager: {},
|
|
checkForUpdate: async ({ currentVersion }) => ({ status: 'update-available', currentVersion, latestVersion: '1.1.0' }),
|
|
currentVersion: '1.0.0',
|
|
openExternal: async (url) => { opened.push(url); },
|
|
});
|
|
assert.deepEqual(await runtime.checkForUpdates(), {
|
|
success: true,
|
|
status: 'update-available',
|
|
currentVersion: '1.0.0',
|
|
latestVersion: '1.1.0',
|
|
});
|
|
assert.deepEqual(await runtime.openFixedReleasesPage(), { success: true });
|
|
assert.deepEqual(opened, ['https://git.pejicorp.com/peji/Alta-Proxy-Tool/releases']);
|
|
});
|
|
|
|
test('preload and renderer expose only narrow, credential-free contracts', () => {
|
|
const preload = read('preload.js');
|
|
const renderer = read('renderer.js');
|
|
const html = read('index.html');
|
|
const expectedMethods = [
|
|
'getDevices', 'getDeviceSites', 'getAuthInfo', 'launchProxy', 'stopProxy', 'disconnect',
|
|
'getConnectionState', 'checkForUpdates', 'openFixedReleasesPage', 'rotatePairing',
|
|
'revokePairing', 'getPairingStatus', 'onConnectionStateChanged',
|
|
];
|
|
for (const method of expectedMethods) assert.match(preload, new RegExp(`\\b${method}\\b`));
|
|
assert.doesNotMatch(preload, /downloadAndInstall|download-and-install|onUpdateDownloadProgress|onExtensionCookie/);
|
|
assert.doesNotMatch(renderer, /cookieValue|sessionData\.cookies|cookies\s*:/);
|
|
assert.doesNotMatch(html, /id="cookieKey"|updateProgress|Install Update/);
|
|
assert.match(renderer, /openFixedReleasesPage/);
|
|
assert.match(html, /Bridge Pairing/);
|
|
});
|
|
|
|
test('source policy removes legacy credential IPC, shell launch, broad kill, and executable updater', () => {
|
|
const production = ['main.js', 'preload.js', 'renderer.js', 'index.html', 'src/electron-runtime.js']
|
|
.map(read).join('\n');
|
|
const forbidden = [
|
|
/sanitizeBatchInput/, /taskkill/i, /\.bat\b/i, /download-and-install-update/,
|
|
/httpsGetFollowRedirects/, /api\.github\.com/i, /github releases/i,
|
|
/apt-local-bridge-token/, /X-APT-Token/, /cookie-proxy-/,
|
|
];
|
|
for (const pattern of forbidden) assert.doesNotMatch(production, pattern);
|
|
assert.doesNotMatch(read('main.js'), /axios/);
|
|
assert.match(read('main.js'), /event\.sender === webContents/);
|
|
assert.match(read('main.js'), /frame === webContents\.mainFrame/);
|
|
assert.match(read('main.js'), /pathToFileURL\(path\.join\(__dirname, 'index\.html'\)\)/);
|
|
assert.match(read('main.js'), /127\.0\.0\.1/);
|
|
assert.match(read('main.js'), /18247/);
|
|
assert.match(read('main.js'), /shell\.openExternal/);
|
|
});
|