111 lines
4.3 KiB
JavaScript
111 lines
4.3 KiB
JavaScript
// Subdomain routing + auth flow: a per-user `Host: <username>.<baseDomain>` routes
|
||
// to that user's DSH only when the caller's session cookie matches the subdomain.
|
||
import { request as httpRequest } from 'node:http'
|
||
import { mkdirSync, mkdtempSync, rmSync } from 'node:fs'
|
||
import { tmpdir } from 'node:os'
|
||
import { dirname, join } from 'node:path'
|
||
import { fileURLToPath } from 'node:url'
|
||
import { buildServer } from '../lib/web/server.js'
|
||
import { resolveConfig } from '../lib/config.js'
|
||
import { hashPassword } from '../lib/web/auth.js'
|
||
|
||
function assert(condition, message) {
|
||
if (!condition) throw new Error('ASSERT: ' + message)
|
||
}
|
||
|
||
const here = dirname(fileURLToPath(import.meta.url))
|
||
const fakeDsh = join(here, 'fake-dsh.mjs')
|
||
const dataRoot = mkdtempSync(join(tmpdir(), 'dsh-smoke-subdomain-'))
|
||
|
||
const app = await buildServer(
|
||
resolveConfig({ port: 0, dbPath: ':memory:', dataRoot, baseDomain: 'test.local', dshCommand: [process.execPath, fakeDsh] }),
|
||
)
|
||
await app.listen({ port: 0 })
|
||
const port = app.server.address().port
|
||
|
||
await app.db.createUser({
|
||
id: 'u1',
|
||
username: 'Carol',
|
||
passHash: await hashPassword('carolpass123'),
|
||
role: 'active',
|
||
homeDir: '/tmp/u1-home',
|
||
})
|
||
await app.db.createUser({
|
||
id: 'u2',
|
||
username: 'bob',
|
||
passHash: await hashPassword('bobpass123'),
|
||
role: 'active',
|
||
homeDir: '/tmp/u2-home',
|
||
})
|
||
mkdirSync(join(dataRoot, 'users', 'u1', 'ws', 'proj'), { recursive: true })
|
||
|
||
async function json(path, { method = 'GET', body, cookie } = {}) {
|
||
const res = await fetch(`http://127.0.0.1:${port}${path}`, {
|
||
method,
|
||
headers: { ...(body ? { 'content-type': 'application/json' } : {}), ...(cookie ? { cookie } : {}) },
|
||
body: body ? JSON.stringify(body) : undefined,
|
||
})
|
||
const text = await res.text()
|
||
return { status: res.status, body: text ? JSON.parse(text) : null, setCookie: res.headers.get('set-cookie') }
|
||
}
|
||
|
||
function getWithHost(path, host, cookie) {
|
||
return new Promise((resolve, reject) => {
|
||
const req = httpRequest(
|
||
{ hostname: '127.0.0.1', port, path, method: 'GET', headers: { host, ...(cookie ? { cookie } : {}) } },
|
||
(res) => {
|
||
let data = ''
|
||
res.on('data', (chunk) => (data += chunk))
|
||
res.on('end', () => resolve({ status: res.statusCode, body: data }))
|
||
},
|
||
)
|
||
req.on('error', reject)
|
||
req.end()
|
||
})
|
||
}
|
||
|
||
const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))
|
||
|
||
try {
|
||
let r = await json('/api/auth/login', { method: 'POST', body: { username: 'Carol', password: 'carolpass123' } })
|
||
const cookie = r.setCookie.split(';')[0]
|
||
r = await json('/api/auth/login', { method: 'POST', body: { username: 'bob', password: 'bobpass123' } })
|
||
const bobCookie = r.setCookie.split(';')[0]
|
||
|
||
r = await json('/api/dsh/launch', { method: 'POST', cookie, body: { folder: 'proj' } })
|
||
console.log('launch ->', r.status, r.body?.url)
|
||
assert(r.status === 200, 'launch succeeds')
|
||
// 2026-09-15（T08 S3）：夹具 `fake-dsh.mjs` 现在**照实打印带 token 的 URL**（与真实 dsh 一致），
|
||
// 于是这里不能再写死成不带 token 的相等 —— 原断言是"夹具不吐 token"时的意外产物。
|
||
// 保留原意（是子域 URL、不泄露回环端口），并把 token 的存在一并纳入判据。
|
||
assert(r.body.url.startsWith('https://carol.test.local/'), 'launch returns the subdomain URL')
|
||
assert(!r.body.url.includes('127.0.0.1'), 'launch URL must not leak the loopback port')
|
||
|
||
await sleep(200)
|
||
|
||
let res = await getWithHost('/hello', 'carol.test.local', cookie)
|
||
console.log('authed /hello ->', res.status)
|
||
assert(res.status === 200 && res.body.includes('fake-dsh'), 'authed subdomain routes to the DSH')
|
||
|
||
res = await getWithHost('/hello', 'carol.test.local')
|
||
console.log('no-cookie /hello ->', res.status)
|
||
assert(res.status === 401, 'unauthenticated subdomain is rejected')
|
||
|
||
res = await getWithHost('/hello', 'carol.test.local', bobCookie)
|
||
console.log('bob /hello ->', res.status)
|
||
assert(res.status === 403, 'wrong user is rejected')
|
||
|
||
res = await getWithHost('/', `127.0.0.1:${port}`)
|
||
assert(!res.body.includes('fake-dsh'), 'non-subdomain Host does not proxy')
|
||
|
||
console.log('OK: subdomain routing + auth flow passed')
|
||
} finally {
|
||
await app.close()
|
||
await sleep(300)
|
||
try {
|
||
rmSync(dataRoot, { recursive: true, force: true })
|
||
} catch {
|
||
// best-effort cleanup
|
||
}
|
||
}
|