BetterDesk/web-nodejs/tests/privilegedPorts.test.js

'use strict';

const {
    isPrivilegedPort,
    resolvePortForCurrentUser,
    parseEnvPortSettings,
    resolvePanelHealthPort,
    consoleEnvUsesPrivilegedPorts,
    ensureBindCapabilityInServiceUnit,
    serviceUnitHasBindCapability,
    serviceUnitHasBindServiceEnv,
    processHasBindServiceCapability,
    canBindPrivilegedPorts,
    BIND_SERVICE_ENV,
} = require('../lib/privilegedPorts');

describe('privilegedPorts', () => {
    test('isPrivilegedPort detects ports below 1024', () => {
        expect(isPrivilegedPort(443)).toBe(true);
        expect(isPrivilegedPort(80)).toBe(true);
        expect(isPrivilegedPort(1024)).toBe(false);
        expect(isPrivilegedPort(5443)).toBe(false);
    });

    test('parseEnvPortSettings reads HTTPS settings from env content', () => {
        const settings = parseEnvPortSettings([
            'HTTPS_ENABLED=true',
            'HTTPS_PORT=443',
            'PORT=80',
            'HTTP_REDIRECT_HTTPS=false',
        ].join('\n'));
        expect(settings).toEqual({
            port: 80,
            httpsPort: 443,
            httpsEnabled: true,
            httpRedirect: false,
        });
    });

    test('resolvePanelHealthPort uses HTTPS_PORT when HTTPS enabled (not PORT)', () => {
        const settings = parseEnvPortSettings([
            'HTTPS_ENABLED=true',
            'HTTPS_PORT=5443',
            'PORT=5000',
        ].join('\n'));
        expect(resolvePanelHealthPort(settings)).toBe(5443);
    });

    test('resolvePanelHealthPort uses PORT when HTTP mode', () => {
        const settings = parseEnvPortSettings([
            'HTTPS_ENABLED=false',
            'PORT=5000',
            'HTTPS_PORT=5443',
        ].join('\n'));
        expect(resolvePanelHealthPort(settings)).toBe(5000);
    });

    test('consoleEnvUsesPrivilegedPorts detects HTTPS on 443', () => {
        expect(consoleEnvUsesPrivilegedPorts({
            httpsEnabled: true,
            httpsPort: 443,
            port: 5000,
            httpRedirect: true,
        })).toBe(true);
        expect(consoleEnvUsesPrivilegedPorts({
            httpsEnabled: true,
            httpsPort: 5443,
            port: 5000,
            httpRedirect: true,
        })).toBe(false);
    });

    test('ensureBindCapabilityInServiceUnit adds capability and bind-service env', () => {
        const base = [
            '[Service]',
            'User=betterdesk',
            'ExecStart=/usr/bin/node server.js',
        ].join('\n');
        const first = ensureBindCapabilityInServiceUnit(base);
        expect(first.changed).toBe(true);
        expect(serviceUnitHasBindCapability(first.content)).toBe(true);
        expect(serviceUnitHasBindServiceEnv(first.content)).toBe(true);
        expect(first.content).toContain('AmbientCapabilities=CAP_NET_BIND_SERVICE');
        expect(first.content).toContain(`Environment=${BIND_SERVICE_ENV}=1`);

        const second = ensureBindCapabilityInServiceUnit(first.content);
        expect(second.changed).toBe(false);
    });

    test('resolvePortForCurrentUser falls back for privileged ports when not root and no bind capability', () => {
        const originalGetuid = process.getuid;
        const originalEnv = process.env[BIND_SERVICE_ENV];
        process.getuid = () => 1000;
        delete process.env[BIND_SERVICE_ENV];
        try {
            expect(resolvePortForCurrentUser(443, 5443, 'HTTPS')).toBe(5443);
            expect(resolvePortForCurrentUser(80, 5000, 'HTTP')).toBe(5000);
            expect(resolvePortForCurrentUser(5443, 5000, 'HTTPS')).toBe(5443);
        } finally {
            process.getuid = originalGetuid;
            if (originalEnv === undefined) {
                delete process.env[BIND_SERVICE_ENV];
            } else {
                process.env[BIND_SERVICE_ENV] = originalEnv;
            }
        }
    });

    test('resolvePortForCurrentUser keeps privileged port when BETTERDESK_HAS_BIND_SERVICE is set (#219)', () => {
        const originalGetuid = process.getuid;
        const originalEnv = process.env[BIND_SERVICE_ENV];
        process.getuid = () => 1000;
        process.env[BIND_SERVICE_ENV] = '1';
        try {
            expect(resolvePortForCurrentUser(443, 5443, 'HTTPS')).toBe(443);
            expect(resolvePortForCurrentUser(80, 5000, 'HTTP')).toBe(80);
            expect(canBindPrivilegedPorts()).toBe(true);
            expect(processHasBindServiceCapability()).toBe(true);
        } finally {
            process.getuid = originalGetuid;
            if (originalEnv === undefined) {
                delete process.env[BIND_SERVICE_ENV];
            } else {
                process.env[BIND_SERVICE_ENV] = originalEnv;
            }
        }
    });

    test('formatHttpsRedirectUrl omits :443 for standard HTTPS port', () => {
        const { formatHttpsRedirectUrl } = require('../lib/privilegedPorts');
        expect(formatHttpsRedirectUrl('desk.example.com', 443, '/login')).toBe('https://desk.example.com/login');
        expect(formatHttpsRedirectUrl('desk.example.com', 5443, '/login')).toBe('https://desk.example.com:5443/login');
        expect(formatHttpsRedirectUrl('desk.example.com', 5443, '')).toBe('https://desk.example.com:5443/');
    });
});