sencho/backend/src/__tests__/mesh-proxy-tunnel-from-peer.test.ts

/**
 * `meshProxyTunnelFromPeer.ts`: central-side ingress for peer-initiated
 * dial-back tunnels. Validates the chain of JWT claims and node-state
 * preconditions that the peer's `mesh_tunnel` bootstrap token must satisfy
 * before the upgrade succeeds and a proxy bridge is registered.
 *
 * The chain (in order): algorithm whitelist, signature, scope, audience
 * (= SENCHO_PRIMARY_URL), issuer (= central instance_id), exp, iat clock
 * skew (60s), node existence, mode==proxy, api_token fingerprint match.
 * Every failure point returns HTTP 401 with a JSON `{reason}` body using
 * a stable machine-readable code; the happy path constructs a
 * `PilotTunnelBridge` and registers it via
 * `PilotTunnelManager.replaceOrRegisterProxyBridge`.
 */
import http from 'http';
import { afterAll, beforeAll, beforeEach, describe, expect, it } from 'vitest';
import WebSocket from 'ws';
import jwt from 'jsonwebtoken';
import { createHash } from 'crypto';
import type { AddressInfo } from 'net';
import { setupTestDb, cleanupTestDb } from './helpers/setupTestDb';

let tmpDir: string;
let handleMeshProxyTunnelFromPeerUpgrade: typeof import('../websocket/meshProxyTunnelFromPeer').handleMeshProxyTunnelFromPeerUpgrade;
let DatabaseService: typeof import('../services/DatabaseService').DatabaseService;
let PilotTunnelManager: typeof import('../services/PilotTunnelManager').PilotTunnelManager;

interface ServerHandle {
    server: http.Server;
    port: number;
    close: () => Promise<void>;
}

async function startServer(): Promise<ServerHandle> {
    const server = http.createServer();
    server.on('upgrade', (req, socket, head) => {
        const pathname = new URL(req.url ?? '/', 'http://localhost').pathname;
        if (pathname === '/api/mesh/proxy-tunnel-from-peer') {
            handleMeshProxyTunnelFromPeerUpgrade(req, socket, head);
        } else {
            socket.destroy();
        }
    });
    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', () => resolve()));
    const port = (server.address() as AddressInfo).port;
    return {
        server,
        port,
        close: () => new Promise<void>((resolve) => server.close(() => resolve())),
    };
}

interface UpgradeOutcome {
    kind: 'open' | 'unexpected' | 'error';
    status?: number;
    body?: string;
    ws?: WebSocket;
}

function attemptUpgrade(port: number, token: string): Promise<UpgradeOutcome> {
    return new Promise((resolve) => {
        const ws = new WebSocket(`ws://127.0.0.1:${port}/api/mesh/proxy-tunnel-from-peer`, {
            headers: { authorization: `Bearer ${token}` },
        });
        const timer = setTimeout(() => resolve({ kind: 'error' }), 3000);
        ws.once('open', () => {
            clearTimeout(timer);
            resolve({ kind: 'open', ws });
        });
        ws.once('unexpected-response', (_req, res) => {
            const chunks: Buffer[] = [];
            res.on('data', (c: Buffer) => chunks.push(c));
            res.on('end', () => {
                clearTimeout(timer);
                resolve({ kind: 'unexpected', status: res.statusCode, body: Buffer.concat(chunks).toString('utf8') });
            });
        });
        ws.once('error', () => {
            // 'unexpected-response' fires first; 'error' here is the
            // post-handshake failure ws raises after the server destroys
            // the socket. Already resolved above.
        });
    });
}

function parseReason(body: string | undefined): string | null {
    if (!body) return null;
    try {
        const parsed = JSON.parse(body) as { reason?: unknown };
        return typeof parsed.reason === 'string' ? parsed.reason : null;
    } catch {
        return null;
    }
}

const CANONICAL_ORIGIN = 'https://central.example.com';
const INSTANCE_ID = 'test-central-instance';
const PEER_API_TOKEN = 'peer-token-123';

let secret: string;
let peerNodeId: number;
let srv: ServerHandle;

beforeAll(async () => {
    tmpDir = await setupTestDb();
    ({ handleMeshProxyTunnelFromPeerUpgrade } = await import('../websocket/meshProxyTunnelFromPeer'));
    ({ DatabaseService } = await import('../services/DatabaseService'));
    ({ PilotTunnelManager } = await import('../services/PilotTunnelManager'));
});

beforeEach(async () => {
    process.env.SENCHO_PRIMARY_URL = CANONICAL_ORIGIN;
    const db = DatabaseService.getInstance();
    secret = db.getGlobalSettings().auth_jwt_secret;
    db.setSystemState('instance_id', INSTANCE_ID);
    // Unique peer per test to avoid PilotTunnelManager collisions across
    // the 12 cases (one happy path actually registers a bridge).
    peerNodeId = db.addNode({
        name: `peer-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`,
        type: 'remote',
        mode: 'proxy',
        api_url: 'https://peer.example.com',
        api_token: PEER_API_TOKEN,
        compose_dir: '/tmp',
        is_default: false,
    });
    db.setNodeMeshEnabled(peerNodeId, true);
    if (!srv) srv = await startServer();
});

afterAll(async () => {
    if (srv) await srv.close();
    delete process.env.SENCHO_PRIMARY_URL;
    cleanupTestDb(tmpDir);
});

function expectedFp(token: string = PEER_API_TOKEN): string {
    return createHash('sha256').update(token).digest('hex').slice(0, 16);
}

function makeJwt(overrides: Partial<Record<string, unknown>> = {}, signOpts: { alg?: jwt.Algorithm; secret?: string } = {}): string {
    const payload: Record<string, unknown> = {
        sub: String(peerNodeId),
        iss: INSTANCE_ID,
        aud: CANONICAL_ORIGIN,
        scope: 'mesh_tunnel',
        iat: Math.floor(Date.now() / 1000),
        exp: Math.floor(Date.now() / 1000) + 3600,
        kid: 'v1',
        peer_token_fp: expectedFp(),
        ...overrides,
    };
    return jwt.sign(payload, signOpts.secret ?? secret, { algorithm: signOpts.alg ?? 'HS256' });
}

describe('/api/mesh/proxy-tunnel-from-peer validation chain', () => {
    it('rejects alg=none (algorithm_mismatch)', async () => {
        // jsonwebtoken refuses to sign with alg=none unless explicitly
        // enabled and given a null secret; we build the token manually so
        // the test exercises the central's defence, not the library's.
        const header = Buffer.from(JSON.stringify({ alg: 'none', typ: 'JWT' })).toString('base64url');
        const body = Buffer.from(JSON.stringify({
            sub: String(peerNodeId), iss: INSTANCE_ID, aud: CANONICAL_ORIGIN,
            scope: 'mesh_tunnel', iat: Math.floor(Date.now() / 1000),
            exp: Math.floor(Date.now() / 1000) + 3600, peer_token_fp: expectedFp(),
        })).toString('base64url');
        const token = `${header}.${body}.`;
        const outcome = await attemptUpgrade(srv.port, token);
        expect(outcome.kind).toBe('unexpected');
        expect(outcome.status).toBe(401);
        expect(parseReason(outcome.body)).toBe('algorithm_mismatch');
    });

    it('rejects alg=RS256 (algorithm_mismatch)', async () => {
        const { generateKeyPairSync } = await import('crypto');
        const { privateKey } = generateKeyPairSync('rsa', { modulusLength: 2048 });
        const token = jwt.sign({
            sub: String(peerNodeId), iss: INSTANCE_ID, aud: CANONICAL_ORIGIN,
            scope: 'mesh_tunnel', exp: Math.floor(Date.now() / 1000) + 3600,
            peer_token_fp: expectedFp(),
        }, privateKey, { algorithm: 'RS256' });
        const outcome = await attemptUpgrade(srv.port, token);
        expect(outcome.kind).toBe('unexpected');
        expect(outcome.status).toBe(401);
        expect(parseReason(outcome.body)).toBe('algorithm_mismatch');
    });

    it('rejects bad signature (signature_invalid)', async () => {
        const token = makeJwt({}, { secret: 'wrong-secret-not-the-real-one' });
        const outcome = await attemptUpgrade(srv.port, token);
        expect(outcome.kind).toBe('unexpected');
        expect(outcome.status).toBe(401);
        expect(parseReason(outcome.body)).toBe('signature_invalid');
    });

    it('rejects scope mismatch', async () => {
        const token = makeJwt({ scope: 'pilot_tunnel' });
        const outcome = await attemptUpgrade(srv.port, token);
        expect(outcome.kind).toBe('unexpected');
        expect(outcome.status).toBe(401);
        expect(parseReason(outcome.body)).toBe('scope_mismatch');
    });

    it('rejects audience mismatch', async () => {
        const token = makeJwt({ aud: 'https://other.example.com' });
        const outcome = await attemptUpgrade(srv.port, token);
        expect(outcome.kind).toBe('unexpected');
        expect(outcome.status).toBe(401);
        expect(parseReason(outcome.body)).toBe('audience_mismatch');
    });

    it('rejects issuer mismatch', async () => {
        const token = makeJwt({ iss: 'wrong-instance-id' });
        const outcome = await attemptUpgrade(srv.port, token);
        expect(outcome.kind).toBe('unexpected');
        expect(outcome.status).toBe(401);
        expect(parseReason(outcome.body)).toBe('instance_mismatch');
    });

    it('rejects expired token (stale)', async () => {
        const token = makeJwt({ exp: Math.floor(Date.now() / 1000) - 10 });
        const outcome = await attemptUpgrade(srv.port, token);
        expect(outcome.kind).toBe('unexpected');
        expect(outcome.status).toBe(401);
        // jsonwebtoken throws on expired tokens before our exp check sees it,
        // so the rejection surfaces as signature_invalid via the verify catch.
        // The contract: stale tokens are rejected with a 401 and some
        // deterministic reason code; accept either of the two equivalent
        // failures since both convey "stale credential" to the operator.
        const reason = parseReason(outcome.body);
        expect(['stale', 'signature_invalid']).toContain(reason);
    });

    it('rejects clock-skewed token (clock_skew)', async () => {
        const token = makeJwt({ iat: Math.floor(Date.now() / 1000) + 600 });
        const outcome = await attemptUpgrade(srv.port, token);
        expect(outcome.kind).toBe('unexpected');
        expect(outcome.status).toBe(401);
        expect(parseReason(outcome.body)).toBe('clock_skew');
    });

    it('rejects missing node (node_deleted)', async () => {
        const token = makeJwt({ sub: '999999' });
        const outcome = await attemptUpgrade(srv.port, token);
        expect(outcome.kind).toBe('unexpected');
        expect(outcome.status).toBe(401);
        expect(parseReason(outcome.body)).toBe('node_deleted');
    });

    it('rejects mode mismatch', async () => {
        DatabaseService.getInstance().updateNode(peerNodeId, { mode: 'pilot_agent' });
        const token = makeJwt();
        const outcome = await attemptUpgrade(srv.port, token);
        expect(outcome.kind).toBe('unexpected');
        expect(outcome.status).toBe(401);
        expect(parseReason(outcome.body)).toBe('mode_mismatch');
    });

    it('rejects token fingerprint mismatch', async () => {
        const token = makeJwt();
        // Rotate the api_token after minting; the JWT now carries the
        // fingerprint of the old token, but getNode returns the new one.
        DatabaseService.getInstance().updateNode(peerNodeId, { api_token: 'rotated-token-xyz' });
        const outcome = await attemptUpgrade(srv.port, token);
        expect(outcome.kind).toBe('unexpected');
        expect(outcome.status).toBe(401);
        expect(parseReason(outcome.body)).toBe('token_fingerprint_mismatch');
    });

    it('accepts a fully valid token and registers a proxy bridge', async () => {
        const token = makeJwt();
        const outcome = await attemptUpgrade(srv.port, token);
        expect(outcome.kind).toBe('open');
        // Give the bridge.start() microtasks a moment to land and register.
        await new Promise((r) => setTimeout(r, 50));
        const bridge = PilotTunnelManager.getInstance().getBridge(peerNodeId);
        expect(bridge).not.toBeNull();
        try { outcome.ws?.close(1000, 'test cleanup'); } catch { /* ignore */ }
        // Allow the manager's 'closed' handler to remove the bridge entry.
        await new Promise((r) => setTimeout(r, 30));
    });
});