summaryrefslogtreecommitdiffhomepage
path: root/scripts
diff options
context:
space:
mode:
Diffstat (limited to 'scripts')
-rw-r--r--scripts/network-policy.test.ts37
-rw-r--r--scripts/probe-tab.ts (renamed from scripts/probe-tab-PII_REDACTED_CONVERSATION_SHORT_01.ts)16
-rw-r--r--scripts/vite-network-guard.test.ts18
3 files changed, 46 insertions, 25 deletions
diff --git a/scripts/network-policy.test.ts b/scripts/network-policy.test.ts
index af7d870..4c3ed12 100644
--- a/scripts/network-policy.test.ts
+++ b/scripts/network-policy.test.ts
@@ -9,9 +9,10 @@ import {
tailscaleSelf,
} from "./network-policy";
+// Synthetic status: reserved .example DNS and documentation-only IPv4/IPv6 addresses.
const tailscaleStatusJson = `{"Self":{"HostName":"laptop",
- "DNSName":"PII_REDACTED_TAILSCALE_HOST_01.",
- "TailscaleIPs":["PII_REDACTED_DEV_IPV4_01","PII_REDACTED_DEV_IPV6_01"]}}`;
+ "DNSName":"dev-node.tailnet.example.",
+ "TailscaleIPs":["192.0.2.10","2001:db8::10"]}}`;
const allowedHosts = buildAllowedHosts({ tailscaleStatusJson, env: {} });
const allowedAddresses = new Set(["127.0.0.1", "::1", ...tailscaleSelf(tailscaleStatusJson).ips]);
const policy = { allowedHosts, allowedAddresses };
@@ -23,10 +24,10 @@ describe("backend-compatible hosts", () => {
["LOCALHOST.:34204", "localhost"],
["127.0.0.1:34204", "127.0.0.1"],
["[0:0:0:0:0:0:0:1]:34204", "::1"],
- ["PII_REDACTED_DEVICE_01", "PII_REDACTED_DEVICE_01"],
- ["PII_REDACTED_TAILSCALE_HOST_01.:34204", "PII_REDACTED_TAILSCALE_HOST_01"],
- ["PII_REDACTED_DEV_IPV4_01:34204", "PII_REDACTED_DEV_IPV4_01"],
- ["[PII_REDACTED_DEV_IPV6_01]:34204", "PII_REDACTED_DEV_IPV6_01"],
+ ["DEV-NODE", "dev-node"],
+ ["DEV-NODE.tailnet.example.:34204", "dev-node.tailnet.example"],
+ ["192.0.2.10:34204", "192.0.2.10"],
+ ["[2001:db8::10]:34204", "2001:db8::10"],
])("normalizes and allows %s", (raw, expected) => {
expect(normalizeHost(raw)).toBe(expected);
expect(checkHost(raw, allowedHosts)).toBe("ok");
@@ -34,7 +35,7 @@ describe("backend-compatible hosts", () => {
it.each(
(
- "evil.com|PII_REDACTED_DEVICE_01.evil.com|PII_REDACTED_DEV_IPV4_01.nip.io|laptop|localhost.evil.com|" +
+ "evil.com|dev-node.evil.com|192.0.2.10.nip.io|laptop|localhost.evil.com|" +
"sub.localhost|127.0.0.2|100.1.2.3|172.17.0.1|[email protected]|localhost/path|" +
"localhost:bad|localhost:65536|[::1]suffix|localhost\n|localhost..|%6cocalhost|"
).split("|"),
@@ -48,10 +49,10 @@ describe("backend-compatible hosts", () => {
...(json !== undefined ? { tailscaleStatusJson: json } : {}),
env: {
DISPATCH_ALLOWED_HOSTS: " EXTRA.example.:8080, https://evil.com",
- DISPATCH_TAILSCALE_NAME: "PII_REDACTED_DEVICE_01",
+ DISPATCH_TAILSCALE_NAME: "DEV-NODE",
},
};
- const expected = "localhost,127.0.0.1,::1,extra.example,PII_REDACTED_DEVICE_01".split(",");
+ const expected = "localhost,127.0.0.1,::1,extra.example,dev-node".split(",");
expect([...buildAllowedHosts(input)]).toEqual(expected);
expect(tailscaleSelf(json)).toEqual({ ips: [] });
});
@@ -61,20 +62,20 @@ describe("backend-compatible hosts", () => {
tailscaleStatusJson,
env: { DISPATCH_ALLOWED_HOSTS: "extra.example" },
});
- expect(hosts.has("PII_REDACTED_TAILSCALE_HOST_01")).toBe(true);
+ expect(hosts.has("dev-node.tailnet.example")).toBe(true);
expect(hosts.has("extra.example")).toBe(true);
expect(hosts.has("laptop")).toBe(false);
expect(tailscaleSelf(tailscaleStatusJson).hostName).toBe("laptop");
- expect(
- tailscaleSelf('{"Self":{"TailscaleIPs":[null,"evil.com","PII_REDACTED_DEV_IPV4_01"]}}').ips,
- ).toEqual(["PII_REDACTED_DEV_IPV4_01"]);
+ expect(tailscaleSelf('{"Self":{"TailscaleIPs":[null,"evil.com","192.0.2.10"]}}').ips).toEqual([
+ "192.0.2.10",
+ ]);
});
it.each([
["LOCALHOST.:34204", "localhost:34204"],
["[0:0:0:0:0:0:0:1]:34204", "[::1]:34204"],
["[::1]", "[::1]"],
- ["PII_REDACTED_DEVICE_01.", "PII_REDACTED_DEVICE_01"],
+ ["DEV-NODE.", "dev-node"],
])("preserves valid authorities for Vite: %s", (raw, expected) => {
expect(normalizeHostHeader(raw)).toBe(expected);
});
@@ -84,7 +85,7 @@ describe("destination interfaces (not remote peer addresses)", () => {
it.each(
(
"127.0.0.1|::1|0:0:0:0:0:0:0:1|::ffff:127.0.0.1|::ffff:7f00:1|" +
- "PII_REDACTED_DEV_IPV4_01|::ffff:PII_REDACTED_DEV_IPV4_01|PII_REDACTED_DEV_IPV6_01"
+ "192.0.2.10|::ffff:192.0.2.10|2001:db8::10"
).split("|"),
)("allows local address %s", (address) => {
expect(isAllowedLocalAddress(address, allowedAddresses)).toBe(true);
@@ -115,10 +116,10 @@ describe("destination interfaces (not remote peer addresses)", () => {
describe("shared HTTP / HMR request decision", () => {
it.each([
undefined,
- "http://PII_REDACTED_DEVICE_01.:34204",
- "https://[PII_REDACTED_DEV_IPV6_01]:443",
+ "http://DEV-NODE.:34204",
+ "https://[2001:db8::10]:443",
])("allows trusted or absent Origin %j", (origin) => {
- expect(request("::ffff:PII_REDACTED_DEV_IPV4_01", "PII_REDACTED_DEVICE_01", origin)).toBe("ok");
+ expect(request("::ffff:192.0.2.10", "dev-node", origin)).toBe("ok");
});
const badOrigins =
"null|file://localhost|https://evil.com|http://localhost/|http://user@localhost";
diff --git a/scripts/probe-tab-PII_REDACTED_CONVERSATION_SHORT_01.ts b/scripts/probe-tab.ts
index 7e2fad7..16ad423 100644
--- a/scripts/probe-tab-PII_REDACTED_CONVERSATION_SHORT_01.ts
+++ b/scripts/probe-tab.ts
@@ -1,8 +1,8 @@
/**
- * Focused probe: load conversation PII_REDACTED_CONVERSATION_SHORT_01 through the FE's REAL pure modules
+ * Focused probe: load a selected conversation through the FE's REAL pure modules
* and see whether the tab's render path would throw. Not part of the test suite.
*
- * bun scripts/probe-tab-PII_REDACTED_CONVERSATION_SHORT_01.ts
+ * bun scripts/probe-tab.ts <conversationId>
*/
import "fake-indexeddb/auto";
import type {
@@ -23,7 +23,11 @@ import {
} from "../src/core/metrics/index.ts";
const HTTP_BASE = process.env.PROBE_HTTP ?? "http://localhost:24991";
-const CONV = "PII_REDACTED_CONVERSATION_01";
+const CONV = process.argv[2];
+if (!CONV) {
+ console.error("Usage: bun scripts/probe-tab.ts <conversationId>");
+ process.exit(1);
+}
async function historySync(id: string, sinceSeq: number): Promise<ConversationHistoryResponse> {
const url = `${HTTP_BASE}/conversations/${encodeURIComponent(id)}?sinceSeq=${sinceSeq}`;
@@ -56,7 +60,11 @@ try {
let state = initialState();
try {
state = applyHistory(state, chunks as never);
- record("applyHistory(145 chunks)", true, `state=${JSON.stringify(state).length} bytes`);
+ record(
+ `applyHistory(${chunks.length} chunks)`,
+ true,
+ `state=${JSON.stringify(state).length} bytes`,
+ );
} catch (e) {
record("applyHistory", false, String(e));
}
diff --git a/scripts/vite-network-guard.test.ts b/scripts/vite-network-guard.test.ts
index 651b635..8bef397 100644
--- a/scripts/vite-network-guard.test.ts
+++ b/scripts/vite-network-guard.test.ts
@@ -5,8 +5,14 @@ import { describe, expect, it, vi } from "vitest";
import { applyViteNetworkPolicy, devNetworkGuard } from "./vite-network-guard";
const policy = {
- allowedHosts: new Set(["localhost", "127.0.0.1", "::1", "node.ts.net", "100.64.0.10"]),
- allowedAddresses: new Set(["127.0.0.1", "::1", "100.64.0.10"]),
+ allowedHosts: new Set([
+ "localhost",
+ "127.0.0.1",
+ "::1",
+ "dev-node.tailnet.example",
+ "192.0.2.10",
+ ]),
+ allowedAddresses: new Set(["127.0.0.1", "::1", "192.0.2.10"]),
};
function install(mode: "dev" | "preview") {
@@ -39,7 +45,13 @@ const cases = [
["loopback", "127.0.0.1", "localhost", undefined, 200],
["IPv6 loopback", "::1", "[::1]:34204", undefined, 200],
["mapped address / canonical Host", "::ffff:127.0.0.1", "LOCALHOST.:34204", undefined, 200],
- ["tailnet", "100.64.0.10", "node.ts.net", "https://node.ts.net:34204", 200],
+ [
+ "tailnet",
+ "192.0.2.10",
+ "dev-node.tailnet.example",
+ "https://dev-node.tailnet.example:34204",
+ 200,
+ ],
["unselected interface with trusted Host", "172.17.0.1", "localhost", undefined, 403],
["missing interface", undefined, "localhost", undefined, 403],
["arbitrary IP Host", "127.0.0.1", "127.0.0.2", undefined, 421],
generated by cgit v1.2.3 (git 2.39.1) at 2026-10-25 23:52:30 +0000