Customers install one command / log in once; hardware-generated keys never leave the device; CSRs return certs + subdomain; frpc + base-app run as durable services. No .p12, no manual cert import. Implements the MVP fast-path of docs/PLAN_TUNNEL_AUTOMATION.md. Control-plane / PKI (control-plane/): - ca/x509-assembler.ts: single KMS-signed real X.509 issuance primitive (Ed25519 + P-256) - ca/csr-ec.ts: P-256 PKCS#10 proof-of-possession (verifyCsrPoPEc) + CSR-key routing - ca/frpclient-issue.ts, ca/device-issue.ts: P-256 frp-client + device leaf signers - ca/rotate.ts + api/renew.ts: real-X.509 /renew + /device/:id/renew (mTLS current cert) - registry/devices.ts: device registry + per-account cap/rate-limit - auth/session.ts: device:enroll capability token mint/verify - api/device-enroll.ts: POST /device/enroll (ownership-gated, deny-by-default) - pairing/native-redeem.ts + shared gateAndConsumePairingCode; api/provision.ts native arm - boot/native-ca.ts + main.ts: wire two P-256 CAs + issuers + routers (dev / KMS fail-fast) Contracts: relay-contracts enroll right; relay-auth SPIFFE /device/ arm + spiffeIdFor(kind) Host agent (agent/): - transport/frpcToml.ts; provision/frpcBinary.ts + untar.ts (verify-download + traversal-safe extract) - keys P-256 keygen/CSR/loadIdentity; service two-unit install + BIND_HOST loopback S-GATE - net/loopbackLiteral.ts strict guard; health/probe.ts + transport/frpSupervise.ts; cli pair --install iOS (ios/Packages/ClientTLS): SecureEnclaveKey + CertificateSigningRequest + DeviceEnrollmentClient + Keychain enroll refactor (SecKey/Security.framework end-to-end, avoids the -25300 trap) Isolation (deploy/nginx): njs/getCertSub.js SAN parser + zone-anchored map -> 403 Verified: 758 tests green (control-plane 246, agent 267, relay-auth 133, relay-contracts 85, iOS ClientTLS 27), all tsc clean; real nginx+njs docker 403/200/400; Swift CSR accepted by the real control-plane verifier; frpc extract byte-identical to `tar -xO`. Cross-validation caught + fixed 5 real defects (1 critical, 4 high). Remaining = infra (KMS, nginx deploy, VPS frps, physical iPhone) per PROGRESS_LOG runbook. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
149 lines
4.5 KiB
TypeScript
149 lines
4.5 KiB
TypeScript
import { describe, expect, it, vi } from 'vitest'
|
|
import { createLogger } from '../src/log/logger.js'
|
|
import { createBackoff } from '../src/transport/backoff.js'
|
|
import {
|
|
STABLE_RUN_MS,
|
|
superviseFrpc,
|
|
type FrpcChild,
|
|
type SpawnFrpc,
|
|
} from '../src/transport/frpSupervise.js'
|
|
|
|
const silentLogger = createLogger('error', () => {})
|
|
|
|
/**
|
|
* A fake frpc child whose exit is driven from the test. `kill()` models a real process: it dies,
|
|
* firing the exit handler (so the supervisor's `stop()` — which kills the live child — can unblock).
|
|
* exit/kill fire the handler at most once.
|
|
*/
|
|
function makeChild(): { child: FrpcChild; exit: (code: number | null) => void; killed: boolean } {
|
|
let onExit: ((code: number | null) => void) | null = null
|
|
let alive = true
|
|
const state = { killed: false }
|
|
const fire = (code: number | null): void => {
|
|
if (!alive) return
|
|
alive = false
|
|
onExit?.(code)
|
|
}
|
|
return {
|
|
child: {
|
|
onExit: (cb) => {
|
|
onExit = cb
|
|
},
|
|
isAlive: () => alive,
|
|
kill: () => {
|
|
state.killed = true
|
|
fire(null)
|
|
},
|
|
},
|
|
exit: (code) => fire(code),
|
|
get killed() {
|
|
return state.killed
|
|
},
|
|
}
|
|
}
|
|
|
|
describe('superviseFrpc (B4/H4 — restart-on-exit backoff)', () => {
|
|
it('spawns the frpc binary with -c <toml> via the child seam', async () => {
|
|
const spawn: SpawnFrpc = vi.fn(() => makeChild().child)
|
|
superviseFrpc('/opt/agent/bin/frpc', '/state/frpc.toml', {
|
|
spawn,
|
|
sleep: async () => {},
|
|
logger: silentLogger,
|
|
})
|
|
await Promise.resolve()
|
|
expect(spawn).toHaveBeenCalledWith('/opt/agent/bin/frpc', '/state/frpc.toml')
|
|
})
|
|
|
|
it('restarts the child on exit, backing off 1s → 2s → 4s', async () => {
|
|
const children = [makeChild(), makeChild(), makeChild(), makeChild()]
|
|
let n = 0
|
|
const spawn: SpawnFrpc = () => children[n++]!.child
|
|
const sleeps: number[] = []
|
|
// now() fixed so no run counts as "stable" ⇒ backoff monotonically increases.
|
|
const handle = superviseFrpc('/frpc', '/toml', {
|
|
spawn,
|
|
backoff: createBackoff(),
|
|
sleep: async (ms) => {
|
|
sleeps.push(ms)
|
|
},
|
|
logger: silentLogger,
|
|
now: () => 1000,
|
|
})
|
|
|
|
// Crash three times; each crash schedules the next spawn after the growing backoff.
|
|
for (let i = 0; i < 3; i += 1) {
|
|
children[i]!.exit(1)
|
|
await Promise.resolve()
|
|
await Promise.resolve()
|
|
}
|
|
expect(sleeps).toEqual([1000, 2000, 4000])
|
|
|
|
await handle.stop()
|
|
})
|
|
|
|
it('resets the backoff after a run that stayed up past the stability window', async () => {
|
|
const children = [makeChild(), makeChild(), makeChild()]
|
|
let n = 0
|
|
const spawn: SpawnFrpc = () => children[n++]!.child
|
|
const sleeps: number[] = []
|
|
let clock = 0
|
|
const handle = superviseFrpc('/frpc', '/toml', {
|
|
spawn,
|
|
backoff: createBackoff(),
|
|
sleep: async (ms) => {
|
|
sleeps.push(ms)
|
|
},
|
|
logger: silentLogger,
|
|
now: () => clock,
|
|
})
|
|
|
|
// First run crashes instantly ⇒ backoff 1s.
|
|
children[0]!.exit(1)
|
|
await Promise.resolve()
|
|
await Promise.resolve()
|
|
// Second run stays up past STABLE_RUN_MS before dying ⇒ backoff resets to 1s (not 2s).
|
|
clock += STABLE_RUN_MS + 1
|
|
children[1]!.exit(1)
|
|
await Promise.resolve()
|
|
await Promise.resolve()
|
|
|
|
expect(sleeps).toEqual([1000, 1000])
|
|
await handle.stop()
|
|
})
|
|
|
|
it('stop() halts the loop and kills the live child; done resolves 0', async () => {
|
|
const c = makeChild()
|
|
const spawn: SpawnFrpc = () => c.child
|
|
const handle = superviseFrpc('/frpc', '/toml', {
|
|
spawn,
|
|
sleep: async () => {},
|
|
logger: silentLogger,
|
|
})
|
|
await Promise.resolve()
|
|
expect(handle.isChildAlive()).toBe(true)
|
|
|
|
// stop() kills the child; that fires the exit handler and the loop observes `stopped` → breaks.
|
|
const stopping = handle.stop()
|
|
c.exit(null)
|
|
await expect(stopping).resolves.toBeUndefined()
|
|
await expect(handle.done).resolves.toBe(0)
|
|
expect(c.killed).toBe(true)
|
|
})
|
|
|
|
it('does not restart after stop (no spawn past shutdown)', async () => {
|
|
const first = makeChild()
|
|
let n = 0
|
|
const spawn: SpawnFrpc = vi.fn(() => (n++ === 0 ? first.child : makeChild().child))
|
|
const handle = superviseFrpc('/frpc', '/toml', {
|
|
spawn,
|
|
sleep: async () => {},
|
|
logger: silentLogger,
|
|
})
|
|
await Promise.resolve()
|
|
const stopping = handle.stop()
|
|
first.exit(0)
|
|
await stopping
|
|
expect(spawn).toHaveBeenCalledTimes(1)
|
|
})
|
|
})
|