707 lines
31 KiB
TypeScript
707 lines
31 KiB
TypeScript
import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
|
|
import { newFixture, type Fixture } from '../helpers/fixture.js';
|
|
|
|
let fixture: Fixture;
|
|
beforeEach(async () => {
|
|
vi.resetModules();
|
|
fixture = await newFixture([]);
|
|
});
|
|
afterEach(async () => {
|
|
vi.restoreAllMocks();
|
|
await fixture.cleanup();
|
|
});
|
|
|
|
async function seedHistory(count = 53) {
|
|
const hosts = await import('../../src/lib/server/hosts/index.js');
|
|
const { db } = await import('../../src/lib/server/db/index.js');
|
|
const first = hosts.createHost({ name: 'Alpha host' });
|
|
const second = hosts.createHost({ name: 'Beta host' });
|
|
const deleted = hosts.createHost({ name: 'Removed host' });
|
|
const handle = db();
|
|
const ids: string[] = [];
|
|
handle.transaction(() => {
|
|
const insert = handle.prepare(`INSERT INTO ec_host_operations
|
|
(id,host_id,kind,instance_id,generation,payload,result,state,error,created_at,updated_at)
|
|
VALUES(?,?,'instance.inspect','instance-one',2,?,?,'completed',NULL,?,?)`);
|
|
for (let index = 0; index < count; index++) {
|
|
// Reverse IDs and tied timestamps ensure insertion order breaks ties.
|
|
const id = `operation-${String(count - index).padStart(4, '0')}`;
|
|
const timestamp = index < 3 ? '2026-10-01T12:00:00.000Z' : '2026-10-05T12:00:00.000Z';
|
|
ids.push(id);
|
|
insert.run(
|
|
id,
|
|
[first, second, deleted][index % 3].id,
|
|
'{"credential":"payload-secret"}',
|
|
'{"credential":"result-secret"}',
|
|
timestamp,
|
|
timestamp
|
|
);
|
|
}
|
|
handle
|
|
.prepare('UPDATE ec_hosts SET deleted_at=? WHERE id=?')
|
|
.run('2026-10-05T12:30:00.000Z', deleted.id);
|
|
})();
|
|
return { ...hosts, handle, ids, first, second, deleted };
|
|
}
|
|
|
|
async function operationHistory() {
|
|
const api = await seedHistory(0);
|
|
function add(
|
|
kind: string,
|
|
options: {
|
|
payload?: Record<string, unknown>;
|
|
state?: string;
|
|
result?: unknown;
|
|
error?: string;
|
|
} = {}
|
|
) {
|
|
const operation = api.queueHostOperation(api.first.id, kind, options.payload ?? {});
|
|
if (options.state !== 'pending')
|
|
api.reportHostOperationStatus(api.first.id, operation.id, {
|
|
state: options.state ?? 'completed',
|
|
result: options.result,
|
|
error: options.error
|
|
});
|
|
return operation.id;
|
|
}
|
|
return { ...api, add };
|
|
}
|
|
|
|
describe('host operation history', () => {
|
|
it('maintains exact scoped totals through receipts, expiration, rollback, deletion and reopening without recounting history', async () => {
|
|
const api = await operationHistory();
|
|
const { importantOperationSql } =
|
|
await import('../../src/lib/server/hosts/observations.js');
|
|
const { closeDb, db } = await import('../../src/lib/server/db/index.js');
|
|
const ids = Array.from({ length: 35 }, (_, i) =>
|
|
api.add(i % 2 ? 'instance.inspect' : 'instance.restart', { state: 'pending' })
|
|
);
|
|
const verify = () => {
|
|
for (const host of [undefined, api.first.id, api.second.id])
|
|
for (const server of [undefined, 'server-one']) {
|
|
for (const filter of ['all', 'routine', 'important'] as const) {
|
|
const where = ['o.history_expired_at IS NULL'];
|
|
const args: string[] = [];
|
|
if (host) {
|
|
where.push('o.host_id=?');
|
|
args.push(host);
|
|
}
|
|
if (server) {
|
|
where.push('o.server_name=?');
|
|
args.push(server);
|
|
}
|
|
if (filter !== 'all')
|
|
where.push(
|
|
filter === 'routine' ? 'o.routine=1' : importantOperationSql
|
|
);
|
|
const expected = db()
|
|
.prepare(
|
|
`SELECT COUNT(*) total FROM ec_host_operations o WHERE ${where.join(' AND ')}`
|
|
)
|
|
.get(...args) as { total: number };
|
|
expect(
|
|
api.listHostOperationHistory(1, filter, { host, server }).total
|
|
).toBe(expected.total);
|
|
}
|
|
}
|
|
};
|
|
verify();
|
|
for (const [index, id] of ids.entries())
|
|
api.reportHostOperationStatus(
|
|
api.first.id,
|
|
id,
|
|
index % 3
|
|
? { state: 'completed', result: { healthy: index % 5 !== 0 } }
|
|
: { state: 'failed', error: 'failure' }
|
|
);
|
|
api.handle
|
|
.prepare(
|
|
"UPDATE ec_host_operations SET server_name='server-one',host_id=? WHERE rowid%2=0"
|
|
)
|
|
.run(api.second.id);
|
|
api.handle
|
|
.prepare('UPDATE ec_host_operations SET history_expired_at=? WHERE rowid%4=0')
|
|
.run(new Date().toISOString());
|
|
api.handle.exec(
|
|
'DELETE FROM ec_host_operation_events WHERE operation_id IN (SELECT id FROM ec_host_operations WHERE rowid%7=0); DELETE FROM ec_host_operations WHERE rowid%7=0'
|
|
);
|
|
expect(() =>
|
|
api.handle.transaction(() => {
|
|
api.handle.exec(
|
|
'DELETE FROM ec_host_operation_events; DELETE FROM ec_host_operations'
|
|
);
|
|
throw new Error('rollback');
|
|
})()
|
|
).toThrow('rollback');
|
|
verify();
|
|
closeDb();
|
|
verify();
|
|
const prepare = vi.spyOn(db(), 'prepare');
|
|
api.listHostOperationHistory(1);
|
|
api.listHostOperationHistory(2);
|
|
expect(prepare.mock.calls.some(([sql]) => /COUNT\(/i.test(sql))).toBe(false);
|
|
const count = prepare.mock.calls.find(([sql]) =>
|
|
sql.includes('FROM ec_host_operation_history_counts')
|
|
)![0];
|
|
expect(
|
|
db()
|
|
.prepare('EXPLAIN QUERY PLAN ' + count)
|
|
.all('', '')
|
|
).toEqual(
|
|
expect.arrayContaining([
|
|
expect.objectContaining({ detail: expect.stringContaining('USING PRIMARY KEY') })
|
|
])
|
|
);
|
|
});
|
|
|
|
it('scopes counts and pages to one host or server and preserves deleted-host history', async () => {
|
|
const api = await seedHistory(90);
|
|
api.handle
|
|
.prepare("UPDATE ec_host_operations SET server_name='server-one' WHERE host_id=?")
|
|
.run(api.first.id);
|
|
const first = api.listHostOperationHistory(1, 'all', { host: api.first.id });
|
|
const second = api.listHostOperationHistory(2, 'all', { host: api.first.id });
|
|
expect(first).toMatchObject({ total: 30, totalPages: 2 });
|
|
expect([...first.operations, ...second.operations]).toHaveLength(30);
|
|
expect(first.operations.every((operation) => operation.hostId === api.first.id)).toBe(true);
|
|
expect(api.listHostOperationHistory(1, 'all', { server: 'server-one' })).toEqual(first);
|
|
expect(
|
|
api.listHostOperationHistory(1, 'all', { host: api.second.id, server: 'server-one' })
|
|
.total
|
|
).toBe(0);
|
|
expect(
|
|
api
|
|
.listHostOperationHistory(1, 'all', { host: api.deleted.id })
|
|
.operations.every((operation) => operation.hostName === null)
|
|
).toBe(true);
|
|
const { GET } = await import('../../src/routes/api/hosts/operations/+server.js');
|
|
const response = GET({
|
|
request: new Request(
|
|
`https://ec.test/api/hosts/operations?filter=all&host=${api.first.id}&page=2`
|
|
)
|
|
});
|
|
expect(await response.json()).toEqual(second);
|
|
});
|
|
|
|
it('applies host scope to failures as well as ordinary actions', async () => {
|
|
const api = await operationHistory();
|
|
const first = api.add('instance.restart');
|
|
const other = api.queueHostOperation(api.second.id, 'instance.inspect', {});
|
|
api.reportHostOperationStatus(api.second.id, other.id, {
|
|
state: 'failed',
|
|
error: 'Unreachable'
|
|
});
|
|
expect(
|
|
api
|
|
.listHostOperationHistory(1, 'important', { host: api.first.id })
|
|
.operations.map((operation) => operation.id)
|
|
).toEqual([first]);
|
|
expect(
|
|
api
|
|
.listHostOperationHistory(1, 'important', { host: api.second.id })
|
|
.operations.map((operation) => operation.id)
|
|
).toEqual([other.id]);
|
|
});
|
|
|
|
it('finds an exact old operation without walking pages and keeps all scope and retention filters', async () => {
|
|
const api = await seedHistory(1003);
|
|
const operation = api.ids[0];
|
|
api.handle
|
|
.prepare("UPDATE ec_host_operations SET server_name='server-one' WHERE id=?")
|
|
.run(operation);
|
|
const prepare = vi.spyOn(api.handle, 'prepare');
|
|
const history = api.listHostOperationHistory(999, 'all', {
|
|
operation,
|
|
host: api.first.id,
|
|
server: 'server-one'
|
|
});
|
|
const exactCount = prepare.mock.calls
|
|
.map(([sql]) => sql)
|
|
.find((sql) => sql.startsWith('SELECT 1 AS total'))!;
|
|
prepare.mockRestore();
|
|
expect(history).toMatchObject({ page: 1, total: 1, totalPages: 1 });
|
|
expect(history.operations.map((row) => row.id)).toEqual([operation]);
|
|
expect(JSON.stringify(history)).not.toContain('secret');
|
|
const plan = api.handle
|
|
.prepare(`EXPLAIN QUERY PLAN ${exactCount}`)
|
|
.all(api.first.id, 'server-one', operation) as { detail: string }[];
|
|
expect(
|
|
plan.some((row) =>
|
|
row.detail.includes('USING INDEX sqlite_autoindex_ec_host_operations_1')
|
|
)
|
|
).toBe(true);
|
|
expect(
|
|
api.listHostOperationHistory(1, 'all', { operation, host: api.second.id }).total
|
|
).toBe(0);
|
|
expect(
|
|
api.listHostOperationHistory(1, 'all', { operation, server: 'another-server' }).total
|
|
).toBe(0);
|
|
expect(api.listHostOperationHistory(1, 'routine', { operation }).total).toBe(0);
|
|
expect(
|
|
api.listHostOperationHistory(1, 'all', { operation: 'missing-operation' }).total
|
|
).toBe(0);
|
|
api.handle
|
|
.prepare('UPDATE ec_host_operations SET history_expired_at=? WHERE id=?')
|
|
.run(new Date().toISOString(), operation);
|
|
expect(api.listHostOperationHistory(1, 'all', { operation })).toMatchObject({
|
|
operations: [],
|
|
page: 1,
|
|
total: 0
|
|
});
|
|
});
|
|
|
|
it('pages all hosts in stable newest-first order, retaining deleted-host records', async () => {
|
|
const api = await seedHistory();
|
|
const pages = [1, 2, 3].map((page) => api.listHostOperationHistory(page, 'all'));
|
|
expect(pages.map((page) => page.operations.length)).toEqual([25, 25, 3]);
|
|
pages.forEach((page, index) =>
|
|
expect(page).toMatchObject({
|
|
page: index + 1,
|
|
pageSize: 25,
|
|
total: 53,
|
|
totalPages: 3,
|
|
filter: 'all'
|
|
})
|
|
);
|
|
const operations = pages.flatMap((page) => page.operations);
|
|
expect(operations.map((operation) => operation.id)).toEqual([...api.ids].reverse());
|
|
expect(operations.find((operation) => operation.hostId === api.first.id)?.hostName).toBe(
|
|
'Alpha host'
|
|
);
|
|
expect(operations.find((operation) => operation.hostId === api.second.id)?.hostName).toBe(
|
|
'Beta host'
|
|
);
|
|
expect(
|
|
operations.filter((operation) => operation.hostId === api.deleted.id).length
|
|
).toBeGreaterThan(0);
|
|
expect(
|
|
operations
|
|
.filter((operation) => operation.hostId === api.deleted.id)
|
|
.every((operation) => operation.hostName === null)
|
|
).toBe(true);
|
|
expect(api.listHostOperationHistory(999, 'all')).toEqual(pages[2]);
|
|
});
|
|
|
|
it('bounds reads in SQLite using the history index and omits private payloads and results', async () => {
|
|
const api = await seedHistory(1003);
|
|
const prepare = vi.spyOn(api.handle, 'prepare');
|
|
const history = api.listHostOperationHistory(2, 'all');
|
|
api.listHostOperationHistory(1, 'important');
|
|
api.listHostOperationHistory(1, 'routine');
|
|
const statements = prepare.mock.calls.map(([sql]) => sql);
|
|
const query = prepare.mock.calls
|
|
.map(([sql]) => sql)
|
|
.find((sql) => sql.includes('FROM ec_host_operations o LEFT JOIN'))!;
|
|
prepare.mockRestore();
|
|
expect(
|
|
statements.every(
|
|
(sql) => !/\b(?:payload|result|json_extract|ec_host_operation_payloads)\b/.test(sql)
|
|
)
|
|
).toBe(true);
|
|
const projection = query.split('FROM ec_host_operations')[0];
|
|
expect(projection).not.toContain('payload');
|
|
expect(projection).not.toContain('result');
|
|
expect(projection).not.toContain('*');
|
|
expect(query).toContain('LIMIT ? OFFSET ?');
|
|
const plan = api.handle.prepare(`EXPLAIN QUERY PLAN ${query}`).all(25, 25) as {
|
|
detail: string;
|
|
}[];
|
|
expect(
|
|
plan.some((row) => row.detail.includes('USING INDEX ec_host_operations_history'))
|
|
).toBe(true);
|
|
expect(plan.some((row) => row.detail.includes('TEMP B-TREE'))).toBe(false);
|
|
expect(history.operations).toHaveLength(25);
|
|
expect(history.operations[0]).toMatchObject({
|
|
instanceId: 'instance-one',
|
|
generation: 2,
|
|
state: 'completed'
|
|
});
|
|
expect(
|
|
history.operations.every(
|
|
(operation) => !('payload' in operation) && !('result' in operation)
|
|
)
|
|
).toBe(true);
|
|
expect(JSON.stringify(history)).not.toContain('secret');
|
|
});
|
|
|
|
it('seeks through the selected history index without sorting or reading private payloads', async () => {
|
|
const api = await seedHistory(1003);
|
|
for (const filter of ['important', 'routine'] as const) {
|
|
const prepare = vi.spyOn(api.handle, 'prepare');
|
|
api.listHostOperationHistory(2, filter);
|
|
const query = prepare.mock.calls
|
|
.map(([sql]) => sql)
|
|
.find((sql) => sql.includes('FROM ec_host_operations o LEFT JOIN'))!;
|
|
prepare.mockRestore();
|
|
const plan = api.handle.prepare(`EXPLAIN QUERY PLAN ${query}`).all(25, 25) as {
|
|
detail: string;
|
|
}[];
|
|
expect(
|
|
plan.some((row) =>
|
|
row.detail.includes(`USING INDEX ec_host_operations_${filter}_history`)
|
|
)
|
|
).toBe(true);
|
|
expect(plan.some((row) => row.detail.includes('TEMP B-TREE'))).toBe(false);
|
|
expect(query).not.toMatch(/\b(?:payload|result|json_extract)\b/);
|
|
}
|
|
});
|
|
|
|
it('returns an empty first page and normalizes invalid internal page numbers', async () => {
|
|
const api = await seedHistory(0);
|
|
const empty = {
|
|
operations: [],
|
|
page: 1,
|
|
pageSize: 25,
|
|
total: 0,
|
|
totalPages: 1,
|
|
filter: 'important'
|
|
};
|
|
expect(api.listHostOperationHistory()).toEqual(empty);
|
|
for (const page of [0, -1, 1.5, NaN, Infinity, Number.MAX_SAFE_INTEGER + 1, 999]) {
|
|
expect(api.listHostOperationHistory(page)).toEqual(empty);
|
|
}
|
|
});
|
|
|
|
it('defaults to actions and errors, with independent counts and pagination for every filter', async () => {
|
|
const api = await operationHistory();
|
|
const actions = Array.from({ length: 26 }, () => api.add('instance.restart'));
|
|
actions.push(api.add('rcon.execute', { payload: { command: 'map_restart' } }));
|
|
const successful = Array.from({ length: 26 }, () =>
|
|
api.add('files.manifest', { result: { files: [] } })
|
|
);
|
|
const pending = ['pending', 'accepted', 'running'].map((state) =>
|
|
api.add('files.read', { state })
|
|
);
|
|
const failures = ['failed', 'unknown'].map((state) =>
|
|
api.add('files.read', { state, error: 'Observation unavailable' })
|
|
);
|
|
const negative = [
|
|
api.add('rcon.execute', {
|
|
payload: { command: 'status' },
|
|
result: { ok: false, reason: 'timeout' }
|
|
}),
|
|
api.add('instance.inspect', { result: { healthy: false, state: 'stopped' } }),
|
|
api.add('files.read', { result: { error: 'Read was incomplete' } }),
|
|
api.add('files.stat', { error: 'Could not inspect the file' })
|
|
];
|
|
const ids = [...actions, ...successful, ...pending, ...failures, ...negative];
|
|
for (const [filter, matching] of [
|
|
['important', [...actions, ...failures, ...negative]],
|
|
['routine', [...successful, ...pending, ...failures, ...negative]],
|
|
['all', ids]
|
|
] as const) {
|
|
const pages = Array.from({ length: Math.ceil(matching.length / 25) }, (_, index) =>
|
|
api.listHostOperationHistory(index + 1, filter)
|
|
);
|
|
expect(pages[0]).toMatchObject({
|
|
filter,
|
|
total: matching.length,
|
|
totalPages: pages.length,
|
|
pageSize: 25
|
|
});
|
|
expect(
|
|
pages.flatMap((page) => page.operations.map((operation) => operation.id))
|
|
).toEqual([...matching].reverse());
|
|
expect(api.listHostOperationHistory(999, filter)).toEqual(pages.at(-1));
|
|
}
|
|
expect(api.listHostOperationHistory()).toEqual(
|
|
api.listHostOperationHistory(1, 'important')
|
|
);
|
|
const routine = api.listHostOperationHistory(1, 'routine').operations;
|
|
expect(routine.every((operation) => operation.routine)).toBe(true);
|
|
expect(
|
|
api
|
|
.listHostOperationHistory(2, 'important')
|
|
.operations.every((operation) => !operation.routine)
|
|
).toBe(true);
|
|
});
|
|
|
|
it('keeps manual RCON commands visible and only exposes safe read command names', async () => {
|
|
const api = await operationHistory();
|
|
const reads = ['status', 'getstatus', 'version'].map((command) =>
|
|
api.add('rcon.execute', { payload: { command } })
|
|
);
|
|
const manual = api.add('rcon.execute', { payload: { command: 'say credential-secret' } });
|
|
const combined = api.add('rcon.execute', { payload: { command: 'status; map_restart' } });
|
|
const important = api.listHostOperationHistory();
|
|
expect(important.operations.map((operation) => operation.id)).toEqual([combined, manual]);
|
|
expect(
|
|
important.operations.every(
|
|
(operation) => !operation.routine && operation.targetPath === null
|
|
)
|
|
).toBe(true);
|
|
const routine = api.listHostOperationHistory(1, 'routine');
|
|
expect(routine.operations.map((operation) => operation.id)).toEqual([...reads].reverse());
|
|
expect(routine.operations.map((operation) => operation.targetPath)).toEqual([
|
|
'version',
|
|
'getstatus',
|
|
'status'
|
|
]);
|
|
expect(JSON.stringify(api.listHostOperationHistory(1, 'all'))).not.toContain(
|
|
'credential-secret'
|
|
);
|
|
});
|
|
|
|
it('persists server, target, and source summaries without depending on current instance records', async () => {
|
|
const api = await operationHistory();
|
|
const { withOperationSource } =
|
|
await import('../../src/lib/server/hosts/operation-context.js');
|
|
api.handle
|
|
.prepare(
|
|
`INSERT INTO native_instances(id,server,host_id,library_id,image,port,created_at)
|
|
VALUES('history-instance','t5_zombie_theater_1',?,'library','plutainer:test',28960,?)`
|
|
)
|
|
.run(api.first.id, new Date().toISOString());
|
|
const read = withOperationSource('Routine status', () =>
|
|
api.queueHostOperation(
|
|
api.first.id,
|
|
'files.read',
|
|
{
|
|
path: 'configs/server.cfg',
|
|
credential: 'payload-secret'
|
|
},
|
|
{ instanceId: 'history-instance', generation: 1 }
|
|
)
|
|
);
|
|
const manifest = withOperationSource('Watchdog drift scan', () =>
|
|
api.queueHostOperation(
|
|
api.first.id,
|
|
'files.manifest',
|
|
{
|
|
roots: ['scripts', 'configs', 'plugins'],
|
|
ignoreNames: [],
|
|
paths: ['configs/server.cfg']
|
|
},
|
|
{ instanceId: 'history-instance', generation: 1 }
|
|
)
|
|
);
|
|
api.reportHostOperationStatus(api.first.id, read.id, {
|
|
state: 'completed',
|
|
result: { contentBase64: 'result-secret' }
|
|
});
|
|
api.handle.prepare('DELETE FROM native_instances WHERE id=?').run('history-instance');
|
|
const history = api.listHostOperationHistory(1, 'all');
|
|
expect(history.operations.find((operation) => operation.id === read.id)).toMatchObject({
|
|
serverName: 't5_zombie_theater_1',
|
|
targetPath: 'configs/server.cfg',
|
|
source: 'Routine status',
|
|
routine: true
|
|
});
|
|
expect(history.operations.find((operation) => operation.id === manifest.id)).toMatchObject({
|
|
serverName: 't5_zombie_theater_1',
|
|
targetPath: 'scripts, configs, plugins',
|
|
source: 'Watchdog drift scan',
|
|
routine: true
|
|
});
|
|
expect(JSON.stringify(history)).not.toContain('secret');
|
|
});
|
|
|
|
it('refuses unsafe target summaries and never derives labels from arbitrary payload fields', async () => {
|
|
const api = await operationHistory();
|
|
const unsafe = [
|
|
'/etc/private-secret',
|
|
'../private-secret',
|
|
'configs/../../private-secret',
|
|
'configs/line\nprivate-secret',
|
|
'configs\\private-secret'
|
|
];
|
|
const ids = unsafe.map((path) =>
|
|
api.add('files.read', {
|
|
payload: { path, command: 'command-secret', name: 'name-secret' }
|
|
})
|
|
);
|
|
ids.push(
|
|
api.add('files.manifest', { payload: { roots: ['scripts', '../private-secret'] } })
|
|
);
|
|
ids.push(
|
|
api.add('instance.restart', {
|
|
payload: { path: 'configs/private-secret', command: 'command-secret' }
|
|
})
|
|
);
|
|
const history = api.listHostOperationHistory(1, 'all');
|
|
expect(history.operations).toHaveLength(ids.length);
|
|
expect(
|
|
history.operations.every(
|
|
(operation) => operation.targetPath === null && operation.serverName === null
|
|
)
|
|
).toBe(true);
|
|
expect(JSON.stringify(history)).not.toContain('secret');
|
|
});
|
|
|
|
it('backfills safe legacy summaries from immutable payloads while leaving source unknown', async () => {
|
|
const api = await operationHistory();
|
|
const { closeDb } = await import('../../src/lib/server/db/index.js');
|
|
api.handle
|
|
.prepare(
|
|
`INSERT INTO native_instances(id,server,host_id,library_id,image,port,created_at)
|
|
VALUES('legacy-instance','t5_zombie_theater_1',?,'library','plutainer:test',28960,?)`
|
|
)
|
|
.run(api.first.id, new Date().toISOString());
|
|
const read = api.queueHostOperationSerialized(
|
|
api.first.id,
|
|
'files.read',
|
|
Buffer.from(
|
|
JSON.stringify({
|
|
path: 'configs/server.cfg',
|
|
credential: 'payload-secret'
|
|
})
|
|
),
|
|
{ instanceId: 'legacy-instance', generation: 1 },
|
|
{ path: 'configs/routing-secret' }
|
|
);
|
|
api.reportHostOperationStatus(api.first.id, read.id, {
|
|
state: 'completed',
|
|
result: { credential: 'result-secret' }
|
|
});
|
|
const command = api.queueHostOperationSerialized(
|
|
api.first.id,
|
|
'rcon.execute',
|
|
Buffer.from('{"command":"status"}'),
|
|
{},
|
|
{ command: 'command-secret' }
|
|
);
|
|
const manual = api.add('rcon.execute', { payload: { command: 'say command-secret' } });
|
|
const unsafe = api.add('files.read', { payload: { path: '../private-secret' } });
|
|
api.handle.exec(`DROP INDEX ec_host_operations_routine_history;
|
|
DROP TRIGGER operation_history_count_insert;
|
|
DROP TRIGGER operation_history_count_delete;
|
|
DROP TRIGGER operation_history_count_update;
|
|
DROP TABLE ec_host_operation_history_counts;
|
|
DELETE FROM ec_host_schema_migrations WHERE name='history-counts-v1';
|
|
DROP INDEX ec_host_operations_important_history;
|
|
DROP INDEX ec_host_operations_server_history;
|
|
ALTER TABLE ec_host_operations DROP COLUMN routine;
|
|
ALTER TABLE ec_host_operations DROP COLUMN server_name;
|
|
ALTER TABLE ec_host_operations DROP COLUMN target_path;
|
|
ALTER TABLE ec_host_operations DROP COLUMN source;`);
|
|
api.handle.pragma('user_version = 0');
|
|
closeDb();
|
|
const history = api.listHostOperationHistory(1, 'all');
|
|
expect(history.operations).toHaveLength(4);
|
|
expect(history.operations.find((operation) => operation.id === read.id)).toMatchObject({
|
|
routine: true,
|
|
serverName: 't5_zombie_theater_1',
|
|
targetPath: 'configs/server.cfg',
|
|
source: null
|
|
});
|
|
expect(history.operations.find((operation) => operation.id === command.id)).toMatchObject({
|
|
routine: true,
|
|
targetPath: 'status',
|
|
source: null
|
|
});
|
|
expect(history.operations.find((operation) => operation.id === manual)).toMatchObject({
|
|
routine: false,
|
|
targetPath: null,
|
|
source: null
|
|
});
|
|
expect(history.operations.find((operation) => operation.id === unsafe)).toMatchObject({
|
|
routine: true,
|
|
targetPath: null,
|
|
source: null
|
|
});
|
|
expect(JSON.stringify(history)).not.toContain('secret');
|
|
closeDb();
|
|
expect(api.listHostOperationHistory(1, 'all')).toEqual(history);
|
|
});
|
|
|
|
it('serves fixed-size API pages without caching or exposing private operation data', async () => {
|
|
const api = await seedHistory();
|
|
const { GET } = await import('../../src/routes/api/hosts/operations/+server.js');
|
|
const first = GET({
|
|
request: new Request('https://ec.test/api/hosts/operations?filter=all')
|
|
});
|
|
expect(first.headers.get('cache-control')).toBe('no-store');
|
|
expect(await first.json()).toEqual(api.listHostOperationHistory(1, 'all'));
|
|
const second = GET({
|
|
request: new Request(
|
|
'https://ec.test/api/hosts/operations?page=2&pageSize=500&filter=all'
|
|
)
|
|
});
|
|
const body = await second.json();
|
|
expect(body).toEqual(api.listHostOperationHistory(2, 'all'));
|
|
expect(body.operations).toHaveLength(25);
|
|
expect(JSON.stringify(body)).not.toContain('secret');
|
|
const last = GET({
|
|
request: new Request('https://ec.test/api/hosts/operations?page=999&filter=all')
|
|
});
|
|
expect(await last.json()).toEqual(api.listHostOperationHistory(3, 'all'));
|
|
});
|
|
|
|
it('serves the selected filter and defaults the API to actions and errors', async () => {
|
|
const api = await operationHistory();
|
|
const action = api.add('instance.restart');
|
|
const read = api.add('instance.inspect', { result: { healthy: true } });
|
|
const { GET } = await import('../../src/routes/api/hosts/operations/+server.js');
|
|
const request = (query = '') =>
|
|
GET({ request: new Request(`https://ec.test/api/hosts/operations${query}`) }).json();
|
|
expect(await request()).toEqual(api.listHostOperationHistory());
|
|
expect(
|
|
(await request()).operations.map((operation: { id: string }) => operation.id)
|
|
).toEqual([action]);
|
|
expect(
|
|
(await request('?filter=routine')).operations.map(
|
|
(operation: { id: string }) => operation.id
|
|
)
|
|
).toEqual([read]);
|
|
expect(await request('?filter=all')).toEqual(api.listHostOperationHistory(1, 'all'));
|
|
});
|
|
|
|
it('serves an exact old operation through the API without exposing command data', async () => {
|
|
const api = await seedHistory();
|
|
const operation = api.ids[0];
|
|
const { GET } = await import('../../src/routes/api/hosts/operations/+server.js');
|
|
const response = GET({
|
|
request: new Request(
|
|
`https://ec.test/api/hosts/operations?filter=all&operation=${operation}`
|
|
)
|
|
});
|
|
const body = await response.json();
|
|
expect(body).toMatchObject({ page: 1, total: 1, totalPages: 1 });
|
|
expect(body.operations.map((row: { id: string }) => row.id)).toEqual([operation]);
|
|
expect(JSON.stringify(body)).not.toContain('secret');
|
|
});
|
|
|
|
it('rejects invalid API pages and keeps host management access restrictions', async () => {
|
|
const { GET } = await import('../../src/routes/api/hosts/operations/+server.js');
|
|
const url = 'https://ec.test/api/hosts/operations';
|
|
for (const page of ['', '0', '-1', '1.5', 'nope', 'Infinity', '9007199254740992']) {
|
|
expect(() => GET({ request: new Request(`${url}?page=${page}`) })).toThrow(
|
|
expect.objectContaining({ status: 400 })
|
|
);
|
|
}
|
|
for (const filter of ['', 'unknown', 'ALL', 'important%27%20OR%201=1']) {
|
|
expect(() => GET({ request: new Request(`${url}?filter=${filter}`) })).toThrow(
|
|
expect.objectContaining({ status: 400 })
|
|
);
|
|
}
|
|
for (const operation of ['', 'x'.repeat(513), 'operation%00bad', 'operation%0Abad']) {
|
|
expect(() => GET({ request: new Request(`${url}?operation=${operation}`) })).toThrow(
|
|
expect.objectContaining({ status: 400 })
|
|
);
|
|
}
|
|
const blockedHeaders: HeadersInit[] = [
|
|
{ origin: 'https://other.test' },
|
|
{ 'sec-fetch-site': 'cross-site' },
|
|
{ authorization: 'Bearer ec_host_secret' },
|
|
{ authorization: 'Bearer ec_enroll_secret' }
|
|
];
|
|
for (const headers of blockedHeaders) {
|
|
expect(() => GET({ request: new Request(url, { headers }) })).toThrow(
|
|
expect.objectContaining({ status: 403 })
|
|
);
|
|
}
|
|
});
|
|
|
|
it('keeps operation history out of host detail responses', async () => {
|
|
const api = await seedHistory();
|
|
const { GET } = await import('../../src/routes/api/hosts/[id]/+server.js');
|
|
const body = await GET({
|
|
request: new Request(`https://ec.test/api/hosts/${api.first.id}`),
|
|
params: { id: api.first.id }
|
|
}).json();
|
|
expect(body.host.id).toBe(api.first.id);
|
|
expect(body).not.toHaveProperty('operations');
|
|
expect(JSON.stringify(body)).not.toContain('secret');
|
|
});
|
|
});
|