376 lines
27 KiB
TypeScript
376 lines
27 KiB
TypeScript
import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
|
|
import { newFixture, type Fixture } from '../helpers/fixture.js';
|
|
|
|
let fixture: Fixture;
|
|
beforeEach(async () => { vi.resetModules(); fixture = await newFixture([]); });
|
|
afterEach(async () => { vi.restoreAllMocks(); await fixture.cleanup(); });
|
|
|
|
async function seedHistory(count = 53) {
|
|
const hosts = await import('../../src/lib/server/hosts/index.js');
|
|
const { db } = await import('../../src/lib/server/db/index.js');
|
|
const first = hosts.createHost({ name: 'Alpha host' });
|
|
const second = hosts.createHost({ name: 'Beta host' });
|
|
const deleted = hosts.createHost({ name: 'Removed host' });
|
|
const handle = db();
|
|
const ids: string[] = [];
|
|
handle.transaction(() => {
|
|
const insert = handle.prepare(`INSERT INTO ec_host_operations
|
|
(id,host_id,kind,instance_id,generation,payload,result,state,error,created_at,updated_at)
|
|
VALUES(?,?,'instance.inspect','instance-one',2,?,?,'completed',NULL,?,?)`);
|
|
for (let index = 0; index < count; index++) {
|
|
// Reverse IDs and tied timestamps ensure insertion order breaks ties.
|
|
const id = `operation-${String(count - index).padStart(4, '0')}`;
|
|
const timestamp = index < 3 ? '2026-10-01T12:00:00.000Z' : '2026-10-05T12:00:00.000Z';
|
|
ids.push(id);
|
|
insert.run(id, [first, second, deleted][index % 3].id,
|
|
'{"credential":"payload-secret"}', '{"credential":"result-secret"}', timestamp, timestamp);
|
|
}
|
|
handle.prepare('UPDATE ec_hosts SET deleted_at=? WHERE id=?').run('2026-10-05T12:30:00.000Z', deleted.id);
|
|
})();
|
|
return { ...hosts, handle, ids, first, second, deleted };
|
|
}
|
|
|
|
async function operationHistory() {
|
|
const api = await seedHistory(0);
|
|
function add(kind: string, options: { payload?: Record<string, unknown>; state?: string; result?: unknown; error?: string } = {}) {
|
|
const operation = api.queueHostOperation(api.first.id, kind, options.payload ?? {});
|
|
if (options.state !== 'pending') api.reportHostOperationStatus(api.first.id, operation.id, {
|
|
state: options.state ?? 'completed', result: options.result, error: options.error
|
|
});
|
|
return operation.id;
|
|
}
|
|
return { ...api, add };
|
|
}
|
|
|
|
describe('host operation history', () => {
|
|
it('maintains exact scoped totals through receipts, expiration, rollback, deletion and reopening without recounting history', async () => {
|
|
const api = await operationHistory();
|
|
const { importantOperationSql } = await import('../../src/lib/server/hosts/observations.js');
|
|
const { closeDb, db } = await import('../../src/lib/server/db/index.js');
|
|
const ids = Array.from({ length: 35 }, (_, i) => api.add(i % 2 ? 'instance.inspect' : 'instance.restart', { state: 'pending' }));
|
|
const verify = () => {
|
|
for (const host of [undefined, api.first.id, api.second.id]) for (const server of [undefined, 'server-one']) {
|
|
for (const filter of ['all', 'routine', 'important'] as const) {
|
|
const where = ['o.history_expired_at IS NULL']; const args: string[] = [];
|
|
if (host) { where.push('o.host_id=?'); args.push(host); }
|
|
if (server) { where.push('o.server_name=?'); args.push(server); }
|
|
if (filter !== 'all') where.push(filter === 'routine' ? 'o.routine=1' : importantOperationSql);
|
|
const expected = db().prepare(`SELECT COUNT(*) total FROM ec_host_operations o WHERE ${where.join(' AND ')}`).get(...args) as { total: number };
|
|
expect(api.listHostOperationHistory(1, filter, { host, server }).total).toBe(expected.total);
|
|
}
|
|
}
|
|
};
|
|
verify();
|
|
for (const [index, id] of ids.entries()) api.reportHostOperationStatus(api.first.id, id,
|
|
index % 3 ? { state: 'completed', result: { healthy: index % 5 !== 0 } } : { state: 'failed', error: 'failure' });
|
|
api.handle.prepare("UPDATE ec_host_operations SET server_name='server-one',host_id=? WHERE rowid%2=0").run(api.second.id);
|
|
api.handle.prepare('UPDATE ec_host_operations SET history_expired_at=? WHERE rowid%4=0').run(new Date().toISOString());
|
|
api.handle.exec('DELETE FROM ec_host_operation_events WHERE operation_id IN (SELECT id FROM ec_host_operations WHERE rowid%7=0); DELETE FROM ec_host_operations WHERE rowid%7=0');
|
|
expect(() => api.handle.transaction(() => { api.handle.exec('DELETE FROM ec_host_operation_events; DELETE FROM ec_host_operations'); throw new Error('rollback'); })()).toThrow('rollback');
|
|
verify(); closeDb(); verify();
|
|
const prepare = vi.spyOn(db(), 'prepare');
|
|
api.listHostOperationHistory(1); api.listHostOperationHistory(2);
|
|
expect(prepare.mock.calls.some(([sql]) => /COUNT\(/i.test(sql))).toBe(false);
|
|
const count = prepare.mock.calls.find(([sql]) => sql.includes('FROM ec_host_operation_history_counts'))![0];
|
|
expect(db().prepare('EXPLAIN QUERY PLAN ' + count).all('', '')).toEqual(expect.arrayContaining([
|
|
expect.objectContaining({ detail: expect.stringContaining('USING PRIMARY KEY') })
|
|
]));
|
|
});
|
|
|
|
it('scopes counts and pages to one host or server and preserves deleted-host history', async () => {
|
|
const api = await seedHistory(90);
|
|
api.handle.prepare("UPDATE ec_host_operations SET server_name='server-one' WHERE host_id=?").run(api.first.id);
|
|
const first = api.listHostOperationHistory(1, 'all', { host: api.first.id });
|
|
const second = api.listHostOperationHistory(2, 'all', { host: api.first.id });
|
|
expect(first).toMatchObject({ total: 30, totalPages: 2 });
|
|
expect([...first.operations, ...second.operations]).toHaveLength(30);
|
|
expect(first.operations.every(operation => operation.hostId === api.first.id)).toBe(true);
|
|
expect(api.listHostOperationHistory(1, 'all', { server: 'server-one' })).toEqual(first);
|
|
expect(api.listHostOperationHistory(1, 'all', { host: api.second.id, server: 'server-one' }).total).toBe(0);
|
|
expect(api.listHostOperationHistory(1, 'all', { host: api.deleted.id }).operations.every(operation => operation.hostName === null)).toBe(true);
|
|
const { GET } = await import('../../src/routes/api/hosts/operations/+server.js');
|
|
const response = GET({ request: new Request(`https://ec.test/api/hosts/operations?filter=all&host=${api.first.id}&page=2`) });
|
|
expect(await response.json()).toEqual(second);
|
|
});
|
|
|
|
it('applies host scope to failures as well as ordinary actions', async () => {
|
|
const api = await operationHistory();
|
|
const first = api.add('instance.restart');
|
|
const other = api.queueHostOperation(api.second.id, 'instance.inspect', {});
|
|
api.reportHostOperationStatus(api.second.id, other.id, { state: 'failed', error: 'Unreachable' });
|
|
expect(api.listHostOperationHistory(1, 'important', { host: api.first.id }).operations.map(operation => operation.id)).toEqual([first]);
|
|
expect(api.listHostOperationHistory(1, 'important', { host: api.second.id }).operations.map(operation => operation.id)).toEqual([other.id]);
|
|
});
|
|
|
|
it('finds an exact old operation without walking pages and keeps all scope and retention filters', async () => {
|
|
const api = await seedHistory(1003);
|
|
const operation = api.ids[0];
|
|
api.handle.prepare("UPDATE ec_host_operations SET server_name='server-one' WHERE id=?").run(operation);
|
|
const prepare = vi.spyOn(api.handle, 'prepare');
|
|
const history = api.listHostOperationHistory(999, 'all', { operation, host: api.first.id, server: 'server-one' });
|
|
const exactCount = prepare.mock.calls.map(([sql]) => sql).find(sql => sql.startsWith('SELECT 1 AS total'))!;
|
|
prepare.mockRestore();
|
|
expect(history).toMatchObject({ page: 1, total: 1, totalPages: 1 });
|
|
expect(history.operations.map(row => row.id)).toEqual([operation]);
|
|
expect(JSON.stringify(history)).not.toContain('secret');
|
|
const plan = api.handle.prepare(`EXPLAIN QUERY PLAN ${exactCount}`).all(api.first.id, 'server-one', operation) as { detail: string }[];
|
|
expect(plan.some(row => row.detail.includes('USING INDEX sqlite_autoindex_ec_host_operations_1'))).toBe(true);
|
|
expect(api.listHostOperationHistory(1, 'all', { operation, host: api.second.id }).total).toBe(0);
|
|
expect(api.listHostOperationHistory(1, 'all', { operation, server: 'another-server' }).total).toBe(0);
|
|
expect(api.listHostOperationHistory(1, 'routine', { operation }).total).toBe(0);
|
|
expect(api.listHostOperationHistory(1, 'all', { operation: 'missing-operation' }).total).toBe(0);
|
|
api.handle.prepare('UPDATE ec_host_operations SET history_expired_at=? WHERE id=?').run(new Date().toISOString(), operation);
|
|
expect(api.listHostOperationHistory(1, 'all', { operation })).toMatchObject({ operations: [], page: 1, total: 0 });
|
|
});
|
|
|
|
it('pages all hosts in stable newest-first order, retaining deleted-host records', async () => {
|
|
const api = await seedHistory();
|
|
const pages = [1, 2, 3].map(page => api.listHostOperationHistory(page, 'all'));
|
|
expect(pages.map(page => page.operations.length)).toEqual([25, 25, 3]);
|
|
pages.forEach((page, index) => expect(page).toMatchObject({ page: index + 1, pageSize: 25, total: 53, totalPages: 3, filter: 'all' }));
|
|
const operations = pages.flatMap(page => page.operations);
|
|
expect(operations.map(operation => operation.id)).toEqual([...api.ids].reverse());
|
|
expect(operations.find(operation => operation.hostId === api.first.id)?.hostName).toBe('Alpha host');
|
|
expect(operations.find(operation => operation.hostId === api.second.id)?.hostName).toBe('Beta host');
|
|
expect(operations.filter(operation => operation.hostId === api.deleted.id).length).toBeGreaterThan(0);
|
|
expect(operations.filter(operation => operation.hostId === api.deleted.id).every(operation => operation.hostName === null)).toBe(true);
|
|
expect(api.listHostOperationHistory(999, 'all')).toEqual(pages[2]);
|
|
});
|
|
|
|
it('bounds reads in SQLite using the history index and omits private payloads and results', async () => {
|
|
const api = await seedHistory(1003);
|
|
const prepare = vi.spyOn(api.handle, 'prepare');
|
|
const history = api.listHostOperationHistory(2, 'all');
|
|
api.listHostOperationHistory(1, 'important');
|
|
api.listHostOperationHistory(1, 'routine');
|
|
const statements = prepare.mock.calls.map(([sql]) => sql);
|
|
const query = prepare.mock.calls.map(([sql]) => sql).find(sql => sql.includes('FROM ec_host_operations o LEFT JOIN'))!;
|
|
prepare.mockRestore();
|
|
expect(statements.every(sql => !/\b(?:payload|result|json_extract|ec_host_operation_payloads)\b/.test(sql))).toBe(true);
|
|
const projection = query.split('FROM ec_host_operations')[0];
|
|
expect(projection).not.toContain('payload');
|
|
expect(projection).not.toContain('result');
|
|
expect(projection).not.toContain('*');
|
|
expect(query).toContain('LIMIT ? OFFSET ?');
|
|
const plan = api.handle.prepare(`EXPLAIN QUERY PLAN ${query}`).all(25, 25) as { detail: string }[];
|
|
expect(plan.some(row => row.detail.includes('USING INDEX ec_host_operations_history'))).toBe(true);
|
|
expect(plan.some(row => row.detail.includes('TEMP B-TREE'))).toBe(false);
|
|
expect(history.operations).toHaveLength(25);
|
|
expect(history.operations[0]).toMatchObject({ instanceId: 'instance-one', generation: 2, state: 'completed' });
|
|
expect(history.operations.every(operation => !('payload' in operation) && !('result' in operation))).toBe(true);
|
|
expect(JSON.stringify(history)).not.toContain('secret');
|
|
});
|
|
|
|
it('seeks through the selected history index without sorting or reading private payloads', async () => {
|
|
const api = await seedHistory(1003);
|
|
for (const filter of ['important', 'routine'] as const) {
|
|
const prepare = vi.spyOn(api.handle, 'prepare');
|
|
api.listHostOperationHistory(2, filter);
|
|
const query = prepare.mock.calls.map(([sql]) => sql).find(sql => sql.includes('FROM ec_host_operations o LEFT JOIN'))!;
|
|
prepare.mockRestore();
|
|
const plan = api.handle.prepare(`EXPLAIN QUERY PLAN ${query}`).all(25, 25) as { detail: string }[];
|
|
expect(plan.some(row => row.detail.includes(`USING INDEX ec_host_operations_${filter}_history`))).toBe(true);
|
|
expect(plan.some(row => row.detail.includes('TEMP B-TREE'))).toBe(false);
|
|
expect(query).not.toMatch(/\b(?:payload|result|json_extract)\b/);
|
|
}
|
|
});
|
|
|
|
it('returns an empty first page and normalizes invalid internal page numbers', async () => {
|
|
const api = await seedHistory(0);
|
|
const empty = { operations: [], page: 1, pageSize: 25, total: 0, totalPages: 1, filter: 'important' };
|
|
expect(api.listHostOperationHistory()).toEqual(empty);
|
|
for (const page of [0, -1, 1.5, NaN, Infinity, Number.MAX_SAFE_INTEGER + 1, 999]) {
|
|
expect(api.listHostOperationHistory(page)).toEqual(empty);
|
|
}
|
|
});
|
|
|
|
it('defaults to actions and errors, with independent counts and pagination for every filter', async () => {
|
|
const api = await operationHistory();
|
|
const actions = Array.from({ length: 26 }, () => api.add('instance.restart'));
|
|
actions.push(api.add('rcon.execute', { payload: { command: 'map_restart' } }));
|
|
const successful = Array.from({ length: 26 }, () => api.add('files.manifest', { result: { files: [] } }));
|
|
const pending = ['pending', 'accepted', 'running'].map(state => api.add('files.read', { state }));
|
|
const failures = ['failed', 'unknown'].map(state => api.add('files.read', { state, error: 'Observation unavailable' }));
|
|
const negative = [
|
|
api.add('rcon.execute', { payload: { command: 'status' }, result: { ok: false, reason: 'timeout' } }),
|
|
api.add('instance.inspect', { result: { healthy: false, state: 'stopped' } }),
|
|
api.add('files.read', { result: { error: 'Read was incomplete' } }),
|
|
api.add('files.stat', { error: 'Could not inspect the file' })
|
|
];
|
|
const ids = [...actions, ...successful, ...pending, ...failures, ...negative];
|
|
for (const [filter, matching] of [
|
|
['important', [...actions, ...failures, ...negative]],
|
|
['routine', [...successful, ...pending, ...failures, ...negative]],
|
|
['all', ids]
|
|
] as const) {
|
|
const pages = Array.from({ length: Math.ceil(matching.length / 25) }, (_, index) => api.listHostOperationHistory(index + 1, filter));
|
|
expect(pages[0]).toMatchObject({ filter, total: matching.length, totalPages: pages.length, pageSize: 25 });
|
|
expect(pages.flatMap(page => page.operations.map(operation => operation.id))).toEqual([...matching].reverse());
|
|
expect(api.listHostOperationHistory(999, filter)).toEqual(pages.at(-1));
|
|
}
|
|
expect(api.listHostOperationHistory()).toEqual(api.listHostOperationHistory(1, 'important'));
|
|
const routine = api.listHostOperationHistory(1, 'routine').operations;
|
|
expect(routine.every(operation => operation.routine)).toBe(true);
|
|
expect(api.listHostOperationHistory(2, 'important').operations.every(operation => !operation.routine)).toBe(true);
|
|
});
|
|
|
|
it('keeps manual RCON commands visible and only exposes safe read command names', async () => {
|
|
const api = await operationHistory();
|
|
const reads = ['status', 'getstatus', 'version'].map(command => api.add('rcon.execute', { payload: { command } }));
|
|
const manual = api.add('rcon.execute', { payload: { command: 'say credential-secret' } });
|
|
const combined = api.add('rcon.execute', { payload: { command: 'status; map_restart' } });
|
|
const important = api.listHostOperationHistory();
|
|
expect(important.operations.map(operation => operation.id)).toEqual([combined, manual]);
|
|
expect(important.operations.every(operation => !operation.routine && operation.targetPath === null)).toBe(true);
|
|
const routine = api.listHostOperationHistory(1, 'routine');
|
|
expect(routine.operations.map(operation => operation.id)).toEqual([...reads].reverse());
|
|
expect(routine.operations.map(operation => operation.targetPath)).toEqual(['version', 'getstatus', 'status']);
|
|
expect(JSON.stringify(api.listHostOperationHistory(1, 'all'))).not.toContain('credential-secret');
|
|
});
|
|
|
|
it('persists server, target, and source summaries without depending on current instance records', async () => {
|
|
const api = await operationHistory();
|
|
const { withOperationSource } = await import('../../src/lib/server/hosts/operation-context.js');
|
|
api.handle.prepare(`INSERT INTO native_instances(id,server,host_id,library_id,image,port,created_at)
|
|
VALUES('history-instance','t5_zombie_theater_1',?,'library','plutainer:test',28960,?)`)
|
|
.run(api.first.id, new Date().toISOString());
|
|
const read = withOperationSource('Routine status', () => api.queueHostOperation(api.first.id, 'files.read', {
|
|
path: 'configs/server.cfg', credential: 'payload-secret'
|
|
}, { instanceId: 'history-instance', generation: 1 }));
|
|
const manifest = withOperationSource('Watchdog drift scan', () => api.queueHostOperation(api.first.id, 'files.manifest', {
|
|
roots: ['scripts', 'configs', 'plugins'], ignoreNames: [], paths: ['configs/server.cfg']
|
|
}, { instanceId: 'history-instance', generation: 1 }));
|
|
api.reportHostOperationStatus(api.first.id, read.id, { state: 'completed', result: { contentBase64: 'result-secret' } });
|
|
api.handle.prepare('DELETE FROM native_instances WHERE id=?').run('history-instance');
|
|
const history = api.listHostOperationHistory(1, 'all');
|
|
expect(history.operations.find(operation => operation.id === read.id)).toMatchObject({
|
|
serverName: 't5_zombie_theater_1', targetPath: 'configs/server.cfg', source: 'Routine status', routine: true
|
|
});
|
|
expect(history.operations.find(operation => operation.id === manifest.id)).toMatchObject({
|
|
serverName: 't5_zombie_theater_1', targetPath: 'scripts, configs, plugins', source: 'Watchdog drift scan', routine: true
|
|
});
|
|
expect(JSON.stringify(history)).not.toContain('secret');
|
|
});
|
|
|
|
it('refuses unsafe target summaries and never derives labels from arbitrary payload fields', async () => {
|
|
const api = await operationHistory();
|
|
const unsafe = ['/etc/private-secret', '../private-secret', 'configs/../../private-secret', 'configs/line\nprivate-secret', 'configs\\private-secret'];
|
|
const ids = unsafe.map(path => api.add('files.read', { payload: { path, command: 'command-secret', name: 'name-secret' } }));
|
|
ids.push(api.add('files.manifest', { payload: { roots: ['scripts', '../private-secret'] } }));
|
|
ids.push(api.add('instance.restart', { payload: { path: 'configs/private-secret', command: 'command-secret' } }));
|
|
const history = api.listHostOperationHistory(1, 'all');
|
|
expect(history.operations).toHaveLength(ids.length);
|
|
expect(history.operations.every(operation => operation.targetPath === null && operation.serverName === null)).toBe(true);
|
|
expect(JSON.stringify(history)).not.toContain('secret');
|
|
});
|
|
|
|
it('backfills safe legacy summaries from immutable payloads while leaving source unknown', async () => {
|
|
const api = await operationHistory();
|
|
const { closeDb } = await import('../../src/lib/server/db/index.js');
|
|
api.handle.prepare(`INSERT INTO native_instances(id,server,host_id,library_id,image,port,created_at)
|
|
VALUES('legacy-instance','t5_zombie_theater_1',?,'library','plutainer:test',28960,?)`)
|
|
.run(api.first.id, new Date().toISOString());
|
|
const read = api.queueHostOperationSerialized(api.first.id, 'files.read', Buffer.from(JSON.stringify({
|
|
path: 'configs/server.cfg', credential: 'payload-secret'
|
|
})), { instanceId: 'legacy-instance', generation: 1 }, { path: 'configs/routing-secret' });
|
|
api.reportHostOperationStatus(api.first.id, read.id, { state: 'completed', result: { credential: 'result-secret' } });
|
|
const command = api.queueHostOperationSerialized(api.first.id, 'rcon.execute', Buffer.from('{"command":"status"}'), {}, { command: 'command-secret' });
|
|
const manual = api.add('rcon.execute', { payload: { command: 'say command-secret' } });
|
|
const unsafe = api.add('files.read', { payload: { path: '../private-secret' } });
|
|
api.handle.exec(`DROP INDEX ec_host_operations_routine_history;
|
|
DROP TRIGGER operation_history_count_insert;
|
|
DROP TRIGGER operation_history_count_delete;
|
|
DROP TRIGGER operation_history_count_update;
|
|
DROP TABLE ec_host_operation_history_counts;
|
|
DELETE FROM ec_host_schema_migrations WHERE name='history-counts-v1';
|
|
DROP INDEX ec_host_operations_important_history;
|
|
DROP INDEX ec_host_operations_server_history;
|
|
ALTER TABLE ec_host_operations DROP COLUMN routine;
|
|
ALTER TABLE ec_host_operations DROP COLUMN server_name;
|
|
ALTER TABLE ec_host_operations DROP COLUMN target_path;
|
|
ALTER TABLE ec_host_operations DROP COLUMN source;`);
|
|
closeDb();
|
|
const history = api.listHostOperationHistory(1, 'all');
|
|
expect(history.operations).toHaveLength(4);
|
|
expect(history.operations.find(operation => operation.id === read.id)).toMatchObject({
|
|
routine: true, serverName: 't5_zombie_theater_1', targetPath: 'configs/server.cfg', source: null
|
|
});
|
|
expect(history.operations.find(operation => operation.id === command.id)).toMatchObject({ routine: true, targetPath: 'status', source: null });
|
|
expect(history.operations.find(operation => operation.id === manual)).toMatchObject({ routine: false, targetPath: null, source: null });
|
|
expect(history.operations.find(operation => operation.id === unsafe)).toMatchObject({ routine: true, targetPath: null, source: null });
|
|
expect(JSON.stringify(history)).not.toContain('secret');
|
|
closeDb();
|
|
expect(api.listHostOperationHistory(1, 'all')).toEqual(history);
|
|
});
|
|
|
|
it('serves fixed-size API pages without caching or exposing private operation data', async () => {
|
|
const api = await seedHistory();
|
|
const { GET } = await import('../../src/routes/api/hosts/operations/+server.js');
|
|
const first = GET({ request: new Request('https://ec.test/api/hosts/operations?filter=all') });
|
|
expect(first.headers.get('cache-control')).toBe('no-store');
|
|
expect(await first.json()).toEqual(api.listHostOperationHistory(1, 'all'));
|
|
const second = GET({ request: new Request('https://ec.test/api/hosts/operations?page=2&pageSize=500&filter=all') });
|
|
const body = await second.json();
|
|
expect(body).toEqual(api.listHostOperationHistory(2, 'all'));
|
|
expect(body.operations).toHaveLength(25);
|
|
expect(JSON.stringify(body)).not.toContain('secret');
|
|
const last = GET({ request: new Request('https://ec.test/api/hosts/operations?page=999&filter=all') });
|
|
expect(await last.json()).toEqual(api.listHostOperationHistory(3, 'all'));
|
|
});
|
|
|
|
it('serves the selected filter and defaults the API to actions and errors', async () => {
|
|
const api = await operationHistory();
|
|
const action = api.add('instance.restart');
|
|
const read = api.add('instance.inspect', { result: { healthy: true } });
|
|
const { GET } = await import('../../src/routes/api/hosts/operations/+server.js');
|
|
const request = (query = '') => GET({ request: new Request(`https://ec.test/api/hosts/operations${query}`) }).json();
|
|
expect(await request()).toEqual(api.listHostOperationHistory());
|
|
expect((await request()).operations.map((operation: { id: string }) => operation.id)).toEqual([action]);
|
|
expect((await request('?filter=routine')).operations.map((operation: { id: string }) => operation.id)).toEqual([read]);
|
|
expect(await request('?filter=all')).toEqual(api.listHostOperationHistory(1, 'all'));
|
|
});
|
|
|
|
it('serves an exact old operation through the API without exposing command data', async () => {
|
|
const api = await seedHistory();
|
|
const operation = api.ids[0];
|
|
const { GET } = await import('../../src/routes/api/hosts/operations/+server.js');
|
|
const response = GET({ request: new Request(`https://ec.test/api/hosts/operations?filter=all&operation=${operation}`) });
|
|
const body = await response.json();
|
|
expect(body).toMatchObject({ page: 1, total: 1, totalPages: 1 });
|
|
expect(body.operations.map((row: { id: string }) => row.id)).toEqual([operation]);
|
|
expect(JSON.stringify(body)).not.toContain('secret');
|
|
});
|
|
|
|
it('rejects invalid API pages and keeps host management access restrictions', async () => {
|
|
const { GET } = await import('../../src/routes/api/hosts/operations/+server.js');
|
|
const url = 'https://ec.test/api/hosts/operations';
|
|
for (const page of ['', '0', '-1', '1.5', 'nope', 'Infinity', '9007199254740992']) {
|
|
expect(() => GET({ request: new Request(`${url}?page=${page}`) })).toThrow(expect.objectContaining({ status: 400 }));
|
|
}
|
|
for (const filter of ['', 'unknown', 'ALL', 'important%27%20OR%201=1']) {
|
|
expect(() => GET({ request: new Request(`${url}?filter=${filter}`) })).toThrow(expect.objectContaining({ status: 400 }));
|
|
}
|
|
for (const operation of ['', 'x'.repeat(513), 'operation%00bad', 'operation%0Abad']) {
|
|
expect(() => GET({ request: new Request(`${url}?operation=${operation}`) })).toThrow(expect.objectContaining({ status: 400 }));
|
|
}
|
|
const blockedHeaders: HeadersInit[] = [
|
|
{ origin: 'https://other.test' },
|
|
{ 'sec-fetch-site': 'cross-site' },
|
|
{ authorization: 'Bearer ec_host_secret' },
|
|
{ authorization: 'Bearer ec_enroll_secret' }
|
|
];
|
|
for (const headers of blockedHeaders) {
|
|
expect(() => GET({ request: new Request(url, { headers }) })).toThrow(expect.objectContaining({ status: 403 }));
|
|
}
|
|
});
|
|
|
|
it('keeps operation history out of host detail responses', async () => {
|
|
const api = await seedHistory();
|
|
const { GET } = await import('../../src/routes/api/hosts/[id]/+server.js');
|
|
const body = await GET({ request: new Request(`https://ec.test/api/hosts/${api.first.id}`), params: { id: api.first.id } }).json();
|
|
expect(body.host.id).toBe(api.first.id);
|
|
expect(body).not.toHaveProperty('operations');
|
|
expect(JSON.stringify(body)).not.toContain('secret');
|
|
});
|
|
});
|