mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-28 20:21:50 +01:00
DottaandClaude Opus 4.8
ec7adcaf3d
Foundation for opt-in `tailscale_https` exposure of managed branch runtimes, implementing the PAP-17049 plan under the PAP-17050 threat-model verdict. Broker (packages/tailscale-https-broker): root/dedicated-account host broker exposing only idempotent list/expose/remove over a Unix socket. Implements the six required verdict controls: SO_PEERCRED + UID/GID allowlist + unguessable broker-issued lease handles (req #1); dedicated port allowlist + /proc listener ownership/loopback proof before mutation (req #2); per-mutation transaction (strict-parse serve JSON -> verify absence/exact-lease -> verify :443 -> one fixed per-port op -> reread -> require only-intended-changed + :443 identical -> atomic root-owned registry commit, quarantine-on-ambiguity) (req #3); execve/shell=false argv built only from canonical integers + fixed tokens, pinned CLI schema (req #4); versioned length-bounded strict-JSON protocol (req #5); bounded append-only audit events (req #6). Deny-by-default for Funnel/cert/Services/reset/set-config/path-handlers/:443/reserved ports. Shared contract (packages/shared): single source of truth for exposure config, lifecycle state (pending/ready/failed/cleanup_pending/removed), listener ownership, and status, with strict zod validators and deterministic app/HMR port-pair + URL derivation so DB/server/UI/runtime cannot drift. Tests: broker 57/57, shared runtime-exposure 13/13, both typecheck clean. Server/DB/UI lifecycle integration + docs land in follow-on commits. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
70 lines
2.6 KiB
TypeScript
70 lines
2.6 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
import {
|
|
ServeParseError,
|
|
assertPrimaryIntact,
|
|
changedPorts,
|
|
isSameNumberLoopbackEntry,
|
|
parseServeStatus,
|
|
primaryDigest,
|
|
} from "./serve-config.js";
|
|
|
|
const HOST = "paperclip-dev.tail29c1aa.ts.net";
|
|
|
|
function serve(ports: Record<number, string | null>): unknown {
|
|
const TCP: Record<string, unknown> = {};
|
|
const Web: Record<string, unknown> = {};
|
|
for (const [portStr, proxy] of Object.entries(ports)) {
|
|
TCP[portStr] = { HTTPS: true };
|
|
Web[`${HOST}:${portStr}`] = { Handlers: { "/": { Proxy: proxy } } };
|
|
}
|
|
return { TCP, Web };
|
|
}
|
|
|
|
const PRIMARY = { 443: "http://127.0.0.1:3100" };
|
|
|
|
describe("parseServeStatus", () => {
|
|
it("normalizes TCP + Web into port entries", () => {
|
|
const parsed = parseServeStatus(serve({ ...PRIMARY, 42010: "http://127.0.0.1:42010" }));
|
|
expect(parsed.entries.get(42010)?.https).toBe(true);
|
|
expect(isSameNumberLoopbackEntry(parsed.entries.get(42010), 42010)).toBe(true);
|
|
});
|
|
|
|
it("fails closed on malformed shapes", () => {
|
|
expect(() => parseServeStatus(null)).toThrow(ServeParseError);
|
|
expect(() => parseServeStatus({ TCP: [] })).toThrow(ServeParseError);
|
|
expect(() => parseServeStatus({ Web: { "no-port": {} } })).toThrow(ServeParseError);
|
|
});
|
|
|
|
it("tolerates unknown top-level fields", () => {
|
|
expect(() => parseServeStatus({ ...(serve(PRIMARY) as object), AllowFunnel: {} })).not.toThrow();
|
|
});
|
|
});
|
|
|
|
describe(":443 invariant", () => {
|
|
it("asserts the primary route intact", () => {
|
|
const parsed = parseServeStatus(serve(PRIMARY));
|
|
expect(() => assertPrimaryIntact(parsed)).not.toThrow();
|
|
});
|
|
|
|
it("throws when :443 is missing or retargeted", () => {
|
|
expect(() => assertPrimaryIntact(parseServeStatus(serve({ 42010: "http://127.0.0.1:42010" })))).toThrow();
|
|
expect(() => assertPrimaryIntact(parseServeStatus(serve({ 443: "http://127.0.0.1:9999" })))).toThrow();
|
|
});
|
|
|
|
it("produces a stable digest that changes only when :443 changes", () => {
|
|
const a = primaryDigest(parseServeStatus(serve({ ...PRIMARY, 42010: "http://127.0.0.1:42010" })));
|
|
const b = primaryDigest(parseServeStatus(serve({ ...PRIMARY, 42011: "http://127.0.0.1:42011" })));
|
|
expect(a).toBe(b);
|
|
const c = primaryDigest(parseServeStatus(serve({ 443: "http://127.0.0.1:9999" })));
|
|
expect(c).not.toBe(a);
|
|
});
|
|
});
|
|
|
|
describe("changedPorts", () => {
|
|
it("detects only the ports whose entry differs", () => {
|
|
const before = parseServeStatus(serve({ ...PRIMARY }));
|
|
const after = parseServeStatus(serve({ ...PRIMARY, 42010: "http://127.0.0.1:42010" }));
|
|
expect(changedPorts(before, after)).toEqual([42010]);
|
|
});
|
|
});
|