paperclip/packages/tailscale-https-broker/src/argv.test.ts

41 lines
1.5 KiB
TypeScript

import { describe, expect, it } from "vitest";
import { buildExposeArgv, buildRemoveArgv, buildStatusArgv } from "./argv.js";
const BIN = "/usr/bin/tailscale";
describe("argv construction", () => {
it("builds an exact status argv with no shell tokens", () => {
expect(buildStatusArgv(BIN)).toEqual([BIN, "serve", "status", "--json"]);
});
it("builds exact same-number expose/remove argv vectors", () => {
expect(buildExposeArgv(BIN, 42010)).toEqual([
BIN,
"serve",
"--bg",
"--https=42010",
"http://127.0.0.1:42010",
]);
expect(buildRemoveArgv(BIN, 42010)).toEqual([BIN, "serve", "--https=42010", "off"]);
});
it("refuses the protected primary port 443 and privileged ports", () => {
expect(() => buildExposeArgv(BIN, 443)).toThrow(/443/);
expect(() => buildRemoveArgv(BIN, 443)).toThrow(/443/);
expect(() => buildExposeArgv(BIN, 80)).toThrow(/privileged/);
expect(() => buildExposeArgv(BIN, 1023)).toThrow(/privileged/);
});
it("refuses non-canonical ports (string, float, overflow)", () => {
expect(() => buildExposeArgv(BIN, "42010" as unknown as number)).toThrow();
expect(() => buildExposeArgv(BIN, 42010.5)).toThrow();
expect(() => buildExposeArgv(BIN, 70000)).toThrow();
});
it("refuses a non-absolute or shell-metacharacter binary path", () => {
expect(() => buildStatusArgv("tailscale")).toThrow(/absolute/);
expect(() => buildStatusArgv("/usr/bin/tailscale; rm -rf /")).toThrow();
expect(() => buildStatusArgv("/usr/bin/tail scale")).toThrow();
});
});