dcrouter/test/test.vpn-runtime.node.ts

import { expect, tap } from '@git.zone/tstest/tapbundle';
import { DcRouter } from '../ts/classes.dcrouter.js';
import { VpnManager } from '../ts/vpn/classes.vpn-manager.js';
import { RouteConfigManager } from '../ts/config/classes.route-config-manager.js';

tap.test('VpnManager downgrades back to socket mode when no host-IP clients remain', async () => {
  const manager = new VpnManager({ forwardingMode: 'socket' });

  let stopCalls = 0;
  let startCalls = 0;

  (manager as any).vpnServer = { running: true };
  (manager as any).resolvedForwardingMode = 'hybrid';
  (manager as any).clients = new Map([
    ['client-1', { useHostIp: false }],
  ]);
  (manager as any).stop = async () => {
    stopCalls++;
  };
  (manager as any).start = async () => {
    startCalls++;
    (manager as any).resolvedForwardingMode = (manager as any).forwardingModeOverride ?? 'socket';
    (manager as any).forwardingModeOverride = undefined;
    (manager as any).vpnServer = { running: true };
  };

  const restarted = await (manager as any).reconcileForwardingMode();

  expect(restarted).toEqual(true);
  expect(stopCalls).toEqual(1);
  expect(startCalls).toEqual(1);
  expect((manager as any).resolvedForwardingMode).toEqual('socket');
});

tap.test('VpnManager keeps explicit hybrid mode even without host-IP clients', async () => {
  const manager = new VpnManager({ forwardingMode: 'hybrid' });

  let stopCalls = 0;
  let startCalls = 0;

  (manager as any).vpnServer = { running: true };
  (manager as any).resolvedForwardingMode = 'hybrid';
  (manager as any).clients = new Map([
    ['client-1', { useHostIp: false }],
  ]);
  (manager as any).stop = async () => {
    stopCalls++;
  };
  (manager as any).start = async () => {
    startCalls++;
  };

  const restarted = await (manager as any).reconcileForwardingMode();

  expect(restarted).toEqual(false);
  expect(stopCalls).toEqual(0);
  expect(startCalls).toEqual(0);
  expect((manager as any).resolvedForwardingMode).toEqual('hybrid');
});

tap.test('DcRouter.updateVpnConfig swaps the runtime VPN resolver and restarts VPN services', async () => {
  const dcRouter = new DcRouter({
    smartProxyConfig: { routes: [] },
    dbConfig: { enabled: false },
    vpnConfig: { enabled: false },
  });

  let stopCalls = 0;
  let setupCalls = 0;
  let applyCalls = 0;
  const resolverValues: Array<unknown> = [];

  dcRouter.vpnManager = {
    stop: async () => {
      stopCalls++;
    },
  } as any;
  (dcRouter as any).routeConfigManager = {
    setVpnClientIpsResolver: (resolver: unknown) => {
      resolverValues.push(resolver);
    },
    applyRoutes: async () => {
      applyCalls++;
    },
  };
  (dcRouter as any).setupVpnServer = async () => {
    setupCalls++;
    dcRouter.vpnManager = {
      stop: async () => {
        stopCalls++;
      },
    } as any;
  };

  await dcRouter.updateVpnConfig({ enabled: true, subnet: '10.9.0.0/24' });

  expect(stopCalls).toEqual(1);
  expect(setupCalls).toEqual(1);
  expect(applyCalls).toEqual(0);
  expect(typeof resolverValues.at(-1)).toEqual('function');

  await dcRouter.updateVpnConfig({ enabled: false });

  expect(stopCalls).toEqual(2);
  expect(setupCalls).toEqual(1);
  expect(applyCalls).toEqual(1);
  expect(resolverValues.at(-1)).toBeUndefined();
  expect(dcRouter.vpnManager).toBeUndefined();
});

tap.test('RouteConfigManager makes vpnOnly routes fail closed without VPN clients', async () => {
  const manager = new RouteConfigManager(() => undefined);
  const route = {
    name: 'private-route',
    vpnOnly: true,
    match: { domains: ['private.example.com'] },
    action: { type: 'forward', targets: [{ host: '127.0.0.1', port: 8080 }] },
    security: { ipAllowList: ['*'] },
  } as any;

  const prepared = (manager as any).injectVpnSecurity(route);

  expect(prepared.security.ipAllowList).toEqual([]);
  expect(prepared.security.ipBlockList).toContain('*');
});

tap.test('RouteConfigManager replaces public allow lists for vpnOnly routes', async () => {
  const manager = new RouteConfigManager(
    () => undefined,
    undefined,
    () => ['10.8.0.2'],
  );
  const route = {
    name: 'private-route',
    vpnOnly: true,
    match: { domains: ['private.example.com'] },
    action: { type: 'forward', targets: [{ host: '127.0.0.1', port: 8080 }] },
    security: {
      ipAllowList: ['*', '203.0.113.10'],
      ipBlockList: ['198.51.100.5'],
    },
  } as any;

  const prepared = (manager as any).injectVpnSecurity(route);

  expect(prepared.security.ipAllowList).toEqual(['10.8.0.2']);
  expect(prepared.security.ipBlockList).toEqual(['198.51.100.5']);
});

tap.test('VpnManager rewrites WireGuard AllowedIPs after key rotation', async () => {
  const manager = new VpnManager({
    serverEndpoint: 'vpn.example.com',
    getClientAllowedIPs: async () => ['10.8.0.0/24', '203.0.113.10/32'],
  });

  (manager as any).vpnServer = {
    rotateClientKey: async () => ({
      entry: {
        clientId: 'client-1',
        publicKey: 'noise-public-key',
        wgPublicKey: 'wg-public-key',
      },
      wireguardConfig: '[Interface]\nPrivateKey = old\nAddress = 10.8.0.2/24\n[Peer]\nAllowedIPs = 0.0.0.0/0\nEndpoint = vpn.example.com:51820\n',
      secrets: { noisePrivateKey: 'noise-private-key', wgPrivateKey: 'wg-private-key' },
    }),
  };
  (manager as any).clients = new Map([
    ['client-1', { clientId: 'client-1', targetProfileIds: ['profile-1'] }],
  ]);
  (manager as any).persistClient = async () => {};

  const bundle = await manager.rotateClientKey('client-1');

  expect(bundle.wireguardConfig).toContain('AllowedIPs = 10.8.0.0/24, 203.0.113.10/32');
});

export default tap.start()