Files
Triple-C/app/src/components/settings/GatewaySettings.test.tsx
T
shadow-testandClaude Opus 5 2de00b3c55 Fix review findings: secrets in snapshots, URL spoofing, migration data loss
Adversarial review of the branch produced findings across four areas.
This addresses them, plus the Windows CI environment.

Secrets. commit_container_snapshot baked the container's full env into
the per-project snapshot image, so the shared OAuth token — and the AWS
keys, git token and gateway master key — outlived revocation and were
readable via docker inspect. Verified against Engine 29.6 that a commit
body's config merges over the container's: keys cannot be dropped but
can be overwritten, so all of them now commit as KEY=. clear_claude_token
additionally rewrites images from earlier builds and reports honestly
when a tag could not be rewritten.

The recommendation to move the token out of env entirely was not taken,
with reasoning: apiKeyHelper is a different auth method that outranks
CLAUDE_CODE_OAUTH_TOKEN rather than a transport for it, and no
file-based delivery exists. The durable exposure — the image — is what
is closed here. Separately noted, not fixed: entrypoint.sh captures the
token into the scheduler's .env inside the persisted volume.

URL spoofing. Three call sites reached openUrl with container-controlled
strings, one of which the review missed (the WebLinksAddon handler).
The sign-in URL was scraped from container output with a longest-match
tie-break and no userinfo check, so claude.ai@evil.tld rendered as
"claude.ai…" in a truncating element. There is now one sanitizer in
front of every sink — scheme allowlist, no userinfo, C0/C1 and quote
rejection, host allowlist for the sign-in case, first-match — and the
origin renders un-truncated. The toast is keyed so a changed URL
remounts, closing a bait-and-switch where the user read one URL and
clicked another.

Migration. The rollback pin was best-effort: a tag failure was logged
and the migration continued past remove_container, after which the
final commit overwrote the only copy of the old system layer. It now
aborts before anything destructive and reads the tag back. /var was
destroyed while the ordinary recreate path preserves it — making the
"safe" alternative to Reset more destructive than Reset's alternative;
data-bearing subtrees are now detected and disclosed in the pre-flight
rather than copied, since tarring a live database onto a different
base's packages is a corruption risk. resume_migration now verifies the
migration-state label instead of reporting success for a container that
never swapped. dismiss actually resolves the record rather than leaving
the feature permanently refusing to migrate. Start and Reset are guarded
while a migration is live.

Lifecycle. The gateway no longer publishes on 0.0.0.0 — bind address and
advertised URL are derived together so they cannot drift. Disabling it
now stops it. App exit runs teardown concurrently under a budget with a
visible shutting-down state instead of blocking for minutes. Auto-starts
retry when Docker is not up yet, and the polling-recovery path now
reconciles, so interrupted migrations are still recovered. Auth-bridge
forwards are capped, closing a container-driven fd exhaustion.

Windows CI. build-windows failed on this branch with "linker link.exe
not found". The runner had no MSVC build tools and the workflow assumed
a hand-provisioned machine, so a bare runner registers, accepts jobs and
fails at link time after downloading the whole crate graph. The job now
installs the VC++ workload when vswhere cannot find it, matching how it
already conditionally installs Rust and Node.

192 Rust tests, 274 frontend tests, both builds clean, zero warnings.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-09 19:35:39 -07:00

106 lines
3.9 KiB
TypeScript

import { describe, it, expect, vi, beforeEach } from "vitest";
import { render, screen, fireEvent, waitFor } from "@testing-library/react";
import GatewaySettings from "./GatewaySettings";
import type { AppSettings, GatewayStatus } from "../../lib/types";
const getGatewayStatus = vi.fn();
const stopGateway = vi.fn();
const startGateway = vi.fn();
const checkGatewayHealth = vi.fn();
const saveSettings = vi.fn();
vi.mock("../../lib/tauri-commands", () => ({
getGatewayStatus: () => getGatewayStatus(),
startGateway: () => startGateway(),
stopGateway: () => stopGateway(),
checkGatewayHealth: () => checkGatewayHealth(),
pullGatewayImage: vi.fn(),
buildGatewayImage: vi.fn(),
setGatewayApiKey: vi.fn(),
clearGatewayApiKey: vi.fn(),
getGatewayAuthToken: vi.fn(),
regenerateGatewayAuthToken: vi.fn(),
}));
vi.mock("@tauri-apps/api/event", () => ({ listen: vi.fn(async () => vi.fn()) }));
let appSettings: AppSettings | null = null;
vi.mock("../../hooks/useSettings", () => ({
useSettings: () => ({ appSettings, saveSettings }),
}));
const settingsWithGateway = (enabled: boolean): AppSettings =>
({
gateway: { enabled, port: 4000, provider: "openai", api_base: null, models: [] },
}) as unknown as AppSettings;
const status = (over: Partial<GatewayStatus> = {}): GatewayStatus => ({
container_exists: true,
running: true,
port: 4000,
image_exists: true,
model_count: 0,
has_api_key: false,
base_url: "http://host.docker.internal:4000",
...over,
});
describe("GatewaySettings", () => {
beforeEach(() => {
vi.clearAllMocks();
appSettings = settingsWithGateway(false);
getGatewayStatus.mockResolvedValue(status());
checkGatewayHealth.mockResolvedValue(true);
saveSettings.mockImplementation(async (s: AppSettings) => s);
stopGateway.mockResolvedValue(undefined);
});
it("keeps a working Stop button when the gateway is disabled but its container exists", async () => {
render(<GatewaySettings />);
const stop = await screen.findByRole("button", { name: "Stop" });
// The configuration UI stays hidden — only the container row survives.
expect(screen.queryByLabelText("Provider")).not.toBeInTheDocument();
expect(screen.getByTestId("gateway-leftover-container")).toHaveTextContent(
/gateway container is still present/i,
);
// Status is a word, not just a colour.
expect(screen.getByTestId("gateway-leftover-container")).toHaveTextContent(
/Running on port 4000/,
);
fireEvent.click(stop);
await waitFor(() => expect(stopGateway).toHaveBeenCalledTimes(1));
// Stopping re-reads status: once on mount, once after the action.
await waitFor(() => expect(getGatewayStatus).toHaveBeenCalledTimes(2));
});
it("shows nothing extra when the gateway is disabled and no container exists", async () => {
getGatewayStatus.mockResolvedValue(status({ container_exists: false, running: false }));
render(<GatewaySettings />);
await waitFor(() => expect(getGatewayStatus).toHaveBeenCalled());
expect(screen.queryByTestId("gateway-leftover-container")).not.toBeInTheDocument();
expect(screen.queryByRole("button", { name: "Stop" })).not.toBeInTheDocument();
});
it("re-reads container status after toggling the gateway off", async () => {
appSettings = settingsWithGateway(true);
render(<GatewaySettings />);
await waitFor(() => expect(getGatewayStatus).toHaveBeenCalledTimes(1));
// The backend stops the container as part of update_settings, so the UI has
// to re-read rather than trust the status it already has.
getGatewayStatus.mockResolvedValue(status({ running: false }));
fireEvent.click(screen.getByRole("switch", { name: "Model gateway" }));
await waitFor(() =>
expect(saveSettings).toHaveBeenCalledWith(
expect.objectContaining({ gateway: expect.objectContaining({ enabled: false }) }),
),
);
await waitFor(() => expect(getGatewayStatus).toHaveBeenCalledTimes(2));
});
});